diff --git a/.github/workflows/dotnet-sdk-tests.yml b/.github/workflows/dotnet-sdk-tests.yml
index 707a99af30..b70278cc54 100644
--- a/.github/workflows/dotnet-sdk-tests.yml
+++ b/.github/workflows/dotnet-sdk-tests.yml
@@ -32,12 +32,9 @@ jobs:
           - os: windows-latest
             transport: default
             shard: full
-          # TODO(cli-1.0.81-2): @github/copilot 1.0.81-2 never completes a model-driven
-          # turn when the runtime is hosted in-process against the CAPI backend. A full
-          # run reported 241 failures across 43 classes and took 150-225 minutes, which
-          # also starved the rest of the matrix. The defect is specific to this pairing:
-          # the in-process BYOK cells below and the stdio capi cells are unaffected.
-          # Drop these two entries once a fixed CLI build is picked up.
+          # TODO(cli-1.0.81-4): in-process CAPI model turns eventually stop
+          # completing and poison the shared runtime until the job times out.
+          # Stdio CAPI and in-process BYOK cells remain enabled.
           - os: ubuntu-latest
             transport: inprocess
           - os: macos-latest
diff --git a/dotnet/src/Generated/Rpc.cs b/dotnet/src/Generated/Rpc.cs
index bd8f3b9d3a..75405b142d 100644
--- a/dotnet/src/Generated/Rpc.cs
+++ b/dotnet/src/Generated/Rpc.cs
@@ -1141,7637 +1141,7847 @@ internal sealed class McpDiscoverRequest
     public string? WorkingDirectory { get; set; }
 }
 
-/// <summary>User-configured MCP servers, keyed by server name.</summary>
+/// <summary>Outcome of an mcp.planInstall call: either a normalised plan, or one typed refusal. Nothing is written in either case.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpConfigList
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "kind",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(McpPlanInstallResultPlanned), "planned")]
+[JsonDerivedType(typeof(McpPlanInstallResultNegotiationRefused), "negotiation-refused")]
+[JsonDerivedType(typeof(McpPlanInstallResultHandleRejected), "handle-rejected")]
+[JsonDerivedType(typeof(McpPlanInstallResultInvalidRequest), "invalid-request")]
+[JsonDerivedType(typeof(McpPlanInstallResultAuthenticationRequired), "authentication-required")]
+[JsonDerivedType(typeof(McpPlanInstallResultPolicyRejected), "policy-rejected")]
+[JsonDerivedType(typeof(McpPlanInstallResultNetworkFailure), "network-failure")]
+[JsonDerivedType(typeof(McpPlanInstallResultUnsafeRetrieval), "unsafe-retrieval")]
+[JsonDerivedType(typeof(McpPlanInstallResultMalformedCard), "malformed-card")]
+[JsonDerivedType(typeof(McpPlanInstallResultContractViolation), "contract-violation")]
+[JsonDerivedType(typeof(McpPlanInstallResultUnavailableTransport), "unavailable-transport")]
+[JsonDerivedType(typeof(McpPlanInstallResultNotInstallable), "not-installable")]
+[JsonDerivedType(typeof(McpPlanInstallResultUnavailable), "unavailable")]
+public partial class McpPlanInstallResult
 {
-    /// <summary>All MCP servers from user config, keyed by name.</summary>
-    [JsonPropertyName("servers")]
-    public IDictionary<string, JsonElement> Servers { get => field ??= new Dictionary<string, JsonElement>(); set; }
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("kind")]
+    public virtual string Kind { get; set; } = string.Empty;
 }
 
-/// <summary>MCP server name and configuration to add to user configuration.</summary>
+
+/// <summary>The protocol version and capability set the runtime actually honoured for a successful catalog operation.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpConfigAddRequest
+public sealed class CatalogNegotiatedContract
 {
-    /// <summary>MCP server configuration (stdio process or remote HTTP/SSE).</summary>
-    [JsonPropertyName("config")]
-    public JsonElement Config { get; set; }
+    /// <summary>Wire features the runtime understood for this operation. Always a superset of the caller's required features, because any shortfall is a refusal instead. Operation availability remains a separate typed result.</summary>
+    [JsonPropertyName("grantedCapabilities")]
+    public IList<CatalogCapability> GrantedCapabilities { get => field ??= []; set; }
 
-    /// <summary>Unique name for the MCP server.</summary>
-    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Protocol version of the runtime that served the request.</summary>
+    [JsonPropertyName("runtimeProtocolVersion")]
+    public long RuntimeProtocolVersion { get; set; }
 }
 
-/// <summary>MCP server name and replacement configuration to write to user configuration.</summary>
+/// <summary>One change applying the plan would make, described rather than serialised so the configuration payload stays behind the runtime boundary.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpConfigUpdateRequest
+public sealed class McpPlanConfigurationChange
 {
-    /// <summary>MCP server configuration (stdio process or remote HTTP/SSE).</summary>
-    [JsonPropertyName("config")]
-    public JsonElement Config { get; set; }
+    /// <summary>Names of the configuration fields the change would set, without their values.</summary>
+    [JsonPropertyName("changedFields")]
+    public IList<string> ChangedFields { get => field ??= []; set; }
 
-    /// <summary>Name of the MCP server to update.</summary>
-    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
+    /// <summary>Configuration key the change applies to.</summary>
     [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
     [MinLength(1)]
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    [JsonPropertyName("configKey")]
+    public string ConfigKey { get; set; } = string.Empty;
+
+    /// <summary>Whether the change would create a new entry or modify an existing one.</summary>
+    [JsonPropertyName("operation")]
+    public McpPlanConfigurationOperation Operation { get; set; }
+
+    /// <summary>Scope the change would be written to.</summary>
+    [JsonPropertyName("scope")]
+    public McpPlanScope Scope { get; set; }
+
+    /// <summary>Secret placeholders the written configuration would reference. The constrained placeholder type cannot carry a literal secret value.</summary>
+    [JsonPropertyName("secretReferences")]
+    public IList<string> SecretReferences { get => field ??= []; set; }
 }
 
-/// <summary>MCP server name to remove from user configuration.</summary>
+/// <summary>Normalised identity of the MCP server a plan targets, independent of how the card spelled it.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpConfigRemoveRequest
+public sealed class McpPlanResourceIdentity
 {
-    /// <summary>Name of the MCP server to remove.</summary>
-    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
+    /// <summary>Canonical, normalised name of the server, for example `io.github.owner/server`.</summary>
     [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
     [MinLength(1)]
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
-}
+    [JsonPropertyName("canonicalName")]
+    public string CanonicalName { get; set; } = string.Empty;
 
-/// <summary>MCP server names to enable for new sessions.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class McpConfigEnableRequest
-{
-    /// <summary>Names of MCP servers to enable. Each server is removed from the persisted disabled list so new sessions spawn it. Unknown or already-enabled names are ignored.</summary>
-    [JsonPropertyName("names")]
-    public IList<string> Names { get => field ??= []; set; }
+    /// <summary>Registry identifier of the server, when it came from a registry.</summary>
+    [JsonPropertyName("registryId")]
+    public string? RegistryId { get; set; }
+
+    /// <summary>Local configuration key the server would be recorded under.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("serverName")]
+    public string ServerName { get; set; } = string.Empty;
+
+    /// <summary>Version advertised by the card, when it declares one.</summary>
+    [JsonPropertyName("version")]
+    public string? Version { get; set; }
 }
 
-/// <summary>MCP server names to disable for new sessions.</summary>
+/// <summary>Outcome of evaluating the planned server against registry and enterprise policy. Evaluation is read-only.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpConfigDisableRequest
+public sealed class McpPlanPolicyResult
 {
-    /// <summary>Names of MCP servers to disable. Each server is added to the persisted disabled list so new sessions skip it. Already-disabled names are ignored. Active sessions keep their current connections until they end.</summary>
-    [JsonPropertyName("names")]
-    public IList<string> Names { get => field ??= []; set; }
+    /// <summary>What policy decided for this server.</summary>
+    [JsonPropertyName("decision")]
+    public McpPlanPolicyDecision Decision { get; set; }
+
+    /// <summary>Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("reason")]
+    public string? Reason { get; set; }
+
+    /// <summary>Which authority produced the decision.</summary>
+    [JsonPropertyName("source")]
+    public McpPlanPolicySource Source { get; set; }
 }
 
-/// <summary>Installed plugin that contributes a discovered extension.</summary>
+/// <summary>Semantic digest of a strictly parsed and schema-validated JSON MCP card. Both URL-backed and embedded cards are canonicalised with RFC 8785 JSON Canonicalization Scheme, encoded as UTF-8, and hashed with SHA-256.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class DiscoveredExtensionPlugin
+public sealed class CardDigest
 {
-    /// <summary>Installed plugin name.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Digest algorithm and canonical representation.</summary>
+    [JsonPropertyName("algorithm")]
+    public CardDigestAlgorithm Algorithm { get; set; }
+
+    /// <summary>SHA-256 digest of the RFC 8785 canonical UTF-8 bytes, encoded as exactly 64 lowercase hexadecimal characters.</summary>
+    [RegularExpression("^[0-9a-f]{64}$")]
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(64)]
+    [MaxLength(64)]
+    [JsonPropertyName("value")]
+    public string Value { get; set; } = string.Empty;
 }
 
-/// <summary>Discovered extension metadata and persistent enablement state.</summary>
+/// <summary>Provenance of the exact validated JSON MCP card content bound privately to a completed plan and its opaque handle.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class DiscoveredExtension
+public sealed class McpPlanProvenance
 {
-    /// <summary>Whether this extension's persistent per-ID preference is enabled.</summary>
-    [JsonPropertyName("enabled")]
-    public bool Enabled { get; set; }
-
-    /// <summary>Source-qualified ID accepted by both server and session extension enablement methods.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
-
-    /// <summary>Human-readable extension name.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Authority associated with the validated card, without path, query, or credentials. Inert untrusted data.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("authority")]
+    public string Authority { get; set; } = string.Empty;
 
-    /// <summary>Absolute path to the extension entry module, suitable for revealing it in a file manager.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+    /// <summary>Semantic digest of the exact validated JSON content bound to the plan handle.</summary>
+    [JsonPropertyName("cardDigest")]
+    public CardDigest CardDigest { get => field ??= new(); set; }
 
-    /// <summary>Containing plugin metadata for plugin-contributed extensions.</summary>
-    [JsonPropertyName("plugin")]
-    public DiscoveredExtensionPlugin? Plugin { get; set; }
+    /// <summary>JSON MCP media type the validated card was interpreted as.</summary>
+    [JsonPropertyName("mediaType")]
+    public McpServerCardMediaType MediaType { get; set; }
 
-    /// <summary>Discovery source.</summary>
-    [JsonPropertyName("source")]
-    public DiscoveredExtensionSource Source { get; set; }
+    /// <summary>ISO 8601 timestamp at which the runtime completed strict parsing and schema validation of the card content.</summary>
+    [JsonPropertyName("validatedAt")]
+    public string ValidatedAt { get; set; } = string.Empty;
 }
 
-/// <summary>Extensions discovered from persisted Copilot home state and their effective loading mode. Launch-scoped additional plugins are not included.</summary>
+/// <summary>Where a plan would be written.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class DiscoveredExtensions
+public sealed class McpPlanTarget
 {
-    /// <summary>Discovered user and enabled installed-plugin extensions from persisted Copilot home state.</summary>
-    [JsonPropertyName("extensions")]
-    public IList<DiscoveredExtension> Extensions { get => field ??= []; set; }
+    /// <summary>Configuration key the server would be recorded under within that scope.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("configKey")]
+    public string ConfigKey { get; set; } = string.Empty;
 
-    /// <summary>Effective extension loading mode. Defaults to load_and_augment when unset.</summary>
-    [JsonPropertyName("mode")]
-    public DiscoveredExtensionMode Mode { get; set; }
+    /// <summary>Configuration scope the plan targets.</summary>
+    [JsonPropertyName("scope")]
+    public McpPlanScope Scope { get; set; }
 }
 
-/// <summary>Source-qualified extension identifiers to persistently enable for future sessions.</summary>
+/// <summary>One eligible way to run the server, represented as a tagged package or remote variant so package identity and endpoint states cannot contradict the install method.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>installMethod</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class DiscoveredExtensionsEnableRequest
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "installMethod",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(McpPlanTransportChoicePackage), "package")]
+[JsonDerivedType(typeof(McpPlanTransportChoiceRemote), "remote")]
+public partial class McpPlanTransportChoice
 {
-    /// <summary>Source-qualified user or plugin extension IDs to enable.</summary>
-    [JsonPropertyName("ids")]
-    public IList<string> Ids { get => field ??= []; set; }
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("installMethod")]
+    public virtual string InstallMethod { get; set; } = string.Empty;
 }
 
-/// <summary>Source-qualified extension identifiers to persistently disable for future sessions.</summary>
+
+/// <summary>One non-secret value a transport choice needs, represented as a scalar or enumerated variant so enum values cannot be missing or attached to another type.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class DiscoveredExtensionsDisableRequest
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "kind",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(McpPlanRequiredValueScalar), "scalar")]
+[JsonDerivedType(typeof(McpPlanRequiredValueEnum), "enum")]
+public partial class McpPlanRequiredValue
 {
-    /// <summary>Source-qualified user or plugin extension IDs to disable.</summary>
-    [JsonPropertyName("ids")]
-    public IList<string> Ids { get => field ??= []; set; }
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("kind")]
+    public virtual string Kind { get; set; } = string.Empty;
 }
 
-/// <summary>Information about an installed plugin tracked in global state.</summary>
+
+/// <summary>One non-secret scalar value a transport choice needs before it can be applied.</summary>
+/// <remarks>The <c>scalar</c> variant of <see cref="McpPlanRequiredValue"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class InstalledPluginInfo
+public partial class McpPlanRequiredValueScalar : McpPlanRequiredValue
 {
-    /// <summary>Opaque, stable hash identifying a direct (non-marketplace) install source. Present only for direct repo / URL / local installs; absent for marketplace plugins. Same source yields the same id; distinct sources never collide.</summary>
-    [JsonPropertyName("directSourceId")]
-    public string? DirectSourceId { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "scalar";
 
-    /// <summary>Whether the plugin is currently enabled for new sessions.</summary>
-    [JsonPropertyName("enabled")]
-    public bool Enabled { get; set; }
+    /// <summary>Where the value is applied when the server is launched.</summary>
+    [JsonPropertyName("category")]
+    public required McpPlanValueCategory Category { get; set; }
 
-    /// <summary>Marketplace the plugin came from. Empty string ("") for direct repo / URL / local installs.</summary>
-    [JsonPropertyName("marketplace")]
-    public string Marketplace { get; set; } = string.Empty;
+    /// <summary>Default supplied by the card, when the value can be resolved without input. Presence is the authoritative indication that a default exists. Inert untrusted data.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("defaultValue")]
+    public string? DefaultValue { get; set; }
 
-    /// <summary>Plugin name.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Human-readable explanation from the card. Inert untrusted text.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("description")]
+    public string? Description { get; set; }
 
-    /// <summary>Installed version (when reported by the plugin manifest).</summary>
-    [JsonPropertyName("version")]
-    public string? Version { get; set; }
-}
+    /// <summary>Whether the value may be supplied more than once.</summary>
+    [JsonPropertyName("isRepeated")]
+    public required bool IsRepeated { get; set; }
 
-/// <summary>Plugins installed in user/global state.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class PluginListResult
-{
-    /// <summary>Installed plugins.</summary>
-    [JsonPropertyName("plugins")]
-    public IList<InstalledPluginInfo> Plugins { get => field ??= []; set; }
+    /// <summary>Key the value is supplied under. Inert untrusted data.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("key")]
+    public required string Key { get; set; }
+
+    /// <summary>Whether the value must be present for the plan to be applicable.</summary>
+    [JsonPropertyName("required")]
+    public required bool Required { get; set; }
+
+    /// <summary>Human-readable label from the card. Inert untrusted text.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(200)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("title")]
+    public string? Title { get; set; }
+
+    /// <summary>Scalar type the value must conform to.</summary>
+    [JsonPropertyName("valueType")]
+    public required McpPlanScalarValueType ValueType { get; set; }
 }
 
-/// <summary>Result of installing a plugin.</summary>
+/// <summary>One enumerated non-secret value a transport choice needs before it can be applied. The permitted values are structurally required.</summary>
+/// <remarks>The <c>enum</c> variant of <see cref="McpPlanRequiredValue"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PluginInstallResult
+public partial class McpPlanRequiredValueEnum : McpPlanRequiredValue
 {
-    /// <summary>Set when the install path is deprecated (e.g. direct repo / URL / local installs). Callers should surface this to end users.</summary>
-    [JsonPropertyName("deprecationWarning")]
-    public string? DeprecationWarning { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "enum";
 
-    /// <summary>The newly installed plugin's metadata.</summary>
-    [JsonPropertyName("plugin")]
-    public InstalledPluginInfo Plugin { get => field ??= new(); set; }
+    /// <summary>Where the value is applied when the server is launched.</summary>
+    [JsonPropertyName("category")]
+    public required McpPlanValueCategory Category { get; set; }
 
-    /// <summary>Optional post-install message provided by the plugin (e.g. setup instructions).</summary>
-    [JsonPropertyName("postInstallMessage")]
-    public string? PostInstallMessage { get; set; }
+    /// <summary>Default supplied by the card, when the value can be resolved without input. Presence is the authoritative indication that a default exists. Inert untrusted data.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("defaultValue")]
+    public string? DefaultValue { get; set; }
 
-    /// <summary>Number of skills discovered and installed from the plugin.</summary>
-    [JsonPropertyName("skillsInstalled")]
-    public long SkillsInstalled { get; set; }
-}
+    /// <summary>Human-readable explanation from the card. Inert untrusted text.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("description")]
+    public string? Description { get; set; }
 
-/// <summary>Plugin source and optional working directory for relative-path resolution.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class PluginsInstallRequest
-{
-    /// <summary>Plugin install spec. Accepts the same forms as the CLI: "plugin@marketplace" (marketplace install), "owner/repo" or "owner/repo:subpath" (GitHub direct), an http/https/ssh URL, or a local path. Direct (non-marketplace) installs are deprecated and will produce a deprecationWarning in the result.</summary>
-    [JsonPropertyName("source")]
-    public string Source { get; set; } = string.Empty;
+    /// <summary>Non-empty permitted value set. Inert untrusted data.</summary>
+    [JsonPropertyName("enumValues")]
+    public required IList<string> EnumValues { get; set; }
 
-    /// <summary>Working directory used to resolve relative local paths in `source`. Defaults to the server's current working directory.</summary>
-    [JsonPropertyName("workingDirectory")]
-    public string? WorkingDirectory { get; set; }
-}
+    /// <summary>Whether the value may be supplied more than once.</summary>
+    [JsonPropertyName("isRepeated")]
+    public required bool IsRepeated { get; set; }
 
-/// <summary>Name (or spec) of the plugin to uninstall.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class PluginsUninstallRequest
-{
-    /// <summary>Stable source identity for a direct (non-marketplace) install. Disambiguates uninstall when multiple installed plugins share the same name.</summary>
-    [JsonPropertyName("directSourceId")]
-    public string? DirectSourceId { get; set; }
+    /// <summary>Key the value is supplied under. Inert untrusted data.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("key")]
+    public required string Key { get; set; }
 
-    /// <summary>Plugin name or "plugin@marketplace" spec to uninstall. When ambiguous, prefer the fully-qualified spec.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Whether the value must be present for the plan to be applicable.</summary>
+    [JsonPropertyName("required")]
+    public required bool Required { get; set; }
+
+    /// <summary>Human-readable label from the card. Inert untrusted text.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(200)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("title")]
+    public string? Title { get; set; }
+
+    /// <summary>Discriminator: the value must be one of `enumValues`.</summary>
+    [JsonPropertyName("valueType")]
+    public required McpPlanEnumValueType ValueType { get; set; }
 }
 
-/// <summary>Result of updating a single plugin.</summary>
+/// <summary>A secret a transport choice needs, referenced by placeholder. No secret value ever appears in a plan, and the placeholder resolves against the keychain only when a plan is applied.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PluginUpdateResult
+public sealed class McpPlanSecretPlaceholder
 {
-    /// <summary>Version after the update, when reported by the plugin manifest.</summary>
-    [JsonPropertyName("newVersion")]
-    public string? NewVersion { get; set; }
+    /// <summary>Key the secret is supplied under. Inert untrusted data.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("key")]
+    public string Key { get; set; } = string.Empty;
 
-    /// <summary>Version that was previously installed, when available.</summary>
-    [JsonPropertyName("previousVersion")]
-    public string? PreviousVersion { get; set; }
+    /// <summary>The runtime-assigned `${secret:&lt;id&gt;}` placeholder written into configuration in place of the value.</summary>
+    [JsonPropertyName("placeholder")]
+    public string Placeholder { get; set; } = string.Empty;
 
-    /// <summary>Number of skills discovered and installed after the update.</summary>
-    [JsonPropertyName("skillsInstalled")]
-    public long SkillsInstalled { get; set; }
+    /// <summary>Human-readable label from the card. Inert untrusted text.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(200)]
+    [JsonPropertyName("title")]
+    public string? Title { get; set; }
 }
 
-/// <summary>Name (or spec) of the plugin to update.</summary>
+/// <summary>An eligible local-package transport choice. Package identity is required and a remote endpoint cannot be represented.</summary>
+/// <remarks>The <c>package</c> variant of <see cref="McpPlanTransportChoice"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PluginsUpdateRequest
+public partial class McpPlanTransportChoicePackage : McpPlanTransportChoice
 {
-    /// <summary>Plugin name or "plugin@marketplace" spec to update.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
-}
-
-/// <summary>Per-plugin result from updating all plugins, with versions, skills installed, success flag, and optional error.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class PluginUpdateAllEntry
-{
-    /// <summary>Error message (failure only).</summary>
-    [JsonPropertyName("error")]
-    public string? Error { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string InstallMethod => "package";
 
-    /// <summary>Marketplace the plugin came from. Empty string ("") for direct installs.</summary>
-    [JsonPropertyName("marketplace")]
-    public string Marketplace { get; set; } = string.Empty;
+    /// <summary>Stable identifier for this choice within the plan, used to select it when the plan is applied.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [MaxLength(128)]
+    [JsonPropertyName("choiceId")]
+    public required string ChoiceId { get; set; }
 
-    /// <summary>Plugin name that was updated.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Package identifier. Inert untrusted data.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [MaxLength(512)]
+    [JsonPropertyName("packageIdentifier")]
+    public required string PackageIdentifier { get; set; }
 
-    /// <summary>Version after the update, when available.</summary>
-    [JsonPropertyName("newVersion")]
-    public string? NewVersion { get; set; }
+    /// <summary>Packaging ecosystem, for example `oci` or `npm`.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [MaxLength(64)]
+    [JsonPropertyName("packageType")]
+    public required string PackageType { get; set; }
 
-    /// <summary>Previously installed version, when available.</summary>
-    [JsonPropertyName("previousVersion")]
-    public string? PreviousVersion { get; set; }
+    /// <summary>Typed values this choice requires, excluding secrets.</summary>
+    [JsonPropertyName("requiredValues")]
+    public required IList<McpPlanRequiredValue> RequiredValues { get; set; }
 
-    /// <summary>Number of skills installed after the update (success only).</summary>
-    [JsonPropertyName("skillsInstalled")]
-    public long? SkillsInstalled { get; set; }
+    /// <summary>Secrets this choice requires, referenced by placeholder only.</summary>
+    [JsonPropertyName("secretPlaceholders")]
+    public required IList<McpPlanSecretPlaceholder> SecretPlaceholders { get; set; }
 
-    /// <summary>Whether the update succeeded for this plugin.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
+    /// <summary>Local process transport this package choice would use.</summary>
+    [JsonPropertyName("transport")]
+    public required McpPlanPackageTransport Transport { get; set; }
 }
 
-/// <summary>Result of updating all installed plugins.</summary>
+/// <summary>An eligible remote-endpoint transport choice. The endpoint is required and package identity cannot be represented.</summary>
+/// <remarks>The <c>remote</c> variant of <see cref="McpPlanTransportChoice"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PluginUpdateAllResult
+public partial class McpPlanTransportChoiceRemote : McpPlanTransportChoice
 {
-    /// <summary>Per-plugin update results in deterministic order.</summary>
-    [JsonPropertyName("results")]
-    public IList<PluginUpdateAllEntry> Results { get => field ??= []; set; }
-}
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string InstallMethod => "remote";
 
-/// <summary>Plugin names (or specs) to enable.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class PluginsEnableRequest
-{
-    /// <summary>Plugin names or "plugin@marketplace" specs to enable. Unknown names are ignored. Non-marketplace direct installs are always enabled and cannot be toggled via this API.</summary>
-    [JsonPropertyName("names")]
-    public IList<string> Names { get => field ??= []; set; }
+    /// <summary>Stable identifier for this choice within the plan, used to select it when the plan is applied.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [MaxLength(128)]
+    [JsonPropertyName("choiceId")]
+    public required string ChoiceId { get; set; }
+
+    /// <summary>Endpoint URL. Inert untrusted data.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [MaxLength(2048)]
+    [JsonPropertyName("endpoint")]
+    public required string Endpoint { get; set; }
+
+    /// <summary>Typed values this choice requires, excluding secrets.</summary>
+    [JsonPropertyName("requiredValues")]
+    public required IList<McpPlanRequiredValue> RequiredValues { get; set; }
+
+    /// <summary>Secrets this choice requires, referenced by placeholder only.</summary>
+    [JsonPropertyName("secretPlaceholders")]
+    public required IList<McpPlanSecretPlaceholder> SecretPlaceholders { get; set; }
+
+    /// <summary>Endpoint transport this remote choice would use.</summary>
+    [JsonPropertyName("transport")]
+    public required McpPlanRemoteTransport Transport { get; set; }
 }
 
-/// <summary>Plugin names (or specs) to disable.</summary>
+/// <summary>A normalised, inert description of what installing an MCP server would involve. Carries no raw card, no install specification, and no secret value.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PluginsDisableRequest
+public sealed class McpInstallPlan
 {
-    /// <summary>Plugin names or "plugin@marketplace" specs to disable. Unknown names are ignored. Non-marketplace direct installs cannot be disabled via this API; uninstall them instead. Plugin-owned MCP servers are stopped in active sessions immediately; other plugin contributions remain available until each session reloads plugins.</summary>
-    [JsonPropertyName("names")]
-    public IList<string> Names { get => field ??= []; set; }
+    /// <summary>The configuration changes installing would make, described rather than serialised, so the mutable configuration payload stays behind the runtime boundary.</summary>
+    [JsonPropertyName("configurationChanges")]
+    public IList<McpPlanConfigurationChange> ConfigurationChanges { get => field ??= []; set; }
+
+    /// <summary>Normalised identity of the server the plan would install.</summary>
+    [JsonPropertyName("identity")]
+    public McpPlanResourceIdentity Identity { get => field ??= new(); set; }
+
+    /// <summary>Opaque, runtime-instance scoped, TTL-bound, single-use handle for this plan. Rejected when stale, replayed, or presented to a different runtime instance. Never logged.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("planHandle")]
+    public string PlanHandle { get; set; } = string.Empty;
+
+    /// <summary>ISO 8601 timestamp after which the plan handle is stale and will be rejected. Abandoning a plan needs no call: an unused handle simply expires, so cancellation before commit is side-effect free.</summary>
+    [JsonPropertyName("planHandleExpiresAt")]
+    public string PlanHandleExpiresAt { get; set; } = string.Empty;
+
+    /// <summary>Outcome of evaluating the server against registry and enterprise policy.</summary>
+    [JsonPropertyName("policy")]
+    public McpPlanPolicyResult Policy { get => field ??= new(); set; }
+
+    /// <summary>Origin and semantic digest of the exact validated JSON MCP card content bound to this plan.</summary>
+    [JsonPropertyName("provenance")]
+    public McpPlanProvenance Provenance { get => field ??= new(); set; }
+
+    /// <summary>Identifier of the choice the runtime would pick by default. Omitted when there is no eligible transport, or when the runtime expresses no preference.</summary>
+    [JsonPropertyName("recommendedTransportChoiceId")]
+    public string? RecommendedTransportChoiceId { get; set; }
+
+    /// <summary>Whether applying this plan would require an MCP reload to take effect. Planning itself never reloads.</summary>
+    [JsonPropertyName("reloadRequired")]
+    public bool ReloadRequired { get; set; }
+
+    /// <summary>Whether the plan cannot be applied without further input, because a required value has no default or a secret must be supplied.</summary>
+    [JsonPropertyName("requiresInteractiveConfiguration")]
+    public bool RequiresInteractiveConfiguration { get; set; }
+
+    /// <summary>Configuration scope and key the plan would write to.</summary>
+    [JsonPropertyName("target")]
+    public McpPlanTarget Target { get => field ??= new(); set; }
+
+    /// <summary>Every eligible transport, so a host can present an explicit choice. A completed plan always has at least one; when none is eligible, planning returns `CatalogUnavailableTransportError` instead.</summary>
+    [JsonPropertyName("transportChoices")]
+    public IList<McpPlanTransportChoice> TransportChoices { get => field ??= []; set; }
 }
 
-/// <summary>Trusted built-in plugin directories to use for this runtime process.</summary>
+/// <summary>A computed MCP install plan. Nothing has been applied: the plan describes what installing would change, and the plan handle is what a later apply operation would consume.</summary>
+/// <remarks>The <c>planned</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PluginsBuiltinSetRequest
+public partial class McpPlanInstallResultPlanned : McpPlanInstallResult
 {
-    /// <summary>Complete replacement set of trusted built-in plugin directories. Every entry must be an absolute local filesystem path no longer than 4096 characters.</summary>
-    [JsonPropertyName("paths")]
-    public IList<string> Paths { get => field ??= []; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "planned";
+
+    /// <summary>Protocol version and capabilities the runtime honoured.</summary>
+    [JsonPropertyName("negotiated")]
+    public required CatalogNegotiatedContract Negotiated { get; set; }
+
+    /// <summary>The normalised plan.</summary>
+    [JsonPropertyName("plan")]
+    public required McpInstallPlan Plan { get; set; }
 }
 
-/// <summary>Registered marketplace summary.</summary>
+/// <summary>The caller's protocol version or required capabilities cannot be honoured. Returned instead of a partial or ambiguous success.</summary>
+/// <remarks>The <c>negotiation-refused</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class MarketplaceInfo
+public partial class McpPlanInstallResultNegotiationRefused : McpPlanInstallResult
 {
-    /// <summary>True when this is a default marketplace shipped with the runtime. Defaults are not removable.</summary>
-    [JsonPropertyName("isDefault")]
-    public bool? IsDefault { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "negotiation-refused";
 
-    /// <summary>Marketplace name (matches the @marketplace suffix in plugin specs).</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
 
-    /// <summary>Human-readable description of where the marketplace data is fetched from (e.g. "GitHub: owner/repo").</summary>
-    [JsonPropertyName("source")]
-    public string Source { get; set; } = string.Empty;
+    /// <summary>Lowest caller protocol version this runtime will serve.</summary>
+    [JsonPropertyName("minimumSupportedProtocolVersion")]
+    public required long MinimumSupportedProtocolVersion { get; set; }
+
+    /// <summary>Whether the version or the capability set was the problem.</summary>
+    [JsonPropertyName("reason")]
+    public required CatalogNegotiationRefusedReason Reason { get; set; }
+
+    /// <summary>Protocol version of the runtime that refused the request.</summary>
+    [JsonPropertyName("runtimeProtocolVersion")]
+    public required long RuntimeProtocolVersion { get; set; }
+
+    /// <summary>Every wire feature this runtime understands, so the caller can retry within that contract. This list does not imply that every deployment has enabled every operation.</summary>
+    [JsonPropertyName("supportedCapabilities")]
+    public required IList<CatalogCapability> SupportedCapabilities { get; set; }
+
+    /// <summary>The subset of the caller's bounded extensible capability identifiers this runtime cannot honour.</summary>
+    [JsonPropertyName("unsupportedCapabilities")]
+    public required IList<string> UnsupportedCapabilities { get; set; }
 }
 
-/// <summary>All registered marketplaces, including built-in defaults.</summary>
+/// <summary>A presented handle was not accepted. Handles are runtime-instance scoped, TTL-bound, and single-use, so each way of failing is reported distinctly.</summary>
+/// <remarks>The <c>handle-rejected</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class MarketplaceListResult
+public partial class McpPlanInstallResultHandleRejected : McpPlanInstallResult
 {
-    /// <summary>Registered marketplaces.</summary>
-    [JsonPropertyName("marketplaces")]
-    public IList<MarketplaceInfo> Marketplaces { get => field ??= []; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "handle-rejected";
+
+    /// <summary>Which kind of handle was presented.</summary>
+    [JsonPropertyName("handleType")]
+    public required CatalogHandleType HandleType { get; set; }
+
+    /// <summary>Human-readable explanation, safe to surface. Never contains the handle itself, nor a query, URL, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
+
+    /// <summary>Why the handle was rejected.</summary>
+    [JsonPropertyName("reason")]
+    public required CatalogHandleRejectionReason Reason { get; set; }
 }
 
-/// <summary>Result of registering a new marketplace.</summary>
+/// <summary>The request was rejected before any work was done, because a bounded field fell outside its permitted range or a required field was unusable.</summary>
+/// <remarks>The <c>invalid-request</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class MarketplaceAddResult
+public partial class McpPlanInstallResultInvalidRequest : McpPlanInstallResult
 {
-    /// <summary>Final name of the marketplace as resolved from its manifest.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "invalid-request";
+
+    /// <summary>Which request field was rejected.</summary>
+    [JsonPropertyName("field")]
+    public required CatalogInvalidRequestField Field { get; set; }
+
+    /// <summary>Human-readable explanation, safe to surface. Never echoes the offending value, nor a query, URL, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
 }
 
-/// <summary>Marketplace source and optional working directory for relative-path resolution.</summary>
+/// <summary>An optional catalog authentication exchange did not establish the caller's identity. Anonymous search remains supported; this refusal is reserved for an operation that cannot continue after the attempted exchange. It is distinct from `policy-rejected` and from a network failure, and the reason identifies the recovery action.</summary>
+/// <remarks>The <c>authentication-required</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PluginsMarketplacesAddRequest
+public partial class McpPlanInstallResultAuthenticationRequired : McpPlanInstallResult
 {
-    /// <summary>Marketplace source. Accepts the same forms as the CLI: "owner/repo" or "owner/repo#ref" (GitHub), an http/https/ssh URL (optionally with #ref), a git scp-style URL (user@host:path), or a local path. The marketplace's own name (from its manifest) is used as the registration key.</summary>
-    [JsonPropertyName("source")]
-    public string Source { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "authentication-required";
 
-    /// <summary>Working directory used to resolve relative local paths in `source`. Defaults to the server's current working directory.</summary>
-    [JsonPropertyName("workingDirectory")]
-    public string? WorkingDirectory { get; set; }
+    /// <summary>Human-readable explanation, safe to surface. Never contains a credential or token, nor a query, URL, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
+
+    /// <summary>Why authentication failed. Only an expired credential justifies attempting a silent refresh; an absent or rejected credential requires sign-in.</summary>
+    [JsonPropertyName("reason")]
+    public required CatalogAuthenticationRequiredReason Reason { get; set; }
 }
 
-/// <summary>Outcome of the remove attempt, including dependent-plugin info when applicable.</summary>
+/// <summary>Registry or enterprise policy refused the operation.</summary>
+/// <remarks>The <c>policy-rejected</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class MarketplaceRemoveResult
+public partial class McpPlanInstallResultPolicyRejected : McpPlanInstallResult
 {
-    /// <summary>Names of installed plugins that prevented removal. Populated only when `removed=false`.</summary>
-    [JsonPropertyName("dependentPlugins")]
-    public IList<string>? DependentPlugins { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "policy-rejected";
 
-    /// <summary>True when the marketplace was actually removed. False when removal was skipped because the marketplace has dependent plugins and `force` was not set.</summary>
-    [JsonPropertyName("removed")]
-    public bool Removed { get; set; }
+    /// <summary>Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
+
+    /// <summary>Which authority produced the decision.</summary>
+    [JsonPropertyName("source")]
+    public required McpPlanPolicySource Source { get; set; }
 }
 
-/// <summary>Name of the marketplace to remove and an optional force flag.</summary>
+/// <summary>The runtime could not reach the catalog authority or retrieve a card. Covers being offline as well as transport-level failure.</summary>
+/// <remarks>The <c>network-failure</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PluginsMarketplacesRemoveRequest
+public partial class McpPlanInstallResultNetworkFailure : McpPlanInstallResult
 {
-    /// <summary>When true, also uninstall every plugin sourced from this marketplace. When false (default), removal is a no-op if any plugin from this marketplace is installed and the dependent plugin names are returned in the result.</summary>
-    [JsonPropertyName("force")]
-    public bool? Force { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "network-failure";
 
-    /// <summary>Marketplace name to remove.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
+
+    /// <summary>Categorised failure, low cardinality so it can be aggregated without carrying a URL.</summary>
+    [JsonPropertyName("reason")]
+    public required CatalogNetworkFailureReason Reason { get; set; }
+
+    /// <summary>HTTP status code, when the failure was a rejected response.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("statusCode")]
+    public int? StatusCode { get; set; }
 }
 
-/// <summary>Plugin entry advertised by a marketplace.</summary>
+/// <summary>Retrieval was refused by the runtime's hardened fetch boundary before any request left the process, or before a redirect was followed.</summary>
+/// <remarks>The <c>unsafe-retrieval</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class MarketplacePluginInfo
+public partial class McpPlanInstallResultUnsafeRetrieval : McpPlanInstallResult
 {
-    /// <summary>Short description from the marketplace catalog, when present.</summary>
-    [JsonPropertyName("description")]
-    public string? Description { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "unsafe-retrieval";
 
-    /// <summary>Plugin name as listed in the marketplace catalog.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Human-readable explanation, safe to surface. Never contains the refused URL, nor a query, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
+
+    /// <summary>Which control refused the retrieval, low cardinality so it can be aggregated without carrying a URL.</summary>
+    [JsonPropertyName("reason")]
+    public required CatalogUnsafeRetrievalReason Reason { get; set; }
 }
 
-/// <summary>Plugins advertised by the marketplace.</summary>
+/// <summary>A card could not be parsed or did not satisfy its declared media type's schema.</summary>
+/// <remarks>The <c>malformed-card</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class MarketplaceBrowseResult
+public partial class McpPlanInstallResultMalformedCard : McpPlanInstallResult
 {
-    /// <summary>Plugins advertised by the marketplace.</summary>
-    [JsonPropertyName("plugins")]
-    public IList<MarketplacePluginInfo> Plugins { get => field ??= []; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "malformed-card";
+
+    /// <summary>Media type the card was interpreted as, when it declared one this runtime recognises.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("mediaType")]
+    public CatalogMediaType? MediaType { get; set; }
+
+    /// <summary>Human-readable explanation, safe to surface. Never echoes card content, nor a query, URL, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
+
+    /// <summary>How the card failed validation.</summary>
+    [JsonPropertyName("reason")]
+    public required CatalogMalformedCardReason Reason { get; set; }
 }
 
-/// <summary>Name of the marketplace whose plugin catalog to fetch.</summary>
+/// <summary>An upstream catalog response broke the wire contract. Most importantly, every result must carry exactly one of a URL or embedded data: a result carrying both, or neither, is refused here rather than being guessed at.</summary>
+/// <remarks>The <c>contract-violation</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PluginsMarketplacesBrowseRequest
+public partial class McpPlanInstallResultContractViolation : McpPlanInstallResult
 {
-    /// <summary>Marketplace name to browse.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "contract-violation";
+
+    /// <summary>Human-readable explanation, safe to surface. Never echoes response content, nor a query, URL, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
+
+    /// <summary>Which rule the response broke.</summary>
+    [JsonPropertyName("reason")]
+    public required CatalogContractViolationReason Reason { get; set; }
 }
 
-/// <summary>Per-marketplace refresh result, including marketplace name, success flag, and optional failure error.</summary>
+/// <summary>No transport this runtime can use is available for the requested server.</summary>
+/// <remarks>The <c>unavailable-transport</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class MarketplaceRefreshEntry
+public partial class McpPlanInstallResultUnavailableTransport : McpPlanInstallResult
 {
-    /// <summary>Error message (failure only).</summary>
-    [JsonPropertyName("error")]
-    public string? Error { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "unavailable-transport";
 
-    /// <summary>Marketplace name that was refreshed.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
 
-    /// <summary>Whether the refresh succeeded.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
+    /// <summary>Why no transport could be offered.</summary>
+    [JsonPropertyName("reason")]
+    public required CatalogUnavailableTransportReason Reason { get; set; }
 }
 
-/// <summary>Result of refreshing one or more marketplace catalogs.</summary>
+/// <summary>The candidate is discoverable but cannot be installed. `application/ai-skill` resolves here, because it stays searchable while remaining typed non-installable.</summary>
+/// <remarks>The <c>not-installable</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class MarketplaceRefreshResult
+public partial class McpPlanInstallResultNotInstallable : McpPlanInstallResult
 {
-    /// <summary>Per-marketplace refresh results in deterministic order.</summary>
-    [JsonPropertyName("results")]
-    public IList<MarketplaceRefreshEntry> Results { get => field ??= []; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "not-installable";
+
+    /// <summary>Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
+
+    /// <summary>Why the candidate cannot be installed.</summary>
+    [JsonPropertyName("reason")]
+    public required CatalogNotInstallableReason Reason { get; set; }
 }
 
-/// <summary>RPC data type for PluginsMarketplacesRefresh operations.</summary>
+/// <summary>The operation is not available on this runtime. Distinct from a network failure: nothing was attempted.</summary>
+/// <remarks>The <c>unavailable</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PluginsMarketplacesRefreshRequest
+public partial class McpPlanInstallResultUnavailable : McpPlanInstallResult
 {
-    /// <summary>Marketplace name to refresh. When omitted, every registered marketplace is refreshed.</summary>
-    [JsonPropertyName("name")]
-    public string? Name { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "unavailable";
+
+    /// <summary>Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
+
+    /// <summary>Why the operation is unavailable.</summary>
+    [JsonPropertyName("reason")]
+    public required CatalogUnavailableReason Reason { get; set; }
 }
 
-/// <summary>Server-side skill metadata, including name, description, source, enabled/invocable state, path, project path, and argument hint.</summary>
+/// <summary>The protocol version and capability set a caller requires, supplied on every catalog request so negotiation cannot be skipped by omission.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ServerSkill
+public sealed class CatalogClientContract
 {
-    /// <summary>Optional freeform hint describing the skill's expected arguments, from the `argument-hint` frontmatter field.</summary>
-    [JsonPropertyName("argumentHint")]
-    public string? ArgumentHint { get; set; }
-
-    /// <summary>Canonical slash command name used to invoke the skill, without the leading '/'.</summary>
-    [JsonPropertyName("commandName")]
-    public string? CommandName { get; set; }
-
-    /// <summary>Description of what the skill does.</summary>
-    [JsonPropertyName("description")]
-    public string Description { get; set; } = string.Empty;
+    /// <summary>SDK protocol version the caller was generated against. A caller below the runtime's minimum supported version is refused rather than served a partial result.</summary>
+    [JsonPropertyName("protocolVersion")]
+    public long ProtocolVersion { get; set; }
 
-    /// <summary>Whether the skill is currently enabled (based on global config).</summary>
-    [JsonPropertyName("enabled")]
-    public bool Enabled { get; set; }
+    /// <summary>Wire features the caller requires the runtime to understand. Identifiers are bounded but extensible so a newer caller can negotiate with an older runtime. Requiring an unknown feature yields a typed refusal listing what is understood, never a partial grant. A grant does not promise that a deployment has enabled the operation; typed unavailable results report that separately.</summary>
+    [JsonPropertyName("requiredCapabilities")]
+    public IList<string> RequiredCapabilities { get => field ??= []; set; }
+}
 
-    /// <summary>Unique identifier for the skill.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+/// <summary>What an install plan is computed from: a candidate handle from a previous search, or a card supplied directly.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "kind",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(McpPlanInstallSourceCandidate), "candidate")]
+[JsonDerivedType(typeof(McpPlanInstallSourceCard), "card")]
+public partial class McpPlanInstallSource
+{
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("kind")]
+    public virtual string Kind { get; set; } = string.Empty;
+}
 
-    /// <summary>Absolute path to the skill file.</summary>
-    [JsonPropertyName("path")]
-    public string? Path { get; set; }
 
-    /// <summary>The project path this skill belongs to (only for project/inherited skills).</summary>
-    [JsonPropertyName("projectPath")]
-    public string? ProjectPath { get; set; }
+/// <summary>Plan from a candidate returned by a previous catalog search.</summary>
+/// <remarks>The <c>candidate</c> variant of <see cref="McpPlanInstallSource"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class McpPlanInstallSourceCandidate : McpPlanInstallSource
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "candidate";
 
-    /// <summary>Source location type (e.g., project, personal-copilot, plugin, builtin).</summary>
-    [JsonPropertyName("source")]
-    public SkillSource Source { get; set; }
+    /// <summary>Single-use candidate handle. Consumed by this call, so a replay of the same handle is rejected.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [MaxLength(256)]
+    [JsonPropertyName("candidateHandle")]
+    public required string CandidateHandle { get; set; }
 
-    /// <summary>Whether the skill can be invoked by the user as a slash command.</summary>
-    [JsonPropertyName("userInvocable")]
-    public bool UserInvocable { get; set; }
+    /// <summary>The runtime- or authority-minted `searchId` returned with the search that produced this candidate. A search implementation binds it to private candidate-handle context; a planning implementation must verify that context before returning a plan. The unavailable planning implementation in this contract layer validates presence but does not claim the verification has occurred. It identifies a search rather than a person and must never be joined with user identity to re-identify anyone.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [MaxLength(64)]
+    [JsonPropertyName("searchId")]
+    public required string SearchId { get; set; }
 }
 
-/// <summary>Skills discovered across global and project sources.</summary>
+/// <summary>A card supplied directly by the caller. Exactly one of a URL or embedded data, encoded structurally so neither both nor neither can be expressed.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ServerSkillList
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "kind",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(McpServerCardReferenceUrl), "url")]
+[JsonDerivedType(typeof(McpServerCardReferenceEmbedded), "embedded")]
+public partial class McpServerCardReference
 {
-    /// <summary>Messages for skills that failed to load (e.g. malformed SKILL.md). Empty when host skills are excluded so host-local paths are not disclosed to multitenant callers.</summary>
-    [JsonPropertyName("errors")]
-    public IList<string>? Errors { get; set; }
-
-    /// <summary>All discovered skills across all sources.</summary>
-    [JsonPropertyName("skills")]
-    public IList<ServerSkill> Skills { get => field ??= []; set; }
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("kind")]
+    public virtual string Kind { get; set; } = string.Empty;
 }
 
-/// <summary>Optional project paths and additional skill directories to include in discovery.</summary>
+
+/// <summary>An MCP server card to be retrieved from a URL through the runtime's hardened fetch boundary.</summary>
+/// <remarks>The <c>url</c> variant of <see cref="McpServerCardReference"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SkillsDiscoverRequest
+public partial class McpServerCardReferenceUrl : McpServerCardReference
 {
-    /// <summary>When true, omit skills from the host's global sources (personal, custom, plugin, and built-in), returning only project-scoped skills. For multitenant deployments.</summary>
-    [JsonPropertyName("excludeHostSkills")]
-    public bool? ExcludeHostSkills { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "url";
 
-    /// <summary>Optional list of project directory paths to scan for project-scoped skills.</summary>
-    [JsonPropertyName("projectPaths")]
-    public IList<string>? ProjectPaths { get; set; }
+    /// <summary>Media type the card is expected to conform to.</summary>
+    [JsonPropertyName("mediaType")]
+    public required McpServerCardMediaType MediaType { get; set; }
 
-    /// <summary>Optional list of additional skill directory paths to include.</summary>
-    [JsonPropertyName("skillDirectories")]
-    public IList<string>? SkillDirectories { get; set; }
+    /// <summary>Card URL. Retrieved only through the runtime's hardened boundary, with scheme, credential, address-range, redirect, timeout, and response-size controls applied. Never logged.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [MaxLength(2048)]
+    [JsonPropertyName("url")]
+    public required string Url { get; set; }
 }
 
-/// <summary>Canonical directory where skills can be discovered or created, with scope, preference, and optional project path.</summary>
+/// <summary>An MCP server card supplied inline as an inert document.</summary>
+/// <remarks>The <c>embedded</c> variant of <see cref="McpServerCardReference"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SkillDiscoveryPath
+public partial class McpServerCardReferenceEmbedded : McpServerCardReference
 {
-    /// <summary>Absolute path of the create/discovery target (may not exist on disk yet).</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
-
-    /// <summary>Whether this is the canonical directory to create a new skill in its tier. At most one entry per tier is preferred; the `personal-agents` and `custom` scopes are never preferred.</summary>
-    [JsonPropertyName("preferredForCreation")]
-    public bool PreferredForCreation { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "embedded";
 
-    /// <summary>The input project path this directory was derived from (only for project scope).</summary>
-    [JsonPropertyName("projectPath")]
-    public string? ProjectPath { get; set; }
+    /// <summary>The card document verbatim, treated as inert untrusted bytes. The runtime parses and validates it; the host is not expected to interpret it. Never logged.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [MaxLength(1048576)]
+    [JsonPropertyName("data")]
+    public required string Data { get; set; }
 
-    /// <summary>Which tier this directory belongs to.</summary>
-    [JsonPropertyName("scope")]
-    public SkillDiscoveryScope Scope { get; set; }
+    /// <summary>Media type the card is expected to conform to.</summary>
+    [JsonPropertyName("mediaType")]
+    public required McpServerCardMediaType MediaType { get; set; }
 }
 
-/// <summary>Canonical locations where skills can be created so the runtime will recognize them.</summary>
+/// <summary>Plan from a card supplied directly by the caller, without a preceding search.</summary>
+/// <remarks>The <c>card</c> variant of <see cref="McpPlanInstallSource"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SkillDiscoveryPathList
+public partial class McpPlanInstallSourceCard : McpPlanInstallSource
 {
-    /// <summary>Canonical skill create/discovery directories, in priority order.</summary>
-    [JsonPropertyName("paths")]
-    public IList<SkillDiscoveryPath> Paths { get => field ??= []; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "card";
+
+    /// <summary>The card to plan from: exactly one of a URL or embedded data.</summary>
+    [JsonPropertyName("card")]
+    public required McpServerCardReference Card { get; set; }
 }
 
-/// <summary>Optional project paths to enumerate.</summary>
+/// <summary>A side-effect-free request for an MCP install plan. Computing a plan never writes configuration, stores a secret, or reloads MCP servers.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SkillsGetDiscoveryPathsRequest
+internal sealed class McpPlanInstallRequest
 {
-    /// <summary>When true, omit the host's personal and custom skill directories, leaving only project directories. For multitenant deployments.</summary>
-    [JsonPropertyName("excludeHostSkills")]
-    public bool? ExcludeHostSkills { get; set; }
+    /// <summary>Protocol version and capabilities the caller requires.</summary>
+    [JsonPropertyName("contract")]
+    public CatalogClientContract Contract { get => field ??= new(); set; }
 
-    /// <summary>Optional list of project directory paths. When omitted or empty, only personal and custom directories are returned.</summary>
-    [JsonPropertyName("projectPaths")]
-    public IList<string>? ProjectPaths { get; set; }
+    /// <summary>Configuration scope the plan targets. Defaults to user scope when omitted.</summary>
+    [JsonPropertyName("scope")]
+    public McpPlanScope? Scope { get; set; }
+
+    /// <summary>What to plan: either a candidate handle from a previous search, or a card supplied directly.</summary>
+    [JsonPropertyName("source")]
+    public McpPlanInstallSource Source { get => field ??= new(); set; }
 }
 
-/// <summary>Skill names to mark as disabled in global configuration, replacing any previous list.</summary>
+/// <summary>User-configured MCP servers, keyed by server name.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SkillsConfigSetDisabledSkillsRequest
+public sealed class McpConfigList
 {
-    /// <summary>List of skill names to disable.</summary>
-    [JsonPropertyName("disabledSkills")]
-    public IList<string> DisabledSkills { get => field ??= []; set; }
+    /// <summary>All MCP servers from user config, keyed by name.</summary>
+    [JsonPropertyName("servers")]
+    public IDictionary<string, JsonElement> Servers { get => field ??= new Dictionary<string, JsonElement>(); set; }
 }
 
-/// <summary>Adds or removes a single skill from the global disabled list, leaving every other entry untouched.</summary>
+/// <summary>MCP server name and configuration to add to user configuration.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SkillsConfigSetSkillDisabledRequest
+internal sealed class McpConfigAddRequest
 {
-    /// <summary>True to disable the skill, false to enable it.</summary>
-    [JsonPropertyName("disabled")]
-    public bool Disabled { get; set; }
+    /// <summary>MCP server configuration (stdio process or remote HTTP/SSE).</summary>
+    [JsonPropertyName("config")]
+    public JsonElement Config { get; set; }
 
-    /// <summary>Name of the skill to add to or remove from the disabled list.</summary>
+    /// <summary>Unique name for the MCP server.</summary>
+    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
     [JsonPropertyName("name")]
     public string Name { get; set; } = string.Empty;
 }
 
-/// <summary>Agent metadata, including identifiers, display details, source, tools, model, MCP servers, skills, and file path.</summary>
+/// <summary>MCP server name and replacement configuration to write to user configuration.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class AgentInfo
+internal sealed class McpConfigUpdateRequest
 {
-    /// <summary>Description of the agent's purpose.</summary>
-    [JsonPropertyName("description")]
-    public string Description { get; set; } = string.Empty;
-
-    /// <summary>Human-readable display name.</summary>
-    [JsonPropertyName("displayName")]
-    public string DisplayName { get; set; } = string.Empty;
-
-    /// <summary>Stable identifier for selection. For most agents this is the same as `name`; for plugin/builtin agents it may differ. Always populated; defaults to `name` when no distinct id was assigned.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
-
-    /// <summary>MCP server configurations attached to this agent, keyed by server name. Server config shape mirrors the MCP `mcpServers` schema.</summary>
-    [Experimental(Diagnostics.Experimental)]
-    [JsonPropertyName("mcpServers")]
-    public IDictionary<string, JsonElement>? McpServers { get; set; }
-
-    /// <summary>Authored preferred model id for this agent. Runtime model selection may choose a different model; omitted means no authored preference.</summary>
-    [JsonPropertyName("model")]
-    public string? Model { get; set; }
+    /// <summary>MCP server configuration (stdio process or remote HTTP/SSE).</summary>
+    [JsonPropertyName("config")]
+    public JsonElement Config { get; set; }
 
-    /// <summary>Name of the agent. Use `id` as the stable selection identifier.</summary>
+    /// <summary>Name of the MCP server to update.</summary>
+    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
     [JsonPropertyName("name")]
     public string Name { get; set; } = string.Empty;
-
-    /// <summary>Absolute local file path of the agent definition. Only set for file-based agents loaded from disk; remote agents do not have a path.</summary>
-    [JsonPropertyName("path")]
-    public string? Path { get; set; }
-
-    /// <summary>Authored base prompt for the agent. Runtime prompt assembly may add dynamic context at invocation time. Omitted from `session.agent.list` unless `includePrompt` is true.</summary>
-    [JsonPropertyName("prompt")]
-    public string? Prompt { get; set; }
-
-    /// <summary>Skill names preloaded into this agent's context. Omitted means none.</summary>
-    [JsonPropertyName("skills")]
-    public IList<string>? Skills { get; set; }
-
-    /// <summary>Where the agent definition was loaded from.</summary>
-    [JsonPropertyName("source")]
-    public AgentInfoSource? Source { get; set; }
-
-    /// <summary>Allowed tool names for this agent. Empty array means none; omitted means inherit defaults.</summary>
-    [JsonPropertyName("tools")]
-    public IList<string>? Tools { get; set; }
-
-    /// <summary>Whether the agent can be selected directly by the user. Agents marked `false` are subagent-only.</summary>
-    [JsonPropertyName("userInvocable")]
-    public bool? UserInvocable { get; set; }
 }
 
-/// <summary>Agents discovered across user, project, plugin, and remote sources.</summary>
+/// <summary>MCP server name to remove from user configuration.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ServerAgentList
+internal sealed class McpConfigRemoveRequest
 {
-    /// <summary>All discovered agents across all sources.</summary>
-    [JsonPropertyName("agents")]
-    public IList<AgentInfo> Agents { get => field ??= []; set; }
+    /// <summary>Name of the MCP server to remove.</summary>
+    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 }
 
-/// <summary>Optional project paths to include in agent discovery.</summary>
+/// <summary>MCP server names to enable for new sessions.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class AgentsDiscoverRequest
+internal sealed class McpConfigEnableRequest
 {
-    /// <summary>When true, omit the host's agents (the user-level agent directory and all plugin agents), leaving only project and remote agents. For multitenant deployments.</summary>
-    [JsonPropertyName("excludeHostAgents")]
-    public bool? ExcludeHostAgents { get; set; }
-
-    /// <summary>Optional list of project directory paths to scan for project-scoped agents. When omitted or empty, only user/plugin/remote-independent agents are returned (no project scan).</summary>
-    [JsonPropertyName("projectPaths")]
-    public IList<string>? ProjectPaths { get; set; }
+    /// <summary>Names of MCP servers to enable. Each server is removed from the persisted disabled list so new sessions spawn it. Unknown or already-enabled names are ignored.</summary>
+    [JsonPropertyName("names")]
+    public IList<string> Names { get => field ??= []; set; }
 }
 
-/// <summary>Canonical directory where custom agents can be discovered or created, with scope, preference, and optional project path.</summary>
+/// <summary>MCP server names to disable for new sessions.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class AgentDiscoveryPath
+internal sealed class McpConfigDisableRequest
 {
-    /// <summary>Absolute path of the search/create directory (may not exist on disk yet).</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
-
-    /// <summary>Whether this is the canonical directory to create a new agent in its tier. At most one entry per tier is preferred.</summary>
-    [JsonPropertyName("preferredForCreation")]
-    public bool PreferredForCreation { get; set; }
-
-    /// <summary>The input project path this directory was derived from (only for project scope).</summary>
-    [JsonPropertyName("projectPath")]
-    public string? ProjectPath { get; set; }
-
-    /// <summary>Which tier this directory belongs to.</summary>
-    [JsonPropertyName("scope")]
-    public AgentDiscoveryPathScope Scope { get; set; }
-}
-
-/// <summary>Canonical locations where custom agents can be created so the runtime will recognize them.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class AgentDiscoveryPathList
-{
-    /// <summary>Canonical agent create/discovery directories, in priority order.</summary>
-    [JsonPropertyName("paths")]
-    public IList<AgentDiscoveryPath> Paths { get => field ??= []; set; }
+    /// <summary>Names of MCP servers to disable. Each server is added to the persisted disabled list so new sessions skip it. Already-disabled names are ignored. Active sessions keep their current connections until they end.</summary>
+    [JsonPropertyName("names")]
+    public IList<string> Names { get => field ??= []; set; }
 }
 
-/// <summary>Optional project paths to include when enumerating agent discovery directories.</summary>
+/// <summary>Installed plugin that contributes a discovered extension.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class AgentsGetDiscoveryPathsRequest
+public sealed class DiscoveredExtensionPlugin
 {
-    /// <summary>When true, omit the host's user-level agent directory, leaving only project directories. For multitenant deployments (mirrors `discover`'s `excludeHostAgents`).</summary>
-    [JsonPropertyName("excludeHostAgents")]
-    public bool? ExcludeHostAgents { get; set; }
-
-    /// <summary>Optional list of project directory paths. When omitted or empty, only the user-level directory is returned.</summary>
-    [JsonPropertyName("projectPaths")]
-    public IList<string>? ProjectPaths { get; set; }
+    /// <summary>Installed plugin name.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 }
 
-/// <summary>Loaded instruction source for a session, including path, content, category, location, applicability, and optional description.</summary>
+/// <summary>Discovered extension metadata and persistent enablement state.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class InstructionSource
+public sealed class DiscoveredExtension
 {
-    /// <summary>Glob pattern(s) from frontmatter — when set, this instruction applies only to matching files.</summary>
-    [JsonPropertyName("applyTo")]
-    public IList<string>? ApplyTo { get; set; }
-
-    /// <summary>Raw content of the instruction file.</summary>
-    [JsonPropertyName("content")]
-    public string Content { get; set; } = string.Empty;
-
-    /// <summary>When true, this source starts disabled and must be toggled on by the user.</summary>
-    [JsonPropertyName("defaultDisabled")]
-    public bool? DefaultDisabled { get; set; }
-
-    /// <summary>Short description (body after frontmatter) for use in instruction tables.</summary>
-    [JsonPropertyName("description")]
-    public string? Description { get; set; }
+    /// <summary>Whether this extension's persistent per-ID preference is enabled.</summary>
+    [JsonPropertyName("enabled")]
+    public bool Enabled { get; set; }
 
-    /// <summary>Unique identifier for this source (used for toggling).</summary>
+    /// <summary>Source-qualified ID accepted by both server and session extension enablement methods.</summary>
     [JsonPropertyName("id")]
     public string Id { get; set; } = string.Empty;
 
-    /// <summary>Human-readable label.</summary>
-    [JsonPropertyName("label")]
-    public string Label { get; set; } = string.Empty;
+    /// <summary>Human-readable extension name.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
-    /// <summary>Where this source lives — used for UI grouping.</summary>
-    [JsonPropertyName("location")]
-    public InstructionSourceLocation Location { get; set; }
+    /// <summary>Absolute path to the extension entry module, suitable for revealing it in a file manager.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
 
-    /// <summary>The project path this source was discovered from. Only set by sessionless discovery for repository, working-directory, and project-scoped plugin sources, where it disambiguates sources across multiple workspace roots. The session-scoped getSources leaves it unset.</summary>
-    [JsonPropertyName("projectPath")]
-    public string? ProjectPath { get; set; }
+    /// <summary>Containing plugin metadata for plugin-contributed extensions.</summary>
+    [JsonPropertyName("plugin")]
+    public DiscoveredExtensionPlugin? Plugin { get; set; }
 
-    /// <summary>File path relative to repo or absolute for home.</summary>
-    [JsonPropertyName("sourcePath")]
-    public string SourcePath { get; set; } = string.Empty;
+    /// <summary>Discovery source.</summary>
+    [JsonPropertyName("source")]
+    public DiscoveredExtensionSource Source { get; set; }
+}
 
-    /// <summary>Category of instruction source — used for merge logic.</summary>
-    [JsonPropertyName("type")]
-    public InstructionSourceType Type { get; set; }
+/// <summary>Extensions discovered from persisted Copilot home state and their effective loading mode. Launch-scoped additional plugins are not included.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class DiscoveredExtensions
+{
+    /// <summary>Discovered user and enabled installed-plugin extensions from persisted Copilot home state.</summary>
+    [JsonPropertyName("extensions")]
+    public IList<DiscoveredExtension> Extensions { get => field ??= []; set; }
+
+    /// <summary>Effective extension loading mode. Defaults to load_and_augment when unset.</summary>
+    [JsonPropertyName("mode")]
+    public DiscoveredExtensionMode Mode { get; set; }
 }
 
-/// <summary>Instruction sources discovered across user, repository, and plugin sources.</summary>
+/// <summary>Source-qualified extension identifiers to persistently enable for future sessions.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ServerInstructionSourceList
+internal sealed class DiscoveredExtensionsEnableRequest
 {
-    /// <summary>All discovered instruction sources.</summary>
-    [JsonPropertyName("sources")]
-    public IList<InstructionSource> Sources { get => field ??= []; set; }
+    /// <summary>Source-qualified user or plugin extension IDs to enable.</summary>
+    [JsonPropertyName("ids")]
+    public IList<string> Ids { get => field ??= []; set; }
 }
 
-/// <summary>Optional project paths to include in instruction discovery.</summary>
+/// <summary>Source-qualified extension identifiers to persistently disable for future sessions.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class InstructionsDiscoverRequest
+internal sealed class DiscoveredExtensionsDisableRequest
 {
-    /// <summary>When true, omit the host's instruction sources (user/home-level files and plugin rules), leaving only repository and working-directory sources. For multitenant deployments.</summary>
-    [JsonPropertyName("excludeHostInstructions")]
-    public bool? ExcludeHostInstructions { get; set; }
+    /// <summary>Source-qualified user or plugin extension IDs to disable.</summary>
+    [JsonPropertyName("ids")]
+    public IList<string> Ids { get => field ??= []; set; }
+}
 
-    /// <summary>Optional list of project directory paths to scan for repository/working-directory instruction sources. When omitted or empty, only user-level and plugin instruction sources are returned (no project scan).</summary>
-    [JsonPropertyName("projectPaths")]
-    public IList<string>? ProjectPaths { get; set; }
+/// <summary>Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal. Never a partial success.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "kind",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(CatalogSearchResultSucceeded), "succeeded")]
+[JsonDerivedType(typeof(CatalogSearchResultNegotiationRefused), "negotiation-refused")]
+[JsonDerivedType(typeof(CatalogSearchResultUnsupportedKind), "unsupported-kind")]
+[JsonDerivedType(typeof(CatalogSearchResultInvalidRequest), "invalid-request")]
+[JsonDerivedType(typeof(CatalogSearchResultAuthenticationRequired), "authentication-required")]
+[JsonDerivedType(typeof(CatalogSearchResultPolicyRejected), "policy-rejected")]
+[JsonDerivedType(typeof(CatalogSearchResultNetworkFailure), "network-failure")]
+[JsonDerivedType(typeof(CatalogSearchResultUnsafeRetrieval), "unsafe-retrieval")]
+[JsonDerivedType(typeof(CatalogSearchResultMalformedCard), "malformed-card")]
+[JsonDerivedType(typeof(CatalogSearchResultContractViolation), "contract-violation")]
+[JsonDerivedType(typeof(CatalogSearchResultUnavailable), "unavailable")]
+public partial class CatalogSearchResult
+{
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("kind")]
+    public virtual string Kind { get; set; } = string.Empty;
 }
 
-/// <summary>Canonical file or directory where custom instructions can be discovered or created, with location, kind, preference, and project path.</summary>
+
+/// <summary>One inert catalog result, represented as an MCP server or discovery-only AI skill variant so kind, media type, provenance, and installability cannot contradict each other.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class InstructionDiscoveryPath
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "kind",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(CatalogCandidateMcpServer), "mcp-server")]
+[JsonDerivedType(typeof(CatalogCandidateAiSkill), "ai-skill")]
+public partial class CatalogCandidate
 {
-    /// <summary>Whether the target is a single file or a directory of instruction files.</summary>
+    /// <summary>The type discriminator.</summary>
     [JsonPropertyName("kind")]
-    public InstructionDiscoveryPathKind Kind { get; set; }
+    public virtual string Kind { get; set; } = string.Empty;
+}
 
-    /// <summary>Which tier this target belongs to.</summary>
-    [JsonPropertyName("location")]
-    public InstructionDiscoveryPathLocation Location { get; set; }
 
-    /// <summary>Absolute path of the file or directory (may not exist on disk yet).</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+/// <summary>Where and when an MCP server catalog reference was observed. Discovery provenance deliberately carries no content digest because search does not establish the exact validated content a later plan will bind.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class CatalogMcpServerCandidateProvenance
+{
+    /// <summary>Host of the catalog authority that advertised the reference, without path, query, or credentials. Inert untrusted data.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("authority")]
+    public string Authority { get; set; } = string.Empty;
 
-    /// <summary>Whether this is the canonical target to create new instructions in its tier. At most one entry per tier is preferred.</summary>
-    [JsonPropertyName("preferredForCreation")]
-    public bool PreferredForCreation { get; set; }
+    /// <summary>JSON MCP media type advertised for the referenced card.</summary>
+    [JsonPropertyName("mediaType")]
+    public McpServerCardMediaType MediaType { get; set; }
 
-    /// <summary>The input project path this target was derived from (only for repository targets).</summary>
-    [JsonPropertyName("projectPath")]
-    public string? ProjectPath { get; set; }
+    /// <summary>ISO 8601 timestamp at which the runtime observed the catalog reference. This is not a retrieval or validation timestamp.</summary>
+    [JsonPropertyName("observedAt")]
+    public string ObservedAt { get; set; } = string.Empty;
 }
 
-/// <summary>Canonical files and directories where custom instructions can be created so the runtime will recognize them.</summary>
+/// <summary>Where a candidate's card came from. Exactly one of a URL or embedded data: the union has no variant carrying both, and no variant carrying neither, so the rule holds structurally rather than by validation.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class InstructionDiscoveryPathList
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "kind",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(CatalogCandidateSourceUrl), "url")]
+[JsonDerivedType(typeof(CatalogCandidateSourceEmbedded), "embedded")]
+public partial class CatalogCandidateSource
 {
-    /// <summary>Canonical instruction create/discovery files and directories, in priority order.</summary>
-    [JsonPropertyName("paths")]
-    public IList<InstructionDiscoveryPath> Paths { get => field ??= []; set; }
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("kind")]
+    public virtual string Kind { get; set; } = string.Empty;
 }
 
-/// <summary>Optional project paths to include when enumerating instruction discovery targets.</summary>
+
+/// <summary>Candidate whose card is retrieved from a URL through the runtime's hardened fetch boundary.</summary>
+/// <remarks>The <c>url</c> variant of <see cref="CatalogCandidateSource"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class InstructionsGetDiscoveryPathsRequest
+public partial class CatalogCandidateSourceUrl : CatalogCandidateSource
 {
-    /// <summary>When true, omit the host's user-level instruction targets, leaving only repository targets. For multitenant deployments (mirrors `discover`'s `excludeHostInstructions`).</summary>
-    [JsonPropertyName("excludeHostInstructions")]
-    public bool? ExcludeHostInstructions { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "url";
 
-    /// <summary>Optional list of project directory paths. When omitted or empty, only the user-level targets are returned.</summary>
-    [JsonPropertyName("projectPaths")]
-    public IList<string>? ProjectPaths { get; set; }
+    /// <summary>Card URL as advertised. Inert untrusted data: the runtime retrieves it only through its own hardened boundary, and it is never logged.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("url")]
+    public required string Url { get; set; }
 }
 
-/// <summary>A literal choice the command input accepts, with a human-facing description.</summary>
+/// <summary>Candidate whose card reference arrived inline. The document and its content-derived properties stay behind the runtime boundary.</summary>
+/// <remarks>The <c>embedded</c> variant of <see cref="CatalogCandidateSource"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SlashCommandInputChoice
+public partial class CatalogCandidateSourceEmbedded : CatalogCandidateSource
 {
-    /// <summary>Human-readable description shown alongside the choice.</summary>
-    [JsonPropertyName("description")]
-    public string Description { get; set; } = string.Empty;
-
-    /// <summary>The literal choice value (e.g. 'on', 'off', 'show').</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "embedded";
 }
 
-/// <summary>Optional unstructured input hint.</summary>
+/// <summary>An inert MCP server catalog result. Every free-text field is untrusted external data and must never be treated as an instruction, and the handle is the only way to refer to the candidate in a later operation.</summary>
+/// <remarks>The <c>mcp-server</c> variant of <see cref="CatalogCandidate"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SlashCommandInput
+public partial class CatalogCandidateMcpServer : CatalogCandidate
 {
-    /// <summary>Optional literal choices the input accepts, each with a human-facing description; clients may render these as selectable options.</summary>
-    [JsonPropertyName("choices")]
-    public IList<SlashCommandInputChoice>? Choices { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "mcp-server";
 
-    /// <summary>Optional completion hint for the input (e.g. 'directory' for filesystem path completion).</summary>
-    [JsonPropertyName("completion")]
-    public SlashCommandInputCompletion? Completion { get; set; }
+    /// <summary>Description taken verbatim from the card. Inert untrusted text.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("description")]
+    public string? Description { get; set; }
 
-    /// <summary>Hint to display when command input has not been provided.</summary>
-    [JsonPropertyName("hint")]
-    public string Hint { get; set; } = string.Empty;
+    /// <summary>Display name taken verbatim from the card. Inert untrusted text.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(200)]
+    [JsonPropertyName("displayName")]
+    public required string DisplayName { get; set; }
 
-    /// <summary>When true, clients should pass the full text after the command name as a single argument rather than splitting on whitespace.</summary>
-    [JsonPropertyName("preserveMultilineInput")]
-    public bool? PreserveMultilineInput { get; set; }
+    /// <summary>Opaque, runtime-instance scoped, TTL-bound, single-use handle for this candidate. Carries no readable information and is rejected when stale, replayed, or presented to a different runtime instance. Never logged.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("handle")]
+    public required string Handle { get; set; }
 
-    /// <summary>When true, the command requires non-empty input; clients should render the input hint as required.</summary>
-    [JsonPropertyName("required")]
-    public bool? Required { get; set; }
+    /// <summary>ISO 8601 timestamp after which the handle is stale and will be rejected.</summary>
+    [JsonPropertyName("handleExpiresAt")]
+    public required string HandleExpiresAt { get; set; }
+
+    /// <summary>Whether this MCP server can be planned for installation, and if policy prevents it.</summary>
+    [JsonPropertyName("installability")]
+    public required CatalogMcpServerInstallability Installability { get; set; }
+
+    /// <summary>JSON MCP media type of the underlying card.</summary>
+    [JsonPropertyName("mediaType")]
+    public required McpServerCardMediaType MediaType { get; set; }
+
+    /// <summary>Where the catalog reference was observed, without the card itself or any content digest.</summary>
+    [JsonPropertyName("provenance")]
+    public required CatalogMcpServerCandidateProvenance Provenance { get; set; }
+
+    /// <summary>Publisher taken verbatim from the card. Inert untrusted text.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(200)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("publisher")]
+    public string? Publisher { get; set; }
+
+    /// <summary>Where the card came from: exactly one of a URL or embedded data, encoded as a tagged union so neither both nor neither can be represented.</summary>
+    [JsonPropertyName("source")]
+    public required CatalogCandidateSource Source { get; set; }
 }
 
-/// <summary>Slash-command metadata with name, aliases, description, kind, input hint, execution allowance, and schedulability.</summary>
+/// <summary>Where and when an AI skill catalog reference was observed. Discovery provenance deliberately carries no content digest because search does not establish the exact validated content a later plan will bind.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SlashCommandInfo
+public sealed class CatalogAiSkillCandidateProvenance
 {
-    /// <summary>Canonical aliases without leading slashes.</summary>
-    [JsonPropertyName("aliases")]
-    public IList<string>? Aliases { get; set; }
-
-    /// <summary>Whether the command may run while an agent turn is active.</summary>
-    [JsonPropertyName("allowDuringAgentExecution")]
-    public bool AllowDuringAgentExecution { get; set; }
+    /// <summary>Host of the catalog authority that advertised the reference, without path, query, or credentials. Inert untrusted data.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("authority")]
+    public string Authority { get; set; } = string.Empty;
 
-    /// <summary>Human-readable command description.</summary>
-    [JsonPropertyName("description")]
-    public string Description { get; set; } = string.Empty;
+    /// <summary>Media type advertised for the referenced AI skill card.</summary>
+    [JsonPropertyName("mediaType")]
+    public string MediaType { get; set; } = string.Empty;
 
-    /// <summary>Whether the command is experimental.</summary>
-    [JsonPropertyName("experimental")]
-    public bool? Experimental { get; set; }
+    /// <summary>ISO 8601 timestamp at which the runtime observed the catalog reference. This is not a retrieval or validation timestamp.</summary>
+    [JsonPropertyName("observedAt")]
+    public string ObservedAt { get; set; } = string.Empty;
+}
 
-    /// <summary>Optional unstructured input hint.</summary>
-    [JsonPropertyName("input")]
-    public SlashCommandInput? Input { get; set; }
+/// <summary>An inert AI skill catalog result. AI skills are discovery-only and cannot be represented as installable through this surface.</summary>
+/// <remarks>The <c>ai-skill</c> variant of <see cref="CatalogCandidate"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class CatalogCandidateAiSkill : CatalogCandidate
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "ai-skill";
 
-    /// <summary>Coarse command category for grouping and behavior: runtime built-in, skill-backed command, or SDK/client-owned command.</summary>
-    [JsonPropertyName("kind")]
-    public SlashCommandKind Kind { get; set; }
+    /// <summary>Description taken verbatim from the card. Inert untrusted text.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("description")]
+    public string? Description { get; set; }
 
-    /// <summary>Canonical command name without a leading slash.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Display name taken verbatim from the card. Inert untrusted text.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(200)]
+    [JsonPropertyName("displayName")]
+    public required string DisplayName { get; set; }
 
-    /// <summary>Whether the command may be the target of `/every` / `/after` schedules. Resolution happens at every tick, so only set this when the command is safe to re-invoke and produces an agent prompt.</summary>
-    [JsonPropertyName("schedulable")]
-    public bool? Schedulable { get; set; }
-}
+    /// <summary>Opaque, runtime-instance scoped, TTL-bound, single-use handle for this candidate. Carries no readable information and is rejected when stale, replayed, or presented to a different runtime instance. Never logged.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("handle")]
+    public required string Handle { get; set; }
 
-/// <summary>Slash commands available in the session, after applying any include/exclude filters.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class CommandList
-{
-    /// <summary>Commands available in this session.</summary>
-    [JsonPropertyName("commands")]
-    public IList<SlashCommandInfo> Commands { get => field ??= []; set; }
-}
+    /// <summary>ISO 8601 timestamp after which the handle is stale and will be rejected.</summary>
+    [JsonPropertyName("handleExpiresAt")]
+    public required string HandleExpiresAt { get; set; }
 
-/// <summary>A single user setting's effective value alongside its default, so consumers can render settings left at their default.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class UserSettingMetadata
-{
-    /// <summary>The centrally-known default for this setting (null when no default is registered).</summary>
-    [JsonPropertyName("default")]
-    public JsonElement Default { get; set; }
+    /// <summary>AI skills are discovery-only and cannot be installed through this surface.</summary>
+    [JsonPropertyName("installability")]
+    public required string Installability { get; set; }
 
-    /// <summary>True when the user has not set an explicit value for this setting (i.e. it is left at its default). Reflects whether the user has overridden the key, not whether the effective value happens to equal the default — a key explicitly set to a value identical to the default still reports false.</summary>
-    [JsonPropertyName("isDefault")]
-    public bool IsDefault { get; set; }
+    /// <summary>Media type of the underlying AI skill card.</summary>
+    [JsonPropertyName("mediaType")]
+    public required string MediaType { get; set; }
 
-    /// <summary>The effective value: the user's value if set, otherwise the default.</summary>
-    [JsonPropertyName("value")]
-    public JsonElement Value { get; set; }
+    /// <summary>Where the catalog reference was observed, without the card itself or any content digest.</summary>
+    [JsonPropertyName("provenance")]
+    public required CatalogAiSkillCandidateProvenance Provenance { get; set; }
+
+    /// <summary>Publisher taken verbatim from the card. Inert untrusted text.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(200)]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("publisher")]
+    public string? Publisher { get; set; }
+
+    /// <summary>Where the card came from: exactly one of a URL or embedded data, encoded as a tagged union so neither both nor neither can be represented.</summary>
+    [JsonPropertyName("source")]
+    public required CatalogCandidateSource Source { get; set; }
 }
 
-/// <summary>Per-key metadata for every known user setting (settings.json overlaid with the legacy config.json, config.json wins), including settings left at their default. Excludes repository- and enterprise-managed overrides.</summary>
+/// <summary>A completed catalog search: inert candidate summaries, each carrying a single-use handle.</summary>
+/// <remarks>The <c>succeeded</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class UserSettingsGetResult
+public partial class CatalogSearchResultSucceeded : CatalogSearchResult
 {
-    /// <summary>Every known user setting keyed by setting name, each with its effective value, default, and whether it is at the default.</summary>
-    [JsonPropertyName("settings")]
-    public IDictionary<string, UserSettingMetadata> Settings { get => field ??= new Dictionary<string, UserSettingMetadata>(); set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "succeeded";
+
+    /// <summary>Matching candidates, never more than the requested limit. All text is inert untrusted data.</summary>
+    [JsonPropertyName("candidates")]
+    public required IList<CatalogCandidate> Candidates { get; set; }
+
+    /// <summary>Protocol version and capabilities the runtime honoured.</summary>
+    [JsonPropertyName("negotiated")]
+    public required CatalogNegotiatedContract Negotiated { get; set; }
+
+    /// <summary>Pseudonymous identifier for this search, issued by the runtime or by the catalog authority it queried and never by the caller, so it cannot be forged or replayed to attribute an install to a search that never happened. Always present on a success, so a result set can be tied to the installs it leads to. It identifies a search rather than a person: it is derived from no user, account, device, or query data, and must never be joined with user identity to re-identify anyone.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [MaxLength(64)]
+    [JsonPropertyName("searchId")]
+    public required string SearchId { get; set; }
+
+    /// <summary>Whether further matches existed beyond the requested limit.</summary>
+    [JsonPropertyName("truncated")]
+    public required bool Truncated { get; set; }
 }
 
-/// <summary>Outcome of writing user settings.</summary>
+/// <summary>The caller's protocol version or required capabilities cannot be honoured. Returned instead of a partial or ambiguous success.</summary>
+/// <remarks>The <c>negotiation-refused</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class UserSettingsSetResult
+public partial class CatalogSearchResultNegotiationRefused : CatalogSearchResult
 {
-    /// <summary>Top-level keys whose write landed in settings.json but is shadowed by a value still present in the legacy config.json (config.json wins on read). The write does not take effect until the legacy value is removed.</summary>
-    [JsonPropertyName("shadowedKeys")]
-    public IList<string> ShadowedKeys { get => field ??= []; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "negotiation-refused";
+
+    /// <summary>Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
+
+    /// <summary>Lowest caller protocol version this runtime will serve.</summary>
+    [JsonPropertyName("minimumSupportedProtocolVersion")]
+    public required long MinimumSupportedProtocolVersion { get; set; }
+
+    /// <summary>Whether the version or the capability set was the problem.</summary>
+    [JsonPropertyName("reason")]
+    public required CatalogNegotiationRefusedReason Reason { get; set; }
+
+    /// <summary>Protocol version of the runtime that refused the request.</summary>
+    [JsonPropertyName("runtimeProtocolVersion")]
+    public required long RuntimeProtocolVersion { get; set; }
+
+    /// <summary>Every wire feature this runtime understands, so the caller can retry within that contract. This list does not imply that every deployment has enabled every operation.</summary>
+    [JsonPropertyName("supportedCapabilities")]
+    public required IList<CatalogCapability> SupportedCapabilities { get; set; }
+
+    /// <summary>The subset of the caller's bounded extensible capability identifiers this runtime cannot honour.</summary>
+    [JsonPropertyName("unsupportedCapabilities")]
+    public required IList<string> UnsupportedCapabilities { get; set; }
 }
 
-/// <summary>Partial user settings to write to settings.json. Each top-level key is written individually, replacing the existing value; a key whose value is null is removed.</summary>
+/// <summary>The request asked for a candidate kind this runtime does not serve.</summary>
+/// <remarks>The <c>unsupported-kind</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class UserSettingsSetRequest
+public partial class CatalogSearchResultUnsupportedKind : CatalogSearchResult
 {
-    /// <summary>Partial user settings to write, as a free-form object keyed by setting name.</summary>
-    [JsonPropertyName("settings")]
-    public JsonElement Settings { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "unsupported-kind";
+
+    /// <summary>Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
+
+    /// <summary>The kinds from the request that are not supported.</summary>
+    [JsonPropertyName("requestedKinds")]
+    public required IList<CatalogCandidateKind> RequestedKinds { get; set; }
+
+    /// <summary>Every candidate kind this runtime can serve.</summary>
+    [JsonPropertyName("supportedKinds")]
+    public required IList<CatalogCandidateKind> SupportedKinds { get; set; }
 }
 
-/// <summary>Validated device-managed settings discovered before a session exists.</summary>
+/// <summary>The request was rejected before any work was done, because a bounded field fell outside its permitted range or a required field was unusable.</summary>
+/// <remarks>The <c>invalid-request</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ManagedSettingsReadResult
+public partial class CatalogSearchResultInvalidRequest : CatalogSearchResult
 {
-    /// <summary>Discovery or validation error text when managed settings could not be read safely.</summary>
-    [JsonPropertyName("errorMessage")]
-    public string? ErrorMessage { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "invalid-request";
 
-    /// <summary>Validated, canonical managed-settings JSON. Omitted when no managed settings were discovered or when discovered settings failed validation.</summary>
-    [JsonPropertyName("settingsJson")]
-    public JsonElement? SettingsJson { get; set; }
+    /// <summary>Which request field was rejected.</summary>
+    [JsonPropertyName("field")]
+    public required CatalogInvalidRequestField Field { get; set; }
+
+    /// <summary>Human-readable explanation, safe to surface. Never echoes the offending value, nor a query, URL, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
 }
 
-/// <summary>Indicates whether the calling client was registered as the session filesystem provider.</summary>
+/// <summary>An optional catalog authentication exchange did not establish the caller's identity. Anonymous search remains supported; this refusal is reserved for an operation that cannot continue after the attempted exchange. It is distinct from `policy-rejected` and from a network failure, and the reason identifies the recovery action.</summary>
+/// <remarks>The <c>authentication-required</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsSetProviderResult
+public partial class CatalogSearchResultAuthenticationRequired : CatalogSearchResult
 {
-    /// <summary>Whether the provider was set successfully.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "authentication-required";
+
+    /// <summary>Human-readable explanation, safe to surface. Never contains a credential or token, nor a query, URL, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
+
+    /// <summary>Why authentication failed. Only an expired credential justifies attempting a silent refresh; an absent or rejected credential requires sign-in.</summary>
+    [JsonPropertyName("reason")]
+    public required CatalogAuthenticationRequiredReason Reason { get; set; }
 }
 
-/// <summary>Optional capabilities declared by the provider.</summary>
+/// <summary>Registry or enterprise policy refused the operation.</summary>
+/// <remarks>The <c>policy-rejected</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsSetProviderCapabilities
+public partial class CatalogSearchResultPolicyRejected : CatalogSearchResult
 {
-    /// <summary>Whether the provider supports SQLite query/exists operations.</summary>
-    [JsonPropertyName("sqlite")]
-    public bool? Sqlite { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "policy-rejected";
+
+    /// <summary>Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
+
+    /// <summary>Which authority produced the decision.</summary>
+    [JsonPropertyName("source")]
+    public required McpPlanPolicySource Source { get; set; }
 }
 
-/// <summary>Initial working directory, session-state path layout, and path conventions used to register the calling SDK client as the session filesystem provider.</summary>
+/// <summary>The runtime could not reach the catalog authority or retrieve a card. Covers being offline as well as transport-level failure.</summary>
+/// <remarks>The <c>network-failure</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionFsSetProviderRequest
+public partial class CatalogSearchResultNetworkFailure : CatalogSearchResult
 {
-    /// <summary>Optional capabilities declared by the provider.</summary>
-    [JsonPropertyName("capabilities")]
-    public SessionFsSetProviderCapabilities? Capabilities { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "network-failure";
 
-    /// <summary>Path conventions used by this filesystem.</summary>
-    [JsonPropertyName("conventions")]
-    public SessionFsSetProviderConventions Conventions { get; set; }
+    /// <summary>Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
 
-    /// <summary>Initial working directory for sessions.</summary>
-    [JsonPropertyName("initialCwd")]
-    public string InitialCwd { get; set; } = string.Empty;
+    /// <summary>Categorised failure, low cardinality so it can be aggregated without carrying a URL.</summary>
+    [JsonPropertyName("reason")]
+    public required CatalogNetworkFailureReason Reason { get; set; }
 
-    /// <summary>Path within each session's SessionFs where the runtime stores files for that session.</summary>
-    [JsonPropertyName("sessionStatePath")]
-    public string SessionStatePath { get; set; } = string.Empty;
+    /// <summary>HTTP status code, when the failure was a rejected response.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("statusCode")]
+    public int? StatusCode { get; set; }
 }
 
-/// <summary>Indicates whether the calling client was registered as the LLM inference provider.</summary>
+/// <summary>Retrieval was refused by the runtime's hardened fetch boundary before any request left the process, or before a redirect was followed.</summary>
+/// <remarks>The <c>unsafe-retrieval</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class LlmInferenceSetProviderResult
+public partial class CatalogSearchResultUnsafeRetrieval : CatalogSearchResult
 {
-    /// <summary>Whether the provider was set successfully.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
-}
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "unsafe-retrieval";
 
-/// <summary>Whether the start frame was accepted.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class LlmInferenceHttpResponseStartResult
-{
-    /// <summary>True when the response start was matched to a pending request; false when unknown.</summary>
-    [JsonPropertyName("accepted")]
-    public bool Accepted { get; set; }
+    /// <summary>Human-readable explanation, safe to surface. Never contains the refused URL, nor a query, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
+
+    /// <summary>Which control refused the retrieval, low cardinality so it can be aggregated without carrying a URL.</summary>
+    [JsonPropertyName("reason")]
+    public required CatalogUnsafeRetrievalReason Reason { get; set; }
 }
 
-/// <summary>Response head.</summary>
+/// <summary>A card could not be parsed or did not satisfy its declared media type's schema.</summary>
+/// <remarks>The <c>malformed-card</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class LlmInferenceHttpResponseStartRequest
+public partial class CatalogSearchResultMalformedCard : CatalogSearchResult
 {
-    /// <summary>HTTP response headers, preserving multiple values per name.</summary>
-    [JsonPropertyName("headers")]
-    public IDictionary<string, IList<string>> Headers { get => field ??= new Dictionary<string, IList<string>>(); set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "malformed-card";
 
-    /// <summary>Matches the requestId from the originating httpRequestStart frame.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
+    /// <summary>Media type the card was interpreted as, when it declared one this runtime recognises.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("mediaType")]
+    public CatalogMediaType? MediaType { get; set; }
 
-    /// <summary>HTTP status code.</summary>
-    [JsonPropertyName("status")]
-    public long Status { get; set; }
+    /// <summary>Human-readable explanation, safe to surface. Never echoes card content, nor a query, URL, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
 
-    /// <summary>Optional HTTP status reason phrase.</summary>
-    [JsonPropertyName("statusText")]
-    public string? StatusText { get; set; }
+    /// <summary>How the card failed validation.</summary>
+    [JsonPropertyName("reason")]
+    public required CatalogMalformedCardReason Reason { get; set; }
 }
 
-/// <summary>Whether the chunk was accepted.</summary>
+/// <summary>An upstream catalog response broke the wire contract. Most importantly, every result must carry exactly one of a URL or embedded data: a result carrying both, or neither, is refused here rather than being guessed at.</summary>
+/// <remarks>The <c>contract-violation</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class LlmInferenceHttpResponseChunkResult
+public partial class CatalogSearchResultContractViolation : CatalogSearchResult
 {
-    /// <summary>True when the chunk was matched to a pending request; false when unknown.</summary>
-    [JsonPropertyName("accepted")]
-    public bool Accepted { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "contract-violation";
+
+    /// <summary>Human-readable explanation, safe to surface. Never echoes response content, nor a query, URL, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
+
+    /// <summary>Which rule the response broke.</summary>
+    [JsonPropertyName("reason")]
+    public required CatalogContractViolationReason Reason { get; set; }
 }
 
-/// <summary>Set to terminate the response with a transport-level failure. Implies end-of-stream; any further chunks for this requestId are ignored.</summary>
+/// <summary>The operation is not available on this runtime. Distinct from a network failure: nothing was attempted.</summary>
+/// <remarks>The <c>unavailable</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class LlmInferenceHttpResponseChunkError
+public partial class CatalogSearchResultUnavailable : CatalogSearchResult
 {
-    /// <summary>Optional machine-readable error code.</summary>
-    [JsonPropertyName("code")]
-    public string? Code { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "unavailable";
 
-    /// <summary>Human-readable failure description.</summary>
+    /// <summary>Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(1000)]
     [JsonPropertyName("message")]
-    public string Message { get; set; } = string.Empty;
+    public required string Message { get; set; }
+
+    /// <summary>Why the operation is unavailable.</summary>
+    [JsonPropertyName("reason")]
+    public required CatalogUnavailableReason Reason { get; set; }
 }
 
-/// <summary>A response body chunk or terminal error.</summary>
+/// <summary>A bounded catalog search. Both the query length and the result count are capped by the schema so a caller cannot request an unbounded scan.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class LlmInferenceHttpResponseChunkRequest
+internal sealed class CatalogSearchRequest
 {
-    /// <summary>When true, `data` is base64-encoded bytes. When absent or false, `data` is UTF-8 text.</summary>
-    [JsonPropertyName("binary")]
-    public bool? Binary { get; set; }
-
-    /// <summary>Body byte range. UTF-8 text when `binary` is absent or false; base64-encoded bytes when `binary` is true. May be empty (e.g. when the response body is empty: send a single chunk with empty data and end=true).</summary>
-    [JsonPropertyName("data")]
-    public string Data { get; set; } = string.Empty;
+    /// <summary>Protocol version and capabilities the caller requires.</summary>
+    [JsonPropertyName("contract")]
+    public CatalogClientContract Contract { get => field ??= new(); set; }
 
-    /// <summary>When true, this is the final body chunk for the response. The runtime treats the response body as complete after receiving an end-marked chunk.</summary>
-    [JsonPropertyName("end")]
-    public bool? End { get; set; }
+    /// <summary>Restrict results to these candidate kinds. When omitted, every kind the runtime supports is searched.</summary>
+    [JsonPropertyName("kinds")]
+    public IList<CatalogCandidateKind>? Kinds { get; set; }
 
-    /// <summary>Set to terminate the response with a transport-level failure. Implies end-of-stream; any further chunks for this requestId are ignored.</summary>
-    [JsonPropertyName("error")]
-    public LlmInferenceHttpResponseChunkError? Error { get; set; }
+    /// <summary>Maximum number of candidates to return. Defaults to 10 when omitted.</summary>
+    [JsonPropertyName("limit")]
+    public int? Limit { get; set; }
 
-    /// <summary>Matches the requestId from the originating httpRequestStart frame.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
+    /// <summary>Free-text search query. Never written to logs or telemetry.</summary>
+    [RegularExpression("\\S")]
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [MaxLength(256)]
+    [JsonPropertyName("query")]
+    public string Query { get; set; } = string.Empty;
 }
 
-/// <summary>Pre-resolved working-directory context for session startup.</summary>
+/// <summary>Information about an installed plugin tracked in global state.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionContext
+public sealed class InstalledPluginInfo
 {
-    /// <summary>Active git branch.</summary>
-    [JsonPropertyName("branch")]
-    public string? Branch { get; set; }
-
-    /// <summary>Most recent working directory for this session.</summary>
-    [JsonPropertyName("cwd")]
-    public string Cwd { get; set; } = string.Empty;
-
-    /// <summary>Git repository root, if the cwd was inside a git repo.</summary>
-    [JsonPropertyName("gitRoot")]
-    public string? GitRoot { get; set; }
-
-    /// <summary>Repository host type.</summary>
-    [JsonPropertyName("hostType")]
-    public SessionContextHostType? HostType { get; set; }
+    /// <summary>Opaque, stable hash identifying a direct (non-marketplace) install source. Present only for direct repo / URL / local installs; absent for marketplace plugins. Same source yields the same id; distinct sources never collide.</summary>
+    [JsonPropertyName("directSourceId")]
+    public string? DirectSourceId { get; set; }
 
-    /// <summary>Repository slug in `owner/name` form, when known.</summary>
-    [JsonPropertyName("repository")]
-    public string? Repository { get; set; }
-}
+    /// <summary>Whether the plugin is currently enabled for new sessions.</summary>
+    [JsonPropertyName("enabled")]
+    public bool Enabled { get; set; }
 
-/// <summary>GitHub repository the remote session belongs to.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class RemoteSessionMetadataRepository
-{
-    /// <summary>Branch associated with the remote session.</summary>
-    [JsonPropertyName("branch")]
-    public string Branch { get; set; } = string.Empty;
+    /// <summary>Marketplace the plugin came from. Empty string ("") for direct repo / URL / local installs.</summary>
+    [JsonPropertyName("marketplace")]
+    public string Marketplace { get; set; } = string.Empty;
 
-    /// <summary>Repository name.</summary>
+    /// <summary>Plugin name.</summary>
     [JsonPropertyName("name")]
     public string Name { get; set; } = string.Empty;
 
-    /// <summary>Repository owner.</summary>
-    [JsonPropertyName("owner")]
-    public string Owner { get; set; } = string.Empty;
+    /// <summary>Installed version (when reported by the plugin manifest).</summary>
+    [JsonPropertyName("version")]
+    public string? Version { get; set; }
 }
 
-/// <summary>Remote session metadata for the session to hand off (typically obtained from `sessions.list` with `source: "remote"`).</summary>
+/// <summary>Plugins installed in user/global state.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class RemoteSessionMetadataValue
+public sealed class PluginListResult
 {
-    /// <summary>Most recent working directory context.</summary>
-    [JsonPropertyName("context")]
-    public SessionContext? Context { get; set; }
-
-    /// <summary>Host-supplied human description of what the session is doing right now ("running tests", "waiting for approval"). Optional in the protocol and absent on hosts that do not publish it, so never rely on it -- it enriches `hostStatus`, it does not replace it.</summary>
-    [JsonPropertyName("hostActivity")]
-    public string? HostActivity { get; set; }
-
-    /// <summary>Live status as the owning host reports it in its session listing, so a row for a session running elsewhere can show that it is running. Absent for hosts that publish no such status (the cloud task managers), which read as idle.</summary>
-    [JsonPropertyName("hostStatus")]
-    public RemoteSessionHostStatus? HostStatus { get; set; }
-
-    /// <summary>Always true for remote sessions.</summary>
-    [JsonPropertyName("isRemote")]
-    public bool IsRemote { get; set; }
-
-    /// <summary>Last-modified time as an ISO 8601 timestamp.</summary>
-    [JsonPropertyName("modifiedTime")]
-    public string ModifiedTime { get; set; } = string.Empty;
-
-    /// <summary>Optional human-friendly name set via /rename.</summary>
-    [JsonPropertyName("name")]
-    public string? Name { get; set; }
-
-    /// <summary>Pull request number associated with the session.</summary>
-    [JsonPropertyName("pullRequestNumber")]
-    public long? PullRequestNumber { get; set; }
-
-    /// <summary>Backing remote session IDs (most recent first).</summary>
-    [JsonPropertyName("remoteSessionIds")]
-    public IList<string> RemoteSessionIds { get => field ??= []; set; }
-
-    /// <summary>GitHub repository the remote session belongs to.</summary>
-    [JsonPropertyName("repository")]
-    public RemoteSessionMetadataRepository Repository { get => field ??= new(); set; }
-
-    /// <summary>Original remote resource identifier (task ID or PR node ID).</summary>
-    [JsonPropertyName("resourceId")]
-    public string? ResourceId { get; set; }
-
-    /// <summary>Stable session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-
-    /// <summary>Deadline (ISO 8601) at which a CLI remote session becomes stale without further heartbeats.</summary>
-    [JsonPropertyName("staleAt")]
-    public string? StaleAt { get; set; }
-
-    /// <summary>Session creation time as an ISO 8601 timestamp.</summary>
-    [JsonPropertyName("startTime")]
-    public string StartTime { get; set; } = string.Empty;
-
-    /// <summary>Server-side task state returned by GitHub.</summary>
-    [JsonPropertyName("state")]
-    public string? State { get; set; }
-
-    /// <summary>Short summary of the session, when one has been derived.</summary>
-    [JsonPropertyName("summary")]
-    public string? Summary { get; set; }
-
-    /// <summary>Whether the remote task originated from CCA or CLI `--remote`.</summary>
-    [JsonPropertyName("taskType")]
-    public RemoteSessionMetadataTaskType? TaskType { get; set; }
+    /// <summary>Installed plugins.</summary>
+    [JsonPropertyName("plugins")]
+    public IList<InstalledPluginInfo> Plugins { get => field ??= []; set; }
 }
 
-/// <summary>`sessions.open` handoff progress update with step, status, and optional message.</summary>
+/// <summary>Result of installing a plugin.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionsOpenProgress
+public sealed class PluginInstallResult
 {
-    /// <summary>Optional step message.</summary>
-    [JsonPropertyName("message")]
-    public string? Message { get; set; }
+    /// <summary>Set when the install path is deprecated (e.g. direct repo / URL / local installs). Callers should surface this to end users.</summary>
+    [JsonPropertyName("deprecationWarning")]
+    public string? DeprecationWarning { get; set; }
 
-    /// <summary>Step status.</summary>
-    [JsonPropertyName("status")]
-    public SessionsOpenProgressStatus Status { get; set; }
+    /// <summary>The newly installed plugin's metadata.</summary>
+    [JsonPropertyName("plugin")]
+    public InstalledPluginInfo Plugin { get => field ??= new(); set; }
 
-    /// <summary>Handoff step.</summary>
-    [JsonPropertyName("step")]
-    public SessionsOpenProgressStep Step { get; set; }
+    /// <summary>Optional post-install message provided by the plugin (e.g. setup instructions).</summary>
+    [JsonPropertyName("postInstallMessage")]
+    public string? PostInstallMessage { get; set; }
+
+    /// <summary>Number of skills discovered and installed from the plugin.</summary>
+    [JsonPropertyName("skillsInstalled")]
+    public long SkillsInstalled { get; set; }
 }
 
-/// <summary>Result of opening a session.</summary>
+/// <summary>Plugin source and optional working directory for relative-path resolution.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionOpenResult
+internal sealed class PluginsInstallRequest
 {
-    /// <summary>Remote session metadata, present when status is `connected`.</summary>
-    [JsonPropertyName("metadata")]
-    public RemoteSessionMetadataValue? Metadata { get; set; }
-
-    /// <summary>Handoff progress steps, present when status is `handed_off`.</summary>
-    [JsonPropertyName("progress")]
-    public IList<SessionsOpenProgress>? Progress { get; set; }
-
-    /// <summary>Remote session ID, present when status is `connected`.</summary>
-    [JsonPropertyName("remoteSessionId")]
-    public string? RemoteSessionId { get; set; }
-
-    /// <summary>Opened session ID. Omitted when status is `not_found`.</summary>
-    [JsonPropertyName("sessionId")]
-    public string? SessionId { get; set; }
-
-    /// <summary>Startup prompts queued by user-level hook configs at session creation. Only populated when status is `created`; resumed sessions return an empty array.</summary>
-    [JsonPropertyName("startupPrompts")]
-    public IList<string>? StartupPrompts { get; set; }
+    /// <summary>Plugin install spec. Accepts the same forms as the CLI: "plugin@marketplace" (marketplace install), "owner/repo" or "owner/repo:subpath" (GitHub direct), an http/https/ssh URL, or a local path. Direct (non-marketplace) installs are deprecated and will produce a deprecationWarning in the result.</summary>
+    [JsonPropertyName("source")]
+    public string Source { get; set; } = string.Empty;
 
-    /// <summary>Outcome of the open request.</summary>
-    [JsonPropertyName("status")]
-    public SessionsOpenStatus Status { get; set; }
+    /// <summary>Working directory used to resolve relative local paths in `source`. Defaults to the server's current working directory.</summary>
+    [JsonPropertyName("workingDirectory")]
+    public string? WorkingDirectory { get; set; }
 }
 
-/// <summary>Identifier and optional friendly name assigned to the newly forked session.</summary>
+/// <summary>Name (or spec) of the plugin to uninstall.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionsForkResult
+internal sealed class PluginsUninstallRequest
 {
-    /// <summary>Friendly name assigned to the forked session, if any.</summary>
-    [JsonPropertyName("name")]
-    public string? Name { get; set; }
+    /// <summary>Stable source identity for a direct (non-marketplace) install. Disambiguates uninstall when multiple installed plugins share the same name.</summary>
+    [JsonPropertyName("directSourceId")]
+    public string? DirectSourceId { get; set; }
 
-    /// <summary>The new forked session's ID.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Plugin name or "plugin@marketplace" spec to uninstall. When ambiguous, prefer the fully-qualified spec.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 }
 
-/// <summary>Source session identifier to fork from, optional event-ID boundary, and optional friendly name for the new session.</summary>
+/// <summary>Result of updating a single plugin.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsForkRequest
+public sealed class PluginUpdateResult
 {
-    /// <summary>Optional friendly name to assign to the forked session.</summary>
-    [JsonPropertyName("name")]
-    public string? Name { get; set; }
+    /// <summary>Version after the update, when reported by the plugin manifest.</summary>
+    [JsonPropertyName("newVersion")]
+    public string? NewVersion { get; set; }
 
-    /// <summary>Source session ID to fork from.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Version that was previously installed, when available.</summary>
+    [JsonPropertyName("previousVersion")]
+    public string? PreviousVersion { get; set; }
 
-    /// <summary>Optional event ID boundary. When provided, the fork includes only events before this ID (exclusive). When omitted, all events are included.</summary>
-    [JsonPropertyName("toEventId")]
-    public string? ToEventId { get; set; }
+    /// <summary>Number of skills discovered and installed after the update.</summary>
+    [JsonPropertyName("skillsInstalled")]
+    public long SkillsInstalled { get; set; }
 }
 
-/// <summary>Repository associated with the connected remote session.</summary>
+/// <summary>Name (or spec) of the plugin to update.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ConnectedRemoteSessionMetadataRepository
+internal sealed class PluginsUpdateRequest
 {
-    /// <summary>Branch associated with the remote session.</summary>
-    [JsonPropertyName("branch")]
-    public string Branch { get; set; } = string.Empty;
-
-    /// <summary>Repository name.</summary>
+    /// <summary>Plugin name or "plugin@marketplace" spec to update.</summary>
     [JsonPropertyName("name")]
     public string Name { get; set; } = string.Empty;
-
-    /// <summary>Repository owner or organization login.</summary>
-    [JsonPropertyName("owner")]
-    public string Owner { get; set; } = string.Empty;
 }
 
-/// <summary>Metadata for a connected remote session.</summary>
+/// <summary>Per-plugin result from updating all plugins, with versions, skills installed, success flag, and optional error.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ConnectedRemoteSessionMetadata
+public sealed class PluginUpdateAllEntry
 {
-    /// <summary>Neutral SDK discriminator for the connected remote session kind.</summary>
-    [JsonPropertyName("kind")]
-    public ConnectedRemoteSessionMetadataKind Kind { get; set; }
+    /// <summary>Error message (failure only).</summary>
+    [JsonPropertyName("error")]
+    public string? Error { get; set; }
 
-    /// <summary>Last session update time as an ISO 8601 string.</summary>
-    [JsonPropertyName("modifiedTime")]
-    public DateTimeOffset ModifiedTime { get; set; }
+    /// <summary>Marketplace the plugin came from. Empty string ("") for direct installs.</summary>
+    [JsonPropertyName("marketplace")]
+    public string Marketplace { get; set; } = string.Empty;
 
-    /// <summary>Optional friendly session name.</summary>
+    /// <summary>Plugin name that was updated.</summary>
     [JsonPropertyName("name")]
-    public string? Name { get; set; }
+    public string Name { get; set; } = string.Empty;
 
-    /// <summary>Pull request number associated with the session.</summary>
-    [JsonPropertyName("pullRequestNumber")]
-    public long? PullRequestNumber { get; set; }
+    /// <summary>Version after the update, when available.</summary>
+    [JsonPropertyName("newVersion")]
+    public string? NewVersion { get; set; }
 
-    /// <summary>Repository associated with the connected remote session.</summary>
-    [JsonPropertyName("repository")]
-    public ConnectedRemoteSessionMetadataRepository Repository { get => field ??= new(); set; }
+    /// <summary>Previously installed version, when available.</summary>
+    [JsonPropertyName("previousVersion")]
+    public string? PreviousVersion { get; set; }
 
-    /// <summary>Original remote resource identifier.</summary>
-    [JsonPropertyName("resourceId")]
-    public string? ResourceId { get; set; }
-
-    /// <summary>SDK session ID for the connected remote session.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-
-    /// <summary>Remote session staleness deadline as an ISO 8601 string.</summary>
-    [JsonPropertyName("staleAt")]
-    public DateTimeOffset? StaleAt { get; set; }
-
-    /// <summary>Session start time as an ISO 8601 string.</summary>
-    [JsonPropertyName("startTime")]
-    public DateTimeOffset StartTime { get; set; }
-
-    /// <summary>Remote session state returned by the backing service.</summary>
-    [JsonPropertyName("state")]
-    public string? State { get; set; }
+    /// <summary>Number of skills installed after the update (success only).</summary>
+    [JsonPropertyName("skillsInstalled")]
+    public long? SkillsInstalled { get; set; }
 
-    /// <summary>Optional session summary.</summary>
-    [JsonPropertyName("summary")]
-    public string? Summary { get; set; }
+    /// <summary>Whether the update succeeded for this plugin.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-/// <summary>Remote session connection result.</summary>
+/// <summary>Result of updating all installed plugins.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class RemoteSessionConnectionResult
+public sealed class PluginUpdateAllResult
 {
-    /// <summary>Metadata for a connected remote session.</summary>
-    [JsonPropertyName("metadata")]
-    public ConnectedRemoteSessionMetadata Metadata { get => field ??= new(); set; }
-
-    /// <summary>SDK session ID for the connected remote session.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Per-plugin update results in deterministic order.</summary>
+    [JsonPropertyName("results")]
+    public IList<PluginUpdateAllEntry> Results { get => field ??= []; set; }
 }
 
-/// <summary>Remote session connection parameters.</summary>
+/// <summary>Plugin names (or specs) to enable.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class ConnectRemoteSessionParams
+internal sealed class PluginsEnableRequest
 {
-    /// <summary>Session ID to connect to.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Plugin names or "plugin@marketplace" specs to enable. Unknown names are ignored. Non-marketplace direct installs are always enabled and cannot be toggled via this API.</summary>
+    [JsonPropertyName("names")]
+    public IList<string> Names { get => field ??= []; set; }
 }
 
-/// <summary>Local or remote session metadata entry. Narrow on `isRemote` to access source-specific fields.</summary>
-/// <remarks>Data type discriminated by <c>isRemote</c>.</remarks>
+/// <summary>Plugin names (or specs) to disable.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class SessionListEntry
+internal sealed class PluginsDisableRequest
 {
-    /// <summary>The boolean discriminator.</summary>
-    [JsonPropertyName("isRemote")]
-    public bool IsRemote { get; set; }
-
-    /// <summary>Runtime client name that created/last resumed this session.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("clientName")]
-    public string? ClientName { get; set; }
-
-    /// <summary>Pre-resolved working-directory context for session startup.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("context")]
-    public SessionContext? Context { get; set; }
-
-    /// <summary>Host-supplied human description of what the session is doing right now ("running tests", "waiting for approval"). Optional in the protocol and absent on hosts that do not publish it, so never rely on it -- it enriches `hostStatus`, it does not replace it.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("hostActivity")]
-    public string? HostActivity { get; set; }
-
-    /// <summary>Live status as the owning host reports it in its session listing, so a row for a session running elsewhere can show that it is running. Absent for hosts that publish no such status (the cloud task managers), which read as idle.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("hostStatus")]
-    public RemoteSessionHostStatus? HostStatus { get; set; }
-
-    /// <summary>True for detached maintenance sessions that should be hidden from normal resume lists.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("isDetached")]
-    public bool? IsDetached { get; set; }
+    /// <summary>Plugin names or "plugin@marketplace" specs to disable. Unknown names are ignored. Non-marketplace direct installs cannot be disabled via this API; uninstall them instead. Plugin-owned MCP servers are stopped in active sessions immediately; other plugin contributions remain available until each session reloads plugins.</summary>
+    [JsonPropertyName("names")]
+    public IList<string> Names { get => field ??= []; set; }
+}
 
-    /// <summary>GitHub task ID, when this local session is bound to one. Only present for local sessions exported to remote control.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("mcTaskId")]
-    public string? McTaskId { get; set; }
+/// <summary>Trusted built-in plugin directories to use for this runtime process.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class PluginsBuiltinSetRequest
+{
+    /// <summary>Complete replacement set of trusted built-in plugin directories. Every entry must be an absolute local filesystem path no longer than 4096 characters.</summary>
+    [JsonPropertyName("paths")]
+    public IList<string> Paths { get => field ??= []; set; }
+}
 
-    /// <summary>Last-modified time of the session's persisted state, as ISO 8601.</summary>
-    [JsonPropertyName("modifiedTime")]
-    public required string ModifiedTime { get; set; }
+/// <summary>Registered marketplace summary.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class MarketplaceInfo
+{
+    /// <summary>True when this is a default marketplace shipped with the runtime. Defaults are not removable.</summary>
+    [JsonPropertyName("isDefault")]
+    public bool? IsDefault { get; set; }
 
-    /// <summary>Optional human-friendly name set via /rename.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    /// <summary>Marketplace name (matches the @marketplace suffix in plugin specs).</summary>
     [JsonPropertyName("name")]
-    public string? Name { get; set; }
-
-    /// <summary>Pull request number associated with the session.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("pullRequestNumber")]
-    public long? PullRequestNumber { get; set; }
-
-    /// <summary>Backing remote session IDs (most recent first).</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("remoteSessionIds")]
-    public IList<string>? RemoteSessionIds { get; set; }
-
-    /// <summary>GitHub repository the remote session belongs to.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("repository")]
-    public RemoteSessionMetadataRepository? Repository { get; set; }
-
-    /// <summary>Original remote resource identifier (task ID or PR node ID).</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("resourceId")]
-    public string? ResourceId { get; set; }
-
-    /// <summary>Stable session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public required string SessionId { get; set; }
-
-    /// <summary>Deadline (ISO 8601) at which a CLI remote session becomes stale without further heartbeats.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("staleAt")]
-    public string? StaleAt { get; set; }
-
-    /// <summary>Session creation time as an ISO 8601 timestamp.</summary>
-    [JsonPropertyName("startTime")]
-    public required string StartTime { get; set; }
-
-    /// <summary>Server-side task state returned by GitHub.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("state")]
-    public string? State { get; set; }
+    public string Name { get; set; } = string.Empty;
 
-    /// <summary>Short summary of the session, when one has been derived.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("summary")]
-    public string? Summary { get; set; }
+    /// <summary>Human-readable description of where the marketplace data is fetched from (e.g. "GitHub: owner/repo").</summary>
+    [JsonPropertyName("source")]
+    public string Source { get; set; } = string.Empty;
+}
 
-    /// <summary>Whether the remote task originated from CCA or CLI `--remote`.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("taskType")]
-    public RemoteSessionMetadataTaskType? TaskType { get; set; }
+/// <summary>All registered marketplaces, including built-in defaults.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class MarketplaceListResult
+{
+    /// <summary>Registered marketplaces.</summary>
+    [JsonPropertyName("marketplaces")]
+    public IList<MarketplaceInfo> Marketplaces { get => field ??= []; set; }
 }
 
-/// <summary>Sessions matching the filter, ordered most-recently-modified first.</summary>
+/// <summary>Result of registering a new marketplace.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionList
+public sealed class MarketplaceAddResult
 {
-    /// <summary>Sessions ordered most-recently-modified first. Discriminated by `isRemote`.</summary>
-    [JsonPropertyName("sessions")]
-    public IList<SessionListEntry> Sessions { get => field ??= []; set; }
+    /// <summary>Final name of the marketplace as resolved from its manifest.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 }
 
-/// <summary>Optional filter applied to the returned sessions.</summary>
+/// <summary>Marketplace source and optional working directory for relative-path resolution.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionListFilter
+internal sealed class PluginsMarketplacesAddRequest
 {
-    /// <summary>Match sessions whose context.branch equals this value.</summary>
-    [JsonPropertyName("branch")]
-    public string? Branch { get; set; }
+    /// <summary>Marketplace source. Accepts the same forms as the CLI: "owner/repo" or "owner/repo#ref" (GitHub), an http/https/ssh URL (optionally with #ref), a git scp-style URL (user@host:path), or a local path. The marketplace's own name (from its manifest) is used as the registration key.</summary>
+    [JsonPropertyName("source")]
+    public string Source { get; set; } = string.Empty;
 
-    /// <summary>Match sessions whose context.cwd equals this value.</summary>
-    [JsonPropertyName("cwd")]
-    public string? Cwd { get; set; }
+    /// <summary>Working directory used to resolve relative local paths in `source`. Defaults to the server's current working directory.</summary>
+    [JsonPropertyName("workingDirectory")]
+    public string? WorkingDirectory { get; set; }
+}
 
-    /// <summary>Match sessions whose context.gitRoot equals this value.</summary>
-    [JsonPropertyName("gitRoot")]
-    public string? GitRoot { get; set; }
+/// <summary>Outcome of the remove attempt, including dependent-plugin info when applicable.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class MarketplaceRemoveResult
+{
+    /// <summary>Names of installed plugins that prevented removal. Populated only when `removed=false`.</summary>
+    [JsonPropertyName("dependentPlugins")]
+    public IList<string>? DependentPlugins { get; set; }
 
-    /// <summary>Match sessions whose context.repository equals this value.</summary>
-    [JsonPropertyName("repository")]
-    public string? Repository { get; set; }
+    /// <summary>True when the marketplace was actually removed. False when removal was skipped because the marketplace has dependent plugins and `force` was not set.</summary>
+    [JsonPropertyName("removed")]
+    public bool Removed { get; set; }
 }
 
-/// <summary>Optional source filter, metadata-load limit, and context filter applied to the returned sessions.</summary>
+/// <summary>Name of the marketplace to remove and an optional force flag.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsListRequest
+internal sealed class PluginsMarketplacesRemoveRequest
 {
-    /// <summary>Optional filter applied to the returned sessions.</summary>
-    [JsonPropertyName("filter")]
-    public SessionListFilter? Filter { get; set; }
-
-    /// <summary>When true, include detached maintenance sessions. Defaults to false for user-facing session lists.</summary>
-    [JsonPropertyName("includeDetached")]
-    public bool? IncludeDetached { get; set; }
+    /// <summary>When true, also uninstall every plugin sourced from this marketplace. When false (default), removal is a no-op if any plugin from this marketplace is installed and the dependent plugin names are returned in the result.</summary>
+    [JsonPropertyName("force")]
+    public bool? Force { get; set; }
 
-    /// <summary>When provided, only the first N local sessions (sorted by modification time, newest first) load full metadata; remaining sessions return basic info only. Use 0 to return only basic info for every local session. Has no effect on remote entries (which always carry their full shape).</summary>
-    [JsonPropertyName("metadataLimit")]
-    public long? MetadataLimit { get; set; }
+    /// <summary>Marketplace name to remove.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
+}
 
-    /// <summary>Which session sources to include. Defaults to `local` for backward compatibility.</summary>
-    [JsonPropertyName("source")]
-    public SessionSource? Source { get; set; }
+/// <summary>Plugin entry advertised by a marketplace.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class MarketplacePluginInfo
+{
+    /// <summary>Short description from the marketplace catalog, when present.</summary>
+    [JsonPropertyName("description")]
+    public string? Description { get; set; }
 
-    /// <summary>Only meaningful when `source` includes remote. When true, propagates errors from the remote service instead of silently returning an empty remote list. Defaults to false.</summary>
-    [JsonPropertyName("throwOnError")]
-    public bool? ThrowOnError { get; set; }
+    /// <summary>Plugin name as listed in the marketplace catalog.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 }
 
-/// <summary>Persisted local session metadata, including identifiers, timestamps, summary/name, client, context, detached state, and task ID.</summary>
+/// <summary>Plugins advertised by the marketplace.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class LocalSessionMetadataValue
+public sealed class MarketplaceBrowseResult
 {
-    /// <summary>Runtime client name that created/last resumed this session.</summary>
-    [JsonPropertyName("clientName")]
-    public string? ClientName { get; set; }
-
-    /// <summary>Pre-resolved working-directory context for session startup.</summary>
-    [JsonPropertyName("context")]
-    public SessionContext? Context { get; set; }
-
-    /// <summary>True for detached maintenance sessions that should be hidden from normal resume lists.</summary>
-    [JsonPropertyName("isDetached")]
-    public bool? IsDetached { get; set; }
-
-    /// <summary>Always false for local sessions.</summary>
-    [JsonPropertyName("isRemote")]
-    public bool IsRemote { get; set; }
-
-    /// <summary>GitHub task ID, when this local session is bound to one. Only present for local sessions exported to remote control.</summary>
-    [JsonPropertyName("mcTaskId")]
-    public string? McTaskId { get; set; }
-
-    /// <summary>Last-modified time of the session's persisted state, as ISO 8601.</summary>
-    [JsonPropertyName("modifiedTime")]
-    public string ModifiedTime { get; set; } = string.Empty;
-
-    /// <summary>Optional human-friendly name set via /rename.</summary>
-    [JsonPropertyName("name")]
-    public string? Name { get; set; }
-
-    /// <summary>Stable session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-
-    /// <summary>Session creation time as an ISO 8601 timestamp.</summary>
-    [JsonPropertyName("startTime")]
-    public string StartTime { get; set; } = string.Empty;
-
-    /// <summary>Short summary of the session, when one has been derived.</summary>
-    [JsonPropertyName("summary")]
-    public string? Summary { get; set; }
+    /// <summary>Plugins advertised by the marketplace.</summary>
+    [JsonPropertyName("plugins")]
+    public IList<MarketplacePluginInfo> Plugins { get => field ??= []; set; }
 }
 
-/// <summary>Persisted local session metadata when the session exists.</summary>
+/// <summary>Name of the marketplace whose plugin catalog to fetch.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsGetMetadataResult
+internal sealed class PluginsMarketplacesBrowseRequest
 {
-    /// <summary>Local session metadata, omitted when the session does not exist.</summary>
-    [JsonPropertyName("session")]
-    public LocalSessionMetadataValue? Session { get; set; }
+    /// <summary>Marketplace name to browse.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 }
 
-/// <summary>Session ID whose persisted metadata should be read.</summary>
+/// <summary>Per-marketplace refresh result, including marketplace name, success flag, and optional failure error.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsGetMetadataRequest
+public sealed class MarketplaceRefreshEntry
 {
-    /// <summary>Session ID to inspect.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Error message (failure only).</summary>
+    [JsonPropertyName("error")]
+    public string? Error { get; set; }
 
-/// <summary>Recent local session IDs that contain user-visible history.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsListNonEmptySessionIdsResult
-{
-    /// <summary>Session IDs ordered newest-first.</summary>
-    [JsonPropertyName("sessionIds")]
-    public IList<string> SessionIds { get => field ??= []; set; }
-}
+    /// <summary>Marketplace name that was refreshed.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
-/// <summary>Limit for non-empty local session IDs.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsListNonEmptySessionIdsRequest
-{
-    /// <summary>Maximum number of session IDs to return.</summary>
-    [JsonPropertyName("limit")]
-    public long? Limit { get; set; }
+    /// <summary>Whether the refresh succeeded.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-/// <summary>ID of the local session bound to the given GitHub task, or omitted when none.</summary>
+/// <summary>Result of refreshing one or more marketplace catalogs.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionsFindByTaskIDResult
+public sealed class MarketplaceRefreshResult
 {
-    /// <summary>Omitted when no local session is bound to that GitHub task.</summary>
-    [JsonPropertyName("sessionId")]
-    public string? SessionId { get; set; }
+    /// <summary>Per-marketplace refresh results in deterministic order.</summary>
+    [JsonPropertyName("results")]
+    public IList<MarketplaceRefreshEntry> Results { get => field ??= []; set; }
 }
 
-/// <summary>GitHub task ID to look up.</summary>
+/// <summary>RPC data type for PluginsMarketplacesRefresh operations.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsFindByTaskIDRequest
+internal sealed class PluginsMarketplacesRefreshRequest
 {
-    /// <summary>GitHub task ID to look up.</summary>
-    [JsonPropertyName("taskId")]
-    public string TaskId { get; set; } = string.Empty;
+    /// <summary>Marketplace name to refresh. When omitted, every registered marketplace is refreshed.</summary>
+    [JsonPropertyName("name")]
+    public string? Name { get; set; }
 }
 
-/// <summary>Session ID matching the prefix, omitted when no unique match exists.</summary>
+/// <summary>Server-side skill metadata, including name, description, source, enabled/invocable state, path, project path, and argument hint.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionsFindByPrefixResult
+public sealed class ServerSkill
 {
-    /// <summary>Omitted when no unique session matches the prefix (no match or ambiguous).</summary>
-    [JsonPropertyName("sessionId")]
-    public string? SessionId { get; set; }
-}
+    /// <summary>Optional freeform hint describing the skill's expected arguments, from the `argument-hint` frontmatter field.</summary>
+    [JsonPropertyName("argumentHint")]
+    public string? ArgumentHint { get; set; }
 
-/// <summary>UUID prefix to resolve to a unique session ID.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsFindByPrefixRequest
-{
-    /// <summary>UUID prefix (&gt;=7 hex chars, &lt;36 chars). Returns the unique session ID, or undefined when there is no match or the prefix matches multiple sessions.</summary>
-    [JsonPropertyName("prefix")]
-    public string Prefix { get; set; } = string.Empty;
+    /// <summary>Canonical slash command name used to invoke the skill, without the leading '/'.</summary>
+    [JsonPropertyName("commandName")]
+    public string? CommandName { get; set; }
+
+    /// <summary>Description of what the skill does.</summary>
+    [JsonPropertyName("description")]
+    public string Description { get; set; } = string.Empty;
+
+    /// <summary>Whether the skill is currently enabled (based on global config).</summary>
+    [JsonPropertyName("enabled")]
+    public bool Enabled { get; set; }
+
+    /// <summary>Unique identifier for the skill.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
+
+    /// <summary>Absolute path to the skill file.</summary>
+    [JsonPropertyName("path")]
+    public string? Path { get; set; }
+
+    /// <summary>The project path this skill belongs to (only for project/inherited skills).</summary>
+    [JsonPropertyName("projectPath")]
+    public string? ProjectPath { get; set; }
+
+    /// <summary>Source location type (e.g., project, personal-copilot, plugin, builtin).</summary>
+    [JsonPropertyName("source")]
+    public SkillSource Source { get; set; }
+
+    /// <summary>Whether the skill can be invoked by the user as a slash command.</summary>
+    [JsonPropertyName("userInvocable")]
+    public bool UserInvocable { get; set; }
 }
 
-/// <summary>Most-relevant session ID for the supplied context, or omitted when no sessions exist.</summary>
+/// <summary>Skills discovered across global and project sources.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionsGetLastForContextResult
+public sealed class ServerSkillList
 {
-    /// <summary>Most-relevant session ID for the supplied context, or omitted when no sessions exist.</summary>
-    [JsonPropertyName("sessionId")]
-    public string? SessionId { get; set; }
+    /// <summary>Messages for skills that failed to load (e.g. malformed SKILL.md). Empty when host skills are excluded so host-local paths are not disclosed to multitenant callers.</summary>
+    [JsonPropertyName("errors")]
+    public IList<string>? Errors { get; set; }
+
+    /// <summary>All discovered skills across all sources.</summary>
+    [JsonPropertyName("skills")]
+    public IList<ServerSkill> Skills { get => field ??= []; set; }
 }
 
-/// <summary>Optional working-directory context used to score session relevance.</summary>
+/// <summary>Optional project paths and additional skill directories to include in discovery.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsGetLastForContextRequest
+internal sealed class SkillsDiscoverRequest
 {
-    /// <summary>Optional working-directory context used to score session relevance. When omitted the most-recently-modified session wins.</summary>
-    [JsonPropertyName("context")]
-    public SessionContext? Context { get; set; }
+    /// <summary>When true, omit skills from the host's global sources (personal, custom, plugin, and built-in), returning only project-scoped skills. For multitenant deployments.</summary>
+    [JsonPropertyName("excludeHostSkills")]
+    public bool? ExcludeHostSkills { get; set; }
+
+    /// <summary>Optional list of project directory paths to scan for project-scoped skills.</summary>
+    [JsonPropertyName("projectPaths")]
+    public IList<string>? ProjectPaths { get; set; }
+
+    /// <summary>Optional list of additional skill directory paths to include.</summary>
+    [JsonPropertyName("skillDirectories")]
+    public IList<string>? SkillDirectories { get; set; }
 }
 
-/// <summary>Absolute path to the session's events.jsonl file on disk.</summary>
+/// <summary>Canonical directory where skills can be discovered or created, with scope, preference, and optional project path.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsGetEventFilePathResult
+public sealed class SkillDiscoveryPath
 {
-    /// <summary>Absolute path to the session's events.jsonl file.</summary>
-    [JsonPropertyName("filePath")]
-    public string FilePath { get; set; } = string.Empty;
+    /// <summary>Absolute path of the create/discovery target (may not exist on disk yet).</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
+
+    /// <summary>Whether this is the canonical directory to create a new skill in its tier. At most one entry per tier is preferred; the `personal-agents` and `custom` scopes are never preferred.</summary>
+    [JsonPropertyName("preferredForCreation")]
+    public bool PreferredForCreation { get; set; }
+
+    /// <summary>The input project path this directory was derived from (only for project scope).</summary>
+    [JsonPropertyName("projectPath")]
+    public string? ProjectPath { get; set; }
+
+    /// <summary>Which tier this directory belongs to.</summary>
+    [JsonPropertyName("scope")]
+    public SkillDiscoveryScope Scope { get; set; }
 }
 
-/// <summary>Session ID whose event-log file path to compute.</summary>
+/// <summary>Canonical locations where skills can be created so the runtime will recognize them.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsGetEventFilePathRequest
+public sealed class SkillDiscoveryPathList
 {
-    /// <summary>Session ID whose event-log file path to compute.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Canonical skill create/discovery directories, in priority order.</summary>
+    [JsonPropertyName("paths")]
+    public IList<SkillDiscoveryPath> Paths { get => field ??= []; set; }
 }
 
-/// <summary>Map of sessionId -&gt; on-disk size in bytes for each session's workspace directory.</summary>
+/// <summary>Optional project paths to enumerate.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionSizes
+internal sealed class SkillsGetDiscoveryPathsRequest
 {
-    /// <summary>Map of sessionId -&gt; on-disk size in bytes for the session's workspace directory.</summary>
-    [JsonPropertyName("sizes")]
-    public IDictionary<string, long> Sizes { get => field ??= new Dictionary<string, long>(); set; }
+    /// <summary>When true, omit the host's personal and custom skill directories, leaving only project directories. For multitenant deployments.</summary>
+    [JsonPropertyName("excludeHostSkills")]
+    public bool? ExcludeHostSkills { get; set; }
+
+    /// <summary>Optional list of project directory paths. When omitted or empty, only personal and custom directories are returned.</summary>
+    [JsonPropertyName("projectPaths")]
+    public IList<string>? ProjectPaths { get; set; }
 }
 
-/// <summary>Session IDs from the input set that are currently in use by another process.</summary>
+/// <summary>Skill names to mark as disabled in global configuration, replacing any previous list.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionsCheckInUseResult
+internal sealed class SkillsConfigSetDisabledSkillsRequest
 {
-    /// <summary>Session IDs from the input set that are currently held by another running process via an alive lock file.</summary>
-    [JsonPropertyName("inUse")]
-    public IList<string> InUse { get => field ??= []; set; }
+    /// <summary>List of skill names to disable.</summary>
+    [JsonPropertyName("disabledSkills")]
+    public IList<string> DisabledSkills { get => field ??= []; set; }
 }
 
-/// <summary>Session IDs to test for live in-use locks.</summary>
+/// <summary>Adds or removes a single skill from the global disabled list, leaving every other entry untouched.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsCheckInUseRequest
+internal sealed class SkillsConfigSetSkillDisabledRequest
 {
-    /// <summary>Session IDs to test for live in-use locks.</summary>
-    [JsonPropertyName("sessionIds")]
-    public IList<string> SessionIds { get => field ??= []; set; }
+    /// <summary>True to disable the skill, false to enable it.</summary>
+    [JsonPropertyName("disabled")]
+    public bool Disabled { get; set; }
+
+    /// <summary>Name of the skill to add to or remove from the disabled list.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 }
 
-/// <summary>The session's persisted remote-steerable flag, or omitted when no value has been persisted.</summary>
+/// <summary>Agent metadata, including identifiers, display details, source, tools, model, MCP servers, skills, and file path.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsGetPersistedRemoteSteerableResult
+public sealed class AgentInfo
 {
-    /// <summary>The session's persisted remote-steerable flag if recorded; omitted when no value has been persisted.</summary>
-    [JsonPropertyName("remoteSteerable")]
-    public bool? RemoteSteerable { get; set; }
-}
+    /// <summary>Description of the agent's purpose.</summary>
+    [JsonPropertyName("description")]
+    public string Description { get; set; } = string.Empty;
 
-/// <summary>Session ID to look up the persisted remote-steerable flag for.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsGetPersistedRemoteSteerableRequest
-{
-    /// <summary>Session ID to look up the persisted remote-steerable flag for.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Human-readable display name.</summary>
+    [JsonPropertyName("displayName")]
+    public string DisplayName { get; set; } = string.Empty;
+
+    /// <summary>Stable identifier for selection. For most agents this is the same as `name`; for plugin/builtin agents it may differ. Always populated; defaults to `name` when no distinct id was assigned.</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
+
+    /// <summary>MCP server configurations attached to this agent, keyed by server name. Server config shape mirrors the MCP `mcpServers` schema.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonPropertyName("mcpServers")]
+    public IDictionary<string, JsonElement>? McpServers { get; set; }
+
+    /// <summary>Authored preferred model id for this agent. Runtime model selection may choose a different model; omitted means no authored preference.</summary>
+    [JsonPropertyName("model")]
+    public string? Model { get; set; }
+
+    /// <summary>Name of the agent. Use `id` as the stable selection identifier.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
+
+    /// <summary>Absolute local file path of the agent definition. Only set for file-based agents loaded from disk; remote agents do not have a path.</summary>
+    [JsonPropertyName("path")]
+    public string? Path { get; set; }
+
+    /// <summary>Authored base prompt for the agent. Runtime prompt assembly may add dynamic context at invocation time. Omitted from `session.agent.list` unless `includePrompt` is true.</summary>
+    [JsonPropertyName("prompt")]
+    public string? Prompt { get; set; }
+
+    /// <summary>Skill names preloaded into this agent's context. Omitted means none.</summary>
+    [JsonPropertyName("skills")]
+    public IList<string>? Skills { get; set; }
+
+    /// <summary>Where the agent definition was loaded from.</summary>
+    [JsonPropertyName("source")]
+    public AgentInfoSource? Source { get; set; }
+
+    /// <summary>Allowed tool names for this agent. Empty array means none; omitted means inherit defaults.</summary>
+    [JsonPropertyName("tools")]
+    public IList<string>? Tools { get; set; }
+
+    /// <summary>Whether the agent can be selected directly by the user. Agents marked `false` are subagent-only.</summary>
+    [JsonPropertyName("userInvocable")]
+    public bool? UserInvocable { get; set; }
 }
 
-/// <summary>Closes a session: emits shutdown, flushes pending events to disk, releases the in-use lock, disposes the active session. Idempotent: succeeds even if the session is not currently active.</summary>
+/// <summary>Agents discovered across user, project, plugin, and remote sources.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionsCloseResult
+public sealed class ServerAgentList
 {
+    /// <summary>All discovered agents across all sources.</summary>
+    [JsonPropertyName("agents")]
+    public IList<AgentInfo> Agents { get => field ??= []; set; }
 }
 
-/// <summary>Session ID to close.</summary>
+/// <summary>Optional project paths to include in agent discovery.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsCloseRequest
+internal sealed class AgentsDiscoverRequest
 {
-    /// <summary>Session ID to close.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>When true, omit the host's agents (the user-level agent directory and all plugin agents), leaving only project and remote agents. For multitenant deployments.</summary>
+    [JsonPropertyName("excludeHostAgents")]
+    public bool? ExcludeHostAgents { get; set; }
+
+    /// <summary>Optional list of project directory paths to scan for project-scoped agents. When omitted or empty, only user/plugin/remote-independent agents are returned (no project scan).</summary>
+    [JsonPropertyName("projectPaths")]
+    public IList<string>? ProjectPaths { get; set; }
 }
 
-/// <summary>Map of sessionId -&gt; bytes freed by removing the session's workspace directory.</summary>
+/// <summary>Canonical directory where custom agents can be discovered or created, with scope, preference, and optional project path.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionBulkDeleteResult
+public sealed class AgentDiscoveryPath
 {
-    /// <summary>Map of sessionId -&gt; bytes freed by removing the session's workspace directory. Sessions whose deletion failed are omitted from this map (failures are logged on the server but not surfaced per-id; check the map for absent IDs to detect them).</summary>
-    [JsonPropertyName("freedBytes")]
-    public IDictionary<string, long> FreedBytes { get => field ??= new Dictionary<string, long>(); set; }
+    /// <summary>Absolute path of the search/create directory (may not exist on disk yet).</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
+
+    /// <summary>Whether this is the canonical directory to create a new agent in its tier. At most one entry per tier is preferred.</summary>
+    [JsonPropertyName("preferredForCreation")]
+    public bool PreferredForCreation { get; set; }
+
+    /// <summary>The input project path this directory was derived from (only for project scope).</summary>
+    [JsonPropertyName("projectPath")]
+    public string? ProjectPath { get; set; }
+
+    /// <summary>Which tier this directory belongs to.</summary>
+    [JsonPropertyName("scope")]
+    public AgentDiscoveryPathScope Scope { get; set; }
 }
 
-/// <summary>Session IDs to close, deactivate, and delete from disk.</summary>
+/// <summary>Canonical locations where custom agents can be created so the runtime will recognize them.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsBulkDeleteRequest
+public sealed class AgentDiscoveryPathList
 {
-    /// <summary>Session IDs to close, deactivate, and delete from disk.</summary>
-    [JsonPropertyName("sessionIds")]
-    public IList<string> SessionIds { get => field ??= []; set; }
+    /// <summary>Canonical agent create/discovery directories, in priority order.</summary>
+    [JsonPropertyName("paths")]
+    public IList<AgentDiscoveryPath> Paths { get => field ??= []; set; }
 }
 
-/// <summary>Session ID to delete from disk.</summary>
+/// <summary>Optional project paths to include when enumerating agent discovery directories.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsDeleteRequest
+internal sealed class AgentsGetDiscoveryPathsRequest
 {
-    /// <summary>Session ID to delete.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>When true, omit the host's user-level agent directory, leaving only project directories. For multitenant deployments (mirrors `discover`'s `excludeHostAgents`).</summary>
+    [JsonPropertyName("excludeHostAgents")]
+    public bool? ExcludeHostAgents { get; set; }
 
-    /// <summary>Internal resolved session directory path to delete.</summary>
-    [JsonPropertyName("sessionPath")]
-    public string? SessionPath { get; set; }
+    /// <summary>Optional list of project directory paths. When omitted or empty, only the user-level directory is returned.</summary>
+    [JsonPropertyName("projectPaths")]
+    public IList<string>? ProjectPaths { get; set; }
 }
 
-/// <summary>Outcome of the prune operation: deleted IDs, dry-run candidates, skipped IDs, total bytes freed, and the dry-run flag.</summary>
+/// <summary>Loaded instruction source for a session, including path, content, category, location, applicability, and optional description.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionPruneResult
+public sealed class InstructionSource
 {
-    /// <summary>Session IDs that would be deleted in dry-run mode (always empty otherwise).</summary>
-    [JsonPropertyName("candidates")]
-    public IList<string> Candidates { get => field ??= []; set; }
+    /// <summary>Glob pattern(s) from frontmatter — when set, this instruction applies only to matching files.</summary>
+    [JsonPropertyName("applyTo")]
+    public IList<string>? ApplyTo { get; set; }
 
-    /// <summary>Session IDs that were deleted (always empty in dry-run mode).</summary>
-    [JsonPropertyName("deleted")]
-    public IList<string> Deleted { get => field ??= []; set; }
+    /// <summary>Raw content of the instruction file.</summary>
+    [JsonPropertyName("content")]
+    public string Content { get; set; } = string.Empty;
 
-    /// <summary>True when no deletions were actually performed.</summary>
-    [JsonPropertyName("dryRun")]
-    public bool DryRun { get; set; }
+    /// <summary>When true, this source starts disabled and must be toggled on by the user.</summary>
+    [JsonPropertyName("defaultDisabled")]
+    public bool? DefaultDisabled { get; set; }
 
-    /// <summary>Total bytes freed (actual when not dry-run, projected when dry-run).</summary>
-    [JsonPropertyName("freedBytes")]
-    public long FreedBytes { get; set; }
+    /// <summary>Short description (body after frontmatter) for use in instruction tables.</summary>
+    [JsonPropertyName("description")]
+    public string? Description { get; set; }
 
-    /// <summary>Session IDs that were skipped (e.g., named sessions).</summary>
-    [JsonPropertyName("skipped")]
-    public IList<string> Skipped { get => field ??= []; set; }
-}
+    /// <summary>Unique identifier for this source (used for toggling).</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
 
-/// <summary>Age threshold and optional flags controlling which old sessions are pruned (or simulated when dryRun is true).</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsPruneOldRequest
-{
-    /// <summary>When true, only report what would be deleted without performing any deletion.</summary>
-    [JsonPropertyName("dryRun")]
-    public bool? DryRun { get; set; }
+    /// <summary>Human-readable label.</summary>
+    [JsonPropertyName("label")]
+    public string Label { get; set; } = string.Empty;
 
-    /// <summary>Session IDs that should never be considered for pruning.</summary>
-    [JsonPropertyName("excludeSessionIds")]
-    public IList<string>? ExcludeSessionIds { get; set; }
+    /// <summary>Where this source lives — used for UI grouping.</summary>
+    [JsonPropertyName("location")]
+    public InstructionSourceLocation Location { get; set; }
 
-    /// <summary>When true, named sessions (set via /rename) are also eligible for pruning.</summary>
-    [JsonPropertyName("includeNamed")]
-    public bool? IncludeNamed { get; set; }
+    /// <summary>The project path this source was discovered from. Only set by sessionless discovery for repository, working-directory, and project-scoped plugin sources, where it disambiguates sources across multiple workspace roots. The session-scoped getSources leaves it unset.</summary>
+    [JsonPropertyName("projectPath")]
+    public string? ProjectPath { get; set; }
 
-    /// <summary>Delete sessions whose modifiedTime is at least this many days old.</summary>
-    [JsonPropertyName("olderThanDays")]
-    public long OlderThanDays { get; set; }
+    /// <summary>File path relative to repo or absolute for home.</summary>
+    [JsonPropertyName("sourcePath")]
+    public string SourcePath { get; set; } = string.Empty;
+
+    /// <summary>Category of instruction source — used for merge logic.</summary>
+    [JsonPropertyName("type")]
+    public InstructionSourceType Type { get; set; }
 }
 
-/// <summary>Flush a session's pending events to disk. No-op when no writer exists for the session (e.g., already closed).</summary>
+/// <summary>Instruction sources discovered across user, repository, and plugin sources.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionsSaveResult
+public sealed class ServerInstructionSourceList
 {
+    /// <summary>All discovered instruction sources.</summary>
+    [JsonPropertyName("sources")]
+    public IList<InstructionSource> Sources { get => field ??= []; set; }
 }
 
-/// <summary>Session ID whose pending events should be flushed to disk.</summary>
+/// <summary>Optional project paths to include in instruction discovery.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsSaveRequest
+internal sealed class InstructionsDiscoverRequest
 {
-    /// <summary>Session ID whose pending events should be flushed to disk.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>When true, omit the host's instruction sources (user/home-level files and plugin rules), leaving only repository and working-directory sources. For multitenant deployments.</summary>
+    [JsonPropertyName("excludeHostInstructions")]
+    public bool? ExcludeHostInstructions { get; set; }
+
+    /// <summary>Optional list of project directory paths to scan for repository/working-directory instruction sources. When omitted or empty, only user-level and plugin instruction sources are returned (no project scan).</summary>
+    [JsonPropertyName("projectPaths")]
+    public IList<string>? ProjectPaths { get; set; }
 }
 
-/// <summary>Release the in-use lock held by this process for the given session. No-op when this process does not currently hold a lock for the session.</summary>
+/// <summary>Canonical file or directory where custom instructions can be discovered or created, with location, kind, preference, and project path.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionsReleaseLockResult
+public sealed class InstructionDiscoveryPath
 {
+    /// <summary>Whether the target is a single file or a directory of instruction files.</summary>
+    [JsonPropertyName("kind")]
+    public InstructionDiscoveryPathKind Kind { get; set; }
+
+    /// <summary>Which tier this target belongs to.</summary>
+    [JsonPropertyName("location")]
+    public InstructionDiscoveryPathLocation Location { get; set; }
+
+    /// <summary>Absolute path of the file or directory (may not exist on disk yet).</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
+
+    /// <summary>Whether this is the canonical target to create new instructions in its tier. At most one entry per tier is preferred.</summary>
+    [JsonPropertyName("preferredForCreation")]
+    public bool PreferredForCreation { get; set; }
+
+    /// <summary>The input project path this target was derived from (only for repository targets).</summary>
+    [JsonPropertyName("projectPath")]
+    public string? ProjectPath { get; set; }
 }
 
-/// <summary>Session ID whose in-use lock should be released.</summary>
+/// <summary>Canonical files and directories where custom instructions can be created so the runtime will recognize them.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsReleaseLockRequest
+public sealed class InstructionDiscoveryPathList
 {
-    /// <summary>Session ID whose in-use lock should be released.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Canonical instruction create/discovery files and directories, in priority order.</summary>
+    [JsonPropertyName("paths")]
+    public IList<InstructionDiscoveryPath> Paths { get => field ??= []; set; }
 }
 
-/// <summary>The enriched metadata records, with summary and context fields backfilled where available. Sessions confirmed empty and unnamed are omitted.</summary>
+/// <summary>Optional project paths to include when enumerating instruction discovery targets.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionEnrichMetadataResult
+internal sealed class InstructionsGetDiscoveryPathsRequest
 {
-    /// <summary>Enriched records, with summary and context backfilled. Sessions confirmed empty and unnamed may be omitted.</summary>
-    [JsonPropertyName("sessions")]
-    public IList<LocalSessionMetadataValue> Sessions { get => field ??= []; set; }
-}
+    /// <summary>When true, omit the host's user-level instruction targets, leaving only repository targets. For multitenant deployments (mirrors `discover`'s `excludeHostInstructions`).</summary>
+    [JsonPropertyName("excludeHostInstructions")]
+    public bool? ExcludeHostInstructions { get; set; }
 
-/// <summary>Session metadata records to enrich with summary and context information.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsEnrichMetadataRequest
-{
-    /// <summary>Session metadata records to enrich. Records that already have summary and context are returned unchanged.</summary>
-    [JsonPropertyName("sessions")]
-    public IList<LocalSessionMetadataValue> Sessions { get => field ??= []; set; }
+    /// <summary>Optional list of project directory paths. When omitted or empty, only the user-level targets are returned.</summary>
+    [JsonPropertyName("projectPaths")]
+    public IList<string>? ProjectPaths { get; set; }
 }
 
-/// <summary>Reload all hooks (user, plugin, optionally repo) and apply them to the active session. Call after installing or removing plugins so their hooks take effect immediately. No-op when no active session matches the given sessionId.</summary>
+/// <summary>A literal choice the command input accepts, with a human-facing description.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionsReloadPluginHooksResult
+public sealed class SlashCommandInputChoice
 {
+    /// <summary>Human-readable description shown alongside the choice.</summary>
+    [JsonPropertyName("description")]
+    public string Description { get; set; } = string.Empty;
+
+    /// <summary>The literal choice value (e.g. 'on', 'off', 'show').</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 }
 
-/// <summary>Active session ID and an optional flag for deferring repo-level hooks until folder trust.</summary>
+/// <summary>Optional unstructured input hint.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsReloadPluginHooksRequest
+public sealed class SlashCommandInput
 {
-    /// <summary>When true, skip repo-level hooks. Use before folder trust is confirmed; loadDeferredRepoHooks loads them post-trust.</summary>
-    [JsonPropertyName("deferRepoHooks")]
-    public bool? DeferRepoHooks { get; set; }
+    /// <summary>Optional literal choices the input accepts, each with a human-facing description; clients may render these as selectable options.</summary>
+    [JsonPropertyName("choices")]
+    public IList<SlashCommandInputChoice>? Choices { get; set; }
 
-    /// <summary>Active session ID to reload hooks for.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Optional completion hint for the input (e.g. 'directory' for filesystem path completion).</summary>
+    [JsonPropertyName("completion")]
+    public SlashCommandInputCompletion? Completion { get; set; }
 
-/// <summary>Queued repo-level startup prompts and the total hook command count after loading.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionLoadDeferredRepoHooksResult
-{
-    /// <summary>Total hook command count (user + plugin + repo) loaded for the session by this call. Captured atomically with startupPrompts so callers don't need to read a separate counter.</summary>
-    [JsonPropertyName("hookCount")]
-    public long HookCount { get; set; }
+    /// <summary>Hint to display when command input has not been provided.</summary>
+    [JsonPropertyName("hint")]
+    public string Hint { get; set; } = string.Empty;
 
-    /// <summary>Repo-level startup prompts queued from repo hook configs. Empty on resume, when no repo configs were pending, or when disableAllHooks is set.</summary>
-    [JsonPropertyName("startupPrompts")]
-    public IList<string> StartupPrompts { get => field ??= []; set; }
-}
+    /// <summary>When true, clients should pass the full text after the command name as a single argument rather than splitting on whitespace.</summary>
+    [JsonPropertyName("preserveMultilineInput")]
+    public bool? PreserveMultilineInput { get; set; }
 
-/// <summary>Active session ID whose deferred repo-level hooks should be loaded.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsLoadDeferredRepoHooksRequest
-{
-    /// <summary>Active session ID whose deferred repo-level hooks should be loaded.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>When true, the command requires non-empty input; clients should render the input hint as required.</summary>
+    [JsonPropertyName("required")]
+    public bool? Required { get; set; }
 }
 
-/// <summary>Replace the manager-wide additional plugins. New session creations and subsequent hook reloads see the new set; already-running sessions keep their existing hook installation until the next reload.</summary>
+/// <summary>Slash-command metadata with name, aliases, description, kind, input hint, execution allowance, and schedulability.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionsSetAdditionalPluginsResult
+public sealed class SlashCommandInfo
 {
-}
+    /// <summary>Canonical aliases without leading slashes.</summary>
+    [JsonPropertyName("aliases")]
+    public IList<string>? Aliases { get; set; }
 
-/// <summary>Installed plugin record from global state, with marketplace, version, install time, enabled state, cache path, and source.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class InstalledPlugin
-{
-    /// <summary>Path where the plugin is cached locally.</summary>
-    [JsonPropertyName("cache_path")]
-    public string? CachePath { get; set; }
+    /// <summary>Whether the command may run while an agent turn is active.</summary>
+    [JsonPropertyName("allowDuringAgentExecution")]
+    public bool AllowDuringAgentExecution { get; set; }
 
-    /// <summary>Whether the plugin is currently enabled.</summary>
-    [JsonPropertyName("enabled")]
-    public bool Enabled { get; set; }
+    /// <summary>Human-readable command description.</summary>
+    [JsonPropertyName("description")]
+    public string Description { get; set; } = string.Empty;
 
-    /// <summary>Installation timestamp.</summary>
-    [JsonPropertyName("installed_at")]
-    public string InstalledAt { get; set; } = string.Empty;
+    /// <summary>Whether the command is experimental.</summary>
+    [JsonPropertyName("experimental")]
+    public bool? Experimental { get; set; }
 
-    /// <summary>Marketplace the plugin came from (empty string for direct repo installs).</summary>
-    [JsonPropertyName("marketplace")]
-    public string Marketplace { get; set; } = string.Empty;
+    /// <summary>Optional unstructured input hint.</summary>
+    [JsonPropertyName("input")]
+    public SlashCommandInput? Input { get; set; }
 
-    /// <summary>Plugin name.</summary>
+    /// <summary>Coarse command category for grouping and behavior: runtime built-in, skill-backed command, or SDK/client-owned command.</summary>
+    [JsonPropertyName("kind")]
+    public SlashCommandKind Kind { get; set; }
+
+    /// <summary>Canonical command name without a leading slash.</summary>
     [JsonPropertyName("name")]
     public string Name { get; set; } = string.Empty;
 
-    /// <summary>Source for direct repo installs (when marketplace is empty).</summary>
-    [JsonPropertyName("source")]
-    public JsonElement? Source { get; set; }
-
-    /// <summary>Per-plugin source fingerprint (a SHA-256 hash of the plugin's catalog source spec plus its resolved source subtree — NOT a Git commit SHA) captured at marketplace install/update time. Auto-update compares it against the freshly recomputed fingerprint to detect a content change that does not bump the version. Absent for pre-existing installs and for direct (non-marketplace) installs.</summary>
-    [JsonPropertyName("source_sha")]
-    public string? SourceSha { get; set; }
-
-    /// <summary>Version installed (if available).</summary>
-    [JsonPropertyName("version")]
-    public string? Version { get; set; }
+    /// <summary>Whether the command may be the target of `/every` / `/after` schedules. Resolution happens at every tick, so only set this when the command is safe to re-invoke and produces an agent prompt.</summary>
+    [JsonPropertyName("schedulable")]
+    public bool? Schedulable { get; set; }
 }
 
-/// <summary>Manager-wide additional plugins to register; replaces any previously-configured set.</summary>
+/// <summary>Slash commands available in the session, after applying any include/exclude filters.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsSetAdditionalPluginsRequest
+public sealed class CommandList
 {
-    /// <summary>Manager-wide additional plugins to register. Replaces any previously-configured set. Pass an empty array to clear.</summary>
-    [JsonPropertyName("plugins")]
-    public IList<InstalledPlugin> Plugins { get => field ??= []; set; }
+    /// <summary>Commands available in this session.</summary>
+    [JsonPropertyName("commands")]
+    public IList<SlashCommandInfo> Commands { get => field ??= []; set; }
 }
 
-/// <summary>Dynamic-context board entry count, when available.</summary>
+/// <summary>A single user setting's effective value alongside its default, so consumers can render settings left at their default.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsGetBoardEntryCountResult
+public sealed class UserSettingMetadata
 {
-    /// <summary>Board entry count, when available.</summary>
-    [JsonPropertyName("count")]
-    public long? Count { get; set; }
+    /// <summary>The centrally-known default for this setting (null when no default is registered).</summary>
+    [JsonPropertyName("default")]
+    public JsonElement Default { get; set; }
+
+    /// <summary>True when the user has not set an explicit value for this setting (i.e. it is left at its default). Reflects whether the user has overridden the key, not whether the effective value happens to equal the default — a key explicitly set to a value identical to the default still reports false.</summary>
+    [JsonPropertyName("isDefault")]
+    public bool IsDefault { get; set; }
+
+    /// <summary>The effective value: the user's value if set, otherwise the default.</summary>
+    [JsonPropertyName("value")]
+    public JsonElement Value { get; set; }
 }
 
-/// <summary>Session ID whose board entry count should be returned.</summary>
+/// <summary>Per-key metadata for every known user setting (settings.json overlaid with the legacy config.json, config.json wins), including settings left at their default. Excludes repository- and enterprise-managed overrides.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsGetBoardEntryCountRequest
+public sealed class UserSettingsGetResult
 {
-    /// <summary>Session ID whose board entry count should be returned.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Every known user setting keyed by setting name, each with its effective value, default, and whether it is at the default.</summary>
+    [JsonPropertyName("settings")]
+    public IDictionary<string, UserSettingMetadata> Settings { get => field ??= new Dictionary<string, UserSettingMetadata>(); set; }
 }
 
-/// <summary>State of the runtime-managed remote-control singleton.</summary>
-/// <remarks>Polymorphic base type discriminated by <c>state</c>.</remarks>
+/// <summary>Outcome of writing user settings.</summary>
 [Experimental(Diagnostics.Experimental)]
-[JsonPolymorphic(
-    TypeDiscriminatorPropertyName = "state",
-    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
-[JsonDerivedType(typeof(RemoteControlStatusOff), "off")]
-[JsonDerivedType(typeof(RemoteControlStatusConnecting), "connecting")]
-[JsonDerivedType(typeof(RemoteControlStatusActive), "active")]
-[JsonDerivedType(typeof(RemoteControlStatusError), "error")]
-public partial class RemoteControlStatus
+public sealed class UserSettingsSetResult
 {
-    /// <summary>The type discriminator.</summary>
-    [JsonPropertyName("state")]
-    public virtual string State { get; set; } = string.Empty;
+    /// <summary>Top-level keys whose write landed in settings.json but is shadowed by a value still present in the legacy config.json (config.json wins on read). The write does not take effect until the legacy value is removed.</summary>
+    [JsonPropertyName("shadowedKeys")]
+    public IList<string> ShadowedKeys { get => field ??= []; set; }
 }
 
-
-/// <summary>Remote control is not connected.</summary>
-/// <remarks>The <c>off</c> variant of <see cref="RemoteControlStatus"/>.</remarks>
+/// <summary>Partial user settings to write to settings.json. Each top-level key is written individually, replacing the existing value; a key whose value is null is removed.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class RemoteControlStatusOff : RemoteControlStatus
+internal sealed class UserSettingsSetRequest
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string State => "off";
+    /// <summary>Partial user settings to write, as a free-form object keyed by setting name.</summary>
+    [JsonPropertyName("settings")]
+    public JsonElement Settings { get; set; }
 }
 
-/// <summary>Remote control is in the middle of initial setup.</summary>
-/// <remarks>The <c>connecting</c> variant of <see cref="RemoteControlStatus"/>.</remarks>
+/// <summary>Validated device-managed settings discovered before a session exists.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class RemoteControlStatusConnecting : RemoteControlStatus
+public sealed class ManagedSettingsReadResult
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string State => "connecting";
+    /// <summary>Discovery or validation error text when managed settings could not be read safely.</summary>
+    [JsonPropertyName("errorMessage")]
+    public string? ErrorMessage { get; set; }
 
-    /// <summary>Session id the connection is attaching to.</summary>
-    [JsonPropertyName("attachedSessionId")]
-    public required string AttachedSessionId { get; set; }
+    /// <summary>Validated, canonical managed-settings JSON. Omitted when no managed settings were discovered or when discovered settings failed validation.</summary>
+    [JsonPropertyName("settingsJson")]
+    public JsonElement? SettingsJson { get; set; }
 }
 
-/// <summary>Remote control is connected to a local session.</summary>
-/// <remarks>The <c>active</c> variant of <see cref="RemoteControlStatus"/>.</remarks>
+/// <summary>Indicates whether the calling client was registered as the session filesystem provider.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class RemoteControlStatusActive : RemoteControlStatus
+public sealed class SessionFsSetProviderResult
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string State => "active";
-
-    /// <summary>Session id remote control is pointed at.</summary>
-    [JsonPropertyName("attachedSessionId")]
-    public required string AttachedSessionId { get; set; }
-
-    /// <summary>True while a read-only/session-sync export is deferred, awaiting the first `user.message` before its MC session exists. Marked internal: this field is excluded from the public SDK surface and is populated only on the CLI in-process path.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonInclude]
-    [JsonPropertyName("awaitingFirstMessage")]
-    internal bool? AwaitingFirstMessage { get; set; }
-
-    /// <summary>MC frontend URL for this session, when known.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("frontendUrl")]
-    public string? FrontendUrl { get; set; }
-
-    /// <summary>Whether the MC session may steer this session.</summary>
-    [JsonPropertyName("isSteerable")]
-    public required bool IsSteerable { get; set; }
+    /// <summary>Whether the provider was set successfully.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-/// <summary>The last setup attempt failed. The singleton is otherwise off.</summary>
-/// <remarks>The <c>error</c> variant of <see cref="RemoteControlStatus"/>.</remarks>
+/// <summary>Optional capabilities declared by the provider.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class RemoteControlStatusError : RemoteControlStatus
+public sealed class SessionFsSetProviderCapabilities
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string State => "error";
+    /// <summary>Whether the provider supports SQLite query/exists operations.</summary>
+    [JsonPropertyName("sqlite")]
+    public bool? Sqlite { get; set; }
+}
 
-    /// <summary>Session id the failing setup attempt targeted, when known.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("attachedSessionId")]
-    public string? AttachedSessionId { get; set; }
+/// <summary>Initial working directory, session-state path layout, and path conventions used to register the calling SDK client as the session filesystem provider.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionFsSetProviderRequest
+{
+    /// <summary>Optional capabilities declared by the provider.</summary>
+    [JsonPropertyName("capabilities")]
+    public SessionFsSetProviderCapabilities? Capabilities { get; set; }
 
-    /// <summary>Human-readable error message from the last setup attempt.</summary>
-    [JsonPropertyName("error")]
-    public required string Error { get; set; }
+    /// <summary>Path conventions used by this filesystem.</summary>
+    [JsonPropertyName("conventions")]
+    public SessionFsSetProviderConventions Conventions { get; set; }
+
+    /// <summary>Initial working directory for sessions.</summary>
+    [JsonPropertyName("initialCwd")]
+    public string InitialCwd { get; set; } = string.Empty;
+
+    /// <summary>Path within each session's SessionFs where the runtime stores files for that session.</summary>
+    [JsonPropertyName("sessionStatePath")]
+    public string SessionStatePath { get; set; } = string.Empty;
 }
 
-/// <summary>Wrapper for the singleton's current status.</summary>
+/// <summary>Indicates whether the calling client was registered as the LLM inference provider.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class RemoteControlStatusResult
+public sealed class LlmInferenceSetProviderResult
 {
-    /// <summary>State of the runtime-managed remote-control singleton.</summary>
-    [JsonPropertyName("status")]
-    public RemoteControlStatus Status { get => field ??= new(); set; }
+    /// <summary>Whether the provider was set successfully.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-/// <summary>Reattach to an existing MC session without creating a new one.</summary>
+/// <summary>Whether the start frame was accepted.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class RemoteControlConfigExistingMcSession
+public sealed class LlmInferenceHttpResponseStartResult
 {
-    /// <summary>Existing MC session ID to reattach to.</summary>
-    [JsonPropertyName("mcSessionId")]
-    public string McSessionId { get; set; } = string.Empty;
-
-    /// <summary>Existing MC task ID for the reattached session.</summary>
-    [JsonPropertyName("mcTaskId")]
-    public string McTaskId { get; set; } = string.Empty;
+    /// <summary>True when the response start was matched to a pending request; false when unknown.</summary>
+    [JsonPropertyName("accepted")]
+    public bool Accepted { get; set; }
 }
 
-/// <summary>Configuration for the runtime-managed remote-control singleton.</summary>
+/// <summary>Response head.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class RemoteControlConfig
+internal sealed class LlmInferenceHttpResponseStartRequest
 {
-    /// <summary>Reattach to an existing MC session without creating a new one.</summary>
-    [JsonPropertyName("existingMcSession")]
-    public RemoteControlConfigExistingMcSession? ExistingMcSession { get; set; }
-
-    /// <summary>Whether the user explicitly requested remote (vs. implicit session-sync). Controls warning surfacing for missing-repo cases.</summary>
-    [JsonPropertyName("explicit")]
-    public bool Explicit { get; set; }
-
-    /// <summary>Whether remote export should be enabled.</summary>
-    [JsonPropertyName("remote")]
-    public bool Remote { get; set; }
+    /// <summary>HTTP response headers, preserving multiple values per name.</summary>
+    [JsonPropertyName("headers")]
+    public IDictionary<string, IList<string>> Headers { get => field ??= new Dictionary<string, IList<string>>(); set; }
 
-    /// <summary>When true, suppresses timeline messages on successful setup.</summary>
-    [JsonPropertyName("silent")]
-    public bool Silent { get; set; }
+    /// <summary>Matches the requestId from the originating httpRequestStart frame.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
 
-    /// <summary>Whether the MC session may steer the local session (write mode).</summary>
-    [JsonPropertyName("steerable")]
-    public bool Steerable { get; set; }
+    /// <summary>HTTP status code.</summary>
+    [JsonPropertyName("status")]
+    public long Status { get; set; }
 
-    /// <summary>Existing Mission Control task ID to attach the exported session to.</summary>
-    [JsonPropertyName("taskId")]
-    public string? TaskId { get; set; }
+    /// <summary>Optional HTTP status reason phrase.</summary>
+    [JsonPropertyName("statusText")]
+    public string? StatusText { get; set; }
 }
 
-/// <summary>Parameters for attaching the remote-control singleton to a session.</summary>
+/// <summary>Whether the chunk was accepted.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsStartRemoteControlRequest
+public sealed class LlmInferenceHttpResponseChunkResult
 {
-    /// <summary>Configuration for the runtime-managed remote-control singleton.</summary>
-    [JsonPropertyName("config")]
-    public RemoteControlConfig Config { get => field ??= new(); set; }
-
-    /// <summary>Local session id to attach remote control to.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>True when the chunk was matched to a pending request; false when unknown.</summary>
+    [JsonPropertyName("accepted")]
+    public bool Accepted { get; set; }
 }
 
-/// <summary>Outcome of a transferRemoteControl call.</summary>
+/// <summary>Set to terminate the response with a transport-level failure. Implies end-of-stream; any further chunks for this requestId are ignored.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class RemoteControlTransferResult
+public sealed class LlmInferenceHttpResponseChunkError
 {
-    /// <summary>State of the runtime-managed remote-control singleton.</summary>
-    [JsonPropertyName("status")]
-    public RemoteControlStatus Status { get => field ??= new(); set; }
+    /// <summary>Optional machine-readable error code.</summary>
+    [JsonPropertyName("code")]
+    public string? Code { get; set; }
 
-    /// <summary>Whether the rebinding actually happened.</summary>
-    [JsonPropertyName("transferred")]
-    public bool Transferred { get; set; }
+    /// <summary>Human-readable failure description.</summary>
+    [JsonPropertyName("message")]
+    public string Message { get; set; } = string.Empty;
 }
 
-/// <summary>Parameters for atomically rebinding the remote-control singleton.</summary>
+/// <summary>A response body chunk or terminal error.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsTransferRemoteControlRequest
+internal sealed class LlmInferenceHttpResponseChunkRequest
 {
-    /// <summary>When provided, the transfer is rejected unless the singleton currently points at this session id (compare-and-swap semantics to avoid clobbering newer state).</summary>
-    [JsonPropertyName("expectedFromSessionId")]
-    public string? ExpectedFromSessionId { get; set; }
+    /// <summary>When true, `data` is base64-encoded bytes. When absent or false, `data` is UTF-8 text.</summary>
+    [JsonPropertyName("binary")]
+    public bool? Binary { get; set; }
 
-    /// <summary>Local session id to point remote control at.</summary>
-    [JsonPropertyName("toSessionId")]
-    public string ToSessionId { get; set; } = string.Empty;
-}
+    /// <summary>Body byte range. UTF-8 text when `binary` is absent or false; base64-encoded bytes when `binary` is true. May be empty (e.g. when the response body is empty: send a single chunk with empty data and end=true).</summary>
+    [JsonPropertyName("data")]
+    public string Data { get; set; } = string.Empty;
 
-/// <summary>Patch for the singleton's steering state.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsSetRemoteControlSteeringRequest
-{
-    /// <summary>Target steering state. Today only `true` is actionable on the underlying exporter; `false` is reserved for future use.</summary>
-    [JsonPropertyName("enabled")]
-    public bool Enabled { get; set; }
-}
+    /// <summary>When true, this is the final body chunk for the response. The runtime treats the response body as complete after receiving an end-marked chunk.</summary>
+    [JsonPropertyName("end")]
+    public bool? End { get; set; }
 
-/// <summary>Outcome of a stopRemoteControl call.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class RemoteControlStopResult
-{
-    /// <summary>State of the runtime-managed remote-control singleton.</summary>
-    [JsonPropertyName("status")]
-    public RemoteControlStatus Status { get => field ??= new(); set; }
+    /// <summary>Set to terminate the response with a transport-level failure. Implies end-of-stream; any further chunks for this requestId are ignored.</summary>
+    [JsonPropertyName("error")]
+    public LlmInferenceHttpResponseChunkError? Error { get; set; }
 
-    /// <summary>Whether the singleton was actually torn down by this call.</summary>
-    [JsonPropertyName("stopped")]
-    public bool Stopped { get; set; }
+    /// <summary>Matches the requestId from the originating httpRequestStart frame.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
 }
 
-/// <summary>RPC data type for SessionsStopRemoteControl operations.</summary>
+/// <summary>Pre-resolved working-directory context for session startup.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionsStopRemoteControlRequest
+public sealed class SessionContext
 {
-    /// <summary>When provided, the stop is rejected unless the singleton currently points at this session id (compare-and-swap semantics).</summary>
-    [JsonPropertyName("expectedSessionId")]
-    public string? ExpectedSessionId { get; set; }
+    /// <summary>Active git branch.</summary>
+    [JsonPropertyName("branch")]
+    public string? Branch { get; set; }
 
-    /// <summary>When true, the singleton is unconditionally torn down regardless of `expectedSessionId`. Use during shutdown or explicit `/remote off`.</summary>
-    [JsonPropertyName("force")]
-    public bool? Force { get; set; }
-}
+    /// <summary>Most recent working directory for this session.</summary>
+    [JsonPropertyName("cwd")]
+    public string Cwd { get; set; } = string.Empty;
 
-/// <summary>Handle for releasing the extension tool registration.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class RegisterExtensionToolsResult
-{
-}
+    /// <summary>Git repository root, if the cwd was inside a git repo.</summary>
+    [JsonPropertyName("gitRoot")]
+    public string? GitRoot { get; set; }
 
-/// <summary>Optional registration options.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionsRegisterExtensionToolsOnSessionOptions
-{
+    /// <summary>Repository host type.</summary>
+    [JsonPropertyName("hostType")]
+    public SessionContextHostType? HostType { get; set; }
+
+    /// <summary>Repository slug in `owner/name` form, when known.</summary>
+    [JsonPropertyName("repository")]
+    public string? Repository { get; set; }
 }
 
-/// <summary>Params to attach an extension loader's tools to a session.</summary>
+/// <summary>GitHub repository the remote session belongs to.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class RegisterExtensionToolsParams
+public sealed class RemoteSessionMetadataRepository
 {
-    /// <summary>Optional registration options.</summary>
-    [JsonPropertyName("options")]
-    public SessionsRegisterExtensionToolsOnSessionOptions? Options { get; set; }
+    /// <summary>Branch associated with the remote session.</summary>
+    [JsonPropertyName("branch")]
+    public string Branch { get; set; } = string.Empty;
 
-    /// <summary>Session to register extension tools on.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Repository name.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
-/// <summary>Params to attach or detach an in-process ExtensionController delegate.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class ConfigureSessionExtensionsParams
-{
-    /// <summary>Session to attach the extension controller delegate to.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Repository owner.</summary>
+    [JsonPropertyName("owner")]
+    public string Owner { get; set; } = string.Empty;
 }
 
-/// <summary>Outcome of an agentRegistry.spawn call.</summary>
-/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
+/// <summary>Remote session metadata for the session to hand off (typically obtained from `sessions.list` with `source: "remote"`).</summary>
 [Experimental(Diagnostics.Experimental)]
-[JsonPolymorphic(
-    TypeDiscriminatorPropertyName = "kind",
-    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
-[JsonDerivedType(typeof(AgentRegistrySpawnResultSpawned), "spawned")]
-[JsonDerivedType(typeof(AgentRegistrySpawnResultSpawnError), "spawn-error")]
-[JsonDerivedType(typeof(AgentRegistrySpawnResultRegistryTimeout), "registry-timeout")]
-[JsonDerivedType(typeof(AgentRegistrySpawnResultValidationError), "validation-error")]
-public partial class AgentRegistrySpawnResult
+public sealed class RemoteSessionMetadataValue
 {
-    /// <summary>The type discriminator.</summary>
-    [JsonPropertyName("kind")]
-    public virtual string Kind { get; set; } = string.Empty;
-}
+    /// <summary>Most recent working directory context.</summary>
+    [JsonPropertyName("context")]
+    public SessionContext? Context { get; set; }
 
+    /// <summary>Host-supplied human description of what the session is doing right now ("running tests", "waiting for approval"). Optional in the protocol and absent on hosts that do not publish it, so never rely on it -- it enriches `hostStatus`, it does not replace it.</summary>
+    [JsonPropertyName("hostActivity")]
+    public string? HostActivity { get; set; }
 
-/// <summary>Full registry entry for the spawned child. Lets the controller call `handleLiveTargetSelected(entry)` directly without re-reading the registry (avoids a TOCTOU window).</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class AgentRegistryLiveTargetEntry
-{
-    /// <summary>Kind of attention required when status === "attention". Meaningful only when status === "attention".</summary>
-    [JsonPropertyName("attentionKind")]
-    public AgentRegistryLiveTargetEntryAttentionKind? AttentionKind { get; set; }
+    /// <summary>Live status as the owning host reports it in its session listing, so a row for a session running elsewhere can show that it is running. Absent for hosts that publish no such status (the cloud task managers), which read as idle.</summary>
+    [JsonPropertyName("hostStatus")]
+    public RemoteSessionHostStatus? HostStatus { get; set; }
 
-    /// <summary>Git branch of the session (when known).</summary>
-    [JsonPropertyName("branch")]
-    public string? Branch { get; set; }
+    /// <summary>Always true for remote sessions.</summary>
+    [JsonPropertyName("isRemote")]
+    public bool IsRemote { get; set; }
 
-    /// <summary>Copilot CLI version that wrote the entry.</summary>
-    [JsonPropertyName("copilotVersion")]
-    public string CopilotVersion { get; set; } = string.Empty;
-
-    /// <summary>Working directory of the session (when known).</summary>
-    [JsonPropertyName("cwd")]
-    public string? Cwd { get; set; }
-
-    /// <summary>Bind host for the entry's JSON-RPC server.</summary>
-    [JsonPropertyName("host")]
-    public string Host { get; set; } = string.Empty;
-
-    /// <summary>Process kind tag for the registry entry.</summary>
-    [JsonPropertyName("kind")]
-    public AgentRegistryLiveTargetEntryKind Kind { get; set; }
-
-    /// <summary>Wall-clock milliseconds since the watcher last observed this entry (heartbeat freshness).</summary>
-    [JsonPropertyName("lastSeenMs")]
-    public long LastSeenMs { get; set; }
+    /// <summary>Last-modified time as an ISO 8601 timestamp.</summary>
+    [JsonPropertyName("modifiedTime")]
+    public string ModifiedTime { get; set; } = string.Empty;
 
-    /// <summary>How the most recent turn ended (clean vs aborted). Lets the renderer distinguish done from done_cancelled.</summary>
-    [JsonPropertyName("lastTerminalEvent")]
-    public AgentRegistryLiveTargetEntryLastTerminalEvent? LastTerminalEvent { get; set; }
+    /// <summary>Optional human-friendly name set via /rename.</summary>
+    [JsonPropertyName("name")]
+    public string? Name { get; set; }
 
-    /// <summary>Model identifier currently selected for the session.</summary>
-    [JsonPropertyName("model")]
-    public string? Model { get; set; }
+    /// <summary>Pull request number associated with the session.</summary>
+    [JsonPropertyName("pullRequestNumber")]
+    public long? PullRequestNumber { get; set; }
 
-    /// <summary>Operating-system pid of the process owning this entry.</summary>
-    [JsonPropertyName("pid")]
-    public long Pid { get; set; }
+    /// <summary>Backing remote session IDs (most recent first).</summary>
+    [JsonPropertyName("remoteSessionIds")]
+    public IList<string> RemoteSessionIds { get => field ??= []; set; }
 
-    /// <summary>TCP port the entry's JSON-RPC server is listening on.</summary>
-    [JsonPropertyName("port")]
-    public long Port { get; set; }
+    /// <summary>GitHub repository the remote session belongs to.</summary>
+    [JsonPropertyName("repository")]
+    public RemoteSessionMetadataRepository Repository { get => field ??= new(); set; }
 
-    /// <summary>Registry entry schema version (1 = ui-server, 2 = managed-server).</summary>
-    [JsonPropertyName("schemaVersion")]
-    public long SchemaVersion { get; set; }
+    /// <summary>Original remote resource identifier (task ID or PR node ID).</summary>
+    [JsonPropertyName("resourceId")]
+    public string? ResourceId { get; set; }
 
-    /// <summary>Session ID of the foreground session for this entry.</summary>
+    /// <summary>Stable session identifier.</summary>
     [JsonPropertyName("sessionId")]
-    public string? SessionId { get; set; }
+    public string SessionId { get; set; } = string.Empty;
 
-    /// <summary>Friendly session name (when set).</summary>
-    [JsonPropertyName("sessionName")]
-    public string? SessionName { get; set; }
+    /// <summary>Deadline (ISO 8601) at which a CLI remote session becomes stale without further heartbeats.</summary>
+    [JsonPropertyName("staleAt")]
+    public string? StaleAt { get; set; }
 
-    /// <summary>ISO 8601 timestamp captured at registration.</summary>
-    [JsonPropertyName("startedAt")]
-    public string StartedAt { get; set; } = string.Empty;
+    /// <summary>Session creation time as an ISO 8601 timestamp.</summary>
+    [JsonPropertyName("startTime")]
+    public string StartTime { get; set; } = string.Empty;
 
-    /// <summary>Coarse lifecycle status of the foreground session.</summary>
-    [JsonPropertyName("status")]
-    public AgentRegistryLiveTargetEntryStatus? Status { get; set; }
+    /// <summary>Server-side task state returned by GitHub.</summary>
+    [JsonPropertyName("state")]
+    public string? State { get; set; }
 
-    /// <summary>Monotonic per-publisher revision counter incremented on every status update. Lets watchers detect transient flips.</summary>
-    [JsonPropertyName("statusRevision")]
-    public long? StatusRevision { get; set; }
+    /// <summary>Short summary of the session, when one has been derived.</summary>
+    [JsonPropertyName("summary")]
+    public string? Summary { get; set; }
 
-    /// <summary>Connection token (null when the target is unauthenticated).</summary>
-    [JsonInclude]
-    [JsonPropertyName("token")]
-    internal string? Token { get; set; }
+    /// <summary>Whether the remote task originated from CCA or CLI `--remote`.</summary>
+    [JsonPropertyName("taskType")]
+    public RemoteSessionMetadataTaskType? TaskType { get; set; }
 }
 
-/// <summary>Per-spawn log-capture outcome; populated from spawnLiveTarget.</summary>
+/// <summary>`sessions.open` handoff progress update with step, status, and optional message.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class AgentRegistryLogCapture
+public sealed class SessionsOpenProgress
 {
-    /// <summary>Whether per-spawn log capture is on (false when env-disabled or open failed).</summary>
-    [JsonPropertyName("enabled")]
-    public bool Enabled { get; set; }
-
-    /// <summary>Human-readable open failure message (only set when enabled === false AND the env-disable opt-out was NOT used).</summary>
-    [JsonPropertyName("openError")]
-    public string? OpenError { get; set; }
+    /// <summary>Optional step message.</summary>
+    [JsonPropertyName("message")]
+    public string? Message { get; set; }
 
-    /// <summary>Categorized reason for log-open failure.</summary>
-    [JsonPropertyName("openErrorReason")]
-    public AgentRegistryLogCaptureOpenErrorReason? OpenErrorReason { get; set; }
+    /// <summary>Step status.</summary>
+    [JsonPropertyName("status")]
+    public SessionsOpenProgressStatus Status { get; set; }
 
-    /// <summary>Absolute path to the per-spawn log file (only set when enabled).</summary>
-    [JsonPropertyName("path")]
-    public string? Path { get; set; }
+    /// <summary>Handoff step.</summary>
+    [JsonPropertyName("step")]
+    public SessionsOpenProgressStep Step { get; set; }
 }
 
-/// <summary>Managed-server child was spawned and registered successfully.</summary>
-/// <remarks>The <c>spawned</c> variant of <see cref="AgentRegistrySpawnResult"/>.</remarks>
+/// <summary>Result of opening a session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class AgentRegistrySpawnResultSpawned : AgentRegistrySpawnResult
+public sealed class SessionOpenResult
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "spawned";
+    /// <summary>Remote session metadata, present when status is `connected`.</summary>
+    [JsonPropertyName("metadata")]
+    public RemoteSessionMetadataValue? Metadata { get; set; }
 
-    /// <summary>Full registry entry for the spawned child. Lets the controller call `handleLiveTargetSelected(entry)` directly without re-reading the registry (avoids a TOCTOU window).</summary>
-    [JsonPropertyName("entry")]
-    public required AgentRegistryLiveTargetEntry Entry { get; set; }
+    /// <summary>Handoff progress steps, present when status is `handed_off`.</summary>
+    [JsonPropertyName("progress")]
+    public IList<SessionsOpenProgress>? Progress { get; set; }
 
-    /// <summary>If the delegate attempted to send the initial prompt and failed, the categorized error message.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("initialPromptError")]
-    public string? InitialPromptError { get; set; }
+    /// <summary>Remote session ID, present when status is `connected`.</summary>
+    [JsonPropertyName("remoteSessionId")]
+    public string? RemoteSessionId { get; set; }
 
-    /// <summary>Whether the delegate already sent the initial prompt. Always omitted in the current wiring: the controller sends the prompt post-attach via the standard LocalRpcSession.send path.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("initialPromptSent")]
-    public bool? InitialPromptSent { get; set; }
+    /// <summary>Opened session ID. Omitted when status is `not_found`.</summary>
+    [JsonPropertyName("sessionId")]
+    public string? SessionId { get; set; }
 
-    /// <summary>Per-spawn log-capture outcome; populated from spawnLiveTarget.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("logCapture")]
-    public AgentRegistryLogCapture? LogCapture { get; set; }
+    /// <summary>Startup prompts queued by user-level hook configs at session creation. Only populated when status is `created`; resumed sessions return an empty array.</summary>
+    [JsonPropertyName("startupPrompts")]
+    public IList<string>? StartupPrompts { get; set; }
+
+    /// <summary>Outcome of the open request.</summary>
+    [JsonPropertyName("status")]
+    public SessionsOpenStatus Status { get; set; }
 }
 
-/// <summary>`child_process.spawn` itself failed before the child entered the registry.</summary>
-/// <remarks>The <c>spawn-error</c> variant of <see cref="AgentRegistrySpawnResult"/>.</remarks>
+/// <summary>Identifier and optional friendly name assigned to the newly forked session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class AgentRegistrySpawnResultSpawnError : AgentRegistrySpawnResult
+public sealed class SessionsForkResult
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "spawn-error";
-
-    /// <summary>Underlying errno code (e.g. ENOENT, EACCES) when available.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("code")]
-    public string? Code { get; set; }
+    /// <summary>Friendly name assigned to the forked session, if any.</summary>
+    [JsonPropertyName("name")]
+    public string? Name { get; set; }
 
-    /// <summary>Human-readable error message.</summary>
-    [JsonPropertyName("message")]
-    public required string Message { get; set; }
+    /// <summary>The new forked session's ID.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Spawn succeeded but the child did not publish a matching managed-server entry within the timeout.</summary>
-/// <remarks>The <c>registry-timeout</c> variant of <see cref="AgentRegistrySpawnResult"/>.</remarks>
+/// <summary>Source session identifier to fork from, optional event-ID boundary, and optional friendly name for the new session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class AgentRegistrySpawnResultRegistryTimeout : AgentRegistrySpawnResult
+internal sealed class SessionsForkRequest
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "registry-timeout";
+    /// <summary>Optional friendly name to assign to the forked session.</summary>
+    [JsonPropertyName("name")]
+    public string? Name { get; set; }
 
-    /// <summary>Process ID of the orphaned child (so the caller can offer 'kill the pid' guidance).</summary>
-    [JsonPropertyName("childPid")]
-    public required long ChildPid { get; set; }
+    /// <summary>Source session ID to fork from.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 
-    /// <summary>Per-spawn log-capture outcome; populated from spawnLiveTarget.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("logCapture")]
-    public AgentRegistryLogCapture? LogCapture { get; set; }
+    /// <summary>Optional event ID boundary. When provided, the fork includes only events before this ID (exclusive). When omitted, all events are included.</summary>
+    [JsonPropertyName("toEventId")]
+    public string? ToEventId { get; set; }
 }
 
-/// <summary>Synchronous pre-validation rejected the spawn request.</summary>
-/// <remarks>The <c>validation-error</c> variant of <see cref="AgentRegistrySpawnResult"/>.</remarks>
+/// <summary>Repository associated with the connected remote session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class AgentRegistrySpawnResultValidationError : AgentRegistrySpawnResult
+public sealed class ConnectedRemoteSessionMetadataRepository
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "validation-error";
-
-    /// <summary>Which parameter field was invalid. Omitted when the rejection is not field-specific.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("field")]
-    public AgentRegistrySpawnValidationErrorField? Field { get; set; }
+    /// <summary>Branch associated with the remote session.</summary>
+    [JsonPropertyName("branch")]
+    public string Branch { get; set; } = string.Empty;
 
-    /// <summary>Human-readable explanation; safe to surface in the UI banner. Never logged to unrestricted telemetry.</summary>
-    [JsonPropertyName("message")]
-    public required string Message { get; set; }
+    /// <summary>Repository name.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
-    /// <summary>Categorized reason for the rejection. Low-cardinality enum so telemetry can aggregate by reason without leaking raw paths or agent/model names.</summary>
-    [JsonPropertyName("reason")]
-    public required AgentRegistrySpawnValidationErrorReason Reason { get; set; }
+    /// <summary>Repository owner or organization login.</summary>
+    [JsonPropertyName("owner")]
+    public string Owner { get; set; } = string.Empty;
 }
 
-/// <summary>Inputs to spawn a managed-server child via the controller's spawn delegate.</summary>
+/// <summary>Metadata for a connected remote session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class AgentRegistrySpawnRequest
+public sealed class ConnectedRemoteSessionMetadata
 {
-    /// <summary>Custom or built-in agent name (e.g. 'explore'). When omitted, the child uses its own default.</summary>
-    [JsonPropertyName("agentName")]
-    public string? AgentName { get; set; }
-
-    /// <summary>Working directory for the spawned child (must be an existing directory).</summary>
-    [JsonPropertyName("cwd")]
-    public string Cwd { get; set; } = string.Empty;
-
-    /// <summary>Optional first user message. Forwarded to the caller (the CLI's spawn wrapper sends it post-attach via the standard LocalRpcSession.send path).</summary>
-    [JsonPropertyName("initialPrompt")]
-    public string? InitialPrompt { get; set; }
+    /// <summary>Neutral SDK discriminator for the connected remote session kind.</summary>
+    [JsonPropertyName("kind")]
+    public ConnectedRemoteSessionMetadataKind Kind { get; set; }
 
-    /// <summary>Model identifier to apply to the new session.</summary>
-    [JsonPropertyName("model")]
-    public string? Model { get; set; }
+    /// <summary>Last session update time as an ISO 8601 string.</summary>
+    [JsonPropertyName("modifiedTime")]
+    public DateTimeOffset ModifiedTime { get; set; }
 
-    /// <summary>Friendly session name. Must satisfy validateSessionName: non-empty, no leading/trailing whitespace, &lt;=100 chars, no control chars, no double quotes.</summary>
+    /// <summary>Optional friendly session name.</summary>
     [JsonPropertyName("name")]
     public string? Name { get; set; }
 
-    /// <summary>Permission posture for the new session. 'yolo' requires the controller-local session to currently be in allow-all mode.</summary>
-    [JsonPropertyName("permissionMode")]
-    public AgentRegistrySpawnPermissionMode? PermissionMode { get; set; }
+    /// <summary>Pull request number associated with the session.</summary>
+    [JsonPropertyName("pullRequestNumber")]
+    public long? PullRequestNumber { get; set; }
+
+    /// <summary>Repository associated with the connected remote session.</summary>
+    [JsonPropertyName("repository")]
+    public ConnectedRemoteSessionMetadataRepository Repository { get => field ??= new(); set; }
+
+    /// <summary>Original remote resource identifier.</summary>
+    [JsonPropertyName("resourceId")]
+    public string? ResourceId { get; set; }
+
+    /// <summary>SDK session ID for the connected remote session.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Remote session staleness deadline as an ISO 8601 string.</summary>
+    [JsonPropertyName("staleAt")]
+    public DateTimeOffset? StaleAt { get; set; }
+
+    /// <summary>Session start time as an ISO 8601 string.</summary>
+    [JsonPropertyName("startTime")]
+    public DateTimeOffset StartTime { get; set; }
+
+    /// <summary>Remote session state returned by the backing service.</summary>
+    [JsonPropertyName("state")]
+    public string? State { get; set; }
+
+    /// <summary>Optional session summary.</summary>
+    [JsonPropertyName("summary")]
+    public string? Summary { get; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Remote session connection result.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionSuspendRequest
+public sealed class RemoteSessionConnectionResult
 {
-    /// <summary>Target session identifier.</summary>
+    /// <summary>Metadata for a connected remote session.</summary>
+    [JsonPropertyName("metadata")]
+    public ConnectedRemoteSessionMetadata Metadata { get => field ??= new(); set; }
+
+    /// <summary>SDK session ID for the connected remote session.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Result of sending a user message.</summary>
+/// <summary>Remote session connection parameters.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SendResult
+internal sealed class ConnectRemoteSessionParams
 {
-    /// <summary>Unique identifier assigned to the message.</summary>
-    [JsonPropertyName("messageId")]
-    public string MessageId { get; set; } = string.Empty;
+    /// <summary>Session ID to connect to.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Parameters for sending a user message to the session.</summary>
+/// <summary>Local or remote session metadata entry. Narrow on `isRemote` to access source-specific fields.</summary>
+/// <remarks>Data type discriminated by <c>isRemote</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SendRequest
+public partial class SessionListEntry
 {
-    /// <summary>The UI mode the agent was in when this message was sent. Defaults to the session's current mode.</summary>
-    [JsonPropertyName("agentMode")]
-    public SendAgentMode? AgentMode { get; set; }
+    /// <summary>The boolean discriminator.</summary>
+    [JsonPropertyName("isRemote")]
+    public bool IsRemote { get; set; }
 
-    /// <summary>Optional attachments (files, directories, selections, blobs, GitHub references) to include with the message.</summary>
-    [JsonPropertyName("attachments")]
-    public IList<Attachment>? Attachments { get; set; }
+    /// <summary>Runtime client name that created/last resumed this session.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("clientName")]
+    public string? ClientName { get; set; }
 
-    /// <summary>If false, this message will not trigger a Premium Request Unit charge. User messages default to billable.</summary>
-    [JsonPropertyName("billable")]
-    public bool? Billable { get; set; }
+    /// <summary>Pre-resolved working-directory context for session startup.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("context")]
+    public SessionContext? Context { get; set; }
 
-    /// <summary>If provided, this is shown in the timeline instead of `prompt`.</summary>
-    [JsonPropertyName("displayPrompt")]
-    public string? DisplayPrompt { get; set; }
+    /// <summary>Host-supplied human description of what the session is doing right now ("running tests", "waiting for approval"). Optional in the protocol and absent on hosts that do not publish it, so never rely on it -- it enriches `hostStatus`, it does not replace it.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("hostActivity")]
+    public string? HostActivity { get; set; }
 
-    /// <summary>How to deliver the message. `enqueue` (default) appends to the message queue. `immediate` interjects during an in-progress turn.</summary>
-    [JsonPropertyName("mode")]
-    public SendMode? Mode { get; set; }
+    /// <summary>Live status as the owning host reports it in its session listing, so a row for a session running elsewhere can show that it is running. Absent for hosts that publish no such status (the cloud task managers), which read as idle.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("hostStatus")]
+    public RemoteSessionHostStatus? HostStatus { get; set; }
 
-    /// <summary>If true, adds the message to the front of the queue instead of the end.</summary>
-    [JsonPropertyName("prepend")]
-    public bool? Prepend { get; set; }
+    /// <summary>True for detached maintenance sessions that should be hidden from normal resume lists.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("isDetached")]
+    public bool? IsDetached { get; set; }
 
-    /// <summary>The user message text.</summary>
-    [JsonPropertyName("prompt")]
-    public string Prompt { get; set; } = string.Empty;
+    /// <summary>GitHub task ID, when this local session is bound to one. Only present for local sessions exported to remote control.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("mcTaskId")]
+    public string? McTaskId { get; set; }
 
-    /// <summary>Custom HTTP headers to include in outbound model requests for this turn. Merged with session-level provider headers; per-turn headers augment and overwrite session-level headers with the same key.</summary>
-    [JsonPropertyName("requestHeaders")]
-    public IDictionary<string, string>? RequestHeaders { get; set; }
+    /// <summary>Last-modified time of the session's persisted state, as ISO 8601.</summary>
+    [JsonPropertyName("modifiedTime")]
+    public required string ModifiedTime { get; set; }
 
-    /// <summary>If set, the request will fail if the named tool is not available when this message is among the user messages at the start of the current exchange.</summary>
-    [JsonPropertyName("requiredTool")]
-    public string? RequiredTool { get; set; }
+    /// <summary>Optional human-friendly name set via /rename.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("name")]
+    public string? Name { get; set; }
 
-    /// <summary>Target session identifier.</summary>
+    /// <summary>Pull request number associated with the session.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("pullRequestNumber")]
+    public long? PullRequestNumber { get; set; }
+
+    /// <summary>Backing remote session IDs (most recent first).</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("remoteSessionIds")]
+    public IList<string>? RemoteSessionIds { get; set; }
+
+    /// <summary>GitHub repository the remote session belongs to.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("repository")]
+    public RemoteSessionMetadataRepository? Repository { get; set; }
+
+    /// <summary>Original remote resource identifier (task ID or PR node ID).</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("resourceId")]
+    public string? ResourceId { get; set; }
+
+    /// <summary>Stable session identifier.</summary>
     [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    public required string SessionId { get; set; }
 
-    /// <summary>Optional provenance tag copied to the resulting user.message event. Must be `user`, `system`, `command-&lt;command-id&gt;` for command-originated messages, `schedule-&lt;numeric-id&gt;` for scheduled prompts, or `agent-&lt;agent-id&gt;` for prompts sent by another agent.</summary>
-    [RegularExpression("^(user|system|command-.*|schedule-\\d+|agent-.+)$")]
-    [JsonInclude]
-    [JsonPropertyName("source")]
-    internal string? Source { get; set; }
+    /// <summary>Deadline (ISO 8601) at which a CLI remote session becomes stale without further heartbeats.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("staleAt")]
+    public string? StaleAt { get; set; }
 
-    /// <summary>W3C Trace Context traceparent header for distributed tracing of this agent turn.</summary>
-    [JsonPropertyName("traceparent")]
-    public string? Traceparent { get; set; }
+    /// <summary>Session creation time as an ISO 8601 timestamp.</summary>
+    [JsonPropertyName("startTime")]
+    public required string StartTime { get; set; }
 
-    /// <summary>W3C Trace Context tracestate header for distributed tracing.</summary>
-    [JsonPropertyName("tracestate")]
-    public string? Tracestate { get; set; }
+    /// <summary>Server-side task state returned by GitHub.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("state")]
+    public string? State { get; set; }
 
-    /// <summary>If true, await completion of the agentic loop for this message before returning. Defaults to false (fire-and-forget). When true, the result still contains the same `messageId`; the caller can rely on the agent having processed the message before the call resolves. Transport-dependent tail semantics: on a LOCAL (in-process) session the wait additionally blocks until the completed turn's event tail has been dispatched to this session's in-process subscribers, so a subsequent read of subscriber state already reflects the turn; on a REMOTE session the wait resolves once the loop completes and mirrored delivery follows over the wire. Callers that need the stronger local guarantee on remote sessions should await the event stream explicitly.</summary>
-    [JsonPropertyName("wait")]
-    public bool? Wait { get; set; }
+    /// <summary>Short summary of the session, when one has been derived.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("summary")]
+    public string? Summary { get; set; }
+
+    /// <summary>Whether the remote task originated from CCA or CLI `--remote`.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("taskType")]
+    public RemoteSessionMetadataTaskType? TaskType { get; set; }
 }
 
-/// <summary>Result of sending zero or more user messages.</summary>
+/// <summary>Sessions matching the filter, ordered most-recently-modified first.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SendMessagesResult
+public sealed class SessionList
 {
-    /// <summary>Unique identifiers assigned to the messages, one per provided message in order. Empty when no messages were provided.</summary>
-    [JsonPropertyName("messageIds")]
-    public IList<string> MessageIds { get => field ??= []; set; }
+    /// <summary>Sessions ordered most-recently-modified first. Discriminated by `isRemote`.</summary>
+    [JsonPropertyName("sessions")]
+    public IList<SessionListEntry> Sessions { get => field ??= []; set; }
 }
 
-/// <summary>A single user message to append to the session as part of a `session.sendMessages` turn.</summary>
+/// <summary>Optional filter applied to the returned sessions.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SendMessageItem
+public sealed class SessionListFilter
 {
-    /// <summary>Optional attachments (files, directories, selections, blobs, GitHub references) to include with this message.</summary>
-    [JsonPropertyName("attachments")]
-    public IList<Attachment>? Attachments { get; set; }
-
-    /// <summary>If false, this message will not trigger a Premium Request Unit charge. User messages default to billable.</summary>
-    [JsonInclude]
-    [JsonPropertyName("billable")]
-    internal bool? Billable { get; set; }
-
-    /// <summary>If provided, this is shown in the timeline instead of `prompt`.</summary>
-    [JsonPropertyName("displayPrompt")]
-    public string? DisplayPrompt { get; set; }
+    /// <summary>Match sessions whose context.branch equals this value.</summary>
+    [JsonPropertyName("branch")]
+    public string? Branch { get; set; }
 
-    /// <summary>The user message text.</summary>
-    [JsonPropertyName("prompt")]
-    public string Prompt { get; set; } = string.Empty;
+    /// <summary>Match sessions whose context.cwd equals this value.</summary>
+    [JsonPropertyName("cwd")]
+    public string? Cwd { get; set; }
 
-    /// <summary>If set, the request will fail if the named tool is not available when this message is among the user messages at the start of the current exchange.</summary>
-    [JsonPropertyName("requiredTool")]
-    public string? RequiredTool { get; set; }
+    /// <summary>Match sessions whose context.gitRoot equals this value.</summary>
+    [JsonPropertyName("gitRoot")]
+    public string? GitRoot { get; set; }
 
-    /// <summary>Optional provenance tag copied to the resulting user.message event. Must be `user`, `system`, `command-&lt;command-id&gt;` for command-originated messages, `schedule-&lt;numeric-id&gt;` for scheduled prompts, or `agent-&lt;agent-id&gt;` for prompts sent by another agent.</summary>
-    [RegularExpression("^(user|system|command-.*|schedule-\\d+|agent-.+)$")]
-    [JsonInclude]
-    [JsonPropertyName("source")]
-    internal string? Source { get; set; }
+    /// <summary>Match sessions whose context.repository equals this value.</summary>
+    [JsonPropertyName("repository")]
+    public string? Repository { get; set; }
 }
 
-/// <summary>Parameters for sending zero or more user messages to the session in a single turn. Remote-backed (Mission Control) sessions do not support this method and will return an error.</summary>
+/// <summary>Optional source filter, metadata-load limit, and context filter applied to the returned sessions.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SendMessagesRequest
+internal sealed class SessionsListRequest
 {
-    /// <summary>The UI mode the agent was in when these messages were sent. Defaults to the session's current mode.</summary>
-    [JsonPropertyName("agentMode")]
-    public SendAgentMode? AgentMode { get; set; }
+    /// <summary>Optional filter applied to the returned sessions.</summary>
+    [JsonPropertyName("filter")]
+    public SessionListFilter? Filter { get; set; }
 
-    /// <summary>The user messages to append to the conversation, in order. May be empty, in which case a single turn runs over the existing history with no new user message.</summary>
-    [JsonPropertyName("messages")]
-    public IList<SendMessageItem> Messages { get => field ??= []; set; }
+    /// <summary>When true, include detached maintenance sessions. Defaults to false for user-facing session lists.</summary>
+    [JsonPropertyName("includeDetached")]
+    public bool? IncludeDetached { get; set; }
 
-    /// <summary>How to deliver the messages. `enqueue` (default) appends to the message queue. `immediate` interjects during an in-progress turn.</summary>
-    [JsonPropertyName("mode")]
-    public SendMode? Mode { get; set; }
+    /// <summary>When provided, only the first N local sessions (sorted by modification time, newest first) load full metadata; remaining sessions return basic info only. Use 0 to return only basic info for every local session. Has no effect on remote entries (which always carry their full shape).</summary>
+    [JsonPropertyName("metadataLimit")]
+    public long? MetadataLimit { get; set; }
 
-    /// <summary>If true, adds the messages to the front of the queue instead of the end.</summary>
-    [JsonPropertyName("prepend")]
-    public bool? Prepend { get; set; }
+    /// <summary>Which session sources to include. Defaults to `local` for backward compatibility.</summary>
+    [JsonPropertyName("source")]
+    public SessionSource? Source { get; set; }
 
-    /// <summary>Custom HTTP headers to include in outbound model requests for this turn. Merged with session-level provider headers; per-turn headers augment and overwrite session-level headers with the same key.</summary>
-    [JsonPropertyName("requestHeaders")]
-    public IDictionary<string, string>? RequestHeaders { get; set; }
+    /// <summary>Only meaningful when `source` includes remote. When true, propagates errors from the remote service instead of silently returning an empty remote list. Defaults to false.</summary>
+    [JsonPropertyName("throwOnError")]
+    public bool? ThrowOnError { get; set; }
+}
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+/// <summary>Persisted local session metadata, including identifiers, timestamps, summary/name, client, context, detached state, and task ID.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class LocalSessionMetadataValue
+{
+    /// <summary>Runtime client name that created/last resumed this session.</summary>
+    [JsonPropertyName("clientName")]
+    public string? ClientName { get; set; }
 
-    /// <summary>W3C Trace Context traceparent header for distributed tracing of this agent turn.</summary>
-    [JsonPropertyName("traceparent")]
-    public string? Traceparent { get; set; }
+    /// <summary>Pre-resolved working-directory context for session startup.</summary>
+    [JsonPropertyName("context")]
+    public SessionContext? Context { get; set; }
 
-    /// <summary>W3C Trace Context tracestate header for distributed tracing.</summary>
-    [JsonPropertyName("tracestate")]
-    public string? Tracestate { get; set; }
+    /// <summary>True for detached maintenance sessions that should be hidden from normal resume lists.</summary>
+    [JsonPropertyName("isDetached")]
+    public bool? IsDetached { get; set; }
 
-    /// <summary>If true, await completion of the agentic loop for this turn before returning. Defaults to false (fire-and-forget). When true, the result still contains the same `messageIds`; the caller can rely on the agent having processed the messages before the call resolves. Transport-dependent tail semantics: on a LOCAL (in-process) session the wait additionally blocks until the completed turn's event tail has been dispatched to this session's in-process subscribers, so a subsequent read of subscriber state already reflects the turn; on a REMOTE session the wait resolves once the loop completes and mirrored delivery follows over the wire. Callers that need the stronger local guarantee on remote sessions should await the event stream explicitly.</summary>
-    [JsonPropertyName("wait")]
-    public bool? Wait { get; set; }
-}
+    /// <summary>Always false for local sessions.</summary>
+    [JsonPropertyName("isRemote")]
+    public bool IsRemote { get; set; }
 
-/// <summary>Internal request for sending a system notification.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SendSystemNotificationRequest
-{
-    /// <summary>Optional structured notification kind.</summary>
-    [JsonPropertyName("kind")]
-    public JsonElement? Kind { get; set; }
+    /// <summary>GitHub task ID, when this local session is bound to one. Only present for local sessions exported to remote control.</summary>
+    [JsonPropertyName("mcTaskId")]
+    public string? McTaskId { get; set; }
 
-    /// <summary>Notification text to deliver to the model.</summary>
-    [JsonPropertyName("message")]
-    public string Message { get; set; } = string.Empty;
+    /// <summary>Last-modified time of the session's persisted state, as ISO 8601.</summary>
+    [JsonPropertyName("modifiedTime")]
+    public string ModifiedTime { get; set; } = string.Empty;
 
-    /// <summary>Internal delivery options, including passive policy.</summary>
-    [JsonPropertyName("options")]
-    public JsonElement? Options { get; set; }
+    /// <summary>Optional human-friendly name set via /rename.</summary>
+    [JsonPropertyName("name")]
+    public string? Name { get; set; }
 
-    /// <summary>Target session identifier.</summary>
+    /// <summary>Stable session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Session creation time as an ISO 8601 timestamp.</summary>
+    [JsonPropertyName("startTime")]
+    public string StartTime { get; set; } = string.Empty;
+
+    /// <summary>Short summary of the session, when one has been derived.</summary>
+    [JsonPropertyName("summary")]
+    public string? Summary { get; set; }
 }
 
-/// <summary>Result of aborting the current turn.</summary>
+/// <summary>Persisted local session metadata when the session exists.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class AbortResult
+internal sealed class SessionsGetMetadataResult
 {
-    /// <summary>Error message if the abort failed.</summary>
-    [JsonPropertyName("error")]
-    public string? Error { get; set; }
-
-    /// <summary>Whether the abort completed successfully.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
+    /// <summary>Local session metadata, omitted when the session does not exist.</summary>
+    [JsonPropertyName("session")]
+    public LocalSessionMetadataValue? Session { get; set; }
 }
 
-/// <summary>Parameters for aborting the current turn.</summary>
+/// <summary>Session ID whose persisted metadata should be read.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class AbortRequest
+internal sealed class SessionsGetMetadataRequest
 {
-    /// <summary>Finite reason code describing why the current turn was aborted.</summary>
-    [JsonPropertyName("reason")]
-    public AbortReason? Reason { get; set; }
-
-    /// <summary>Target session identifier.</summary>
+    /// <summary>Session ID to inspect.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Result of interrupting the main agent turn.</summary>
+/// <summary>Recent local session IDs that contain user-visible history.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class InterruptMainTurnResult
+internal sealed class SessionsListNonEmptySessionIdsResult
 {
-    /// <summary>Whether an in-flight main agent turn was interrupted. False when the main loop was not processing.</summary>
-    [JsonPropertyName("interrupted")]
-    public bool Interrupted { get; set; }
+    /// <summary>Session IDs ordered newest-first.</summary>
+    [JsonPropertyName("sessionIds")]
+    public IList<string> SessionIds { get => field ??= []; set; }
 }
 
-/// <summary>Parameters for interrupting the main agent turn.</summary>
+/// <summary>Limit for non-empty local session IDs.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class InterruptMainTurnRequest
+internal sealed class SessionsListNonEmptySessionIdsRequest
 {
-    /// <summary>When true, the user's queued prompts are preserved and run as the next turn once the interrupted turn unwinds; when false (the default), the queue is cleared like a plain abort.</summary>
-    [JsonPropertyName("flushQueued")]
-    public bool? FlushQueued { get; set; }
-
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Maximum number of session IDs to return.</summary>
+    [JsonPropertyName("limit")]
+    public long? Limit { get; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>ID of the local session bound to the given GitHub task, or omitted when none.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionCancelAllBackgroundAgentsRequest
+public sealed class SessionsFindByTaskIDResult
 {
-    /// <summary>Target session identifier.</summary>
+    /// <summary>Omitted when no local session is bound to that GitHub task.</summary>
     [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    public string? SessionId { get; set; }
 }
 
-/// <summary>Parameters for shutting down the session.</summary>
+/// <summary>GitHub task ID to look up.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class ShutdownRequest
+internal sealed class SessionsFindByTaskIDRequest
 {
-    /// <summary>Optional human-readable reason. Typically the message of the error that triggered shutdown when type is 'error'.</summary>
-    [JsonPropertyName("reason")]
-    public string? Reason { get; set; }
-
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-
-    /// <summary>Why the session is being shut down. Defaults to "routine" when omitted.</summary>
-    [JsonPropertyName("type")]
-    public ShutdownType? Type { get; set; }
+    /// <summary>GitHub task ID to look up.</summary>
+    [JsonPropertyName("taskId")]
+    public string TaskId { get; set; } = string.Empty;
 }
 
-/// <summary>Identifier of the session event that was emitted for the log message.</summary>
+/// <summary>Session ID matching the prefix, omitted when no unique match exists.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class LogResult
+public sealed class SessionsFindByPrefixResult
 {
-    /// <summary>The unique identifier of the emitted session event.</summary>
-    [JsonPropertyName("eventId")]
-    public Guid EventId { get; set; }
+    /// <summary>Omitted when no unique session matches the prefix (no match or ambiguous).</summary>
+    [JsonPropertyName("sessionId")]
+    public string? SessionId { get; set; }
 }
 
-/// <summary>Message text, optional severity level, persistence flag, optional follow-up URL, and optional tip.</summary>
+/// <summary>UUID prefix to resolve to a unique session ID.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class LogRequest
+internal sealed class SessionsFindByPrefixRequest
 {
-    /// <summary>When true, the message is transient and not persisted to the session event log on disk.</summary>
-    [JsonPropertyName("ephemeral")]
-    public bool? Ephemeral { get; set; }
-
-    /// <summary>Log severity level. Determines how the message is displayed in the timeline. Defaults to "info".</summary>
-    [JsonPropertyName("level")]
-    public SessionLogLevel? Level { get; set; }
-
-    /// <summary>Human-readable message.</summary>
-    [JsonPropertyName("message")]
-    public string Message { get; set; } = string.Empty;
-
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-
-    /// <summary>Optional actionable tip displayed alongside the message. Only honored on `level: "info"`.</summary>
-    [JsonPropertyName("tip")]
-    public string? Tip { get; set; }
-
-    /// <summary>Domain category for this log entry (e.g., "mcp", "subscription", "policy", "model"). Maps to `infoType`/`warningType`/`errorType` on the emitted event. Defaults to "notification".</summary>
-    [JsonPropertyName("type")]
-    public string? Type { get; set; }
-
-    /// <summary>Optional URL the user can open in their browser for more details.</summary>
-    [Url]
-    [StringSyntax(StringSyntaxAttribute.Uri)]
-    [JsonPropertyName("url")]
-    public string? Url { get; set; }
+    /// <summary>UUID prefix (&gt;=7 hex chars, &lt;36 chars). Returns the unique session ID, or undefined when there is no match or the prefix matches multiple sessions.</summary>
+    [JsonPropertyName("prefix")]
+    public string Prefix { get; set; } = string.Empty;
 }
 
-/// <summary>Authentication status and account metadata for the session.</summary>
+/// <summary>Most-relevant session ID for the supplied context, or omitted when no sessions exist.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionAuthStatus
+public sealed class SessionsGetLastForContextResult
 {
-    /// <summary>Authentication type.</summary>
-    [JsonPropertyName("authType")]
-    public AuthInfoType? AuthType { get; set; }
-
-    /// <summary>Copilot plan tier (e.g., individual_pro, business).</summary>
-    [JsonPropertyName("copilotPlan")]
-    public string? CopilotPlan { get; set; }
-
-    /// <summary>Authentication host URL.</summary>
-    [Url]
-    [StringSyntax(StringSyntaxAttribute.Uri)]
-    [JsonPropertyName("host")]
-    public string? Host { get; set; }
-
-    /// <summary>Whether the session has resolved authentication.</summary>
-    [JsonPropertyName("isAuthenticated")]
-    public bool IsAuthenticated { get; set; }
-
-    /// <summary>Authenticated login/username, if available.</summary>
-    [JsonPropertyName("login")]
-    public string? Login { get; set; }
-
-    /// <summary>Human-readable authentication status description.</summary>
-    [JsonPropertyName("statusMessage")]
-    public string? StatusMessage { get; set; }
+    /// <summary>Most-relevant session ID for the supplied context, or omitted when no sessions exist.</summary>
+    [JsonPropertyName("sessionId")]
+    public string? SessionId { get; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Optional working-directory context used to score session relevance.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionGitHubAuthGetStatusRequest
+internal sealed class SessionsGetLastForContextRequest
 {
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Optional working-directory context used to score session relevance. When omitted the most-recently-modified session wins.</summary>
+    [JsonPropertyName("context")]
+    public SessionContext? Context { get; set; }
 }
 
-/// <summary>Indicates whether the credential update succeeded.</summary>
+/// <summary>Absolute path to the session's events.jsonl file on disk.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionSetCredentialsResult
+internal sealed class SessionsGetEventFilePathResult
 {
-    /// <summary>Whether the session ended up with a populated `copilotUser` for the installed credentials. `true` when the supplied credential already carried `copilotUser` or it was successfully re-resolved server-side. `false` when the credential is installed without `copilotUser` — either re-resolution failed, or the variant cannot be re-resolved from the credential alone (only the raw-token variants `token`, `env`, and `gh-cli` can). In both `false` cases the token swap still applied, but plan/quota/billing metadata is degraded. Present whenever a credential was supplied; omitted only when no credential was supplied (no-op call).</summary>
-    [JsonPropertyName("copilotUserResolved")]
-    public bool? CopilotUserResolved { get; set; }
-
-    /// <summary>Whether the operation succeeded.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
+    /// <summary>Absolute path to the session's events.jsonl file.</summary>
+    [JsonPropertyName("filePath")]
+    public string FilePath { get; set; } = string.Empty;
 }
 
-/// <summary>New auth credentials to install on the session. Omit to leave credentials unchanged.</summary>
+/// <summary>Session ID whose event-log file path to compute.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionSetCredentialsParams
+internal sealed class SessionsGetEventFilePathRequest
 {
-    /// <summary>The new auth credentials to install on the session. When omitted or `undefined`, the call is a no-op and the session's existing credentials are preserved. The runtime installs the supplied value immediately for outbound model/API requests. When the credential carries a raw token (`token`, `env`, or `gh-cli`) but no `copilotUser`, the runtime additionally re-resolves `copilotUser` server-side (best-effort, asynchronously, after the synchronous install) so plan/quota/billing metadata regains fidelity; on resolution failure the verbatim credential remains installed. It does NOT otherwise validate the credential. Several variants carry secret material; treat this method's params as containing secrets at rest and in transit.</summary>
-    [JsonPropertyName("credentials")]
-    public AuthInfo? Credentials { get; set; }
-
-    /// <summary>Target session identifier.</summary>
+    /// <summary>Session ID whose event-log file path to compute.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Credential-free authentication identity safe to expose to hosts and user interfaces.</summary>
+/// <summary>Map of sessionId -&gt; on-disk size in bytes for each session's workspace directory.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class AuthIdentity
+public sealed class SessionSizes
 {
-    /// <summary>Snapshot of the authenticated user's Copilot subscription info, if known.</summary>
-    [JsonPropertyName("copilotUser")]
-    public CopilotUserResponse? CopilotUser { get; set; }
-
-    /// <summary>Name of the environment variable that supplied the credential, when applicable.</summary>
-    [JsonPropertyName("envVar")]
-    public string? EnvVar { get; set; }
+    /// <summary>Map of sessionId -&gt; on-disk size in bytes for the session's workspace directory.</summary>
+    [JsonPropertyName("sizes")]
+    public IDictionary<string, long> Sizes { get => field ??= new Dictionary<string, long>(); set; }
+}
 
-    /// <summary>Authentication host.</summary>
-    [JsonPropertyName("host")]
-    public string Host { get; set; } = string.Empty;
+/// <summary>Session IDs from the input set that are currently in use by another process.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionsCheckInUseResult
+{
+    /// <summary>Session IDs from the input set that are currently held by another running process via an alive lock file.</summary>
+    [JsonPropertyName("inUse")]
+    public IList<string> InUse { get => field ??= []; set; }
+}
 
-    /// <summary>Authenticated login, when available.</summary>
-    [JsonPropertyName("login")]
-    public string? Login { get; set; }
+/// <summary>Session IDs to test for live in-use locks.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionsCheckInUseRequest
+{
+    /// <summary>Session IDs to test for live in-use locks.</summary>
+    [JsonPropertyName("sessionIds")]
+    public IList<string> SessionIds { get => field ??= []; set; }
+}
 
-    /// <summary>Authentication type.</summary>
-    [JsonPropertyName("type")]
-    public AuthInfoType Type { get; set; }
+/// <summary>The session's persisted remote-steerable flag, or omitted when no value has been persisted.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionsGetPersistedRemoteSteerableResult
+{
+    /// <summary>The session's persisted remote-steerable flag if recorded; omitted when no value has been persisted.</summary>
+    [JsonPropertyName("remoteSteerable")]
+    public bool? RemoteSteerable { get; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Session ID to look up the persisted remote-steerable flag for.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionGitHubAuthGetCurrentAuthInfoRequest
+internal sealed class SessionsGetPersistedRemoteSteerableRequest
 {
-    /// <summary>Target session identifier.</summary>
+    /// <summary>Session ID to look up the persisted remote-steerable flag for.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Closes a session: emits shutdown, flushes pending events to disk, releases the in-use lock, disposes the active session. Idempotent: succeeds even if the session is not currently active.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionGitHubAuthGetAllAuthAvailableRequest
+public sealed class SessionsCloseResult
 {
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Session ID to close.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionGitHubAuthRefreshCopilotUserRequest
+internal sealed class SessionsCloseRequest
 {
-    /// <summary>Target session identifier.</summary>
+    /// <summary>Session ID to close.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Internal GitHub login parameters.</summary>
+/// <summary>Map of sessionId -&gt; bytes freed by removing the session's workspace directory.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionAuthLoginRequest
+public sealed class SessionBulkDeleteResult
 {
-    /// <summary>GitHub host URL.</summary>
-    [JsonPropertyName("host")]
-    public string Host { get; set; } = string.Empty;
-
-    /// <summary>GitHub login.</summary>
-    [JsonPropertyName("login")]
-    public string Login { get; set; } = string.Empty;
+    /// <summary>Map of sessionId -&gt; bytes freed by removing the session's workspace directory. Sessions whose deletion failed are omitted from this map (failures are logged on the server but not surfaced per-id; check the map for absent IDs to detect them).</summary>
+    [JsonPropertyName("freedBytes")]
+    public IDictionary<string, long> FreedBytes { get => field ??= new Dictionary<string, long>(); set; }
+}
 
-    /// <summary>Whether to persist the token after login.</summary>
-    [JsonPropertyName("persist")]
-    public bool? Persist { get; set; }
+/// <summary>Session IDs to close, deactivate, and delete from disk.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionsBulkDeleteRequest
+{
+    /// <summary>Session IDs to close, deactivate, and delete from disk.</summary>
+    [JsonPropertyName("sessionIds")]
+    public IList<string> SessionIds { get => field ??= []; set; }
+}
 
-    /// <summary>Target session identifier.</summary>
+/// <summary>Session ID to delete from disk.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionsDeleteRequest
+{
+    /// <summary>Session ID to delete.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 
-    /// <summary>GitHub authentication token.</summary>
-    [JsonPropertyName("token")]
-    public string Token { get; set; } = string.Empty;
+    /// <summary>Internal resolved session directory path to delete.</summary>
+    [JsonPropertyName("sessionPath")]
+    public string? SessionPath { get; set; }
 }
 
-/// <summary>Parameters for switching the session's active authentication.</summary>
+/// <summary>Outcome of the prune operation: deleted IDs, dry-run candidates, skipped IDs, total bytes freed, and the dry-run flag.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionAuthSwitchRequest
+public sealed class SessionPruneResult
 {
-    /// <summary>Authentication information to activate.</summary>
-    [JsonPropertyName("authInfo")]
-    public AuthInfo AuthInfo { get => field ??= new(); set; }
+    /// <summary>Session IDs that would be deleted in dry-run mode (always empty otherwise).</summary>
+    [JsonPropertyName("candidates")]
+    public IList<string> Candidates { get => field ??= []; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Session IDs that were deleted (always empty in dry-run mode).</summary>
+    [JsonPropertyName("deleted")]
+    public IList<string> Deleted { get => field ??= []; set; }
 
-    /// <summary>Optional token paired with the authentication information.</summary>
-    [JsonPropertyName("token")]
-    public string? Token { get; set; }
+    /// <summary>True when no deletions were actually performed.</summary>
+    [JsonPropertyName("dryRun")]
+    public bool DryRun { get; set; }
+
+    /// <summary>Total bytes freed (actual when not dry-run, projected when dry-run).</summary>
+    [JsonPropertyName("freedBytes")]
+    public long FreedBytes { get; set; }
+
+    /// <summary>Session IDs that were skipped (e.g., named sessions).</summary>
+    [JsonPropertyName("skipped")]
+    public IList<string> Skipped { get => field ??= []; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Age threshold and optional flags controlling which old sessions are pruned (or simulated when dryRun is true).</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionGitHubAuthLogoutRequest
+internal sealed class SessionsPruneOldRequest
 {
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>When true, only report what would be deleted without performing any deletion.</summary>
+    [JsonPropertyName("dryRun")]
+    public bool? DryRun { get; set; }
+
+    /// <summary>Session IDs that should never be considered for pruning.</summary>
+    [JsonPropertyName("excludeSessionIds")]
+    public IList<string>? ExcludeSessionIds { get; set; }
+
+    /// <summary>When true, named sessions (set via /rename) are also eligible for pruning.</summary>
+    [JsonPropertyName("includeNamed")]
+    public bool? IncludeNamed { get; set; }
+
+    /// <summary>Delete sessions whose modifiedTime is at least this many days old.</summary>
+    [JsonPropertyName("olderThanDays")]
+    public long OlderThanDays { get; set; }
 }
 
-/// <summary>Parameters identifying a GitHub authentication to log out.</summary>
+/// <summary>Flush a session's pending events to disk. No-op when no writer exists for the session (e.g., already closed).</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionAuthLogoutUserRequest
+public sealed class SessionsSaveResult
 {
-    /// <summary>Authentication information to log out.</summary>
-    [JsonPropertyName("authInfo")]
-    public AuthInfo AuthInfo { get => field ??= new(); set; }
+}
 
-    /// <summary>Target session identifier.</summary>
+/// <summary>Session ID whose pending events should be flushed to disk.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionsSaveRequest
+{
+    /// <summary>Session ID whose pending events should be flushed to disk.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Validation error from an authentication attempt.</summary>
+/// <summary>Release the in-use lock held by this process for the given session. No-op when this process does not currently hold a lock for the session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class AuthValidationError
+public sealed class SessionsReleaseLockResult
 {
-    /// <summary>Optional message returned by GitHub.</summary>
-    [JsonPropertyName("githubMessage")]
-    public string? GitHubMessage { get; set; }
-
-    /// <summary>Authentication validation error message.</summary>
-    [JsonPropertyName("message")]
-    public string Message { get; set; } = string.Empty;
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Session ID whose in-use lock should be released.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionGitHubAuthLastAuthErrorsRequest
+internal sealed class SessionsReleaseLockRequest
 {
-    /// <summary>Target session identifier.</summary>
+    /// <summary>Session ID whose in-use lock should be released.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>A file included in the redacted debug bundle.</summary>
+/// <summary>The enriched metadata records, with summary and context fields backfilled where available. Sessions confirmed empty and unnamed are omitted.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class DebugCollectLogsCollectedEntry
+public sealed class SessionEnrichMetadataResult
 {
-    /// <summary>Relative path of the file in the staged bundle/archive.</summary>
-    [JsonPropertyName("bundlePath")]
-    public string BundlePath { get; set; } = string.Empty;
-
-    /// <summary>Redacted output size in bytes.</summary>
-    [JsonPropertyName("sizeBytes")]
-    public long SizeBytes { get; set; }
-
-    /// <summary>Source category for this entry.</summary>
-    [JsonPropertyName("source")]
-    public DebugCollectLogsSource Source { get; set; }
+    /// <summary>Enriched records, with summary and context backfilled. Sessions confirmed empty and unnamed may be omitted.</summary>
+    [JsonPropertyName("sessions")]
+    public IList<LocalSessionMetadataValue> Sessions { get => field ??= []; set; }
 }
 
-/// <summary>An optional debug bundle entry that could not be included.</summary>
+/// <summary>Session metadata records to enrich with summary and context information.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class DebugCollectLogsSkippedEntry
+internal sealed class SessionsEnrichMetadataRequest
 {
-    /// <summary>Relative path requested for this bundle entry.</summary>
-    [JsonPropertyName("bundlePath")]
-    public string BundlePath { get; set; } = string.Empty;
-
-    /// <summary>Server-local source path that could not be read.</summary>
-    [JsonPropertyName("path")]
-    public string? Path { get; set; }
-
-    /// <summary>Reason the entry was skipped.</summary>
-    [JsonPropertyName("reason")]
-    public string Reason { get; set; } = string.Empty;
+    /// <summary>Session metadata records to enrich. Records that already have summary and context are returned unchanged.</summary>
+    [JsonPropertyName("sessions")]
+    public IList<LocalSessionMetadataValue> Sessions { get => field ??= []; set; }
 }
 
-/// <summary>Result of collecting a redacted debug bundle.</summary>
+/// <summary>Reload all hooks (user, plugin, optionally repo) and apply them to the active session. Call after installing or removing plugins so their hooks take effect immediately. No-op when no active session matches the given sessionId.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class DebugCollectLogsResult
+public sealed class SessionsReloadPluginHooksResult
 {
-    /// <summary>Files included in the redacted bundle.</summary>
-    [JsonPropertyName("entries")]
-    public IList<DebugCollectLogsCollectedEntry> Entries { get => field ??= []; set; }
-
-    /// <summary>Destination kind that was written.</summary>
-    [JsonPropertyName("kind")]
-    public DebugCollectLogsResultKind Kind { get; set; }
-
-    /// <summary>Actual archive path or staging directory path written. This may differ from the requested path when no-overwrite suffixing or fallback-to-temp-directory was needed.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
-
-    /// <summary>Optional files or directories that could not be included.</summary>
-    [JsonPropertyName("skippedEntries")]
-    public IList<DebugCollectLogsSkippedEntry>? SkippedEntries { get; set; }
 }
 
-/// <summary>A caller-provided server-local file or directory to include in the debug bundle.</summary>
+/// <summary>Active session ID and an optional flag for deferring repo-level hooks until folder trust.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class DebugCollectLogsEntry
+internal sealed class SessionsReloadPluginHooksRequest
 {
-    /// <summary>Relative path to use inside the staged bundle/archive.</summary>
-    [JsonPropertyName("bundlePath")]
-    public string BundlePath { get; set; } = string.Empty;
+    /// <summary>When true, skip repo-level hooks. Use before folder trust is confirmed; loadDeferredRepoHooks loads them post-trust.</summary>
+    [JsonPropertyName("deferRepoHooks")]
+    public bool? DeferRepoHooks { get; set; }
 
-    /// <summary>Kind of source path to include.</summary>
-    [JsonPropertyName("kind")]
-    public DebugCollectLogsEntryKind Kind { get; set; }
+    /// <summary>Active session ID to reload hooks for.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Server-local source path to read.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
-
-    /// <summary>How text content from this entry should be redacted. Defaults to plain-text.</summary>
-    [JsonPropertyName("redaction")]
-    public DebugCollectLogsRedaction? Redaction { get; set; }
-
-    /// <summary>When true, collection fails if this entry cannot be read. Defaults to false, which records the entry in `skippedEntries`.</summary>
-    [JsonPropertyName("required")]
-    public bool? Required { get; set; }
-}
-
-/// <summary>Destination for the redacted debug bundle.</summary>
-/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
+/// <summary>Queued repo-level startup prompts and the total hook command count after loading.</summary>
 [Experimental(Diagnostics.Experimental)]
-[JsonPolymorphic(
-    TypeDiscriminatorPropertyName = "kind",
-    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
-[JsonDerivedType(typeof(DebugCollectLogsDestinationArchive), "archive")]
-[JsonDerivedType(typeof(DebugCollectLogsDestinationDirectory), "directory")]
-public partial class DebugCollectLogsDestination
+public sealed class SessionLoadDeferredRepoHooksResult
 {
-    /// <summary>The type discriminator.</summary>
-    [JsonPropertyName("kind")]
-    public virtual string Kind { get; set; } = string.Empty;
-}
+    /// <summary>Total hook command count (user + plugin + repo) loaded for the session by this call. Captured atomically with startupPrompts so callers don't need to read a separate counter.</summary>
+    [JsonPropertyName("hookCount")]
+    public long HookCount { get; set; }
 
+    /// <summary>Repo-level startup prompts queued from repo hook configs. Empty on resume, when no repo configs were pending, or when disableAllHooks is set.</summary>
+    [JsonPropertyName("startupPrompts")]
+    public IList<string> StartupPrompts { get => field ??= []; set; }
+}
 
-/// <summary>The <c>archive</c> variant of <see cref="DebugCollectLogsDestination"/>.</summary>
+/// <summary>Active session ID whose deferred repo-level hooks should be loaded.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class DebugCollectLogsDestinationArchive : DebugCollectLogsDestination
+internal sealed class SessionsLoadDeferredRepoHooksRequest
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "archive";
-
-    /// <summary>When true, create the archive atomically without overwriting an existing file by appending ` (N)` before the extension as needed. Defaults to false.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("noOverwrite")]
-    public bool? NoOverwrite { get; set; }
-
-    /// <summary>Absolute or server-relative path for the .tgz archive to create.</summary>
-    [JsonPropertyName("outputPath")]
-    public required string OutputPath { get; set; }
+    /// <summary>Active session ID whose deferred repo-level hooks should be loaded.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>The <c>directory</c> variant of <see cref="DebugCollectLogsDestination"/>.</summary>
+/// <summary>Replace the manager-wide additional plugins. New session creations and subsequent hook reloads see the new set; already-running sessions keep their existing hook installation until the next reload.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class DebugCollectLogsDestinationDirectory : DebugCollectLogsDestination
+public sealed class SessionsSetAdditionalPluginsResult
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "directory";
-
-    /// <summary>Directory where redacted files should be staged. The directory is created if needed.</summary>
-    [JsonPropertyName("outputDirectory")]
-    public required string OutputDirectory { get; set; }
 }
 
-/// <summary>Built-in session diagnostics to include in the bundle. Omitted fields default to true.</summary>
+/// <summary>Installed plugin record from global state, with marketplace, version, install time, enabled state, cache path, and source.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class DebugCollectLogsInclude
+public sealed class InstalledPlugin
 {
-    /// <summary>Server-local path to the current process log. When set, it is included as `process.log` and its directory is searched for prior logs from the same session.</summary>
-    [JsonPropertyName("currentProcessLogPath")]
-    public string? CurrentProcessLogPath { get; set; }
+    /// <summary>Path where the plugin is cached locally.</summary>
+    [JsonPropertyName("cache_path")]
+    public string? CachePath { get; set; }
 
-    /// <summary>Include the session event log (`events.jsonl`). Defaults to true.</summary>
-    [JsonPropertyName("events")]
-    public bool? Events { get; set; }
+    /// <summary>Whether the plugin is currently enabled.</summary>
+    [JsonPropertyName("enabled")]
+    public bool Enabled { get; set; }
 
-    /// <summary>Server-local path to the session's events.jsonl file. Internal callers normally omit this and let the runtime derive it from the session.</summary>
-    [JsonPropertyName("eventsPath")]
-    public string? EventsPath { get; set; }
+    /// <summary>Installation timestamp.</summary>
+    [JsonPropertyName("installed_at")]
+    public string InstalledAt { get; set; } = string.Empty;
 
-    /// <summary>Maximum number of previous process logs to include. Defaults to 5.</summary>
-    [JsonPropertyName("previousProcessLogLimit")]
-    public long? PreviousProcessLogLimit { get; set; }
+    /// <summary>Marketplace the plugin came from (empty string for direct repo installs).</summary>
+    [JsonPropertyName("marketplace")]
+    public string Marketplace { get; set; } = string.Empty;
 
-    /// <summary>Server-local process log directory to search when `currentProcessLogPath` is unavailable, useful for collecting logs for inactive sessions.</summary>
-    [JsonPropertyName("processLogDirectory")]
-    public string? ProcessLogDirectory { get; set; }
+    /// <summary>Plugin name.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
-    /// <summary>Include process logs for the session. Defaults to true.</summary>
-    [JsonPropertyName("processLogs")]
-    public bool? ProcessLogs { get; set; }
+    /// <summary>Source for direct repo installs (when marketplace is empty).</summary>
+    [JsonPropertyName("source")]
+    public JsonElement? Source { get; set; }
 
-    /// <summary>Include interactive shell logs written under the session's `shell-logs` directory. Defaults to true.</summary>
-    [JsonPropertyName("shellLogs")]
-    public bool? ShellLogs { get; set; }
+    /// <summary>Per-plugin source fingerprint (a SHA-256 hash of the plugin's catalog source spec plus its resolved source subtree — NOT a Git commit SHA) captured at marketplace install/update time. Auto-update compares it against the freshly recomputed fingerprint to detect a content change that does not bump the version. Absent for pre-existing installs and for direct (non-marketplace) installs.</summary>
+    [JsonPropertyName("source_sha")]
+    public string? SourceSha { get; set; }
+
+    /// <summary>Version installed (if available).</summary>
+    [JsonPropertyName("version")]
+    public string? Version { get; set; }
 }
 
-/// <summary>Options for collecting a redacted session debug bundle.</summary>
+/// <summary>Manager-wide additional plugins to register; replaces any previously-configured set.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class DebugCollectLogsRequest
+internal sealed class SessionsSetAdditionalPluginsRequest
 {
-    /// <summary>Caller-provided server-local files or directories to include in addition to the runtime's built-in session diagnostics. This lets host applications add their own diagnostics without changing the API shape.</summary>
-    [JsonPropertyName("additionalEntries")]
-    public IList<DebugCollectLogsEntry>? AdditionalEntries { get; set; }
-
-    /// <summary>Where the redacted bundle should be written. Use `archive` to produce a .tgz, or `directory` to stage redacted files for caller-managed upload/post-processing.</summary>
-    [JsonPropertyName("destination")]
-    public DebugCollectLogsDestination Destination { get => field ??= new(); set; }
+    /// <summary>Manager-wide additional plugins to register. Replaces any previously-configured set. Pass an empty array to clear.</summary>
+    [JsonPropertyName("plugins")]
+    public IList<InstalledPlugin> Plugins { get => field ??= []; set; }
+}
 
-    /// <summary>Which built-in session diagnostics to include. Omitted fields default to true.</summary>
-    [JsonPropertyName("include")]
-    public DebugCollectLogsInclude? Include { get; set; }
+/// <summary>Dynamic-context board entry count, when available.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionsGetBoardEntryCountResult
+{
+    /// <summary>Board entry count, when available.</summary>
+    [JsonPropertyName("count")]
+    public long? Count { get; set; }
+}
 
-    /// <summary>Target session identifier.</summary>
+/// <summary>Session ID whose board entry count should be returned.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionsGetBoardEntryCountRequest
+{
+    /// <summary>Session ID whose board entry count should be returned.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Canvas action that the agent or host can invoke. To discover the input schema for a particular action, call the list_canvas_capabilities tool.</summary>
+/// <summary>State of the runtime-managed remote-control singleton.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>state</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class CanvasAction
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "state",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(RemoteControlStatusOff), "off")]
+[JsonDerivedType(typeof(RemoteControlStatusConnecting), "connecting")]
+[JsonDerivedType(typeof(RemoteControlStatusActive), "active")]
+[JsonDerivedType(typeof(RemoteControlStatusError), "error")]
+public partial class RemoteControlStatus
 {
-    /// <summary>Description of the action.</summary>
-    [JsonPropertyName("description")]
-    public string? Description { get; set; }
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("state")]
+    public virtual string State { get; set; } = string.Empty;
+}
 
-    /// <summary>JSON Schema for the action input.</summary>
-    [JsonPropertyName("inputSchema")]
-    public JsonElement? InputSchema { get; set; }
 
-    /// <summary>Action name exposed by the canvas provider.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+/// <summary>Remote control is not connected.</summary>
+/// <remarks>The <c>off</c> variant of <see cref="RemoteControlStatus"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class RemoteControlStatusOff : RemoteControlStatus
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string State => "off";
 }
 
-/// <summary>Canvas available in the current session.</summary>
+/// <summary>Remote control is in the middle of initial setup.</summary>
+/// <remarks>The <c>connecting</c> variant of <see cref="RemoteControlStatus"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class DiscoveredCanvas
+public partial class RemoteControlStatusConnecting : RemoteControlStatus
 {
-    /// <summary>Actions the agent or host may invoke on an open instance.</summary>
-    [JsonPropertyName("actions")]
-    public IList<CanvasAction>? Actions { get; set; }
-
-    /// <summary>Provider-local canvas identifier.</summary>
-    [JsonPropertyName("canvasId")]
-    public string CanvasId { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string State => "connecting";
 
-    /// <summary>Short, single-sentence description shown to the agent in canvas catalogs.</summary>
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
-    [JsonPropertyName("description")]
-    public string Description { get; set; } = string.Empty;
+    /// <summary>Session id the connection is attaching to.</summary>
+    [JsonPropertyName("attachedSessionId")]
+    public required string AttachedSessionId { get; set; }
+}
 
-    /// <summary>Human-readable canvas name.</summary>
-    [JsonPropertyName("displayName")]
-    public string DisplayName { get; set; } = string.Empty;
+/// <summary>Remote control is connected to a local session.</summary>
+/// <remarks>The <c>active</c> variant of <see cref="RemoteControlStatus"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class RemoteControlStatusActive : RemoteControlStatus
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string State => "active";
 
-    /// <summary>Owning provider identifier.</summary>
-    [JsonPropertyName("extensionId")]
-    public string ExtensionId { get; set; } = string.Empty;
+    /// <summary>Session id remote control is pointed at.</summary>
+    [JsonPropertyName("attachedSessionId")]
+    public required string AttachedSessionId { get; set; }
 
-    /// <summary>Owning extension display name, when available.</summary>
-    [JsonPropertyName("extensionName")]
-    public string? ExtensionName { get; set; }
+    /// <summary>True while a read-only/session-sync export is deferred, awaiting the first `user.message` before its MC session exists. Marked internal: this field is excluded from the public SDK surface and is populated only on the CLI in-process path.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonInclude]
+    [JsonPropertyName("awaitingFirstMessage")]
+    internal bool? AwaitingFirstMessage { get; set; }
 
-    /// <summary>Host-local PNG path for the canvas icon, when supplied.</summary>
-    [JsonPropertyName("icon")]
-    public string? Icon { get; set; }
+    /// <summary>MC frontend URL for this session, when known.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("frontendUrl")]
+    public string? FrontendUrl { get; set; }
 
-    /// <summary>JSON Schema for canvas open input.</summary>
-    [JsonPropertyName("inputSchema")]
-    public JsonElement? InputSchema { get; set; }
+    /// <summary>Whether the MC session may steer this session.</summary>
+    [JsonPropertyName("isSteerable")]
+    public required bool IsSteerable { get; set; }
 }
 
-/// <summary>Declared canvases available in this session.</summary>
+/// <summary>The last setup attempt failed. The singleton is otherwise off.</summary>
+/// <remarks>The <c>error</c> variant of <see cref="RemoteControlStatus"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class CanvasList
+public partial class RemoteControlStatusError : RemoteControlStatus
 {
-    /// <summary>Declared canvases available in this session.</summary>
-    [JsonPropertyName("canvases")]
-    public IList<DiscoveredCanvas> Canvases { get => field ??= []; set; }
-}
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string State => "error";
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionCanvasListRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Session id the failing setup attempt targeted, when known.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("attachedSessionId")]
+    public string? AttachedSessionId { get; set; }
+
+    /// <summary>Human-readable error message from the last setup attempt.</summary>
+    [JsonPropertyName("error")]
+    public required string Error { get; set; }
 }
 
-/// <summary>Open canvas instance snapshot.</summary>
+/// <summary>Wrapper for the singleton's current status.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class OpenCanvasInstance
+public sealed class RemoteControlStatusResult
 {
-    /// <summary>Provider-local canvas identifier.</summary>
-    [JsonPropertyName("canvasId")]
-    public string CanvasId { get; set; } = string.Empty;
+    /// <summary>State of the runtime-managed remote-control singleton.</summary>
+    [JsonPropertyName("status")]
+    public RemoteControlStatus Status { get => field ??= new(); set; }
+}
 
-    /// <summary>Owning provider identifier.</summary>
-    [JsonPropertyName("extensionId")]
-    public string ExtensionId { get; set; } = string.Empty;
+/// <summary>Reattach to an existing MC session without creating a new one.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class RemoteControlConfigExistingMcSession
+{
+    /// <summary>Existing MC session ID to reattach to.</summary>
+    [JsonPropertyName("mcSessionId")]
+    public string McSessionId { get; set; } = string.Empty;
 
-    /// <summary>Owning extension display name, when available.</summary>
-    [JsonPropertyName("extensionName")]
-    public string? ExtensionName { get; set; }
+    /// <summary>Existing MC task ID for the reattached session.</summary>
+    [JsonPropertyName("mcTaskId")]
+    public string McTaskId { get; set; } = string.Empty;
+}
 
-    /// <summary>Host-local PNG path for the canvas icon, when supplied.</summary>
-    [JsonPropertyName("icon")]
-    public string? Icon { get; set; }
+/// <summary>Configuration for the runtime-managed remote-control singleton.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class RemoteControlConfig
+{
+    /// <summary>Reattach to an existing MC session without creating a new one.</summary>
+    [JsonPropertyName("existingMcSession")]
+    public RemoteControlConfigExistingMcSession? ExistingMcSession { get; set; }
 
-    /// <summary>Input supplied when the instance was opened.</summary>
-    [JsonPropertyName("input")]
-    public JsonElement? Input { get; set; }
+    /// <summary>Whether the user explicitly requested remote (vs. implicit session-sync). Controls warning surfacing for missing-repo cases.</summary>
+    [JsonPropertyName("explicit")]
+    public bool Explicit { get; set; }
 
-    /// <summary>Stable caller-supplied canvas instance identifier.</summary>
-    [JsonPropertyName("instanceId")]
-    public string InstanceId { get; set; } = string.Empty;
+    /// <summary>Whether remote export should be enabled.</summary>
+    [JsonPropertyName("remote")]
+    public bool Remote { get; set; }
 
-    /// <summary>Provider-supplied status text.</summary>
-    [JsonPropertyName("status")]
-    public string? Status { get; set; }
+    /// <summary>When true, suppresses timeline messages on successful setup.</summary>
+    [JsonPropertyName("silent")]
+    public bool Silent { get; set; }
 
-    /// <summary>Rendered title.</summary>
-    [JsonPropertyName("title")]
-    public string? Title { get; set; }
+    /// <summary>Whether the MC session may steer the local session (write mode).</summary>
+    [JsonPropertyName("steerable")]
+    public bool Steerable { get; set; }
 
-    /// <summary>URL for web-rendered canvases.</summary>
-    [JsonPropertyName("url")]
-    public string? Url { get; set; }
+    /// <summary>Existing Mission Control task ID to attach the exported session to.</summary>
+    [JsonPropertyName("taskId")]
+    public string? TaskId { get; set; }
 }
 
-/// <summary>Live open-canvas snapshot.</summary>
+/// <summary>Parameters for attaching the remote-control singleton to a session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class CanvasListOpenResult
+internal sealed class SessionsStartRemoteControlRequest
 {
-    /// <summary>Currently open canvas instances.</summary>
-    [JsonPropertyName("openCanvases")]
-    public IList<OpenCanvasInstance> OpenCanvases { get => field ??= []; set; }
-}
+    /// <summary>Configuration for the runtime-managed remote-control singleton.</summary>
+    [JsonPropertyName("config")]
+    public RemoteControlConfig Config { get => field ??= new(); set; }
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionCanvasListOpenRequest
-{
-    /// <summary>Target session identifier.</summary>
+    /// <summary>Local session id to attach remote control to.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Canvas open parameters.</summary>
+/// <summary>Outcome of a transferRemoteControl call.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class CanvasOpenRequest
+public sealed class RemoteControlTransferResult
 {
-    /// <summary>Provider-local canvas identifier.</summary>
-    [JsonPropertyName("canvasId")]
-    public string CanvasId { get; set; } = string.Empty;
-
-    /// <summary>Owning provider identifier. Optional when the canvasId is unique across providers; required to disambiguate when multiple providers register the same canvasId.</summary>
-    [JsonPropertyName("extensionId")]
-    public string? ExtensionId { get; set; }
-
-    /// <summary>Canvas open input.</summary>
-    [JsonPropertyName("input")]
-    public JsonElement? Input { get; set; }
-
-    /// <summary>Caller-supplied stable instance identifier.</summary>
-    [JsonPropertyName("instanceId")]
-    public string InstanceId { get; set; } = string.Empty;
+    /// <summary>State of the runtime-managed remote-control singleton.</summary>
+    [JsonPropertyName("status")]
+    public RemoteControlStatus Status { get => field ??= new(); set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Whether the rebinding actually happened.</summary>
+    [JsonPropertyName("transferred")]
+    public bool Transferred { get; set; }
 }
 
-/// <summary>Canvas close parameters.</summary>
+/// <summary>Parameters for atomically rebinding the remote-control singleton.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class CanvasCloseRequest
+internal sealed class SessionsTransferRemoteControlRequest
 {
-    /// <summary>Open canvas instance identifier.</summary>
-    [JsonPropertyName("instanceId")]
-    public string InstanceId { get; set; } = string.Empty;
+    /// <summary>When provided, the transfer is rejected unless the singleton currently points at this session id (compare-and-swap semantics to avoid clobbering newer state).</summary>
+    [JsonPropertyName("expectedFromSessionId")]
+    public string? ExpectedFromSessionId { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Local session id to point remote control at.</summary>
+    [JsonPropertyName("toSessionId")]
+    public string ToSessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Canvas action invocation result.</summary>
+/// <summary>Patch for the singleton's steering state.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class CanvasActionInvokeResult
+internal sealed class SessionsSetRemoteControlSteeringRequest
 {
-    /// <summary>Provider-supplied action result.</summary>
-    [JsonPropertyName("result")]
-    public JsonElement? Result { get; set; }
+    /// <summary>Target steering state. Today only `true` is actionable on the underlying exporter; `false` is reserved for future use.</summary>
+    [JsonPropertyName("enabled")]
+    public bool Enabled { get; set; }
 }
 
-/// <summary>Canvas action invocation parameters.</summary>
+/// <summary>Outcome of a stopRemoteControl call.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class CanvasActionInvokeRequest
+public sealed class RemoteControlStopResult
 {
-    /// <summary>Action name to invoke.</summary>
-    [JsonPropertyName("actionName")]
-    public string ActionName { get; set; } = string.Empty;
+    /// <summary>State of the runtime-managed remote-control singleton.</summary>
+    [JsonPropertyName("status")]
+    public RemoteControlStatus Status { get => field ??= new(); set; }
 
-    /// <summary>Action input.</summary>
-    [JsonPropertyName("input")]
-    public JsonElement? Input { get; set; }
+    /// <summary>Whether the singleton was actually torn down by this call.</summary>
+    [JsonPropertyName("stopped")]
+    public bool Stopped { get; set; }
+}
 
-    /// <summary>Open canvas instance identifier.</summary>
-    [JsonPropertyName("instanceId")]
-    public string InstanceId { get; set; } = string.Empty;
+/// <summary>RPC data type for SessionsStopRemoteControl operations.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionsStopRemoteControlRequest
+{
+    /// <summary>When provided, the stop is rejected unless the singleton currently points at this session id (compare-and-swap semantics).</summary>
+    [JsonPropertyName("expectedSessionId")]
+    public string? ExpectedSessionId { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>When true, the singleton is unconditionally torn down regardless of `expectedSessionId`. Use during shutdown or explicit `/remote off`.</summary>
+    [JsonPropertyName("force")]
+    public bool? Force { get; set; }
 }
 
-/// <summary>Internal canvas provider registration parameters.</summary>
+/// <summary>Handle for releasing the extension tool registration.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class CanvasProviderRegisterRequest
+internal sealed class RegisterExtensionToolsResult
 {
-    /// <summary>Canvas contributions supplied by the provider.</summary>
-    [JsonPropertyName("canvases")]
-    public IList<JsonElement> Canvases { get => field ??= []; set; }
+}
 
-    /// <summary>Connection identifier for callback routing.</summary>
-    [JsonPropertyName("connectionId")]
-    public string ConnectionId { get; set; } = string.Empty;
+/// <summary>Optional registration options.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionsRegisterExtensionToolsOnSessionOptions
+{
+}
 
-    /// <summary>Provider metadata supplied by the host.</summary>
-    [JsonPropertyName("info")]
-    public JsonElement Info { get; set; }
+/// <summary>Params to attach an extension loader's tools to a session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class RegisterExtensionToolsParams
+{
+    /// <summary>Optional registration options.</summary>
+    [JsonPropertyName("options")]
+    public SessionsRegisterExtensionToolsOnSessionOptions? Options { get; set; }
 
-    /// <summary>Target session identifier.</summary>
+    /// <summary>Session to register extension tools on.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Internal canvas provider unregistration parameters.</summary>
+/// <summary>Params to attach or detach an in-process ExtensionController delegate.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class CanvasProviderUnregisterRequest
+internal sealed class ConfigureSessionExtensionsParams
 {
-    /// <summary>Connection identifier to unregister.</summary>
-    [JsonPropertyName("connectionId")]
-    public string ConnectionId { get; set; } = string.Empty;
-
-    /// <summary>Target session identifier.</summary>
+    /// <summary>Session to attach the extension controller delegate to.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Machine-readable factory run failure.</summary>
-/// <remarks>Polymorphic base type discriminated by <c>type</c>.</remarks>
+/// <summary>Outcome of an agentRegistry.spawn call.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
 [JsonPolymorphic(
-    TypeDiscriminatorPropertyName = "type",
+    TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
-[JsonDerivedType(typeof(FactoryRunFailureFactoryLimitReached), "factory_limit_reached")]
-[JsonDerivedType(typeof(FactoryRunFailureFactoryResumeDeclined), "factory_resume_declined")]
-[JsonDerivedType(typeof(FactoryRunFailureFactoryDurableFailure), "factory_durable_failure")]
-[JsonDerivedType(typeof(FactoryRunFailureFactoryAccountingIncomplete), "factory_accounting_incomplete")]
-public partial class FactoryRunFailure
+[JsonDerivedType(typeof(AgentRegistrySpawnResultSpawned), "spawned")]
+[JsonDerivedType(typeof(AgentRegistrySpawnResultSpawnError), "spawn-error")]
+[JsonDerivedType(typeof(AgentRegistrySpawnResultRegistryTimeout), "registry-timeout")]
+[JsonDerivedType(typeof(AgentRegistrySpawnResultValidationError), "validation-error")]
+public partial class AgentRegistrySpawnResult
 {
     /// <summary>The type discriminator.</summary>
-    [JsonPropertyName("type")]
-    public virtual string Type { get; set; } = string.Empty;
+    [JsonPropertyName("kind")]
+    public virtual string Kind { get; set; } = string.Empty;
 }
 
 
-/// <summary>The <c>factory_limit_reached</c> variant of <see cref="FactoryRunFailure"/>.</summary>
+/// <summary>Full registry entry for the spawned child. Lets the controller call `handleLiveTargetSelected(entry)` directly without re-reading the registry (avoids a TOCTOU window).</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class FactoryRunFailureFactoryLimitReached : FactoryRunFailure
+public sealed class AgentRegistryLiveTargetEntry
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "factory_limit_reached";
-
-    /// <summary>Resource ceiling that stopped the run.</summary>
-    [JsonPropertyName("kind")]
-    public required FactoryRunFailureKind Kind { get; set; }
+    /// <summary>Kind of attention required when status === "attention". Meaningful only when status === "attention".</summary>
+    [JsonPropertyName("attentionKind")]
+    public AgentRegistryLiveTargetEntryAttentionKind? AttentionKind { get; set; }
 
-    /// <summary>Factory run identifier.</summary>
-    [JsonPropertyName("runId")]
-    public required string RunId { get; set; }
+    /// <summary>Git branch of the session (when known).</summary>
+    [JsonPropertyName("branch")]
+    public string? Branch { get; set; }
 
-    /// <summary>Approved effective ceiling that was reached.</summary>
-    [JsonPropertyName("value")]
-    public required double Value { get; set; }
+    /// <summary>Copilot CLI version that wrote the entry.</summary>
+    [JsonPropertyName("copilotVersion")]
+    public string CopilotVersion { get; set; } = string.Empty;
+
+    /// <summary>Working directory of the session (when known).</summary>
+    [JsonPropertyName("cwd")]
+    public string? Cwd { get; set; }
+
+    /// <summary>Bind host for the entry's JSON-RPC server.</summary>
+    [JsonPropertyName("host")]
+    public string Host { get; set; } = string.Empty;
+
+    /// <summary>Process kind tag for the registry entry.</summary>
+    [JsonPropertyName("kind")]
+    public AgentRegistryLiveTargetEntryKind Kind { get; set; }
+
+    /// <summary>Wall-clock milliseconds since the watcher last observed this entry (heartbeat freshness).</summary>
+    [JsonPropertyName("lastSeenMs")]
+    public long LastSeenMs { get; set; }
+
+    /// <summary>How the most recent turn ended (clean vs aborted). Lets the renderer distinguish done from done_cancelled.</summary>
+    [JsonPropertyName("lastTerminalEvent")]
+    public AgentRegistryLiveTargetEntryLastTerminalEvent? LastTerminalEvent { get; set; }
+
+    /// <summary>Model identifier currently selected for the session.</summary>
+    [JsonPropertyName("model")]
+    public string? Model { get; set; }
+
+    /// <summary>Operating-system pid of the process owning this entry.</summary>
+    [JsonPropertyName("pid")]
+    public long Pid { get; set; }
+
+    /// <summary>TCP port the entry's JSON-RPC server is listening on.</summary>
+    [JsonPropertyName("port")]
+    public long Port { get; set; }
+
+    /// <summary>Registry entry schema version (1 = ui-server, 2 = managed-server).</summary>
+    [JsonPropertyName("schemaVersion")]
+    public long SchemaVersion { get; set; }
+
+    /// <summary>Session ID of the foreground session for this entry.</summary>
+    [JsonPropertyName("sessionId")]
+    public string? SessionId { get; set; }
+
+    /// <summary>Friendly session name (when set).</summary>
+    [JsonPropertyName("sessionName")]
+    public string? SessionName { get; set; }
+
+    /// <summary>ISO 8601 timestamp captured at registration.</summary>
+    [JsonPropertyName("startedAt")]
+    public string StartedAt { get; set; } = string.Empty;
+
+    /// <summary>Coarse lifecycle status of the foreground session.</summary>
+    [JsonPropertyName("status")]
+    public AgentRegistryLiveTargetEntryStatus? Status { get; set; }
+
+    /// <summary>Monotonic per-publisher revision counter incremented on every status update. Lets watchers detect transient flips.</summary>
+    [JsonPropertyName("statusRevision")]
+    public long? StatusRevision { get; set; }
+
+    /// <summary>Connection token (null when the target is unauthenticated).</summary>
+    [JsonInclude]
+    [JsonPropertyName("token")]
+    internal string? Token { get; set; }
 }
 
-/// <summary>The <c>factory_resume_declined</c> variant of <see cref="FactoryRunFailure"/>.</summary>
+/// <summary>Per-spawn log-capture outcome; populated from spawnLiveTarget.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class FactoryRunFailureFactoryResumeDeclined : FactoryRunFailure
+public sealed class AgentRegistryLogCapture
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "factory_resume_declined";
+    /// <summary>Whether per-spawn log capture is on (false when env-disabled or open failed).</summary>
+    [JsonPropertyName("enabled")]
+    public bool Enabled { get; set; }
 
-    /// <summary>Human-readable reason the resume did not proceed.</summary>
-    [JsonPropertyName("reason")]
-    public required string Reason { get; set; }
+    /// <summary>Human-readable open failure message (only set when enabled === false AND the env-disable opt-out was NOT used).</summary>
+    [JsonPropertyName("openError")]
+    public string? OpenError { get; set; }
 
-    /// <summary>Factory run identifier whose changed limits were declined.</summary>
-    [JsonPropertyName("runId")]
-    public required string RunId { get; set; }
+    /// <summary>Categorized reason for log-open failure.</summary>
+    [JsonPropertyName("openErrorReason")]
+    public AgentRegistryLogCaptureOpenErrorReason? OpenErrorReason { get; set; }
+
+    /// <summary>Absolute path to the per-spawn log file (only set when enabled).</summary>
+    [JsonPropertyName("path")]
+    public string? Path { get; set; }
 }
 
-/// <summary>The <c>factory_durable_failure</c> variant of <see cref="FactoryRunFailure"/>.</summary>
+/// <summary>Managed-server child was spawned and registered successfully.</summary>
+/// <remarks>The <c>spawned</c> variant of <see cref="AgentRegistrySpawnResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public partial class FactoryRunFailureFactoryDurableFailure : FactoryRunFailure
+public partial class AgentRegistrySpawnResultSpawned : AgentRegistrySpawnResult
 {
     /// <inheritdoc />
     [JsonIgnore]
-    public override string Type => "factory_durable_failure";
+    public override string Kind => "spawned";
 
-    /// <summary>Stable failure code.</summary>
-    [JsonPropertyName("code")]
-    public required string Code { get; set; }
+    /// <summary>Full registry entry for the spawned child. Lets the controller call `handleLiveTargetSelected(entry)` directly without re-reading the registry (avoids a TOCTOU window).</summary>
+    [JsonPropertyName("entry")]
+    public required AgentRegistryLiveTargetEntry Entry { get; set; }
 
-    /// <summary>Execution-critical durable operation that failed.</summary>
-    [JsonPropertyName("operation")]
-    public required FactoryDurableOperation Operation { get; set; }
+    /// <summary>If the delegate attempted to send the initial prompt and failed, the categorized error message.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("initialPromptError")]
+    public string? InitialPromptError { get; set; }
 
-    /// <summary>Factory run identifier.</summary>
-    [JsonPropertyName("runId")]
-    public required string RunId { get; set; }
+    /// <summary>Whether the delegate already sent the initial prompt. Always omitted in the current wiring: the controller sends the prompt post-attach via the standard LocalRpcSession.send path.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("initialPromptSent")]
+    public bool? InitialPromptSent { get; set; }
+
+    /// <summary>Per-spawn log-capture outcome; populated from spawnLiveTarget.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("logCapture")]
+    public AgentRegistryLogCapture? LogCapture { get; set; }
 }
 
-/// <summary>The run stopped because its usage accounting could not be completed.</summary>
-/// <remarks>The <c>factory_accounting_incomplete</c> variant of <see cref="FactoryRunFailure"/>.</remarks>
+/// <summary>`child_process.spawn` itself failed before the child entered the registry.</summary>
+/// <remarks>The <c>spawn-error</c> variant of <see cref="AgentRegistrySpawnResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public partial class FactoryRunFailureFactoryAccountingIncomplete : FactoryRunFailure
+public partial class AgentRegistrySpawnResultSpawnError : AgentRegistrySpawnResult
 {
     /// <inheritdoc />
     [JsonIgnore]
-    public override string Type => "factory_accounting_incomplete";
+    public override string Kind => "spawn-error";
 
-    /// <summary>Confirmed usage in nano-AIU, representing the floor of what the run spent.</summary>
-    [JsonPropertyName("drainedNanoAiu")]
-    public required long DrainedNanoAiu { get; set; }
+    /// <summary>Underlying errno code (e.g. ENOENT, EACCES) when available.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("code")]
+    public string? Code { get; set; }
 
-    /// <summary>Factory run identifier.</summary>
-    [JsonPropertyName("runId")]
-    public required string RunId { get; set; }
+    /// <summary>Human-readable error message.</summary>
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
 }
 
-/// <summary>Complete current or terminal factory run envelope.</summary>
+/// <summary>Spawn succeeded but the child did not publish a matching managed-server entry within the timeout.</summary>
+/// <remarks>The <c>registry-timeout</c> variant of <see cref="AgentRegistrySpawnResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class FactoryRunResult
+public partial class AgentRegistrySpawnResultRegistryTimeout : AgentRegistrySpawnResult
 {
-    /// <summary>Error message for an errored run.</summary>
-    [JsonPropertyName("error")]
-    public string? Error { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "registry-timeout";
 
-    /// <summary>Machine-readable failure details for an errored run.</summary>
-    [JsonPropertyName("failure")]
-    public FactoryRunFailure? Failure { get; set; }
+    /// <summary>Process ID of the orphaned child (so the caller can offer 'kill the pid' guidance).</summary>
+    [JsonPropertyName("childPid")]
+    public required long ChildPid { get; set; }
 
-    /// <summary>Reason for a halted or cancelled run.</summary>
-    [JsonPropertyName("reason")]
-    public string? Reason { get; set; }
+    /// <summary>Per-spawn log-capture outcome; populated from spawnLiveTarget.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("logCapture")]
+    public AgentRegistryLogCapture? LogCapture { get; set; }
+}
 
-    /// <summary>Completed factory result.</summary>
-    [JsonPropertyName("result")]
-    public JsonElement? Result { get; set; }
+/// <summary>Synchronous pre-validation rejected the spawn request.</summary>
+/// <remarks>The <c>validation-error</c> variant of <see cref="AgentRegistrySpawnResult"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class AgentRegistrySpawnResultValidationError : AgentRegistrySpawnResult
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "validation-error";
 
-    /// <summary>Factory run identifier.</summary>
-    [JsonPropertyName("runId")]
-    public string RunId { get; set; } = string.Empty;
+    /// <summary>Which parameter field was invalid. Omitted when the rejection is not field-specific.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("field")]
+    public AgentRegistrySpawnValidationErrorField? Field { get; set; }
 
-    /// <summary>Partial journal and progress snapshot for a halted, cancelled, or errored run.</summary>
-    [JsonPropertyName("snapshot")]
-    public JsonElement? Snapshot { get; set; }
+    /// <summary>Human-readable explanation; safe to surface in the UI banner. Never logged to unrestricted telemetry.</summary>
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
 
-    /// <summary>Current or terminal factory run status.</summary>
-    [JsonPropertyName("status")]
-    public FactoryRunStatus Status { get; set; }
+    /// <summary>Categorized reason for the rejection. Low-cardinality enum so telemetry can aggregate by reason without leaking raw paths or agent/model names.</summary>
+    [JsonPropertyName("reason")]
+    public required AgentRegistrySpawnValidationErrorReason Reason { get; set; }
 }
 
-/// <summary>Wire-only per-invocation factory resource ceiling overrides.</summary>
+/// <summary>Inputs to spawn a managed-server child via the controller's spawn delegate.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class FactoryRunLimits
+internal sealed class AgentRegistrySpawnRequest
 {
-    /// <summary>Maximum AI credits consumed by factory subagents and their descendants. The post-paid ceiling is soft: parallel turns can settle beyond it before the run stops.</summary>
-    [JsonPropertyName("maxAiCredits")]
-    public double? MaxAiCredits { get; set; }
+    /// <summary>Custom or built-in agent name (e.g. 'explore'). When omitted, the child uses its own default.</summary>
+    [JsonPropertyName("agentName")]
+    public string? AgentName { get; set; }
 
-    /// <summary>Maximum number of factory subagents that may run concurrently.</summary>
-    [JsonPropertyName("maxConcurrentSubagents")]
-    public long? MaxConcurrentSubagents { get; set; }
+    /// <summary>Working directory for the spawned child (must be an existing directory).</summary>
+    [JsonPropertyName("cwd")]
+    public string Cwd { get; set; } = string.Empty;
 
-    /// <summary>Maximum total number of factory subagents that may be admitted.</summary>
-    [JsonPropertyName("maxTotalSubagents")]
-    public long? MaxTotalSubagents { get; set; }
+    /// <summary>Optional first user message. Forwarded to the caller (the CLI's spawn wrapper sends it post-attach via the standard LocalRpcSession.send path).</summary>
+    [JsonPropertyName("initialPrompt")]
+    public string? InitialPrompt { get; set; }
 
-    /// <summary>Maximum accumulated active-execution time in seconds. Active execution includes the entire extension body, subprocess waits, queued-agent waits, and sleeps; time between resumed attempts is not counted.</summary>
-    [JsonPropertyName("timeoutSeconds")]
-    public double? TimeoutSeconds { get; set; }
-}
+    /// <summary>Model identifier to apply to the new session.</summary>
+    [JsonPropertyName("model")]
+    public string? Model { get; set; }
 
-/// <summary>Options controlling factory invocation.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class RunOptions
-{
-    /// <summary>Per-invocation resource ceiling overrides.</summary>
-    [JsonPropertyName("limits")]
-    public FactoryRunLimits? Limits { get; set; }
+    /// <summary>Friendly session name. Must satisfy validateSessionName: non-empty, no leading/trailing whitespace, &lt;=100 chars, no control chars, no double quotes.</summary>
+    [JsonPropertyName("name")]
+    public string? Name { get; set; }
 
-    /// <summary>Run identifier whose journal and progress should seed this resumed run.</summary>
-    [JsonPropertyName("resumeFromRunId")]
-    public string? ResumeFromRunId { get; set; }
+    /// <summary>Permission posture for the new session. 'yolo' requires the controller-local session to currently be in allow-all mode.</summary>
+    [JsonPropertyName("permissionMode")]
+    public AgentRegistrySpawnPermissionMode? PermissionMode { get; set; }
 }
 
-/// <summary>Parameters for invoking a registered factory.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class FactoryRunRequest
+internal sealed class SessionSuspendRequest
 {
-    /// <summary>Factory input value.</summary>
-    [JsonPropertyName("args")]
-    public JsonElement Args { get; set; }
-
-    /// <summary>Registered factory name.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
-
-    /// <summary>Factory invocation options.</summary>
-    [JsonPropertyName("options")]
-    public RunOptions? Options { get; set; }
-
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Resolved persisted factory identity and resumed run envelope.</summary>
+/// <summary>Result of sending a user message.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class FactoryResumeResult
+public sealed class SendResult
 {
-    /// <summary>Persisted factory name resolved for the resumed run.</summary>
-    [JsonPropertyName("factoryName")]
-    public string FactoryName { get; set; } = string.Empty;
-
-    /// <summary>Terminal resumed run envelope.</summary>
-    [JsonPropertyName("run")]
-    public FactoryRunResult Run { get => field ??= new(); set; }
+    /// <summary>Unique identifier assigned to the message.</summary>
+    [JsonPropertyName("messageId")]
+    public string MessageId { get; set; } = string.Empty;
 }
 
-/// <summary>Parameters for resuming a factory run from its persisted identity.</summary>
+/// <summary>Parameters for sending a user message to the session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class FactoryResumeRequest
+internal sealed class SendRequest
 {
-    /// <summary>Optional per-invocation resource ceiling overrides.</summary>
-    [JsonPropertyName("limits")]
-    public FactoryRunLimits? Limits { get; set; }
+    /// <summary>The UI mode the agent was in when this message was sent. Defaults to the session's current mode.</summary>
+    [JsonPropertyName("agentMode")]
+    public SendAgentMode? AgentMode { get; set; }
 
-    /// <summary>Factory run identifier.</summary>
-    [JsonPropertyName("runId")]
-    public string RunId { get; set; } = string.Empty;
+    /// <summary>Optional attachments (files, directories, selections, blobs, GitHub references) to include with the message.</summary>
+    [JsonPropertyName("attachments")]
+    public IList<Attachment>? Attachments { get; set; }
+
+    /// <summary>If false, this message will not trigger a Premium Request Unit charge. User messages default to billable.</summary>
+    [JsonPropertyName("billable")]
+    public bool? Billable { get; set; }
+
+    /// <summary>If provided, this is shown in the timeline instead of `prompt`.</summary>
+    [JsonPropertyName("displayPrompt")]
+    public string? DisplayPrompt { get; set; }
+
+    /// <summary>How to deliver the message. `enqueue` (default) appends to the message queue. `immediate` interjects during an in-progress turn.</summary>
+    [JsonPropertyName("mode")]
+    public SendMode? Mode { get; set; }
+
+    /// <summary>If true, adds the message to the front of the queue instead of the end.</summary>
+    [JsonPropertyName("prepend")]
+    public bool? Prepend { get; set; }
+
+    /// <summary>The user message text.</summary>
+    [JsonPropertyName("prompt")]
+    public string Prompt { get; set; } = string.Empty;
+
+    /// <summary>Custom HTTP headers to include in outbound model requests for this turn. Merged with session-level provider headers; per-turn headers augment and overwrite session-level headers with the same key.</summary>
+    [JsonPropertyName("requestHeaders")]
+    public IDictionary<string, string>? RequestHeaders { get; set; }
+
+    /// <summary>If set, the request will fail if the named tool is not available when this message is among the user messages at the start of the current exchange.</summary>
+    [JsonPropertyName("requiredTool")]
+    public string? RequiredTool { get; set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Optional provenance tag copied to the resulting user.message event. Must be `user`, `system`, `command-&lt;command-id&gt;` for command-originated messages, `schedule-&lt;numeric-id&gt;` for scheduled prompts, or `agent-&lt;agent-id&gt;` for prompts sent by another agent.</summary>
+    [RegularExpression("^(user|system|command-.*|schedule-\\d+|agent-.+)$")]
+    [JsonInclude]
+    [JsonPropertyName("source")]
+    internal string? Source { get; set; }
+
+    /// <summary>W3C Trace Context traceparent header for distributed tracing of this agent turn.</summary>
+    [JsonPropertyName("traceparent")]
+    public string? Traceparent { get; set; }
+
+    /// <summary>W3C Trace Context tracestate header for distributed tracing.</summary>
+    [JsonPropertyName("tracestate")]
+    public string? Tracestate { get; set; }
+
+    /// <summary>If true, await completion of the agentic loop for this message before returning. Defaults to false (fire-and-forget). When true, the result still contains the same `messageId`; the caller can rely on the agent having processed the message before the call resolves. Transport-dependent tail semantics: on a LOCAL (in-process) session the wait additionally blocks until the completed turn's event tail has been dispatched to this session's in-process subscribers, so a subsequent read of subscriber state already reflects the turn; on a REMOTE session the wait resolves once the loop completes and mirrored delivery follows over the wire. Callers that need the stronger local guarantee on remote sessions should await the event stream explicitly.</summary>
+    [JsonPropertyName("wait")]
+    public bool? Wait { get; set; }
 }
 
-/// <summary>Parameters for retrieving a factory run.</summary>
+/// <summary>Result of sending zero or more user messages.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class FactoryGetRunRequest
+public sealed class SendMessagesResult
 {
-    /// <summary>Factory run identifier.</summary>
-    [JsonPropertyName("runId")]
-    public string RunId { get; set; } = string.Empty;
-
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Unique identifiers assigned to the messages, one per provided message in order. Empty when no messages were provided.</summary>
+    [JsonPropertyName("messageIds")]
+    public IList<string> MessageIds { get => field ??= []; set; }
 }
 
-/// <summary>Declared or approved factory resource ceilings.</summary>
+/// <summary>A single user message to append to the session as part of a `session.sendMessages` turn.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class FactoryDeclaredLimits
+public sealed class SendMessageItem
 {
-    /// <summary>Maximum AI credits consumed by subagents and descendants.</summary>
-    [JsonPropertyName("maxAiCredits")]
-    public double? MaxAiCredits { get; set; }
+    /// <summary>Optional attachments (files, directories, selections, blobs, GitHub references) to include with this message.</summary>
+    [JsonPropertyName("attachments")]
+    public IList<Attachment>? Attachments { get; set; }
 
-    /// <summary>Maximum concurrently active subagents.</summary>
-    [JsonPropertyName("maxConcurrentSubagents")]
-    public long? MaxConcurrentSubagents { get; set; }
+    /// <summary>If false, this message will not trigger a Premium Request Unit charge. User messages default to billable.</summary>
+    [JsonInclude]
+    [JsonPropertyName("billable")]
+    internal bool? Billable { get; set; }
 
-    /// <summary>Maximum total subagents spawned by the run.</summary>
-    [JsonPropertyName("maxTotalSubagents")]
-    public long? MaxTotalSubagents { get; set; }
+    /// <summary>If provided, this is shown in the timeline instead of `prompt`.</summary>
+    [JsonPropertyName("displayPrompt")]
+    public string? DisplayPrompt { get; set; }
 
-    /// <summary>Maximum accumulated active execution time in seconds.</summary>
-    [JsonPropertyName("timeoutSeconds")]
-    public double? TimeoutSeconds { get; set; }
+    /// <summary>The user message text.</summary>
+    [JsonPropertyName("prompt")]
+    public string Prompt { get; set; } = string.Empty;
+
+    /// <summary>If set, the request will fail if the named tool is not available when this message is among the user messages at the start of the current exchange.</summary>
+    [JsonPropertyName("requiredTool")]
+    public string? RequiredTool { get; set; }
+
+    /// <summary>Optional provenance tag copied to the resulting user.message event. Must be `user`, `system`, `command-&lt;command-id&gt;` for command-originated messages, `schedule-&lt;numeric-id&gt;` for scheduled prompts, or `agent-&lt;agent-id&gt;` for prompts sent by another agent.</summary>
+    [RegularExpression("^(user|system|command-.*|schedule-\\d+|agent-.+)$")]
+    [JsonInclude]
+    [JsonPropertyName("source")]
+    internal string? Source { get; set; }
 }
 
-/// <summary>Durable factory resource consumption.</summary>
+/// <summary>Parameters for sending zero or more user messages to the session in a single turn. Remote-backed (Mission Control) sessions do not support this method and will return an error.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class FactoryRunConsumed
+internal sealed class SendMessagesRequest
 {
-    /// <summary>Accumulated active execution time in milliseconds.</summary>
-    [JsonPropertyName("activeMs")]
-    public long ActiveMs { get; set; }
+    /// <summary>The UI mode the agent was in when these messages were sent. Defaults to the session's current mode.</summary>
+    [JsonPropertyName("agentMode")]
+    public SendAgentMode? AgentMode { get; set; }
 
-    /// <summary>AI usage consumed by the run in nano-AIU.</summary>
-    [JsonPropertyName("nanoAiu")]
-    public long NanoAiu { get; set; }
+    /// <summary>The user messages to append to the conversation, in order. May be empty, in which case a single turn runs over the existing history with no new user message.</summary>
+    [JsonPropertyName("messages")]
+    public IList<SendMessageItem> Messages { get => field ??= []; set; }
 
-    /// <summary>Total subagents spawned by the run.</summary>
-    [JsonPropertyName("subagents")]
-    public long Subagents { get; set; }
+    /// <summary>How to deliver the messages. `enqueue` (default) appends to the message queue. `immediate` interjects during an in-progress turn.</summary>
+    [JsonPropertyName("mode")]
+    public SendMode? Mode { get; set; }
+
+    /// <summary>If true, adds the messages to the front of the queue instead of the end.</summary>
+    [JsonPropertyName("prepend")]
+    public bool? Prepend { get; set; }
+
+    /// <summary>Custom HTTP headers to include in outbound model requests for this turn. Merged with session-level provider headers; per-turn headers augment and overwrite session-level headers with the same key.</summary>
+    [JsonPropertyName("requestHeaders")]
+    public IDictionary<string, string>? RequestHeaders { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>W3C Trace Context traceparent header for distributed tracing of this agent turn.</summary>
+    [JsonPropertyName("traceparent")]
+    public string? Traceparent { get; set; }
+
+    /// <summary>W3C Trace Context tracestate header for distributed tracing.</summary>
+    [JsonPropertyName("tracestate")]
+    public string? Tracestate { get; set; }
+
+    /// <summary>If true, await completion of the agentic loop for this turn before returning. Defaults to false (fire-and-forget). When true, the result still contains the same `messageIds`; the caller can rely on the agent having processed the messages before the call resolves. Transport-dependent tail semantics: on a LOCAL (in-process) session the wait additionally blocks until the completed turn's event tail has been dispatched to this session's in-process subscribers, so a subsequent read of subscriber state already reflects the turn; on a REMOTE session the wait resolves once the loop completes and mirrored delivery follows over the wire. Callers that need the stronger local guarantee on remote sessions should await the event stream explicitly.</summary>
+    [JsonPropertyName("wait")]
+    public bool? Wait { get; set; }
 }
 
-/// <summary>Current factory phase identity.</summary>
+/// <summary>Internal request for sending a system notification.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class FactoryCurrentPhase
+internal sealed class SendSystemNotificationRequest
 {
-    /// <summary>Current phase identifier.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
+    /// <summary>Optional structured notification kind.</summary>
+    [JsonPropertyName("kind")]
+    public JsonElement? Kind { get; set; }
 
-    /// <summary>Zero-based declared phase ordinal, or null for an undeclared phase.</summary>
-    [JsonPropertyName("ordinal")]
-    public long? Ordinal { get; set; }
+    /// <summary>Notification text to deliver to the model.</summary>
+    [JsonPropertyName("message")]
+    public string Message { get; set; } = string.Empty;
+
+    /// <summary>Internal delivery options, including passive policy.</summary>
+    [JsonPropertyName("options")]
+    public JsonElement? Options { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Prompt-safe terminal factory outcome.</summary>
+/// <summary>Result of aborting the current turn.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class FactoryRunTerminal
+public sealed class AbortResult
 {
-    /// <summary>Human-readable terminal error.</summary>
+    /// <summary>Error message if the abort failed.</summary>
     [JsonPropertyName("error")]
     public string? Error { get; set; }
 
-    /// <summary>Machine-readable terminal failure.</summary>
-    [JsonPropertyName("failure")]
-    public FactoryRunFailure? Failure { get; set; }
+    /// <summary>Whether the abort completed successfully.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
+}
 
-    /// <summary>Human-readable terminal reason.</summary>
+/// <summary>Parameters for aborting the current turn.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class AbortRequest
+{
+    /// <summary>Finite reason code describing why the current turn was aborted.</summary>
     [JsonPropertyName("reason")]
-    public string? Reason { get; set; }
+    public AbortReason? Reason { get; set; }
 
-    /// <summary>Prompt-safe preview of the completed result.</summary>
-    [JsonPropertyName("resultPreview")]
-    public string? ResultPreview { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Durable factory run summary with read-time live overlays.</summary>
+/// <summary>Result of interrupting the main agent turn.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class FactoryRunSummary
+public sealed class InterruptMainTurnResult
 {
-    /// <summary>Epoch milliseconds when the current active segment started, or null while inactive.</summary>
-    [JsonPropertyName("activeSegmentStartedAt")]
-    public long? ActiveSegmentStartedAt { get; set; }
-
-    /// <summary>Approved effective resource ceilings, or null until approved.</summary>
-    [JsonPropertyName("approved")]
-    public FactoryDeclaredLimits? Approved { get; set; }
-
-    /// <summary>Epoch milliseconds when the run completed, or null while nonterminal.</summary>
-    [JsonPropertyName("completedAt")]
-    public long? CompletedAt { get; set; }
+    /// <summary>Whether an in-flight main agent turn was interrupted. False when the main loop was not processing.</summary>
+    [JsonPropertyName("interrupted")]
+    public bool Interrupted { get; set; }
+}
 
-    /// <summary>Durable resource consumption.</summary>
-    [JsonPropertyName("consumed")]
-    public FactoryRunConsumed Consumed { get => field ??= new(); set; }
-
-    /// <summary>Epoch milliseconds when the run was created.</summary>
-    [JsonPropertyName("createdAt")]
-    public long CreatedAt { get; set; }
-
-    /// <summary>Current phase identity, or null before any phase is entered.</summary>
-    [JsonPropertyName("currentPhase")]
-    public FactoryCurrentPhase? CurrentPhase { get; set; }
+/// <summary>Parameters for interrupting the main agent turn.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class InterruptMainTurnRequest
+{
+    /// <summary>When true, the user's queued prompts are preserved and run as the next turn once the interrupted turn unwinds; when false (the default), the queue is cleared like a plain abort.</summary>
+    [JsonPropertyName("flushQueued")]
+    public bool? FlushQueued { get; set; }
 
-    /// <summary>Resource ceilings declared by the factory.</summary>
-    [JsonPropertyName("declaredLimits")]
-    public FactoryDeclaredLimits DeclaredLimits { get => field ??= new(); set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Number of phases declared by the factory.</summary>
-    [JsonPropertyName("declaredPhaseCount")]
-    public long DeclaredPhaseCount { get; set; }
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionCancelAllBackgroundAgentsRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Human-readable factory description.</summary>
-    [JsonPropertyName("description")]
-    public string Description { get; set; } = string.Empty;
+/// <summary>Parameters for shutting down the session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class ShutdownRequest
+{
+    /// <summary>Optional human-readable reason. Typically the message of the error that triggered shutdown when type is 'error'.</summary>
+    [JsonPropertyName("reason")]
+    public string? Reason { get; set; }
 
-    /// <summary>Registered factory name.</summary>
-    [JsonPropertyName("factoryName")]
-    public string FactoryName { get; set; } = string.Empty;
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 
-    /// <summary>Number of direct factory agents currently live.</summary>
-    [JsonPropertyName("liveAgentCount")]
-    public long LiveAgentCount { get; set; }
+    /// <summary>Why the session is being shut down. Defaults to "routine" when omitted.</summary>
+    [JsonPropertyName("type")]
+    public ShutdownType? Type { get; set; }
+}
 
-    /// <summary>Epoch milliseconds when this live-overlay snapshot was observed.</summary>
-    [JsonPropertyName("observedAt")]
-    public long ObservedAt { get; set; }
+/// <summary>Identifier of the session event that was emitted for the log message.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class LogResult
+{
+    /// <summary>The unique identifier of the emitted session event.</summary>
+    [JsonPropertyName("eventId")]
+    public Guid EventId { get; set; }
+}
 
-    /// <summary>Monotonic durable run revision.</summary>
-    [JsonPropertyName("revision")]
-    public long Revision { get; set; }
+/// <summary>Message text, optional severity level, persistence flag, optional follow-up URL, and optional tip.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class LogRequest
+{
+    /// <summary>When true, the message is transient and not persisted to the session event log on disk.</summary>
+    [JsonPropertyName("ephemeral")]
+    public bool? Ephemeral { get; set; }
 
-    /// <summary>Factory run identifier.</summary>
-    [JsonPropertyName("runId")]
-    public string RunId { get; set; } = string.Empty;
+    /// <summary>Log severity level. Determines how the message is displayed in the timeline. Defaults to "info".</summary>
+    [JsonPropertyName("level")]
+    public SessionLogLevel? Level { get; set; }
 
-    /// <summary>Epoch milliseconds when execution first started, or null before start.</summary>
-    [JsonPropertyName("startedAt")]
-    public long? StartedAt { get; set; }
+    /// <summary>Human-readable message.</summary>
+    [JsonPropertyName("message")]
+    public string Message { get; set; } = string.Empty;
 
-    /// <summary>Current factory run status.</summary>
-    [JsonPropertyName("status")]
-    public FactoryRunStatus Status { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 
-    /// <summary>Terminal run outcome, or null while nonterminal.</summary>
-    [JsonPropertyName("terminal")]
-    public FactoryRunTerminal? Terminal { get; set; }
+    /// <summary>Optional actionable tip displayed alongside the message. Only honored on `level: "info"`.</summary>
+    [JsonPropertyName("tip")]
+    public string? Tip { get; set; }
 
-    /// <summary>Total direct factory agents spawned across all attempts.</summary>
-    [JsonPropertyName("totalSpawnedAgentCount")]
-    public long TotalSpawnedAgentCount { get; set; }
+    /// <summary>Domain category for this log entry (e.g., "mcp", "subscription", "policy", "model"). Maps to `infoType`/`warningType`/`errorType` on the emitted event. Defaults to "notification".</summary>
+    [JsonPropertyName("type")]
+    public string? Type { get; set; }
 
-    /// <summary>Epoch milliseconds when the durable run was last updated.</summary>
-    [JsonPropertyName("updatedAt")]
-    public long UpdatedAt { get; set; }
+    /// <summary>Optional URL the user can open in their browser for more details.</summary>
+    [Url]
+    [StringSyntax(StringSyntaxAttribute.Uri)]
+    [JsonPropertyName("url")]
+    public string? Url { get; set; }
 }
 
-/// <summary>A page of factory runs in durable creation order.</summary>
+/// <summary>Authentication status and account metadata for the session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class FactoryListRunsResult
+public sealed class SessionAuthStatus
 {
-    /// <summary>Whether terminal runs newer than this page exist.</summary>
-    [JsonPropertyName("hasMoreNewer")]
-    public bool? HasMoreNewer { get; set; }
+    /// <summary>Authentication type.</summary>
+    [JsonPropertyName("authType")]
+    public AuthInfoType? AuthType { get; set; }
 
-    /// <summary>Newest terminal-run cursor in this page, or null when the terminal window is empty.</summary>
-    [JsonPropertyName("newestSeq")]
-    public long? NewestSeq { get; set; }
+    /// <summary>Copilot plan tier (e.g., individual_pro, business).</summary>
+    [JsonPropertyName("copilotPlan")]
+    public string? CopilotPlan { get; set; }
 
-    /// <summary>Oldest terminal-run cursor in this page, or null when the terminal window is empty.</summary>
-    [JsonPropertyName("oldestSeq")]
-    public long? OldestSeq { get; set; }
+    /// <summary>Authentication host URL.</summary>
+    [Url]
+    [StringSyntax(StringSyntaxAttribute.Uri)]
+    [JsonPropertyName("host")]
+    public string? Host { get; set; }
 
-    /// <summary>Number of terminal runs older than this page.</summary>
-    [JsonPropertyName("omittedOlder")]
-    public long? OmittedOlder { get; set; }
+    /// <summary>Whether the session has resolved authentication.</summary>
+    [JsonPropertyName("isAuthenticated")]
+    public bool IsAuthenticated { get; set; }
 
-    /// <summary>Factory run summaries in durable creation order.</summary>
-    [JsonPropertyName("runs")]
-    public IList<FactoryRunSummary> Runs { get => field ??= []; set; }
+    /// <summary>Authenticated login/username, if available.</summary>
+    [JsonPropertyName("login")]
+    public string? Login { get; set; }
+
+    /// <summary>Human-readable authentication status description.</summary>
+    [JsonPropertyName("statusMessage")]
+    public string? StatusMessage { get; set; }
 }
 
-/// <summary>Parameters for paging factory runs.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class FactoryListRunsRequest
+internal sealed class SessionGitHubAuthGetStatusRequest
 {
-    /// <summary>Exclusive forward cursor.</summary>
-    [JsonPropertyName("afterSeq")]
-    public long? AfterSeq { get; set; }
-
-    /// <summary>Exclusive backward cursor.</summary>
-    [JsonPropertyName("beforeSeq")]
-    public long? BeforeSeq { get; set; }
-
-    /// <summary>Maximum terminal runs to return. Defaults to 200 and is capped at 500.</summary>
-    [JsonPropertyName("limit")]
-    public int? Limit { get; set; }
-
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Prompt-safe durable identity and live status for a direct factory agent.</summary>
+/// <summary>Indicates whether the credential update succeeded.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class FactoryAgentSummary
+public sealed class SessionSetCredentialsResult
 {
-    /// <summary>Accumulated active agent time in milliseconds.</summary>
-    [JsonPropertyName("activeMs")]
-    public long ActiveMs { get; set; }
+    /// <summary>Whether the session ended up with a populated `copilotUser` for the installed credentials. `true` when the supplied credential already carried `copilotUser` or it was successfully re-resolved server-side. `false` when the credential is installed without `copilotUser` — either re-resolution failed, or the variant cannot be re-resolved from the credential alone (only the raw-token variants `token`, `env`, and `gh-cli` can). In both `false` cases the token swap still applied, but plan/quota/billing metadata is degraded. Present whenever a credential was supplied; omitted only when no credential was supplied (no-op call).</summary>
+    [JsonPropertyName("copilotUserResolved")]
+    public bool? CopilotUserResolved { get; set; }
 
-    /// <summary>Prompt-safe live activity text.</summary>
-    [JsonPropertyName("activity")]
-    public string? Activity { get; set; }
+    /// <summary>Whether the operation succeeded.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
+}
 
-    /// <summary>Stable direct-agent identifier.</summary>
-    [JsonPropertyName("agentId")]
-    public string AgentId { get; set; } = string.Empty;
+/// <summary>New auth credentials to install on the session. Omit to leave credentials unchanged.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionSetCredentialsParams
+{
+    /// <summary>The new auth credentials to install on the session. When omitted or `undefined`, the call is a no-op and the session's existing credentials are preserved. The runtime installs the supplied value immediately for outbound model/API requests. When the credential carries a raw token (`token`, `env`, or `gh-cli`) but no `copilotUser`, the runtime additionally re-resolves `copilotUser` server-side (best-effort, asynchronously, after the synchronous install) so plan/quota/billing metadata regains fidelity; on resolution failure the verbatim credential remains installed. It does NOT otherwise validate the credential. Several variants carry secret material; treat this method's params as containing secrets at rest and in transit.</summary>
+    [JsonPropertyName("credentials")]
+    public AuthInfo? Credentials { get; set; }
 
-    /// <summary>Registered agent type.</summary>
-    [JsonPropertyName("agentType")]
-    public string AgentType { get; set; } = string.Empty;
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Epoch milliseconds when the agent completed.</summary>
-    [JsonPropertyName("completedAt")]
-    public long? CompletedAt { get; set; }
+/// <summary>Credential-free authentication identity safe to expose to hosts and user interfaces.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class AuthIdentity
+{
+    /// <summary>Snapshot of the authenticated user's Copilot subscription info, if known.</summary>
+    [JsonPropertyName("copilotUser")]
+    public CopilotUserResponse? CopilotUser { get; set; }
 
-    /// <summary>Friendly, non-unique name intended for display.</summary>
-    [JsonPropertyName("displayName")]
-    public string? DisplayName { get; set; }
+    /// <summary>Name of the environment variable that supplied the credential, when applicable.</summary>
+    [JsonPropertyName("envVar")]
+    public string? EnvVar { get; set; }
 
-    /// <summary>Friendly, non-unique name intended for display.</summary>
-    [JsonPropertyName("label")]
-    public string Label { get; set; } = string.Empty;
+    /// <summary>Authentication host.</summary>
+    [JsonPropertyName("host")]
+    public string Host { get; set; } = string.Empty;
 
-    /// <summary>Phase identifier active when the agent was launched, or null.</summary>
-    [JsonPropertyName("phaseId")]
-    public string? PhaseId { get; set; }
+    /// <summary>Authenticated login, when available.</summary>
+    [JsonPropertyName("login")]
+    public string? Login { get; set; }
 
-    /// <summary>Model requested when the agent was launched.</summary>
-    [JsonPropertyName("requestedModel")]
-    public string? RequestedModel { get; set; }
+    /// <summary>Authentication type.</summary>
+    [JsonPropertyName("type")]
+    public AuthInfoType Type { get; set; }
+}
 
-    /// <summary>Concrete model resolved for the agent.</summary>
-    [JsonPropertyName("resolvedModel")]
-    public string? ResolvedModel { get; set; }
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionGitHubAuthGetCurrentAuthInfoRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Owning factory run identifier.</summary>
-    [JsonPropertyName("runId")]
-    public string RunId { get; set; } = string.Empty;
-
-    /// <summary>Epoch milliseconds when the agent started.</summary>
-    [JsonPropertyName("startedAt")]
-    public long? StartedAt { get; set; }
-
-    /// <summary>Current durable or live agent status.</summary>
-    [JsonPropertyName("status")]
-    public string Status { get; set; } = string.Empty;
-
-    /// <summary>Tool-call identifier that launched the agent.</summary>
-    [JsonPropertyName("toolCallId")]
-    public string ToolCallId { get; set; } = string.Empty;
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionGitHubAuthGetAllAuthAvailableRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Durable lifecycle and timing for one factory phase.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class FactoryPhaseObservation
+internal sealed class SessionGitHubAuthRefreshCopilotUserRequest
 {
-    /// <summary>Completed active time accumulated by this phase in milliseconds.</summary>
-    [JsonPropertyName("accumulatedActiveMs")]
-    public long AccumulatedActiveMs { get; set; }
-
-    /// <summary>Epoch milliseconds when this phase completed; for a skipped phase, the synthetic skip timestamp (equal to `startedAt`).</summary>
-    [JsonPropertyName("completedAt")]
-    public long? CompletedAt { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Current live active time for this phase in milliseconds.</summary>
-    [JsonPropertyName("currentActiveMs")]
-    public long CurrentActiveMs { get; set; }
+/// <summary>Internal GitHub login parameters.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionAuthLoginRequest
+{
+    /// <summary>GitHub host URL.</summary>
+    [JsonPropertyName("host")]
+    public string Host { get; set; } = string.Empty;
 
-    /// <summary>Optional human-readable phase detail.</summary>
-    [JsonPropertyName("detail")]
-    public string? Detail { get; set; }
+    /// <summary>GitHub login.</summary>
+    [JsonPropertyName("login")]
+    public string Login { get; set; } = string.Empty;
 
-    /// <summary>Number of times execution entered this phase.</summary>
-    [JsonPropertyName("entryCount")]
-    public long EntryCount { get; set; }
+    /// <summary>Whether to persist the token after login.</summary>
+    [JsonPropertyName("persist")]
+    public bool? Persist { get; set; }
 
-    /// <summary>Phase identifier.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 
-    /// <summary>Most recent run attempt that entered this phase, or `0` if the phase has never been entered.</summary>
-    [JsonPropertyName("lastEnteredRunAttempt")]
-    public long LastEnteredRunAttempt { get; set; }
+    /// <summary>GitHub authentication token.</summary>
+    [JsonPropertyName("token")]
+    public string Token { get; set; } = string.Empty;
+}
 
-    /// <summary>Direct agents in this phase that are currently live.</summary>
-    [JsonPropertyName("liveAgentCount")]
-    public long LiveAgentCount { get; set; }
+/// <summary>Parameters for switching the session's active authentication.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionAuthSwitchRequest
+{
+    /// <summary>Authentication information to activate.</summary>
+    [JsonPropertyName("authInfo")]
+    public AuthInfo AuthInfo { get => field ??= new(); set; }
 
-    /// <summary>Zero-based declared phase ordinal, or null for an undeclared phase.</summary>
-    [JsonPropertyName("ordinal")]
-    public long? Ordinal { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 
-    /// <summary>Epoch milliseconds when this phase first started; for a skipped phase, the synthetic skip timestamp (equal to `completedAt`).</summary>
-    [JsonPropertyName("startedAt")]
-    public long? StartedAt { get; set; }
+    /// <summary>Optional token paired with the authentication information.</summary>
+    [JsonPropertyName("token")]
+    public string? Token { get; set; }
+}
 
-    /// <summary>Derived lifecycle state of the phase.</summary>
-    [JsonPropertyName("status")]
-    public FactoryPhaseStatus Status { get; set; }
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionGitHubAuthLogoutRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Human-readable phase title.</summary>
-    [JsonPropertyName("title")]
-    public string Title { get; set; } = string.Empty;
+/// <summary>Parameters identifying a GitHub authentication to log out.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionAuthLogoutUserRequest
+{
+    /// <summary>Authentication information to log out.</summary>
+    [JsonPropertyName("authInfo")]
+    public AuthInfo AuthInfo { get => field ??= new(); set; }
 
-    /// <summary>Total direct agents associated with this phase.</summary>
-    [JsonPropertyName("totalAgentCount")]
-    public long TotalAgentCount { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>One durable factory progress record.</summary>
+/// <summary>Validation error from an authentication attempt.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class FactoryProgressLine
+public sealed class AuthValidationError
 {
-    /// <summary>Resume attempt that emitted this record.</summary>
-    [JsonPropertyName("attempt")]
-    public long Attempt { get; set; }
+    /// <summary>Optional message returned by GitHub.</summary>
+    [JsonPropertyName("githubMessage")]
+    public string? GitHubMessage { get; set; }
 
-    /// <summary>Progress record kind.</summary>
-    [JsonPropertyName("kind")]
-    public FactoryLogLineKind Kind { get; set; }
+    /// <summary>Authentication validation error message.</summary>
+    [JsonPropertyName("message")]
+    public string Message { get; set; } = string.Empty;
+}
 
-    /// <summary>Phase active when the record was emitted, or null before any phase.</summary>
-    [JsonPropertyName("phaseId")]
-    public string? PhaseId { get; set; }
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionGitHubAuthLastAuthErrorsRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Epoch milliseconds when the record was persisted.</summary>
-    [JsonPropertyName("recordedAt")]
-    public long RecordedAt { get; set; }
+/// <summary>A file included in the redacted debug bundle.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class DebugCollectLogsCollectedEntry
+{
+    /// <summary>Relative path of the file in the staged bundle/archive.</summary>
+    [JsonPropertyName("bundlePath")]
+    public string BundlePath { get; set; } = string.Empty;
 
-    /// <summary>Global monotonic sequence number within the run.</summary>
-    [JsonPropertyName("seq")]
-    public long Seq { get; set; }
+    /// <summary>Redacted output size in bytes.</summary>
+    [JsonPropertyName("sizeBytes")]
+    public long SizeBytes { get; set; }
 
-    /// <summary>Prompt-safe progress text.</summary>
-    [JsonPropertyName("text")]
-    public string Text { get; set; } = string.Empty;
+    /// <summary>Source category for this entry.</summary>
+    [JsonPropertyName("source")]
+    public DebugCollectLogsSource Source { get; set; }
 }
 
-/// <summary>A bidirectional page of factory progress.</summary>
+/// <summary>An optional debug bundle entry that could not be included.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class FactoryProgressPage
+public sealed class DebugCollectLogsSkippedEntry
 {
-    /// <summary>Whether progress records newer than this page exist.</summary>
-    [JsonPropertyName("hasMoreNewer")]
-    public bool HasMoreNewer { get; set; }
+    /// <summary>Relative path requested for this bundle entry.</summary>
+    [JsonPropertyName("bundlePath")]
+    public string BundlePath { get; set; } = string.Empty;
 
-    /// <summary>Whether progress records older than this page exist.</summary>
-    [JsonPropertyName("hasMoreOlder")]
-    public bool HasMoreOlder { get; set; }
+    /// <summary>Server-local source path that could not be read.</summary>
+    [JsonPropertyName("path")]
+    public string? Path { get; set; }
 
-    /// <summary>Newest sequence number in this page, or null when empty.</summary>
-    [JsonPropertyName("newestSeq")]
-    public long? NewestSeq { get; set; }
+    /// <summary>Reason the entry was skipped.</summary>
+    [JsonPropertyName("reason")]
+    public string Reason { get; set; } = string.Empty;
+}
 
-    /// <summary>Oldest sequence number in this page, or null when empty.</summary>
-    [JsonPropertyName("oldestSeq")]
-    public long? OldestSeq { get; set; }
+/// <summary>Result of collecting a redacted debug bundle.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class DebugCollectLogsResult
+{
+    /// <summary>Files included in the redacted bundle.</summary>
+    [JsonPropertyName("entries")]
+    public IList<DebugCollectLogsCollectedEntry> Entries { get => field ??= []; set; }
 
-    /// <summary>Progress records in sequence order.</summary>
-    [JsonPropertyName("records")]
-    public IList<FactoryProgressLine> Records { get => field ??= []; set; }
+    /// <summary>Destination kind that was written.</summary>
+    [JsonPropertyName("kind")]
+    public DebugCollectLogsResultKind Kind { get; set; }
 
-    /// <summary>Run revision reflected by this page.</summary>
-    [JsonPropertyName("revision")]
-    public long Revision { get; set; }
+    /// <summary>Actual archive path or staging directory path written. This may differ from the requested path when no-overwrite suffixing or fallback-to-temp-directory was needed.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
+
+    /// <summary>Optional files or directories that could not be included.</summary>
+    [JsonPropertyName("skippedEntries")]
+    public IList<DebugCollectLogsSkippedEntry>? SkippedEntries { get; set; }
 }
 
-/// <summary>Full factory run observability detail.</summary>
+/// <summary>A caller-provided server-local file or directory to include in the debug bundle.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class FactoryRunDetail
+public sealed class DebugCollectLogsEntry
 {
-    /// <summary>Epoch milliseconds when the current active segment started, or null while inactive.</summary>
-    [JsonPropertyName("activeSegmentStartedAt")]
-    public long? ActiveSegmentStartedAt { get; set; }
+    /// <summary>Relative path to use inside the staged bundle/archive.</summary>
+    [JsonPropertyName("bundlePath")]
+    public string BundlePath { get; set; } = string.Empty;
 
-    /// <summary>Durable identities and live statuses for direct factory agents.</summary>
-    [JsonPropertyName("agents")]
-    public IList<FactoryAgentSummary> Agents { get => field ??= []; set; }
+    /// <summary>Kind of source path to include.</summary>
+    [JsonPropertyName("kind")]
+    public DebugCollectLogsEntryKind Kind { get; set; }
 
-    /// <summary>Approved effective resource ceilings, or null until approved.</summary>
-    [JsonPropertyName("approved")]
-    public FactoryDeclaredLimits? Approved { get; set; }
+    /// <summary>Server-local source path to read.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
 
-    /// <summary>Epoch milliseconds when the run completed, or null while nonterminal.</summary>
-    [JsonPropertyName("completedAt")]
-    public long? CompletedAt { get; set; }
+    /// <summary>How text content from this entry should be redacted. Defaults to plain-text.</summary>
+    [JsonPropertyName("redaction")]
+    public DebugCollectLogsRedaction? Redaction { get; set; }
 
-    /// <summary>Durable resource consumption.</summary>
-    [JsonPropertyName("consumed")]
-    public FactoryRunConsumed Consumed { get => field ??= new(); set; }
+    /// <summary>When true, collection fails if this entry cannot be read. Defaults to false, which records the entry in `skippedEntries`.</summary>
+    [JsonPropertyName("required")]
+    public bool? Required { get; set; }
+}
 
-    /// <summary>Epoch milliseconds when the run was created.</summary>
-    [JsonPropertyName("createdAt")]
-    public long CreatedAt { get; set; }
-
-    /// <summary>Current phase identity, or null before any phase is entered.</summary>
-    [JsonPropertyName("currentPhase")]
-    public FactoryCurrentPhase? CurrentPhase { get; set; }
-
-    /// <summary>Resource ceilings declared by the factory.</summary>
-    [JsonPropertyName("declaredLimits")]
-    public FactoryDeclaredLimits DeclaredLimits { get => field ??= new(); set; }
-
-    /// <summary>Number of phases declared by the factory.</summary>
-    [JsonPropertyName("declaredPhaseCount")]
-    public long DeclaredPhaseCount { get; set; }
+/// <summary>Destination for the redacted debug bundle.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "kind",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(DebugCollectLogsDestinationArchive), "archive")]
+[JsonDerivedType(typeof(DebugCollectLogsDestinationDirectory), "directory")]
+public partial class DebugCollectLogsDestination
+{
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("kind")]
+    public virtual string Kind { get; set; } = string.Empty;
+}
 
-    /// <summary>Human-readable factory description.</summary>
-    [JsonPropertyName("description")]
-    public string Description { get; set; } = string.Empty;
 
-    /// <summary>Registered factory name.</summary>
-    [JsonPropertyName("factoryName")]
-    public string FactoryName { get; set; } = string.Empty;
+/// <summary>The <c>archive</c> variant of <see cref="DebugCollectLogsDestination"/>.</summary>
+[Experimental(Diagnostics.Experimental)]
+public partial class DebugCollectLogsDestinationArchive : DebugCollectLogsDestination
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "archive";
 
-    /// <summary>Number of direct factory agents currently live.</summary>
-    [JsonPropertyName("liveAgentCount")]
-    public long LiveAgentCount { get; set; }
+    /// <summary>When true, create the archive atomically without overwriting an existing file by appending ` (N)` before the extension as needed. Defaults to false.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("noOverwrite")]
+    public bool? NoOverwrite { get; set; }
 
-    /// <summary>Epoch milliseconds when this live-overlay snapshot was observed.</summary>
-    [JsonPropertyName("observedAt")]
-    public long ObservedAt { get; set; }
+    /// <summary>Absolute or server-relative path for the .tgz archive to create.</summary>
+    [JsonPropertyName("outputPath")]
+    public required string OutputPath { get; set; }
+}
 
-    /// <summary>Lifecycle and timing observations for each factory phase.</summary>
-    [JsonPropertyName("phases")]
-    public IList<FactoryPhaseObservation> Phases { get => field ??= []; set; }
+/// <summary>The <c>directory</c> variant of <see cref="DebugCollectLogsDestination"/>.</summary>
+[Experimental(Diagnostics.Experimental)]
+public partial class DebugCollectLogsDestinationDirectory : DebugCollectLogsDestination
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "directory";
 
-    /// <summary>Bidirectional page of durable factory progress.</summary>
-    [JsonPropertyName("progress")]
-    public FactoryProgressPage Progress { get => field ??= new(); set; }
+    /// <summary>Directory where redacted files should be staged. The directory is created if needed.</summary>
+    [JsonPropertyName("outputDirectory")]
+    public required string OutputDirectory { get; set; }
+}
 
-    /// <summary>Monotonic durable run revision.</summary>
-    [JsonPropertyName("revision")]
-    public long Revision { get; set; }
+/// <summary>Built-in session diagnostics to include in the bundle. Omitted fields default to true.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class DebugCollectLogsInclude
+{
+    /// <summary>Server-local path to the current process log. When set, it is included as `process.log` and its directory is searched for prior logs from the same session.</summary>
+    [JsonPropertyName("currentProcessLogPath")]
+    public string? CurrentProcessLogPath { get; set; }
 
-    /// <summary>Factory run identifier.</summary>
-    [JsonPropertyName("runId")]
-    public string RunId { get; set; } = string.Empty;
+    /// <summary>Include the session event log (`events.jsonl`). Defaults to true.</summary>
+    [JsonPropertyName("events")]
+    public bool? Events { get; set; }
 
-    /// <summary>Epoch milliseconds when execution first started, or null before start.</summary>
-    [JsonPropertyName("startedAt")]
-    public long? StartedAt { get; set; }
+    /// <summary>Server-local path to the session's events.jsonl file. Internal callers normally omit this and let the runtime derive it from the session.</summary>
+    [JsonPropertyName("eventsPath")]
+    public string? EventsPath { get; set; }
 
-    /// <summary>Current factory run status.</summary>
-    [JsonPropertyName("status")]
-    public FactoryRunStatus Status { get; set; }
+    /// <summary>Maximum number of previous process logs to include. Defaults to 5.</summary>
+    [JsonPropertyName("previousProcessLogLimit")]
+    public long? PreviousProcessLogLimit { get; set; }
 
-    /// <summary>Terminal run outcome, or null while nonterminal.</summary>
-    [JsonPropertyName("terminal")]
-    public FactoryRunTerminal? Terminal { get; set; }
+    /// <summary>Server-local process log directory to search when `currentProcessLogPath` is unavailable, useful for collecting logs for inactive sessions.</summary>
+    [JsonPropertyName("processLogDirectory")]
+    public string? ProcessLogDirectory { get; set; }
 
-    /// <summary>Total direct factory agents spawned across all attempts.</summary>
-    [JsonPropertyName("totalSpawnedAgentCount")]
-    public long TotalSpawnedAgentCount { get; set; }
+    /// <summary>Include process logs for the session. Defaults to true.</summary>
+    [JsonPropertyName("processLogs")]
+    public bool? ProcessLogs { get; set; }
 
-    /// <summary>Epoch milliseconds when the durable run was last updated.</summary>
-    [JsonPropertyName("updatedAt")]
-    public long UpdatedAt { get; set; }
+    /// <summary>Include interactive shell logs written under the session's `shell-logs` directory. Defaults to true.</summary>
+    [JsonPropertyName("shellLogs")]
+    public bool? ShellLogs { get; set; }
 }
 
-/// <summary>Parameters for paging factory progress.</summary>
+/// <summary>Options for collecting a redacted session debug bundle.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class FactoryGetRunProgressRequest
+internal sealed class DebugCollectLogsRequest
 {
-    /// <summary>Exclusive forward cursor.</summary>
-    [JsonPropertyName("afterSeq")]
-    public long? AfterSeq { get; set; }
-
-    /// <summary>Exclusive backward cursor.</summary>
-    [JsonPropertyName("beforeSeq")]
-    public long? BeforeSeq { get; set; }
-
-    /// <summary>Maximum records to return. Defaults to 200 and is capped at 500.</summary>
-    [JsonPropertyName("limit")]
-    public int? Limit { get; set; }
+    /// <summary>Caller-provided server-local files or directories to include in addition to the runtime's built-in session diagnostics. This lets host applications add their own diagnostics without changing the API shape.</summary>
+    [JsonPropertyName("additionalEntries")]
+    public IList<DebugCollectLogsEntry>? AdditionalEntries { get; set; }
 
-    /// <summary>Optional phase identifier used to scope records and cursors.</summary>
-    [JsonPropertyName("phaseId")]
-    public string? PhaseId { get; set; }
+    /// <summary>Where the redacted bundle should be written. Use `archive` to produce a .tgz, or `directory` to stage redacted files for caller-managed upload/post-processing.</summary>
+    [JsonPropertyName("destination")]
+    public DebugCollectLogsDestination Destination { get => field ??= new(); set; }
 
-    /// <summary>Factory run identifier.</summary>
-    [JsonPropertyName("runId")]
-    public string RunId { get; set; } = string.Empty;
+    /// <summary>Which built-in session diagnostics to include. Omitted fields default to true.</summary>
+    [JsonPropertyName("include")]
+    public DebugCollectLogsInclude? Include { get; set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Parameters for cancelling a factory run.</summary>
+/// <summary>Canvas action that the agent or host can invoke. To discover the input schema for a particular action, call the list_canvas_capabilities tool.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class FactoryCancelRequest
+public sealed class CanvasAction
 {
-    /// <summary>Factory run identifier.</summary>
-    [JsonPropertyName("runId")]
-    public string RunId { get; set; } = string.Empty;
+    /// <summary>Description of the action.</summary>
+    [JsonPropertyName("description")]
+    public string? Description { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>JSON Schema for the action input.</summary>
+    [JsonPropertyName("inputSchema")]
+    public JsonElement? InputSchema { get; set; }
 
-/// <summary>Acknowledgement that a factory request was accepted.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class FactoryAckResult
-{
+    /// <summary>Action name exposed by the canvas provider.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 }
 
-/// <summary>One ordered factory progress line.</summary>
+/// <summary>Canvas available in the current session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class FactoryLogLine
+public sealed class DiscoveredCanvas
 {
-    /// <summary>Progress line kind.</summary>
-    [JsonPropertyName("kind")]
-    public FactoryLogLineKind Kind { get; set; }
+    /// <summary>Actions the agent or host may invoke on an open instance.</summary>
+    [JsonPropertyName("actions")]
+    public IList<CanvasAction>? Actions { get; set; }
 
-    /// <summary>Monotonic sequence number within the factory run.</summary>
-    [JsonPropertyName("seq")]
-    public long Seq { get; set; }
+    /// <summary>Provider-local canvas identifier.</summary>
+    [JsonPropertyName("canvasId")]
+    public string CanvasId { get; set; } = string.Empty;
 
-    /// <summary>Progress text.</summary>
-    [JsonPropertyName("text")]
-    public string Text { get; set; } = string.Empty;
-}
+    /// <summary>Short, single-sentence description shown to the agent in canvas catalogs.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("description")]
+    public string Description { get; set; } = string.Empty;
 
-/// <summary>Parameters for recording factory progress.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class FactoryLogRequest
-{
-    /// <summary>Opaque token identifying the current factory execution attempt.</summary>
-    [JsonPropertyName("executionToken")]
-    public string ExecutionToken { get; set; } = string.Empty;
+    /// <summary>Human-readable canvas name.</summary>
+    [JsonPropertyName("displayName")]
+    public string DisplayName { get; set; } = string.Empty;
 
-    /// <summary>Ordered progress lines to append.</summary>
-    [JsonPropertyName("lines")]
-    public IList<FactoryLogLine> Lines { get => field ??= []; set; }
+    /// <summary>Owning provider identifier.</summary>
+    [JsonPropertyName("extensionId")]
+    public string ExtensionId { get; set; } = string.Empty;
 
-    /// <summary>Factory run identifier.</summary>
-    [JsonPropertyName("runId")]
-    public string RunId { get; set; } = string.Empty;
+    /// <summary>Owning extension display name, when available.</summary>
+    [JsonPropertyName("extensionName")]
+    public string? ExtensionName { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Host-local PNG path for the canvas icon, when supplied.</summary>
+    [JsonPropertyName("icon")]
+    public string? Icon { get; set; }
+
+    /// <summary>JSON Schema for canvas open input.</summary>
+    [JsonPropertyName("inputSchema")]
+    public JsonElement? InputSchema { get; set; }
 }
 
-/// <summary>Result of one factory-scoped subagent call.</summary>
+/// <summary>Declared canvases available in this session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class FactoryAgentResult
+public sealed class CanvasList
 {
-    /// <summary>Agent result, omitted when the agent produced no result.</summary>
-    [JsonPropertyName("result")]
-    public JsonElement? Result { get; set; }
+    /// <summary>Declared canvases available in this session.</summary>
+    [JsonPropertyName("canvases")]
+    public IList<DiscoveredCanvas> Canvases { get => field ??= []; set; }
 }
 
-/// <summary>Options for one factory-scoped subagent call.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class FactoryAgentOptions
+internal sealed class SessionCanvasListRequest
 {
-    /// <summary>Optional custom agent name for the subagent. This field is accepted but not yet honored.</summary>
-    [JsonPropertyName("agent")]
-    public string? Agent { get; set; }
-
-    /// <summary>Optional context tier for the subagent. This field is accepted but not yet honored.</summary>
-    [JsonPropertyName("contextTier")]
-    public ContextTier? ContextTier { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Optional label distinguishing otherwise identical memoized agent calls.</summary>
-    [JsonPropertyName("label")]
-    public string? Label { get; set; }
+/// <summary>Open canvas instance snapshot.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class OpenCanvasInstance
+{
+    /// <summary>Provider-local canvas identifier.</summary>
+    [JsonPropertyName("canvasId")]
+    public string CanvasId { get; set; } = string.Empty;
 
-    /// <summary>Optional model identifier for the subagent.</summary>
-    [JsonPropertyName("model")]
-    public string? Model { get; set; }
+    /// <summary>Owning provider identifier.</summary>
+    [JsonPropertyName("extensionId")]
+    public string ExtensionId { get; set; } = string.Empty;
 
-    /// <summary>Optional reasoning effort for the subagent. This field is accepted but not yet honored.</summary>
-    [JsonPropertyName("reasoningEffort")]
-    public string? ReasoningEffort { get; set; }
+    /// <summary>Owning extension display name, when available.</summary>
+    [JsonPropertyName("extensionName")]
+    public string? ExtensionName { get; set; }
 
-    /// <summary>Optional JSON Schema for structured agent output.</summary>
-    [JsonPropertyName("schema")]
-    public JsonElement? Schema { get; set; }
-}
+    /// <summary>Host-local PNG path for the canvas icon, when supplied.</summary>
+    [JsonPropertyName("icon")]
+    public string? Icon { get; set; }
 
-/// <summary>Parameters for one factory-scoped subagent call.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class FactoryAgentRequest
-{
-    /// <summary>Opaque token identifying the current factory execution attempt.</summary>
-    [JsonPropertyName("executionToken")]
-    public string ExecutionToken { get; set; } = string.Empty;
+    /// <summary>Input supplied when the instance was opened.</summary>
+    [JsonPropertyName("input")]
+    public JsonElement? Input { get; set; }
 
-    /// <summary>Factory run identifier that owns the subagent.</summary>
-    [JsonPropertyName("factoryRunId")]
-    public string FactoryRunId { get; set; } = string.Empty;
+    /// <summary>Stable caller-supplied canvas instance identifier.</summary>
+    [JsonPropertyName("instanceId")]
+    public string InstanceId { get; set; } = string.Empty;
 
-    /// <summary>Subagent execution options.</summary>
-    [JsonPropertyName("opts")]
-    public FactoryAgentOptions Opts { get => field ??= new(); set; }
+    /// <summary>Provider-supplied status text.</summary>
+    [JsonPropertyName("status")]
+    public string? Status { get; set; }
 
-    /// <summary>Prompt to send to the subagent.</summary>
-    [JsonPropertyName("prompt")]
-    public string Prompt { get; set; } = string.Empty;
+    /// <summary>Rendered title.</summary>
+    [JsonPropertyName("title")]
+    public string? Title { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>URL for web-rendered canvases.</summary>
+    [JsonPropertyName("url")]
+    public string? Url { get; set; }
 }
 
-/// <summary>Result of reading a factory journal entry.</summary>
+/// <summary>Live open-canvas snapshot.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class FactoryJournalGetResult
+public sealed class CanvasListOpenResult
 {
-    /// <summary>Whether the journal contained the requested key.</summary>
-    [JsonPropertyName("hit")]
-    public bool Hit { get; set; }
-
-    /// <summary>Cached JSON result. The hit field distinguishes a cached JSON null from a miss.</summary>
-    [JsonPropertyName("resultJson")]
-    public JsonElement? ResultJson { get; set; }
+    /// <summary>Currently open canvas instances.</summary>
+    [JsonPropertyName("openCanvases")]
+    public IList<OpenCanvasInstance> OpenCanvases { get => field ??= []; set; }
 }
 
-/// <summary>Parameters for reading a factory journal entry.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class FactoryJournalGetRequest
+internal sealed class SessionCanvasListOpenRequest
 {
-    /// <summary>Opaque token identifying the current factory execution attempt.</summary>
-    [JsonPropertyName("executionToken")]
-    public string ExecutionToken { get; set; } = string.Empty;
-
-    /// <summary>Namespaced journal key.</summary>
-    [JsonPropertyName("key")]
-    public string Key { get; set; } = string.Empty;
-
-    /// <summary>Factory run identifier.</summary>
-    [JsonPropertyName("runId")]
-    public string RunId { get; set; } = string.Empty;
-
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Parameters for storing a factory journal entry.</summary>
+/// <summary>Canvas open parameters.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class FactoryJournalPutRequest
+internal sealed class CanvasOpenRequest
 {
-    /// <summary>Opaque token identifying the current factory execution attempt.</summary>
-    [JsonPropertyName("executionToken")]
-    public string ExecutionToken { get; set; } = string.Empty;
+    /// <summary>Provider-local canvas identifier.</summary>
+    [JsonPropertyName("canvasId")]
+    public string CanvasId { get; set; } = string.Empty;
 
-    /// <summary>Namespaced journal key.</summary>
-    [JsonPropertyName("key")]
-    public string Key { get; set; } = string.Empty;
+    /// <summary>Owning provider identifier. Optional when the canvasId is unique across providers; required to disambiguate when multiple providers register the same canvasId.</summary>
+    [JsonPropertyName("extensionId")]
+    public string? ExtensionId { get; set; }
 
-    /// <summary>JSON result to memoize.</summary>
-    [JsonPropertyName("resultJson")]
-    public JsonElement ResultJson { get; set; }
+    /// <summary>Canvas open input.</summary>
+    [JsonPropertyName("input")]
+    public JsonElement? Input { get; set; }
 
-    /// <summary>Factory run identifier.</summary>
-    [JsonPropertyName("runId")]
-    public string RunId { get; set; } = string.Empty;
+    /// <summary>Caller-supplied stable instance identifier.</summary>
+    [JsonPropertyName("instanceId")]
+    public string InstanceId { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>The currently selected model, reasoning effort, and context tier for the session. The context tier reflects `Session.getContextTier()`, restored from the session journal on resume.</summary>
+/// <summary>Canvas close parameters.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class CurrentModel
+internal sealed class CanvasCloseRequest
 {
-    /// <summary>Context tier for models that support multiple context-window sizes.</summary>
-    [JsonPropertyName("contextTier")]
-    public ContextTier? ContextTier { get; set; }
-
-    /// <summary>Currently active model identifier.</summary>
-    [JsonPropertyName("modelId")]
-    public string? ModelId { get; set; }
-
-    /// <summary>Reasoning effort level currently applied to the active model, when one is set. Reads `Session.getReasoningEffort()` synchronously after `getSelectedModel()` resolves so the two values are reported as a snapshot.</summary>
-    [JsonPropertyName("reasoningEffort")]
-    public string? ReasoningEffort { get; set; }
-}
+    /// <summary>Open canvas instance identifier.</summary>
+    [JsonPropertyName("instanceId")]
+    public string InstanceId { get; set; } = string.Empty;
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionModelGetCurrentRequest
-{
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>RPC data type for ModelSwitchConfirmation operations.</summary>
+/// <summary>Canvas action invocation result.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ModelSwitchConfirmation
+public sealed class CanvasActionInvokeResult
 {
-    /// <summary>Current conversation token count before switching models.</summary>
-    [JsonPropertyName("currentTokens")]
-    public double CurrentTokens { get; set; }
-
-    /// <summary>Target model token limit used by the compaction preflight.</summary>
-    [JsonPropertyName("targetLimit")]
-    public double TargetLimit { get; set; }
-
-    /// <summary>Display name of the model that requires compaction confirmation.</summary>
-    [JsonPropertyName("targetModelDisplayName")]
-    public string TargetModelDisplayName { get; set; } = string.Empty;
+    /// <summary>Provider-supplied action result.</summary>
+    [JsonPropertyName("result")]
+    public JsonElement? Result { get; set; }
 }
 
-/// <summary>The model identifier active on the session after the switch.</summary>
+/// <summary>Canvas action invocation parameters.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ModelSwitchToResult
+internal sealed class CanvasActionInvokeRequest
 {
-    /// <summary>Compaction confirmation projection when status is confirmation_required.</summary>
-    [JsonPropertyName("confirmation")]
-    public ModelSwitchConfirmation? Confirmation { get; set; }
-
-    /// <summary>True when the switch was deferred (enqueued as a cancellable `/model` command) because a turn was active or another model change was already queued, rather than applied immediately. When true, the session's live model is unchanged until the queued change drains.</summary>
-    [JsonPropertyName("deferred")]
-    public bool? Deferred { get; set; }
-
-    /// <summary>Deprecation warnings associated with the selected model or options.</summary>
-    [JsonPropertyName("deprecationWarnings")]
-    public IList<string>? DeprecationWarnings { get; set; }
-
-    /// <summary>User-facing outcome message for the model switch.</summary>
-    [JsonPropertyName("message")]
-    public string? Message { get; set; }
-
-    /// <summary>Currently active model identifier after the switch.</summary>
-    [JsonPropertyName("modelId")]
-    public string? ModelId { get; set; }
+    /// <summary>Action name to invoke.</summary>
+    [JsonPropertyName("actionName")]
+    public string ActionName { get; set; } = string.Empty;
 
-    /// <summary>Persistence failure encountered after applying the model switch.</summary>
-    [JsonPropertyName("persistenceError")]
-    public string? PersistenceError { get; set; }
+    /// <summary>Action input.</summary>
+    [JsonPropertyName("input")]
+    public JsonElement? Input { get; set; }
 
-    /// <summary>Lifecycle result for the requested switch.</summary>
-    [JsonPropertyName("status")]
-    public string? Status { get; set; }
+    /// <summary>Open canvas instance identifier.</summary>
+    [JsonPropertyName("instanceId")]
+    public string InstanceId { get; set; } = string.Empty;
 
-    /// <summary>User-facing warning produced while applying the model switch.</summary>
-    [JsonPropertyName("warning")]
-    public string? Warning { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Vision-specific limits.</summary>
+/// <summary>Internal canvas provider registration parameters.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ModelCapabilitiesOverrideLimitsVision
+internal sealed class CanvasProviderRegisterRequest
 {
-    /// <summary>Maximum image size in bytes.</summary>
-    [JsonPropertyName("max_prompt_image_size")]
-    public long? MaxPromptImageSize { get; set; }
+    /// <summary>Canvas contributions supplied by the provider.</summary>
+    [JsonPropertyName("canvases")]
+    public IList<JsonElement> Canvases { get => field ??= []; set; }
 
-    /// <summary>Maximum number of images per prompt.</summary>
-    [JsonPropertyName("max_prompt_images")]
-    public long? MaxPromptImages { get; set; }
+    /// <summary>Connection identifier for callback routing.</summary>
+    [JsonPropertyName("connectionId")]
+    public string ConnectionId { get; set; } = string.Empty;
 
-    /// <summary>MIME types the model accepts.</summary>
-    [JsonPropertyName("supported_media_types")]
-    public IList<string>? SupportedMediaTypes { get; set; }
+    /// <summary>Provider metadata supplied by the host.</summary>
+    [JsonPropertyName("info")]
+    public JsonElement Info { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Token limits for prompts, outputs, and context window.</summary>
+/// <summary>Internal canvas provider unregistration parameters.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ModelCapabilitiesOverrideLimits
+internal sealed class CanvasProviderUnregisterRequest
 {
-    /// <summary>Maximum total context window size in tokens.</summary>
-    [JsonPropertyName("max_context_window_tokens")]
-    public long? MaxContextWindowTokens { get; set; }
-
-    /// <summary>Maximum number of output/completion tokens.</summary>
-    [JsonPropertyName("max_output_tokens")]
-    public long? MaxOutputTokens { get; set; }
-
-    /// <summary>Maximum number of prompt/input tokens.</summary>
-    [JsonPropertyName("max_prompt_tokens")]
-    public long? MaxPromptTokens { get; set; }
+    /// <summary>Connection identifier to unregister.</summary>
+    [JsonPropertyName("connectionId")]
+    public string ConnectionId { get; set; } = string.Empty;
 
-    /// <summary>Vision-specific limits.</summary>
-    [JsonPropertyName("vision")]
-    public ModelCapabilitiesOverrideLimitsVision? Vision { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Feature flags indicating what the model supports.</summary>
+/// <summary>Machine-readable factory run failure.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>type</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ModelCapabilitiesOverrideSupports
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "type",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(FactoryRunFailureFactoryLimitReached), "factory_limit_reached")]
+[JsonDerivedType(typeof(FactoryRunFailureFactoryResumeDeclined), "factory_resume_declined")]
+[JsonDerivedType(typeof(FactoryRunFailureFactoryDurableFailure), "factory_durable_failure")]
+[JsonDerivedType(typeof(FactoryRunFailureFactoryAccountingIncomplete), "factory_accounting_incomplete")]
+public partial class FactoryRunFailure
 {
-    /// <summary>Resolved Anthropic adaptive-thinking capability — unsupported / optional / required. 'required' models reject thinking.type='enabled' with HTTP 400 (e.g. opus-4.7/4.8).</summary>
-    [JsonPropertyName("adaptive_thinking")]
-    public AdaptiveThinkingSupport? AdaptiveThinking { get; set; }
-
-    /// <summary>Whether this model supports reasoning effort configuration.</summary>
-    [JsonPropertyName("reasoningEffort")]
-    public bool? ReasoningEffort { get; set; }
-
-    /// <summary>Whether this model supports vision/image input.</summary>
-    [JsonPropertyName("vision")]
-    public bool? Vision { get; set; }
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("type")]
+    public virtual string Type { get; set; } = string.Empty;
 }
 
-/// <summary>Optional capability overrides (vision, tool_calls, reasoning, etc.).</summary>
+
+/// <summary>The <c>factory_limit_reached</c> variant of <see cref="FactoryRunFailure"/>.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ModelCapabilitiesOverride
+public partial class FactoryRunFailureFactoryLimitReached : FactoryRunFailure
 {
-    /// <summary>Token limits for prompts, outputs, and context window.</summary>
-    [JsonPropertyName("limits")]
-    public ModelCapabilitiesOverrideLimits? Limits { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "factory_limit_reached";
 
-    /// <summary>Feature flags indicating what the model supports.</summary>
-    [JsonPropertyName("supports")]
-    public ModelCapabilitiesOverrideSupports? Supports { get; set; }
-}
+    /// <summary>Resource ceiling that stopped the run.</summary>
+    [JsonPropertyName("kind")]
+    public required FactoryRunFailureKind Kind { get; set; }
 
-/// <summary>Environment variables consulted while resolving model-picker settings.</summary>
-public sealed class ModelPickerSettingsContextEnvironment
-{
+    /// <summary>Factory run identifier.</summary>
+    [JsonPropertyName("runId")]
+    public required string RunId { get; set; }
+
+    /// <summary>Approved effective ceiling that was reached.</summary>
+    [JsonPropertyName("value")]
+    public required double Value { get; set; }
 }
 
-/// <summary>Filesystem and environment context used to resolve model-picker settings.</summary>
+/// <summary>The <c>factory_resume_declined</c> variant of <see cref="FactoryRunFailure"/>.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ModelPickerSettingsContext
+public partial class FactoryRunFailureFactoryResumeDeclined : FactoryRunFailure
 {
-    /// <summary>Optional Copilot configuration directory containing persisted settings.</summary>
-    [JsonPropertyName("configDir")]
-    public string? ConfigDir { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "factory_resume_declined";
 
-    /// <summary>Environment variables consulted while resolving model-picker settings.</summary>
-    [JsonPropertyName("environment")]
-    public ModelPickerSettingsContextEnvironment Environment { get => field ??= new(); set; }
+    /// <summary>Human-readable reason the resume did not proceed.</summary>
+    [JsonPropertyName("reason")]
+    public required string Reason { get; set; }
 
-    /// <summary>User home directory used when resolving persisted settings.</summary>
-    [JsonPropertyName("homeDirectory")]
-    public string HomeDirectory { get; set; } = string.Empty;
+    /// <summary>Factory run identifier whose changed limits were declined.</summary>
+    [JsonPropertyName("runId")]
+    public required string RunId { get; set; }
 }
 
-/// <summary>RPC data type for ModelPickerPersistence operations.</summary>
+/// <summary>The <c>factory_durable_failure</c> variant of <see cref="FactoryRunFailure"/>.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ModelPickerPersistenceRequest
+public partial class FactoryRunFailureFactoryDurableFailure : FactoryRunFailure
 {
-    /// <summary>Whether context tier was explicitly selected and should be persisted.</summary>
-    [JsonPropertyName("contextTierExplicit")]
-    public bool? ContextTierExplicit { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "factory_durable_failure";
 
-    /// <summary>Whether reasoning effort was explicitly selected and should be persisted.</summary>
-    [JsonPropertyName("reasoningEffortExplicit")]
-    public bool? ReasoningEffortExplicit { get; set; }
+    /// <summary>Stable failure code.</summary>
+    [JsonPropertyName("code")]
+    public required string Code { get; set; }
 
-    /// <summary>Filesystem and environment context used to resolve settings persistence.</summary>
-    [JsonPropertyName("settingsContext")]
-    public ModelPickerSettingsContext SettingsContext { get => field ??= new(); set; }
+    /// <summary>Execution-critical durable operation that failed.</summary>
+    [JsonPropertyName("operation")]
+    public required FactoryDurableOperation Operation { get; set; }
+
+    /// <summary>Factory run identifier.</summary>
+    [JsonPropertyName("runId")]
+    public required string RunId { get; set; }
 }
 
-/// <summary>Target model identifier and optional reasoning effort, summary, capability overrides, and context tier.</summary>
+/// <summary>The run stopped because its usage accounting could not be completed.</summary>
+/// <remarks>The <c>factory_accounting_incomplete</c> variant of <see cref="FactoryRunFailure"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class ModelSwitchToRequest
+public partial class FactoryRunFailureFactoryAccountingIncomplete : FactoryRunFailure
 {
-    /// <summary>Explicit response to a model-switch compaction preflight. Omit to request a confirmation projection when compaction is necessary.</summary>
-    [JsonPropertyName("compactionDecision")]
-    public string? CompactionDecision { get; set; }
-
-    /// <summary>Explicit context tier for the selected model. `"default"` / `"long_context"` apply the requested tier; omit this field to use normal model behavior with no explicit tier.</summary>
-    [JsonPropertyName("contextTier")]
-    public ContextTier? ContextTier { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "factory_accounting_incomplete";
 
-    /// <summary>When true, defer this switch (enqueue it) if another model change is already queued, even when no turn is active — so it drains last (FIFO) and wins over the already-queued change. Intended for genuine user-initiated model selections; internal restore/reapply switches omit it and apply immediately when no turn is active. When no other model change is queued this has no effect (a switch still applies immediately unless a turn is active).</summary>
-    [JsonPropertyName("deferIfModelChangeQueued")]
-    public bool? DeferIfModelChangeQueued { get; set; }
+    /// <summary>Confirmed usage in nano-AIU, representing the floor of what the run spent.</summary>
+    [JsonPropertyName("drainedNanoAiu")]
+    public required long DrainedNanoAiu { get; set; }
 
-    /// <summary>Override individual model capabilities resolved by the runtime.</summary>
-    [JsonPropertyName("modelCapabilities")]
-    public ModelCapabilitiesOverride? ModelCapabilities { get; set; }
+    /// <summary>Factory run identifier.</summary>
+    [JsonPropertyName("runId")]
+    public required string RunId { get; set; }
+}
 
-    /// <summary>Settings scope used when persisting the selected model.</summary>
-    [JsonPropertyName("modelChangeScope")]
-    public string? ModelChangeScope { get; set; }
+/// <summary>Complete current or terminal factory run envelope.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class FactoryRunResult
+{
+    /// <summary>Error message for an errored run.</summary>
+    [JsonPropertyName("error")]
+    public string? Error { get; set; }
 
-    /// <summary>Model selection id to switch to, as returned by `list`. A bare id (e.g. `claude-sonnet-4.6`) names a Copilot (CAPI) model; a provider-qualified id (`provider/id`, e.g. `acme/claude-sonnet`) targets a registry BYOK model.</summary>
-    [JsonPropertyName("modelId")]
-    public string ModelId { get; set; } = string.Empty;
+    /// <summary>Machine-readable failure details for an errored run.</summary>
+    [JsonPropertyName("failure")]
+    public FactoryRunFailure? Failure { get; set; }
 
-    /// <summary>Optional settings context and explicit-override flags used to persist a picker selection.</summary>
-    [JsonPropertyName("pickerPersistence")]
-    public ModelPickerPersistenceRequest? PickerPersistence { get; set; }
+    /// <summary>Reason for a halted or cancelled run.</summary>
+    [JsonPropertyName("reason")]
+    public string? Reason { get; set; }
 
-    /// <summary>Reasoning effort level to use for the model. CAPI values are model-defined and validated against the selected model; BYOK providers may define additional values. "none" disables reasoning. When omitted, no effort override is applied.</summary>
-    [JsonPropertyName("reasoningEffort")]
-    public string? ReasoningEffort { get; set; }
+    /// <summary>Completed factory result.</summary>
+    [JsonPropertyName("result")]
+    public JsonElement? Result { get; set; }
 
-    /// <summary>Reasoning summary mode to request for supported model clients.</summary>
-    [JsonPropertyName("reasoningSummary")]
-    public ReasoningSummary? ReasoningSummary { get; set; }
+    /// <summary>Factory run identifier.</summary>
+    [JsonPropertyName("runId")]
+    public string RunId { get; set; } = string.Empty;
 
-    /// <summary>Optional repository settings scope to persist after the switch commits.</summary>
-    [JsonPropertyName("repoScope")]
-    public string? RepoScope { get; set; }
+    /// <summary>Partial journal and progress snapshot for a halted, cancelled, or errored run.</summary>
+    [JsonPropertyName("snapshot")]
+    public JsonElement? Snapshot { get; set; }
 
-    /// <summary>Require the target to be currently available and enabled before applying the switch.</summary>
-    [JsonPropertyName("requireAvailable")]
-    public bool? RequireAvailable { get; set; }
+    /// <summary>Current or terminal factory run status.</summary>
+    [JsonPropertyName("status")]
+    public FactoryRunStatus Status { get; set; }
+}
 
-    /// <summary>When true, evaluate context-window compaction policy before applying the switch.</summary>
-    [JsonPropertyName("runCompactionPreflight")]
-    public bool? RunCompactionPreflight { get; set; }
+/// <summary>Wire-only per-invocation factory resource ceiling overrides.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class FactoryRunLimits
+{
+    /// <summary>Maximum AI credits consumed by factory subagents and their descendants. The post-paid ceiling is soft: parallel turns can settle beyond it before the run stops.</summary>
+    [JsonPropertyName("maxAiCredits")]
+    public double? MaxAiCredits { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Maximum number of factory subagents that may run concurrently.</summary>
+    [JsonPropertyName("maxConcurrentSubagents")]
+    public long? MaxConcurrentSubagents { get; set; }
 
-    /// <summary>Origin to record on the effective `session.model_change` event. Defaults to `sdk` when omitted.</summary>
-    [JsonPropertyName("source")]
-    public ModelChangeSource? Source { get; set; }
+    /// <summary>Maximum total number of factory subagents that may be admitted.</summary>
+    [JsonPropertyName("maxTotalSubagents")]
+    public long? MaxTotalSubagents { get; set; }
 
-    /// <summary>Output verbosity level to request for supported models.</summary>
-    [JsonPropertyName("verbosity")]
-    public Verbosity? Verbosity { get; set; }
+    /// <summary>Maximum accumulated active-execution time in seconds. Active execution includes the entire extension body, subprocess waits, queued-agent waits, and sleeps; time between resumed attempts is not counted.</summary>
+    [JsonPropertyName("timeoutSeconds")]
+    public double? TimeoutSeconds { get; set; }
 }
 
-/// <summary>Managed, repository, and CLI model overrides to overlay onto the session at startup.</summary>
+/// <summary>Options controlling factory invocation.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class ModelApplyStartupOverlayRequest
+public sealed class RunOptions
 {
-    /// <summary>Model explicitly selected by the CLI, when provided.</summary>
-    [JsonPropertyName("cliModel")]
-    public string? CliModel { get; set; }
-
-    /// <summary>Whether the overlay is being applied while resuming a deferred session.</summary>
-    [JsonPropertyName("deferredResume")]
-    public bool? DeferredResume { get; set; }
-
-    /// <summary>Model required by device-managed policy, when configured.</summary>
-    [JsonPropertyName("deviceManagedModel")]
-    public string? DeviceManagedModel { get; set; }
+    /// <summary>Per-invocation resource ceiling overrides.</summary>
+    [JsonPropertyName("limits")]
+    public FactoryRunLimits? Limits { get; set; }
 
-    /// <summary>Context tier selected by repository settings, when configured.</summary>
-    [JsonPropertyName("repoContextTier")]
-    public string? RepoContextTier { get; set; }
+    /// <summary>Run identifier whose journal and progress should seed this resumed run.</summary>
+    [JsonPropertyName("resumeFromRunId")]
+    public string? ResumeFromRunId { get; set; }
+}
 
-    /// <summary>Model selected by repository settings, when configured.</summary>
-    [JsonPropertyName("repoModel")]
-    public string? RepoModel { get; set; }
+/// <summary>Parameters for invoking a registered factory.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class FactoryRunRequest
+{
+    /// <summary>Factory input value.</summary>
+    [JsonPropertyName("args")]
+    public JsonElement Args { get; set; }
 
-    /// <summary>Reasoning effort selected by repository settings, when configured.</summary>
-    [JsonPropertyName("repoReasoningEffort")]
-    public string? RepoReasoningEffort { get; set; }
+    /// <summary>Registered factory name.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
-    /// <summary>Model required by server-managed policy, when configured.</summary>
-    [JsonPropertyName("serverManagedModel")]
-    public string? ServerManagedModel { get; set; }
+    /// <summary>Factory invocation options.</summary>
+    [JsonPropertyName("options")]
+    public RunOptions? Options { get; set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Update the session's reasoning effort without changing the selected model. Use `switchTo` instead when you also need to change the model. The runtime stores the effort on the session and applies it to subsequent turns.</summary>
+/// <summary>Resolved persisted factory identity and resumed run envelope.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ModelSetReasoningEffortResult
+public sealed class FactoryResumeResult
 {
-    /// <summary>Reasoning effort level recorded on the session after the update.</summary>
-    [JsonPropertyName("reasoningEffort")]
-    public string ReasoningEffort { get; set; } = string.Empty;
+    /// <summary>Persisted factory name resolved for the resumed run.</summary>
+    [JsonPropertyName("factoryName")]
+    public string FactoryName { get; set; } = string.Empty;
+
+    /// <summary>Terminal resumed run envelope.</summary>
+    [JsonPropertyName("run")]
+    public FactoryRunResult Run { get => field ??= new(); set; }
 }
 
-/// <summary>Reasoning effort level to apply to the currently selected model.</summary>
+/// <summary>Parameters for resuming a factory run from its persisted identity.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class ModelSetReasoningEffortRequest
+internal sealed class FactoryResumeRequest
 {
-    /// <summary>Reasoning effort level to apply to the currently selected model. The host is responsible for validating the value against the model's supported levels before calling.</summary>
-    [JsonPropertyName("reasoningEffort")]
-    public string ReasoningEffort { get; set; } = string.Empty;
+    /// <summary>Optional per-invocation resource ceiling overrides.</summary>
+    [JsonPropertyName("limits")]
+    public FactoryRunLimits? Limits { get; set; }
+
+    /// <summary>Factory run identifier.</summary>
+    [JsonPropertyName("runId")]
+    public string RunId { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Cost-category metadata for a CAPI model.</summary>
+/// <summary>Parameters for retrieving a factory run.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionModelPriceCategory
+internal sealed class FactoryGetRunRequest
 {
-    /// <summary>CAPI model identifier.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
+    /// <summary>Factory run identifier.</summary>
+    [JsonPropertyName("runId")]
+    public string RunId { get; set; } = string.Empty;
 
-    /// <summary>Cost category assigned to the model.</summary>
-    [JsonPropertyName("priceCategory")]
-    public ModelPickerPriceCategory PriceCategory { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>The list of models available to this session.</summary>
+/// <summary>Declared or approved factory resource ceilings.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionModelList
+public sealed class FactoryDeclaredLimits
 {
-    /// <summary>Available models, ordered with the most preferred default first. Includes both Copilot (CAPI) models and any registry BYOK models; a BYOK model appears under its provider-qualified selection id (`provider/id`).</summary>
-    [JsonPropertyName("list")]
-    public IList<JsonElement> List { get => field ??= []; set; }
+    /// <summary>Maximum AI credits consumed by subagents and descendants.</summary>
+    [JsonPropertyName("maxAiCredits")]
+    public double? MaxAiCredits { get; set; }
 
-    /// <summary>Cost categories for the full CAPI catalog, including picker-disabled models that Auto may select. Metadata only; entries absent from `list` are not manually selectable.</summary>
-    [JsonPropertyName("modelPriceCategories")]
-    public IList<SessionModelPriceCategory>? ModelPriceCategories { get; set; }
+    /// <summary>Maximum concurrently active subagents.</summary>
+    [JsonPropertyName("maxConcurrentSubagents")]
+    public long? MaxConcurrentSubagents { get; set; }
 
-    /// <summary>Per-quota snapshots returned alongside the model list, keyed by quota type.</summary>
-    [JsonPropertyName("quotaSnapshots")]
-    public IDictionary<string, JsonElement>? QuotaSnapshots { get; set; }
+    /// <summary>Maximum total subagents spawned by the run.</summary>
+    [JsonPropertyName("maxTotalSubagents")]
+    public long? MaxTotalSubagents { get; set; }
+
+    /// <summary>Maximum accumulated active execution time in seconds.</summary>
+    [JsonPropertyName("timeoutSeconds")]
+    public double? TimeoutSeconds { get; set; }
 }
 
-/// <summary>RPC data type for SessionModelList operations.</summary>
+/// <summary>Durable factory resource consumption.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionModelListRequest
+public sealed class FactoryRunConsumed
 {
-    /// <summary>If true, bypasses the per-session model list cache and re-fetches from CAPI.</summary>
-    [JsonPropertyName("skipCache")]
-    public bool? SkipCache { get; set; }
+    /// <summary>Accumulated active execution time in milliseconds.</summary>
+    [JsonPropertyName("activeMs")]
+    public long ActiveMs { get; set; }
+
+    /// <summary>AI usage consumed by the run in nano-AIU.</summary>
+    [JsonPropertyName("nanoAiu")]
+    public long NanoAiu { get; set; }
+
+    /// <summary>Total subagents spawned by the run.</summary>
+    [JsonPropertyName("subagents")]
+    public long Subagents { get; set; }
 }
 
-/// <summary>RPC data type for SessionModelListRequestWithSession operations.</summary>
+/// <summary>Current factory phase identity.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionModelListRequestWithSession
+public sealed class FactoryCurrentPhase
 {
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Current phase identifier.</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
 
-    /// <summary>If true, bypasses the per-session model list cache and re-fetches from CAPI.</summary>
-    [JsonPropertyName("skipCache")]
-    public bool? SkipCache { get; set; }
+    /// <summary>Zero-based declared phase ordinal, or null for an undeclared phase.</summary>
+    [JsonPropertyName("ordinal")]
+    public long? Ordinal { get; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Prompt-safe terminal factory outcome.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionModeGetRequest
+public sealed class FactoryRunTerminal
 {
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Human-readable terminal error.</summary>
+    [JsonPropertyName("error")]
+    public string? Error { get; set; }
+
+    /// <summary>Machine-readable terminal failure.</summary>
+    [JsonPropertyName("failure")]
+    public FactoryRunFailure? Failure { get; set; }
+
+    /// <summary>Human-readable terminal reason.</summary>
+    [JsonPropertyName("reason")]
+    public string? Reason { get; set; }
+
+    /// <summary>Prompt-safe preview of the completed result.</summary>
+    [JsonPropertyName("resultPreview")]
+    public string? ResultPreview { get; set; }
 }
 
-/// <summary>Outcome of a session mode change, including any model switch it triggered and follow-up the host must perform.</summary>
+/// <summary>Durable factory run summary with read-time live overlays.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ModeSetResult
+public sealed class FactoryRunSummary
 {
-    /// <summary>Whether the host should arm an interactive continuation after the mode change.</summary>
-    [JsonPropertyName("armInteractiveContinuation")]
-    public bool? ArmInteractiveContinuation { get; set; }
-
-    /// <summary>Compaction confirmation required before the mode change can complete.</summary>
-    [JsonPropertyName("confirmation")]
-    public ModelSwitchConfirmation? Confirmation { get; set; }
+    /// <summary>Epoch milliseconds when the current active segment started, or null while inactive.</summary>
+    [JsonPropertyName("activeSegmentStartedAt")]
+    public long? ActiveSegmentStartedAt { get; set; }
 
-    /// <summary>Whether the host must defer implementing the requested mode change.</summary>
-    [JsonPropertyName("deferImplementation")]
-    public bool? DeferImplementation { get; set; }
+    /// <summary>Approved effective resource ceilings, or null until approved.</summary>
+    [JsonPropertyName("approved")]
+    public FactoryDeclaredLimits? Approved { get; set; }
 
-    /// <summary>Deprecation warnings associated with the model selected by the mode change.</summary>
-    [JsonPropertyName("deprecationWarnings")]
-    public IList<string>? DeprecationWarnings { get; set; }
+    /// <summary>Epoch milliseconds when the run completed, or null while nonterminal.</summary>
+    [JsonPropertyName("completedAt")]
+    public long? CompletedAt { get; set; }
 
-    /// <summary>User-facing outcome message for the model switch triggered by the mode change.</summary>
-    [JsonPropertyName("message")]
-    public string? Message { get; set; }
+    /// <summary>Durable resource consumption.</summary>
+    [JsonPropertyName("consumed")]
+    public FactoryRunConsumed Consumed { get => field ??= new(); set; }
 
-    /// <summary>Whether applying the mode changed the active model.</summary>
-    [JsonPropertyName("modelChanged")]
-    public bool ModelChanged { get; set; }
+    /// <summary>Epoch milliseconds when the run was created.</summary>
+    [JsonPropertyName("createdAt")]
+    public long CreatedAt { get; set; }
 
-    /// <summary>Lifecycle status of the requested mode change.</summary>
-    [JsonPropertyName("status")]
-    public string Status { get; set; } = string.Empty;
+    /// <summary>Current phase identity, or null before any phase is entered.</summary>
+    [JsonPropertyName("currentPhase")]
+    public FactoryCurrentPhase? CurrentPhase { get; set; }
 
-    /// <summary>User-facing warning produced while applying the mode change.</summary>
-    [JsonPropertyName("warning")]
-    public string? Warning { get; set; }
-}
+    /// <summary>Resource ceilings declared by the factory.</summary>
+    [JsonPropertyName("declaredLimits")]
+    public FactoryDeclaredLimits DeclaredLimits { get => field ??= new(); set; }
 
-/// <summary>Agent interaction mode to apply to the session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class ModeSetRequest
-{
-    /// <summary>Explicit response to a model-switch compaction preflight.</summary>
-    [JsonPropertyName("compactionDecision")]
-    public string? CompactionDecision { get; set; }
+    /// <summary>Number of phases declared by the factory.</summary>
+    [JsonPropertyName("declaredPhaseCount")]
+    public long DeclaredPhaseCount { get; set; }
 
-    /// <summary>Session whose plan-mode base state should be inherited.</summary>
-    [JsonPropertyName("inheritPlanBaseFromSessionId")]
-    public string? InheritPlanBaseFromSessionId { get; set; }
+    /// <summary>Human-readable factory description.</summary>
+    [JsonPropertyName("description")]
+    public string Description { get; set; } = string.Empty;
 
-    /// <summary>The session mode the agent is operating in.</summary>
-    [JsonPropertyName("mode")]
-    public SessionMode Mode { get; set; }
+    /// <summary>Registered factory name.</summary>
+    [JsonPropertyName("factoryName")]
+    public string FactoryName { get; set; } = string.Empty;
 
-    /// <summary>Whether the selected plan model should be persisted.</summary>
-    [JsonPropertyName("persistPlanSelection")]
-    public bool? PersistPlanSelection { get; set; }
+    /// <summary>Number of direct factory agents currently live.</summary>
+    [JsonPropertyName("liveAgentCount")]
+    public long LiveAgentCount { get; set; }
 
-    /// <summary>Settings context used when persisting the selected plan model.</summary>
-    [JsonPropertyName("pickerSettingsContext")]
-    public ModelPickerSettingsContext? PickerSettingsContext { get; set; }
+    /// <summary>Epoch milliseconds when this live-overlay snapshot was observed.</summary>
+    [JsonPropertyName("observedAt")]
+    public long ObservedAt { get; set; }
 
-    /// <summary>Context tier to use with the dedicated plan model.</summary>
-    [JsonPropertyName("planContextTier")]
-    public string? PlanContextTier { get; set; }
+    /// <summary>Monotonic durable run revision.</summary>
+    [JsonPropertyName("revision")]
+    public long Revision { get; set; }
 
-    /// <summary>Action to perform when leaving plan mode.</summary>
-    [JsonPropertyName("planExitAction")]
-    public string? PlanExitAction { get; set; }
+    /// <summary>Factory run identifier.</summary>
+    [JsonPropertyName("runId")]
+    public string RunId { get; set; } = string.Empty;
 
-    /// <summary>Dedicated model to use in plan mode, when configured.</summary>
-    [JsonPropertyName("planModel")]
-    public string? PlanModel { get; set; }
+    /// <summary>Epoch milliseconds when execution first started, or null before start.</summary>
+    [JsonPropertyName("startedAt")]
+    public long? StartedAt { get; set; }
 
-    /// <summary>Whether a dedicated plan model is configured.</summary>
-    [JsonPropertyName("planModelConfigured")]
-    public bool? PlanModelConfigured { get; set; }
+    /// <summary>Current factory run status.</summary>
+    [JsonPropertyName("status")]
+    public FactoryRunStatus Status { get; set; }
 
-    /// <summary>Reasoning effort to use with the dedicated plan model.</summary>
-    [JsonPropertyName("planReasoningEffort")]
-    public string? PlanReasoningEffort { get; set; }
+    /// <summary>Terminal run outcome, or null while nonterminal.</summary>
+    [JsonPropertyName("terminal")]
+    public FactoryRunTerminal? Terminal { get; set; }
 
-    /// <summary>Whether leaving plan mode should restore the session's previous model.</summary>
-    [JsonPropertyName("restorePlanModel")]
-    public bool? RestorePlanModel { get; set; }
+    /// <summary>Total direct factory agents spawned across all attempts.</summary>
+    [JsonPropertyName("totalSpawnedAgentCount")]
+    public long TotalSpawnedAgentCount { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Epoch milliseconds when the durable run was last updated.</summary>
+    [JsonPropertyName("updatedAt")]
+    public long UpdatedAt { get; set; }
 }
 
-/// <summary>The session's friendly name, or null when not yet set.</summary>
+/// <summary>A page of factory runs in durable creation order.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class NameGetResult
+public sealed class FactoryListRunsResult
 {
-    /// <summary>The session name (user-set or auto-generated), or null if not yet set.</summary>
-    [JsonPropertyName("name")]
-    public string? Name { get; set; }
-}
-
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionNameGetRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
-
-/// <summary>New friendly name to apply to the session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class NameSetRequest
-{
-    /// <summary>New session name (1–100 characters, trimmed of leading/trailing whitespace).</summary>
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
-    [MaxLength(100)]
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Whether terminal runs newer than this page exist.</summary>
+    [JsonPropertyName("hasMoreNewer")]
+    public bool? HasMoreNewer { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Newest terminal-run cursor in this page, or null when the terminal window is empty.</summary>
+    [JsonPropertyName("newestSeq")]
+    public long? NewestSeq { get; set; }
 
-/// <summary>Indicates whether the auto-generated summary was applied as the session's name.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class NameSetAutoResult
-{
-    /// <summary>Whether the auto-generated summary was persisted. False if the session already has a user-set name, the summary normalized to empty, or the session does not have a workspace.</summary>
-    [JsonPropertyName("applied")]
-    public bool Applied { get; set; }
-}
+    /// <summary>Oldest terminal-run cursor in this page, or null when the terminal window is empty.</summary>
+    [JsonPropertyName("oldestSeq")]
+    public long? OldestSeq { get; set; }
 
-/// <summary>Auto-generated session summary to apply as the session's name when no user-set name exists.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class NameSetAutoRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Number of terminal runs older than this page.</summary>
+    [JsonPropertyName("omittedOlder")]
+    public long? OmittedOlder { get; set; }
 
-    /// <summary>Auto-generated session summary. Empty/whitespace-only values are ignored; values are trimmed before persisting.</summary>
-    [JsonPropertyName("summary")]
-    public string Summary { get; set; } = string.Empty;
+    /// <summary>Factory run summaries in durable creation order.</summary>
+    [JsonPropertyName("runs")]
+    public IList<FactoryRunSummary> Runs { get => field ??= []; set; }
 }
 
-/// <summary>Existence, contents, and resolved path of the session plan file.</summary>
+/// <summary>Parameters for paging factory runs.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PlanReadResult
+internal sealed class FactoryListRunsRequest
 {
-    /// <summary>The content of the plan file, or null if it does not exist.</summary>
-    [JsonPropertyName("content")]
-    public string? Content { get; set; }
+    /// <summary>Exclusive forward cursor.</summary>
+    [JsonPropertyName("afterSeq")]
+    public long? AfterSeq { get; set; }
 
-    /// <summary>Whether the plan file exists in the workspace.</summary>
-    [JsonPropertyName("exists")]
-    public bool Exists { get; set; }
+    /// <summary>Exclusive backward cursor.</summary>
+    [JsonPropertyName("beforeSeq")]
+    public long? BeforeSeq { get; set; }
 
-    /// <summary>Absolute file path of the plan file, or null if workspace is not enabled.</summary>
-    [JsonPropertyName("path")]
-    public string? Path { get; set; }
-}
+    /// <summary>Maximum terminal runs to return. Defaults to 200 and is capped at 500.</summary>
+    [JsonPropertyName("limit")]
+    public int? Limit { get; set; }
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionPlanReadRequest
-{
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Replacement contents to write to the session plan file.</summary>
+/// <summary>Prompt-safe durable identity and live status for a direct factory agent.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PlanUpdateRequest
+public sealed class FactoryAgentSummary
 {
-    /// <summary>The new content for the plan file.</summary>
-    [JsonPropertyName("content")]
-    public string Content { get; set; } = string.Empty;
+    /// <summary>Accumulated active agent time in milliseconds.</summary>
+    [JsonPropertyName("activeMs")]
+    public long ActiveMs { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Prompt-safe live activity text.</summary>
+    [JsonPropertyName("activity")]
+    public string? Activity { get; set; }
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionPlanDeleteRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Stable direct-agent identifier.</summary>
+    [JsonPropertyName("agentId")]
+    public string AgentId { get; set; } = string.Empty;
 
-/// <summary>A single todo row read from the session SQL `todos` table. All fields are optional because the SQL schema is best-effort and the agent may not have populated every column.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class PlanSqlTodosRow
-{
-    /// <summary>Todo description.</summary>
-    [JsonPropertyName("description")]
-    public string? Description { get; set; }
+    /// <summary>Registered agent type.</summary>
+    [JsonPropertyName("agentType")]
+    public string AgentType { get; set; } = string.Empty;
 
-    /// <summary>Todo identifier.</summary>
-    [JsonPropertyName("id")]
-    public string? Id { get; set; }
+    /// <summary>Epoch milliseconds when the agent completed.</summary>
+    [JsonPropertyName("completedAt")]
+    public long? CompletedAt { get; set; }
 
-    /// <summary>Todo status.</summary>
-    [JsonPropertyName("status")]
-    public string? Status { get; set; }
+    /// <summary>Friendly, non-unique name intended for display.</summary>
+    [JsonPropertyName("displayName")]
+    public string? DisplayName { get; set; }
 
-    /// <summary>Todo title.</summary>
-    [JsonPropertyName("title")]
-    public string? Title { get; set; }
-}
+    /// <summary>Friendly, non-unique name intended for display.</summary>
+    [JsonPropertyName("label")]
+    public string Label { get; set; } = string.Empty;
 
-/// <summary>Todo rows read from the session SQL database. Empty when no session database is available.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class PlanReadSqlTodosResult
-{
-    /// <summary>Rows from the session SQL todos table, ordered by creation time with insertion order used to break ties when available and id used for WITHOUT ROWID tables.</summary>
-    [JsonPropertyName("rows")]
-    public IList<PlanSqlTodosRow> Rows { get => field ??= []; set; }
-}
+    /// <summary>Phase identifier active when the agent was launched, or null.</summary>
+    [JsonPropertyName("phaseId")]
+    public string? PhaseId { get; set; }
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionPlanReadSqlTodosRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Model requested when the agent was launched.</summary>
+    [JsonPropertyName("requestedModel")]
+    public string? RequestedModel { get; set; }
 
-/// <summary>A single dependency edge read from the session SQL `todo_deps` table, indicating that one todo must complete before another.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class PlanSqlTodoDependency
-{
-    /// <summary>ID of the todo it depends on.</summary>
-    [JsonPropertyName("dependsOn")]
-    public string DependsOn { get; set; } = string.Empty;
+    /// <summary>Concrete model resolved for the agent.</summary>
+    [JsonPropertyName("resolvedModel")]
+    public string? ResolvedModel { get; set; }
 
-    /// <summary>ID of the todo that has the dependency.</summary>
-    [JsonPropertyName("todoId")]
-    public string TodoId { get; set; } = string.Empty;
-}
+    /// <summary>Owning factory run identifier.</summary>
+    [JsonPropertyName("runId")]
+    public string RunId { get; set; } = string.Empty;
 
-/// <summary>Todo rows + dependency edges read from the session SQL database.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class PlanReadSqlTodosWithDependenciesResult
-{
-    /// <summary>Edges from the session SQL todo_deps table. Empty when no database, no todo_deps table, or the SELECT failed. Read independently from `rows`, so a broken todo_deps table does not affect the rows result and vice versa.</summary>
-    [JsonPropertyName("dependencies")]
-    public IList<PlanSqlTodoDependency> Dependencies { get => field ??= []; set; }
+    /// <summary>Epoch milliseconds when the agent started.</summary>
+    [JsonPropertyName("startedAt")]
+    public long? StartedAt { get; set; }
 
-    /// <summary>Rows from the session SQL todos table, ordered by creation time with insertion order used to break ties when available and id used for WITHOUT ROWID tables. Empty when no database, no todos table, or the SELECT failed.</summary>
-    [JsonPropertyName("rows")]
-    public IList<PlanSqlTodosRow> Rows { get => field ??= []; set; }
-}
+    /// <summary>Current durable or live agent status.</summary>
+    [JsonPropertyName("status")]
+    public string Status { get; set; } = string.Empty;
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionPlanReadSqlTodosWithDependenciesRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Tool-call identifier that launched the agent.</summary>
+    [JsonPropertyName("toolCallId")]
+    public string ToolCallId { get; set; } = string.Empty;
 }
 
-/// <summary>RPC data type for WorkspacesGetWorkspaceResultWorkspace operations.</summary>
-public sealed class WorkspacesGetWorkspaceResultWorkspace
+/// <summary>Durable lifecycle and timing for one factory phase.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class FactoryPhaseObservation
 {
-    /// <summary>Current Git branch.</summary>
-    [JsonPropertyName("branch")]
-    public string? Branch { get; set; }
-
-    /// <summary>Whether the per-session Chronicle upgrade prompt was dismissed for the workspace.</summary>
-    [JsonPropertyName("chronicle_sync_dismissed")]
-    public bool? ChronicleSyncDismissed { get; set; }
-
-    /// <summary>Name of the client that created the workspace.</summary>
-    [JsonPropertyName("client_name")]
-    public string? ClientName { get; set; }
+    /// <summary>Completed active time accumulated by this phase in milliseconds.</summary>
+    [JsonPropertyName("accumulatedActiveMs")]
+    public long AccumulatedActiveMs { get; set; }
 
-    /// <summary>Timestamp when the workspace was created.</summary>
-    [JsonPropertyName("created_at")]
-    public DateTimeOffset? CreatedAt { get; set; }
+    /// <summary>Epoch milliseconds when this phase completed; for a skipped phase, the synthetic skip timestamp (equal to `startedAt`).</summary>
+    [JsonPropertyName("completedAt")]
+    public long? CompletedAt { get; set; }
 
-    /// <summary>Current working directory associated with the workspace.</summary>
-    [JsonPropertyName("cwd")]
-    public string? Cwd { get; set; }
+    /// <summary>Current live active time for this phase in milliseconds.</summary>
+    [JsonPropertyName("currentActiveMs")]
+    public long CurrentActiveMs { get; set; }
 
-    /// <summary>Git repository root associated with the workspace.</summary>
-    [JsonPropertyName("git_root")]
-    public string? GitRoot { get; set; }
+    /// <summary>Optional human-readable phase detail.</summary>
+    [JsonPropertyName("detail")]
+    public string? Detail { get; set; }
 
-    /// <summary>Allowed values for the `WorkspacesWorkspaceDetailsHostType` enumeration.</summary>
-    [JsonPropertyName("host_type")]
-    public WorkspacesWorkspaceDetailsHostType? HostType { get; set; }
+    /// <summary>Number of times execution entered this phase.</summary>
+    [JsonPropertyName("entryCount")]
+    public long EntryCount { get; set; }
 
-    /// <summary>Stable workspace identifier.</summary>
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
+    /// <summary>Phase identifier.</summary>
     [JsonPropertyName("id")]
     public string Id { get; set; } = string.Empty;
 
-    /// <summary>Most recent Mission Control event identifier observed for the workspace.</summary>
-    [JsonPropertyName("mc_last_event_id")]
-    public string? McLastEventId { get; set; }
-
-    /// <summary>Mission Control session identifier associated with the workspace.</summary>
-    [JsonPropertyName("mc_session_id")]
-    public string? McSessionId { get; set; }
-
-    /// <summary>Mission Control task identifier associated with the workspace.</summary>
-    [JsonPropertyName("mc_task_id")]
-    public string? McTaskId { get; set; }
+    /// <summary>Most recent run attempt that entered this phase, or `0` if the phase has never been entered.</summary>
+    [JsonPropertyName("lastEnteredRunAttempt")]
+    public long LastEnteredRunAttempt { get; set; }
 
-    /// <summary>Workspace display name.</summary>
-    [JsonPropertyName("name")]
-    public string? Name { get; set; }
+    /// <summary>Direct agents in this phase that are currently live.</summary>
+    [JsonPropertyName("liveAgentCount")]
+    public long LiveAgentCount { get; set; }
 
-    /// <summary>Whether the workspace session can be steered remotely.</summary>
-    [JsonPropertyName("remote_steerable")]
-    public bool? RemoteSteerable { get; set; }
+    /// <summary>Zero-based declared phase ordinal, or null for an undeclared phase.</summary>
+    [JsonPropertyName("ordinal")]
+    public long? Ordinal { get; set; }
 
-    /// <summary>Repository identifier associated with the workspace.</summary>
-    [JsonPropertyName("repository")]
-    public string? Repository { get; set; }
+    /// <summary>Epoch milliseconds when this phase first started; for a skipped phase, the synthetic skip timestamp (equal to `completedAt`).</summary>
+    [JsonPropertyName("startedAt")]
+    public long? StartedAt { get; set; }
 
-    /// <summary>Number of persisted summaries in the workspace.</summary>
-    [JsonPropertyName("summary_count")]
-    public long? SummaryCount { get; set; }
+    /// <summary>Derived lifecycle state of the phase.</summary>
+    [JsonPropertyName("status")]
+    public FactoryPhaseStatus Status { get; set; }
 
-    /// <summary>Timestamp when the workspace was last updated.</summary>
-    [JsonPropertyName("updated_at")]
-    public DateTimeOffset? UpdatedAt { get; set; }
+    /// <summary>Human-readable phase title.</summary>
+    [JsonPropertyName("title")]
+    public string Title { get; set; } = string.Empty;
 
-    /// <summary>Whether the workspace name was explicitly chosen by the user.</summary>
-    [JsonPropertyName("user_named")]
-    public bool? UserNamed { get; set; }
+    /// <summary>Total direct agents associated with this phase.</summary>
+    [JsonPropertyName("totalAgentCount")]
+    public long TotalAgentCount { get; set; }
 }
 
-/// <summary>Current workspace metadata for the session, including its absolute filesystem path when available.</summary>
+/// <summary>One durable factory progress record.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class WorkspacesGetWorkspaceResult
+public sealed class FactoryProgressLine
 {
-    /// <summary>Absolute filesystem path to the workspace directory. Omitted when the session has no workspace (e.g. remote sessions).</summary>
-    [JsonPropertyName("path")]
-    public string? Path { get; set; }
+    /// <summary>Resume attempt that emitted this record.</summary>
+    [JsonPropertyName("attempt")]
+    public long Attempt { get; set; }
 
-    /// <summary>Current workspace metadata, or null if not available.</summary>
-    [JsonPropertyName("workspace")]
-    public WorkspacesGetWorkspaceResultWorkspace? Workspace { get; set; }
+    /// <summary>Progress record kind.</summary>
+    [JsonPropertyName("kind")]
+    public FactoryLogLineKind Kind { get; set; }
+
+    /// <summary>Phase active when the record was emitted, or null before any phase.</summary>
+    [JsonPropertyName("phaseId")]
+    public string? PhaseId { get; set; }
+
+    /// <summary>Epoch milliseconds when the record was persisted.</summary>
+    [JsonPropertyName("recordedAt")]
+    public long RecordedAt { get; set; }
+
+    /// <summary>Global monotonic sequence number within the run.</summary>
+    [JsonPropertyName("seq")]
+    public long Seq { get; set; }
+
+    /// <summary>Prompt-safe progress text.</summary>
+    [JsonPropertyName("text")]
+    public string Text { get; set; } = string.Empty;
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>A bidirectional page of factory progress.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionWorkspacesGetWorkspaceRequest
+public sealed class FactoryProgressPage
 {
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Whether progress records newer than this page exist.</summary>
+    [JsonPropertyName("hasMoreNewer")]
+    public bool HasMoreNewer { get; set; }
+
+    /// <summary>Whether progress records older than this page exist.</summary>
+    [JsonPropertyName("hasMoreOlder")]
+    public bool HasMoreOlder { get; set; }
+
+    /// <summary>Newest sequence number in this page, or null when empty.</summary>
+    [JsonPropertyName("newestSeq")]
+    public long? NewestSeq { get; set; }
+
+    /// <summary>Oldest sequence number in this page, or null when empty.</summary>
+    [JsonPropertyName("oldestSeq")]
+    public long? OldestSeq { get; set; }
+
+    /// <summary>Progress records in sequence order.</summary>
+    [JsonPropertyName("records")]
+    public IList<FactoryProgressLine> Records { get => field ??= []; set; }
+
+    /// <summary>Run revision reflected by this page.</summary>
+    [JsonPropertyName("revision")]
+    public long Revision { get; set; }
 }
 
-/// <summary>Workspace metadata fields to update.</summary>
+/// <summary>Full factory run observability detail.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class WorkspacesUpdateMetadataRequest
+public sealed class FactoryRunDetail
 {
-    /// <summary>Opaque workspace context supplied by the session host.</summary>
-    [JsonPropertyName("context")]
-    public JsonElement? Context { get; set; }
+    /// <summary>Epoch milliseconds when the current active segment started, or null while inactive.</summary>
+    [JsonPropertyName("activeSegmentStartedAt")]
+    public long? ActiveSegmentStartedAt { get; set; }
 
-    /// <summary>Optional workspace display name override.</summary>
-    [JsonPropertyName("name")]
-    public string? Name { get; set; }
+    /// <summary>Durable identities and live statuses for direct factory agents.</summary>
+    [JsonPropertyName("agents")]
+    public IList<FactoryAgentSummary> Agents { get => field ??= []; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Approved effective resource ceilings, or null until approved.</summary>
+    [JsonPropertyName("approved")]
+    public FactoryDeclaredLimits? Approved { get; set; }
+
+    /// <summary>Epoch milliseconds when the run completed, or null while nonterminal.</summary>
+    [JsonPropertyName("completedAt")]
+    public long? CompletedAt { get; set; }
+
+    /// <summary>Durable resource consumption.</summary>
+    [JsonPropertyName("consumed")]
+    public FactoryRunConsumed Consumed { get => field ??= new(); set; }
+
+    /// <summary>Epoch milliseconds when the run was created.</summary>
+    [JsonPropertyName("createdAt")]
+    public long CreatedAt { get; set; }
+
+    /// <summary>Current phase identity, or null before any phase is entered.</summary>
+    [JsonPropertyName("currentPhase")]
+    public FactoryCurrentPhase? CurrentPhase { get; set; }
+
+    /// <summary>Resource ceilings declared by the factory.</summary>
+    [JsonPropertyName("declaredLimits")]
+    public FactoryDeclaredLimits DeclaredLimits { get => field ??= new(); set; }
+
+    /// <summary>Number of phases declared by the factory.</summary>
+    [JsonPropertyName("declaredPhaseCount")]
+    public long DeclaredPhaseCount { get; set; }
+
+    /// <summary>Human-readable factory description.</summary>
+    [JsonPropertyName("description")]
+    public string Description { get; set; } = string.Empty;
+
+    /// <summary>Registered factory name.</summary>
+    [JsonPropertyName("factoryName")]
+    public string FactoryName { get; set; } = string.Empty;
+
+    /// <summary>Number of direct factory agents currently live.</summary>
+    [JsonPropertyName("liveAgentCount")]
+    public long LiveAgentCount { get; set; }
+
+    /// <summary>Epoch milliseconds when this live-overlay snapshot was observed.</summary>
+    [JsonPropertyName("observedAt")]
+    public long ObservedAt { get; set; }
+
+    /// <summary>Lifecycle and timing observations for each factory phase.</summary>
+    [JsonPropertyName("phases")]
+    public IList<FactoryPhaseObservation> Phases { get => field ??= []; set; }
+
+    /// <summary>Bidirectional page of durable factory progress.</summary>
+    [JsonPropertyName("progress")]
+    public FactoryProgressPage Progress { get => field ??= new(); set; }
+
+    /// <summary>Monotonic durable run revision.</summary>
+    [JsonPropertyName("revision")]
+    public long Revision { get; set; }
+
+    /// <summary>Factory run identifier.</summary>
+    [JsonPropertyName("runId")]
+    public string RunId { get; set; } = string.Empty;
+
+    /// <summary>Epoch milliseconds when execution first started, or null before start.</summary>
+    [JsonPropertyName("startedAt")]
+    public long? StartedAt { get; set; }
+
+    /// <summary>Current factory run status.</summary>
+    [JsonPropertyName("status")]
+    public FactoryRunStatus Status { get; set; }
+
+    /// <summary>Terminal run outcome, or null while nonterminal.</summary>
+    [JsonPropertyName("terminal")]
+    public FactoryRunTerminal? Terminal { get; set; }
+
+    /// <summary>Total direct factory agents spawned across all attempts.</summary>
+    [JsonPropertyName("totalSpawnedAgentCount")]
+    public long TotalSpawnedAgentCount { get; set; }
+
+    /// <summary>Epoch milliseconds when the durable run was last updated.</summary>
+    [JsonPropertyName("updatedAt")]
+    public long UpdatedAt { get; set; }
 }
 
-/// <summary>Optional session context used when creating a local workspace.</summary>
+/// <summary>Parameters for paging factory progress.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class WorkspacesEnsureRequest
+internal sealed class FactoryGetRunProgressRequest
 {
-    /// <summary>Opaque workspace context supplied by the session host.</summary>
-    [JsonPropertyName("context")]
-    public JsonElement? Context { get; set; }
+    /// <summary>Exclusive forward cursor.</summary>
+    [JsonPropertyName("afterSeq")]
+    public long? AfterSeq { get; set; }
+
+    /// <summary>Exclusive backward cursor.</summary>
+    [JsonPropertyName("beforeSeq")]
+    public long? BeforeSeq { get; set; }
+
+    /// <summary>Maximum records to return. Defaults to 200 and is capped at 500.</summary>
+    [JsonPropertyName("limit")]
+    public int? Limit { get; set; }
+
+    /// <summary>Optional phase identifier used to scope records and cursors.</summary>
+    [JsonPropertyName("phaseId")]
+    public string? PhaseId { get; set; }
+
+    /// <summary>Factory run identifier.</summary>
+    [JsonPropertyName("runId")]
+    public string RunId { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Relative paths of files stored in the session workspace files directory.</summary>
+/// <summary>Parameters for cancelling a factory run.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class WorkspacesListFilesResult
+internal sealed class FactoryCancelRequest
 {
-    /// <summary>Relative file paths in the workspace files directory.</summary>
-    [JsonPropertyName("files")]
-    public IList<string> Files { get => field ??= []; set; }
-}
+    /// <summary>Factory run identifier.</summary>
+    [JsonPropertyName("runId")]
+    public string RunId { get; set; } = string.Empty;
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionWorkspacesListFilesRequest
-{
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Contents of the requested workspace file as a UTF-8 string.</summary>
+/// <summary>Acknowledgement that a factory request was accepted.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class WorkspacesReadFileResult
+public sealed class FactoryAckResult
 {
-    /// <summary>File content as a UTF-8 string.</summary>
-    [JsonPropertyName("content")]
-    public string Content { get; set; } = string.Empty;
 }
 
-/// <summary>Relative path of the workspace file to read.</summary>
+/// <summary>One ordered factory progress line.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class WorkspacesReadFileRequest
-{
-    /// <summary>Relative path within the workspace files directory.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
-
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
-
-/// <summary>Relative path and UTF-8 content for the workspace file to create or overwrite.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class WorkspacesCreateFileRequest
+public sealed class FactoryLogLine
 {
-    /// <summary>File content to write as a UTF-8 string.</summary>
-    [JsonPropertyName("content")]
-    public string Content { get; set; } = string.Empty;
+    /// <summary>Progress line kind.</summary>
+    [JsonPropertyName("kind")]
+    public FactoryLogLineKind Kind { get; set; }
 
-    /// <summary>Relative path within the workspace files directory.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+    /// <summary>Monotonic sequence number within the factory run.</summary>
+    [JsonPropertyName("seq")]
+    public long Seq { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Progress text.</summary>
+    [JsonPropertyName("text")]
+    public string Text { get; set; } = string.Empty;
 }
 
-/// <summary>Workspace checkpoint metadata with assigned number, human-readable title, and checkpoint filename.</summary>
+/// <summary>Parameters for recording factory progress.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class WorkspacesCheckpoints
+internal sealed class FactoryLogRequest
 {
-    /// <summary>Filename of the checkpoint within the workspace checkpoints directory.</summary>
-    [JsonPropertyName("filename")]
-    public string Filename { get; set; } = string.Empty;
-
-    /// <summary>Checkpoint number assigned by the workspace manager.</summary>
-    [JsonPropertyName("number")]
-    public long Number { get; set; }
+    /// <summary>Opaque token identifying the current factory execution attempt.</summary>
+    [JsonPropertyName("executionToken")]
+    public string ExecutionToken { get; set; } = string.Empty;
 
-    /// <summary>Human-readable checkpoint title.</summary>
-    [JsonPropertyName("title")]
-    public string Title { get; set; } = string.Empty;
-}
+    /// <summary>Ordered progress lines to append.</summary>
+    [JsonPropertyName("lines")]
+    public IList<FactoryLogLine> Lines { get => field ??= []; set; }
 
-/// <summary>Workspace checkpoints in chronological order; empty when the workspace is not enabled.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class WorkspacesListCheckpointsResult
-{
-    /// <summary>Workspace checkpoints in chronological order. Empty when workspace is not enabled.</summary>
-    [JsonPropertyName("checkpoints")]
-    public IList<WorkspacesCheckpoints> Checkpoints { get => field ??= []; set; }
-}
+    /// <summary>Factory run identifier.</summary>
+    [JsonPropertyName("runId")]
+    public string RunId { get; set; } = string.Empty;
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionWorkspacesListCheckpointsRequest
-{
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Checkpoint content as a UTF-8 string, or null when the checkpoint or workspace is missing.</summary>
+/// <summary>Result of one factory-scoped subagent call.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class WorkspacesReadCheckpointResult
+public sealed class FactoryAgentResult
 {
-    /// <summary>Checkpoint content as a UTF-8 string, or null when the checkpoint or workspace is missing.</summary>
-    [JsonPropertyName("content")]
-    public string? Content { get; set; }
+    /// <summary>Agent result, omitted when the agent produced no result.</summary>
+    [JsonPropertyName("result")]
+    public JsonElement? Result { get; set; }
 }
 
-/// <summary>Checkpoint number to read.</summary>
+/// <summary>Options for one factory-scoped subagent call.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class WorkspacesReadCheckpointRequest
+public sealed class FactoryAgentOptions
 {
-    /// <summary>Checkpoint number to read.</summary>
-    [JsonPropertyName("number")]
-    public long Number { get; set; }
+    /// <summary>Optional custom agent name for the subagent. This field is accepted but not yet honored.</summary>
+    [JsonPropertyName("agent")]
+    public string? Agent { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Optional context tier for the subagent. This field is accepted but not yet honored.</summary>
+    [JsonPropertyName("contextTier")]
+    public ContextTier? ContextTier { get; set; }
 
-/// <summary>Metadata for the persisted summary.</summary>
-public sealed class WorkspacesAddSummaryResultSummary
-{
-}
+    /// <summary>Optional label distinguishing otherwise identical memoized agent calls.</summary>
+    [JsonPropertyName("label")]
+    public string? Label { get; set; }
 
-/// <summary>Refreshed metadata for the containing workspace.</summary>
-public sealed class WorkspacesAddSummaryResultWorkspace
-{
-}
+    /// <summary>Optional model identifier for the subagent.</summary>
+    [JsonPropertyName("model")]
+    public string? Model { get; set; }
 
-/// <summary>Persisted summary metadata and refreshed workspace metadata.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class WorkspacesAddSummaryResult
-{
-    /// <summary>Metadata for the persisted summary.</summary>
-    [JsonPropertyName("summary")]
-    public WorkspacesAddSummaryResultSummary? Summary { get; set; }
+    /// <summary>Optional reasoning effort for the subagent. This field is accepted but not yet honored.</summary>
+    [JsonPropertyName("reasoningEffort")]
+    public string? ReasoningEffort { get; set; }
 
-    /// <summary>Refreshed metadata for the containing workspace.</summary>
-    [JsonPropertyName("workspace")]
-    public WorkspacesAddSummaryResultWorkspace? Workspace { get; set; }
+    /// <summary>Optional JSON Schema for structured agent output.</summary>
+    [JsonPropertyName("schema")]
+    public JsonElement? Schema { get; set; }
 }
 
-/// <summary>Compaction summary checkpoint to persist.</summary>
+/// <summary>Parameters for one factory-scoped subagent call.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class WorkspacesAddSummaryRequest
+internal sealed class FactoryAgentRequest
 {
-    /// <summary>Markdown summary content to persist.</summary>
-    [JsonPropertyName("content")]
-    public string Content { get; set; } = string.Empty;
+    /// <summary>Opaque token identifying the current factory execution attempt.</summary>
+    [JsonPropertyName("executionToken")]
+    public string ExecutionToken { get; set; } = string.Empty;
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Factory run identifier that owns the subagent.</summary>
+    [JsonPropertyName("factoryRunId")]
+    public string FactoryRunId { get; set; } = string.Empty;
 
-    /// <summary>Summary title shown in checkpoint listings.</summary>
-    [JsonPropertyName("title")]
-    public string Title { get; set; } = string.Empty;
-}
+    /// <summary>Subagent execution options.</summary>
+    [JsonPropertyName("opts")]
+    public FactoryAgentOptions Opts { get => field ??= new(); set; }
 
-/// <summary>Rollback point for local workspace summaries.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class WorkspacesTruncateSummariesRequest
-{
-    /// <summary>Number of newest summaries to keep.</summary>
-    [JsonPropertyName("keepCount")]
-    public long KeepCount { get; set; }
+    /// <summary>Prompt to send to the subagent.</summary>
+    [JsonPropertyName("prompt")]
+    public string Prompt { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Autopilot objective file content, or null when missing.</summary>
+/// <summary>Result of reading a factory journal entry.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class WorkspacesReadAutopilotObjectiveResult
+public sealed class FactoryJournalGetResult
 {
-    /// <summary>Autopilot objective file content, or null when missing.</summary>
-    [JsonPropertyName("content")]
-    public string? Content { get; set; }
+    /// <summary>Whether the journal contained the requested key.</summary>
+    [JsonPropertyName("hit")]
+    public bool Hit { get; set; }
+
+    /// <summary>Cached JSON result. The hit field distinguishes a cached JSON null from a miss.</summary>
+    [JsonPropertyName("resultJson")]
+    public JsonElement? ResultJson { get; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Parameters for reading a factory journal entry.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionWorkspacesReadAutopilotObjectiveRequest
+internal sealed class FactoryJournalGetRequest
 {
+    /// <summary>Opaque token identifying the current factory execution attempt.</summary>
+    [JsonPropertyName("executionToken")]
+    public string ExecutionToken { get; set; } = string.Empty;
+
+    /// <summary>Namespaced journal key.</summary>
+    [JsonPropertyName("key")]
+    public string Key { get; set; } = string.Empty;
+
+    /// <summary>Factory run identifier.</summary>
+    [JsonPropertyName("runId")]
+    public string RunId { get; set; } = string.Empty;
+
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Result of writing the autopilot objective file.</summary>
+/// <summary>Parameters for storing a factory journal entry.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class WorkspacesWriteAutopilotObjectiveResult
+internal sealed class FactoryJournalPutRequest
 {
-    /// <summary>Filesystem operation performed.</summary>
-    [JsonPropertyName("operation")]
-    public string Operation { get; set; } = string.Empty;
-}
+    /// <summary>Opaque token identifying the current factory execution attempt.</summary>
+    [JsonPropertyName("executionToken")]
+    public string ExecutionToken { get; set; } = string.Empty;
 
-/// <summary>Autopilot objective file content to persist.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class WorkspacesWriteAutopilotObjectiveRequest
-{
-    /// <summary>Autopilot objective file content.</summary>
-    [JsonPropertyName("content")]
-    public string Content { get; set; } = string.Empty;
+    /// <summary>Namespaced journal key.</summary>
+    [JsonPropertyName("key")]
+    public string Key { get; set; } = string.Empty;
+
+    /// <summary>JSON result to memoize.</summary>
+    [JsonPropertyName("resultJson")]
+    public JsonElement ResultJson { get; set; }
+
+    /// <summary>Factory run identifier.</summary>
+    [JsonPropertyName("runId")]
+    public string RunId { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Result of deleting the autopilot objective file.</summary>
+/// <summary>The currently selected model, reasoning effort, and context tier for the session. The context tier reflects `Session.getContextTier()`, restored from the session journal on resume.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class WorkspacesDeleteAutopilotObjectiveResult
+public sealed class CurrentModel
 {
-    /// <summary>True when a file was deleted.</summary>
-    [JsonPropertyName("deleted")]
-    public bool Deleted { get; set; }
+    /// <summary>Context tier for models that support multiple context-window sizes.</summary>
+    [JsonPropertyName("contextTier")]
+    public ContextTier? ContextTier { get; set; }
+
+    /// <summary>Currently active model identifier.</summary>
+    [JsonPropertyName("modelId")]
+    public string? ModelId { get; set; }
+
+    /// <summary>Reasoning effort level currently applied to the active model, when one is set. Reads `Session.getReasoningEffort()` synchronously after `getSelectedModel()` resolves so the two values are reported as a snapshot.</summary>
+    [JsonPropertyName("reasoningEffort")]
+    public string? ReasoningEffort { get; set; }
 }
 
 /// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionWorkspacesDeleteAutopilotObjectiveRequest
+internal sealed class SessionModelGetCurrentRequest
 {
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Whether the autopilot objective file exists.</summary>
+/// <summary>RPC data type for ModelSwitchConfirmation operations.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class WorkspacesAutopilotObjectiveExistsResult
+public sealed class ModelSwitchConfirmation
 {
-    /// <summary>True when the objective file exists.</summary>
-    [JsonPropertyName("exists")]
-    public bool Exists { get; set; }
+    /// <summary>Current conversation token count before switching models.</summary>
+    [JsonPropertyName("currentTokens")]
+    public double CurrentTokens { get; set; }
+
+    /// <summary>Target model token limit used by the compaction preflight.</summary>
+    [JsonPropertyName("targetLimit")]
+    public double TargetLimit { get; set; }
+
+    /// <summary>Display name of the model that requires compaction confirmation.</summary>
+    [JsonPropertyName("targetModelDisplayName")]
+    public string TargetModelDisplayName { get; set; } = string.Empty;
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>The model identifier active on the session after the switch.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionWorkspacesAutopilotObjectiveExistsRequest
+public sealed class ModelSwitchToResult
 {
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Compaction confirmation projection when status is confirmation_required.</summary>
+    [JsonPropertyName("confirmation")]
+    public ModelSwitchConfirmation? Confirmation { get; set; }
 
-/// <summary>RPC data type for WorkspacesSaveLargePasteResultSaved operations.</summary>
-public sealed class WorkspacesSaveLargePasteResultSaved
-{
-    /// <summary>Filename within the workspace files directory.</summary>
-    [JsonPropertyName("filename")]
-    public string Filename { get; set; } = string.Empty;
+    /// <summary>True when the switch was deferred (enqueued as a cancellable `/model` command) because a turn was active or another model change was already queued, rather than applied immediately. When true, the session's live model is unchanged until the queued change drains.</summary>
+    [JsonPropertyName("deferred")]
+    public bool? Deferred { get; set; }
 
-    /// <summary>Absolute filesystem path to the saved paste file.</summary>
-    [JsonPropertyName("filePath")]
-    public string FilePath { get; set; } = string.Empty;
+    /// <summary>Deprecation warnings associated with the selected model or options.</summary>
+    [JsonPropertyName("deprecationWarnings")]
+    public IList<string>? DeprecationWarnings { get; set; }
 
-    /// <summary>Size of the saved file in bytes.</summary>
-    [JsonPropertyName("sizeBytes")]
-    public long SizeBytes { get; set; }
-}
+    /// <summary>User-facing outcome message for the model switch.</summary>
+    [JsonPropertyName("message")]
+    public string? Message { get; set; }
 
-/// <summary>Descriptor for the saved paste file, or null when the workspace is unavailable.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class WorkspacesSaveLargePasteResult
-{
-    /// <summary>Saved-paste descriptor, or null when the workspace is unavailable (e.g. CCA runtime, non-infinite sessions, remote sessions).</summary>
-    [JsonPropertyName("saved")]
-    public WorkspacesSaveLargePasteResultSaved? Saved { get; set; }
-}
+    /// <summary>Currently active model identifier after the switch.</summary>
+    [JsonPropertyName("modelId")]
+    public string? ModelId { get; set; }
 
-/// <summary>Pasted content to save as a UTF-8 file in the session workspace.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class WorkspacesSaveLargePasteRequest
-{
-    /// <summary>Pasted content to save as a UTF-8 file.</summary>
-    [JsonPropertyName("content")]
-    public string Content { get; set; } = string.Empty;
+    /// <summary>Persistence failure encountered after applying the model switch.</summary>
+    [JsonPropertyName("persistenceError")]
+    public string? PersistenceError { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Lifecycle result for the requested switch.</summary>
+    [JsonPropertyName("status")]
+    public string? Status { get; set; }
+
+    /// <summary>User-facing warning produced while applying the model switch.</summary>
+    [JsonPropertyName("warning")]
+    public string? Warning { get; set; }
 }
 
-/// <summary>A single changed file and its unified diff.</summary>
+/// <summary>Vision-specific limits.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class WorkspaceDiffFileChange
+public sealed class ModelCapabilitiesOverrideLimitsVision
 {
-    /// <summary>Type of change represented by this file diff.</summary>
-    [JsonPropertyName("changeType")]
-    public WorkspaceDiffFileChangeType ChangeType { get; set; }
-
-    /// <summary>Unified diff content for the file. Empty when the diff was truncated.</summary>
-    [JsonPropertyName("diff")]
-    public string Diff { get; set; } = string.Empty;
-
-    /// <summary>Whether the diff content was omitted because it exceeded the per-file size limit.</summary>
-    [JsonPropertyName("isTruncated")]
-    public bool? IsTruncated { get; set; }
+    /// <summary>Maximum image size in bytes.</summary>
+    [JsonPropertyName("max_prompt_image_size")]
+    public long? MaxPromptImageSize { get; set; }
 
-    /// <summary>Original file path for renamed files.</summary>
-    [JsonPropertyName("oldPath")]
-    public string? OldPath { get; set; }
+    /// <summary>Maximum number of images per prompt.</summary>
+    [JsonPropertyName("max_prompt_images")]
+    public long? MaxPromptImages { get; set; }
 
-    /// <summary>Path to the changed file, relative to the workspace root when the file lives under it. A file changed outside the workspace root keeps a `../`-relative path, or an absolute path when no relative path exists (for example a different Windows drive).</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+    /// <summary>MIME types the model accepts.</summary>
+    [JsonPropertyName("supported_media_types")]
+    public IList<string>? SupportedMediaTypes { get; set; }
 }
 
-/// <summary>Workspace diff result for the requested mode.</summary>
+/// <summary>Token limits for prompts, outputs, and context window.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class WorkspaceDiffResult
+public sealed class ModelCapabilitiesOverrideLimits
 {
-    /// <summary>Default branch used for a branch diff, when branch mode was requested.</summary>
-    [JsonPropertyName("baseBranch")]
-    public string? BaseBranch { get; set; }
-
-    /// <summary>Changed files and their unified diffs.</summary>
-    [JsonPropertyName("changes")]
-    public IList<WorkspaceDiffFileChange> Changes { get => field ??= []; set; }
-
-    /// <summary>Whether the requested diff fell back to unstaged changes, either because branch diff failed or session diff was unavailable.</summary>
-    [JsonPropertyName("isFallback")]
-    public bool IsFallback { get; set; }
+    /// <summary>Maximum total context window size in tokens.</summary>
+    [JsonPropertyName("max_context_window_tokens")]
+    public long? MaxContextWindowTokens { get; set; }
 
-    /// <summary>Effective mode used for the returned changes.</summary>
-    [JsonPropertyName("mode")]
-    public WorkspaceDiffMode Mode { get; set; }
+    /// <summary>Maximum number of output/completion tokens.</summary>
+    [JsonPropertyName("max_output_tokens")]
+    public long? MaxOutputTokens { get; set; }
 
-    /// <summary>Diff mode requested by the client.</summary>
-    [JsonPropertyName("requestedMode")]
-    public WorkspaceDiffMode RequestedMode { get; set; }
+    /// <summary>Maximum number of prompt/input tokens.</summary>
+    [JsonPropertyName("max_prompt_tokens")]
+    public long? MaxPromptTokens { get; set; }
 
-    /// <summary>Why the session diff could not be produced, when applicable. Set only when `session` mode was requested and `isFallback` is true, so a client can tell the permanent `file-change-tracking-disabled` apart from the transient `session-busy`, which the same request answers once the session settles. Never set for `unstaged` or `branch` mode, and never `unsupported-remote-session`: a remote session's captures live on its own host, so a `session`-mode diff is rejected for one rather than answered with a controller-side fallback.</summary>
-    [JsonPropertyName("unavailableReason")]
-    public HistoryRewindUnavailableReason? UnavailableReason { get; set; }
+    /// <summary>Vision-specific limits.</summary>
+    [JsonPropertyName("vision")]
+    public ModelCapabilitiesOverrideLimitsVision? Vision { get; set; }
 }
 
-/// <summary>Parameters for computing a workspace diff.</summary>
+/// <summary>Feature flags indicating what the model supports.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class WorkspacesDiffRequest
+public sealed class ModelCapabilitiesOverrideSupports
 {
-    /// <summary>When true, ignore whitespace-only changes (git `--ignore-all-space`). Defaults to false.</summary>
-    [JsonPropertyName("ignoreWhitespace")]
-    public bool? IgnoreWhitespace { get; set; }
+    /// <summary>Resolved Anthropic adaptive-thinking capability — unsupported / optional / required. 'required' models reject thinking.type='enabled' with HTTP 400 (e.g. opus-4.7/4.8).</summary>
+    [JsonPropertyName("adaptive_thinking")]
+    public AdaptiveThinkingSupport? AdaptiveThinking { get; set; }
 
-    /// <summary>Diff mode requested by the client.</summary>
-    [JsonPropertyName("mode")]
-    public WorkspaceDiffMode Mode { get; set; }
+    /// <summary>Whether this model supports reasoning effort configuration.</summary>
+    [JsonPropertyName("reasoningEffort")]
+    public bool? ReasoningEffort { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Whether this model supports vision/image input.</summary>
+    [JsonPropertyName("vision")]
+    public bool? Vision { get; set; }
 }
 
-/// <summary>Characters that, when typed in the composer, should trigger a `completions.request`. Empty when the session has no host-driven completions (e.g. local sessions, or a relay host that does not advertise `completionTriggerCharacters`).</summary>
+/// <summary>Optional capability overrides (vision, tool_calls, reasoning, etc.).</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class CompletionsGetTriggerCharactersResult
+public sealed class ModelCapabilitiesOverride
 {
-    /// <summary>Trigger characters advertised by the host (e.g. `["@", "#"]`). Empty disables host-driven completions for the session.</summary>
-    [JsonPropertyName("triggerCharacters")]
-    public IList<string> TriggerCharacters { get => field ??= []; set; }
+    /// <summary>Token limits for prompts, outputs, and context window.</summary>
+    [JsonPropertyName("limits")]
+    public ModelCapabilitiesOverrideLimits? Limits { get; set; }
+
+    /// <summary>Feature flags indicating what the model supports.</summary>
+    [JsonPropertyName("supports")]
+    public ModelCapabilitiesOverrideSupports? Supports { get; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionCompletionsGetTriggerCharactersRequest
+/// <summary>Environment variables consulted while resolving model-picker settings.</summary>
+public sealed class ModelPickerSettingsContextEnvironment
 {
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>A single host-driven completion. Accepting an item replaces `[rangeStart, rangeEnd)` (UTF-16 code units) in the composer with `insertText`; when the range is absent, the active token around the cursor is replaced.</summary>
+/// <summary>Filesystem and environment context used to resolve model-picker settings.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionCompletionItem
+public sealed class ModelPickerSettingsContext
 {
-    /// <summary>Text spliced into the composer when the item is accepted.</summary>
-    [JsonPropertyName("insertText")]
-    public string InsertText { get; set; } = string.Empty;
-
-    /// <summary>Render-kind hint for the picker row (e.g. `"document"`, `"directory"`), derived from the host's display kind.</summary>
-    [JsonPropertyName("kind")]
-    public string? Kind { get; set; }
-
-    /// <summary>Primary display label for the picker row. Falls back to `insertText` when absent.</summary>
-    [JsonPropertyName("label")]
-    public string? Label { get; set; }
+    /// <summary>Optional Copilot configuration directory containing persisted settings.</summary>
+    [JsonPropertyName("configDir")]
+    public string? ConfigDir { get; set; }
 
-    /// <summary>End (exclusive) of the replacement range in `text`, in UTF-16 code units.</summary>
-    [JsonPropertyName("rangeEnd")]
-    public long? RangeEnd { get; set; }
+    /// <summary>Environment variables consulted while resolving model-picker settings.</summary>
+    [JsonPropertyName("environment")]
+    public ModelPickerSettingsContextEnvironment Environment { get => field ??= new(); set; }
 
-    /// <summary>Start of the replacement range in `text`, in UTF-16 code units.</summary>
-    [JsonPropertyName("rangeStart")]
-    public long? RangeStart { get; set; }
+    /// <summary>User home directory used when resolving persisted settings.</summary>
+    [JsonPropertyName("homeDirectory")]
+    public string HomeDirectory { get; set; } = string.Empty;
 }
 
-/// <summary>Host-driven completion items for the current composer input. Empty when the host returns no items or does not support completions.</summary>
+/// <summary>RPC data type for ModelPickerPersistence operations.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class CompletionsRequestResult
+public sealed class ModelPickerPersistenceRequest
 {
-    /// <summary>Completion items in host-ranked order.</summary>
-    [JsonPropertyName("items")]
-    public IList<SessionCompletionItem> Items { get => field ??= []; set; }
+    /// <summary>Whether context tier was explicitly selected and should be persisted.</summary>
+    [JsonPropertyName("contextTierExplicit")]
+    public bool? ContextTierExplicit { get; set; }
+
+    /// <summary>Whether reasoning effort was explicitly selected and should be persisted.</summary>
+    [JsonPropertyName("reasoningEffortExplicit")]
+    public bool? ReasoningEffortExplicit { get; set; }
+
+    /// <summary>Filesystem and environment context used to resolve settings persistence.</summary>
+    [JsonPropertyName("settingsContext")]
+    public ModelPickerSettingsContext SettingsContext { get => field ??= new(); set; }
 }
 
-/// <summary>Request host-driven completions for the current composer input.</summary>
+/// <summary>Target model identifier and optional reasoning effort, summary, capability overrides, and context tier.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class CompletionsRequestRequest
+internal sealed class ModelSwitchToRequest
 {
-    /// <summary>Cursor offset within `text`, in UTF-16 code units.</summary>
-    [JsonPropertyName("offset")]
-    public long Offset { get; set; }
+    /// <summary>Explicit response to a model-switch compaction preflight. Omit to request a confirmation projection when compaction is necessary.</summary>
+    [JsonPropertyName("compactionDecision")]
+    public string? CompactionDecision { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Explicit context tier for the selected model. `"default"` / `"long_context"` apply the requested tier; omit this field to use normal model behavior with no explicit tier.</summary>
+    [JsonPropertyName("contextTier")]
+    public ContextTier? ContextTier { get; set; }
 
-    /// <summary>The full composed composer input.</summary>
-    [JsonPropertyName("text")]
-    public string Text { get; set; } = string.Empty;
-}
+    /// <summary>When true, defer this switch (enqueue it) if another model change is already queued, even when no turn is active — so it drains last (FIFO) and wins over the already-queued change. Intended for genuine user-initiated model selections; internal restore/reapply switches omit it and apply immediately when no turn is active. When no other model change is queued this has no effect (a switch still applies immediately unless a turn is active).</summary>
+    [JsonPropertyName("deferIfModelChangeQueued")]
+    public bool? DeferIfModelChangeQueued { get; set; }
 
-/// <summary>Instruction sources loaded for the session, in merge order.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class InstructionsGetSourcesResult
-{
-    /// <summary>Instruction sources for the session.</summary>
-    [JsonPropertyName("sources")]
-    public IList<InstructionSource> Sources { get => field ??= []; set; }
-}
+    /// <summary>Override individual model capabilities resolved by the runtime.</summary>
+    [JsonPropertyName("modelCapabilities")]
+    public ModelCapabilitiesOverride? ModelCapabilities { get; set; }
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionInstructionsGetSourcesRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Settings scope used when persisting the selected model.</summary>
+    [JsonPropertyName("modelChangeScope")]
+    public string? ModelChangeScope { get; set; }
 
-/// <summary>Indicates whether fleet mode was successfully activated.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class FleetStartResult
-{
-    /// <summary>Whether fleet mode was successfully activated.</summary>
-    [JsonPropertyName("started")]
-    public bool Started { get; set; }
-}
+    /// <summary>Model selection id to switch to, as returned by `list`. A bare id (e.g. `claude-sonnet-4.6`) names a Copilot (CAPI) model; a provider-qualified id (`provider/id`, e.g. `acme/claude-sonnet`) targets a registry BYOK model.</summary>
+    [JsonPropertyName("modelId")]
+    public string ModelId { get; set; } = string.Empty;
 
-/// <summary>Optional user prompt to combine with the fleet orchestration instructions.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class FleetStartRequest
-{
-    /// <summary>Optional user prompt to combine with fleet instructions.</summary>
-    [JsonPropertyName("prompt")]
-    public string? Prompt { get; set; }
+    /// <summary>Optional settings context and explicit-override flags used to persist a picker selection.</summary>
+    [JsonPropertyName("pickerPersistence")]
+    public ModelPickerPersistenceRequest? PickerPersistence { get; set; }
+
+    /// <summary>Reasoning effort level to use for the model. CAPI values are model-defined and validated against the selected model; BYOK providers may define additional values. "none" disables reasoning. When omitted, no effort override is applied.</summary>
+    [JsonPropertyName("reasoningEffort")]
+    public string? ReasoningEffort { get; set; }
+
+    /// <summary>Reasoning summary mode to request for supported model clients.</summary>
+    [JsonPropertyName("reasoningSummary")]
+    public ReasoningSummary? ReasoningSummary { get; set; }
+
+    /// <summary>Optional repository settings scope to persist after the switch commits.</summary>
+    [JsonPropertyName("repoScope")]
+    public string? RepoScope { get; set; }
+
+    /// <summary>Require the target to be currently available and enabled before applying the switch.</summary>
+    [JsonPropertyName("requireAvailable")]
+    public bool? RequireAvailable { get; set; }
+
+    /// <summary>When true, evaluate context-window compaction policy before applying the switch.</summary>
+    [JsonPropertyName("runCompactionPreflight")]
+    public bool? RunCompactionPreflight { get; set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
-}
 
-/// <summary>Agents available to the session.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class AgentList
-{
-    /// <summary>Available agents.</summary>
-    [JsonPropertyName("agents")]
-    public IList<AgentInfo> Agents { get => field ??= []; set; }
+    /// <summary>Origin to record on the effective `session.model_change` event. Defaults to `sdk` when omitted.</summary>
+    [JsonPropertyName("source")]
+    public ModelChangeSource? Source { get; set; }
+
+    /// <summary>Output verbosity level to request for supported models.</summary>
+    [JsonPropertyName("verbosity")]
+    public Verbosity? Verbosity { get; set; }
 }
 
-/// <summary>RPC data type for SessionAgentList operations.</summary>
+/// <summary>Managed, repository, and CLI model overrides to overlay onto the session at startup.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionAgentListRequest
+internal sealed class ModelApplyStartupOverlayRequest
 {
-    /// <summary>When true, request the session's configured built-in agents alongside custom agents. Listing applies feature, context, inclusion, exclusion, and user-disabled-agent policy, but does not evaluate transient invocation requirements such as model availability. Built-in metadata may be omitted when the session cannot project it, such as a relay session.</summary>
-    [JsonPropertyName("includeBuiltInAgents")]
-    public bool? IncludeBuiltInAgents { get; set; }
+    /// <summary>Model explicitly selected by the CLI, when provided.</summary>
+    [JsonPropertyName("cliModel")]
+    public string? CliModel { get; set; }
 
-    /// <summary>When true, request authored base prompt text on each AgentInfo. Prompt text may be omitted when unavailable, such as for agents projected through a relay session.</summary>
-    [JsonPropertyName("includePrompt")]
-    public bool? IncludePrompt { get; set; }
-}
+    /// <summary>Whether the overlay is being applied while resuming a deferred session.</summary>
+    [JsonPropertyName("deferredResume")]
+    public bool? DeferredResume { get; set; }
 
-/// <summary>RPC data type for SessionAgentListRequestWithSession operations.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionAgentListRequestWithSession
-{
-    /// <summary>When true, request the session's configured built-in agents alongside custom agents. Listing applies feature, context, inclusion, exclusion, and user-disabled-agent policy, but does not evaluate transient invocation requirements such as model availability. Built-in metadata may be omitted when the session cannot project it, such as a relay session.</summary>
-    [JsonPropertyName("includeBuiltInAgents")]
-    public bool? IncludeBuiltInAgents { get; set; }
+    /// <summary>Model required by device-managed policy, when configured.</summary>
+    [JsonPropertyName("deviceManagedModel")]
+    public string? DeviceManagedModel { get; set; }
 
-    /// <summary>When true, request authored base prompt text on each AgentInfo. Prompt text may be omitted when unavailable, such as for agents projected through a relay session.</summary>
-    [JsonPropertyName("includePrompt")]
-    public bool? IncludePrompt { get; set; }
+    /// <summary>Context tier selected by repository settings, when configured.</summary>
+    [JsonPropertyName("repoContextTier")]
+    public string? RepoContextTier { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Model selected by repository settings, when configured.</summary>
+    [JsonPropertyName("repoModel")]
+    public string? RepoModel { get; set; }
 
-/// <summary>An in-memory authored prompt override for an available agent.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class AgentSetPromptRequest
-{
-    /// <summary>Stable effective agent id. Plugin namespace separators are normalized.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
+    /// <summary>Reasoning effort selected by repository settings, when configured.</summary>
+    [JsonPropertyName("repoReasoningEffort")]
+    public string? RepoReasoningEffort { get; set; }
 
-    /// <summary>Replacement authored prompt. Empty text is valid.</summary>
-    [JsonPropertyName("prompt")]
-    public string Prompt { get; set; } = string.Empty;
+    /// <summary>Model required by server-managed policy, when configured.</summary>
+    [JsonPropertyName("serverManagedModel")]
+    public string? ServerManagedModel { get; set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>The currently selected custom agent, or null when using the default agent.</summary>
+/// <summary>Update the session's reasoning effort without changing the selected model. Use `switchTo` instead when you also need to change the model. The runtime stores the effort on the session and applies it to subsequent turns.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class AgentGetCurrentResult
+public sealed class ModelSetReasoningEffortResult
 {
-    /// <summary>Currently selected custom agent, or null if using the default agent.</summary>
-    [JsonPropertyName("agent")]
-    public AgentInfo? Agent { get; set; }
+    /// <summary>Reasoning effort level recorded on the session after the update.</summary>
+    [JsonPropertyName("reasoningEffort")]
+    public string ReasoningEffort { get; set; } = string.Empty;
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Reasoning effort level to apply to the currently selected model.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionAgentGetCurrentRequest
+internal sealed class ModelSetReasoningEffortRequest
 {
+    /// <summary>Reasoning effort level to apply to the currently selected model. The host is responsible for validating the value against the model's supported levels before calling.</summary>
+    [JsonPropertyName("reasoningEffort")]
+    public string ReasoningEffort { get; set; } = string.Empty;
+
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>The newly selected custom agent.</summary>
+/// <summary>Cost-category metadata for a CAPI model.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class AgentSelectResult
+public sealed class SessionModelPriceCategory
 {
-    /// <summary>The newly selected custom agent.</summary>
-    [JsonPropertyName("agent")]
-    public AgentInfo Agent { get => field ??= new(); set; }
+    /// <summary>CAPI model identifier.</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
+
+    /// <summary>Cost category assigned to the model.</summary>
+    [JsonPropertyName("priceCategory")]
+    public ModelPickerPriceCategory PriceCategory { get; set; }
 }
 
-/// <summary>Name of the custom agent to select for subsequent turns.</summary>
+/// <summary>The list of models available to this session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class AgentSelectRequest
+public sealed class SessionModelList
 {
-    /// <summary>Name of the custom agent to select.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Available models, ordered with the most preferred default first. Includes both Copilot (CAPI) models and any registry BYOK models; a BYOK model appears under its provider-qualified selection id (`provider/id`).</summary>
+    [JsonPropertyName("list")]
+    public IList<JsonElement> List { get => field ??= []; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Cost categories for the full CAPI catalog, including picker-disabled models that Auto may select. Metadata only; entries absent from `list` are not manually selectable.</summary>
+    [JsonPropertyName("modelPriceCategories")]
+    public IList<SessionModelPriceCategory>? ModelPriceCategories { get; set; }
+
+    /// <summary>Per-quota snapshots returned alongside the model list, keyed by quota type.</summary>
+    [JsonPropertyName("quotaSnapshots")]
+    public IDictionary<string, JsonElement>? QuotaSnapshots { get; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>RPC data type for SessionModelList operations.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionAgentDeselectRequest
+public sealed class SessionModelListRequest
 {
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>If true, bypasses the per-session model list cache and re-fetches from CAPI.</summary>
+    [JsonPropertyName("skipCache")]
+    public bool? SkipCache { get; set; }
 }
 
-/// <summary>Custom agents available to the session after reloading definitions from disk.</summary>
+/// <summary>RPC data type for SessionModelListRequestWithSession operations.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class AgentReloadResult
+internal sealed class SessionModelListRequestWithSession
 {
-    /// <summary>Reloaded custom agents.</summary>
-    [JsonPropertyName("agents")]
-    public IList<AgentInfo> Agents { get => field ??= []; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>If true, bypasses the per-session model list cache and re-fetches from CAPI.</summary>
+    [JsonPropertyName("skipCache")]
+    public bool? SkipCache { get; set; }
 }
 
 /// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionAgentReloadRequest
+internal sealed class SessionModeGetRequest
 {
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Identifier assigned to the newly started background agent task.</summary>
+/// <summary>Outcome of a session mode change, including any model switch it triggered and follow-up the host must perform.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class TasksStartAgentResult
+public sealed class ModeSetResult
 {
-    /// <summary>Generated agent ID for the background task.</summary>
-    [JsonPropertyName("agentId")]
-    public string AgentId { get; set; } = string.Empty;
-}
+    /// <summary>Whether the host should arm an interactive continuation after the mode change.</summary>
+    [JsonPropertyName("armInteractiveContinuation")]
+    public bool? ArmInteractiveContinuation { get; set; }
 
-/// <summary>Agent type, prompt, name, and optional description and model override for the new task.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class TasksStartAgentRequest
-{
-    /// <summary>Type of agent to start (e.g., 'explore', 'task', 'general-purpose').</summary>
-    [JsonPropertyName("agentType")]
-    public string AgentType { get; set; } = string.Empty;
+    /// <summary>Compaction confirmation required before the mode change can complete.</summary>
+    [JsonPropertyName("confirmation")]
+    public ModelSwitchConfirmation? Confirmation { get; set; }
 
-    /// <summary>Short description of the task.</summary>
-    [JsonPropertyName("description")]
-    public string? Description { get; set; }
+    /// <summary>Whether the host must defer implementing the requested mode change.</summary>
+    [JsonPropertyName("deferImplementation")]
+    public bool? DeferImplementation { get; set; }
 
-    /// <summary>Optional model override.</summary>
-    [JsonPropertyName("model")]
-    public string? Model { get; set; }
+    /// <summary>Deprecation warnings associated with the model selected by the mode change.</summary>
+    [JsonPropertyName("deprecationWarnings")]
+    public IList<string>? DeprecationWarnings { get; set; }
 
-    /// <summary>Friendly, non-unique name used when displaying the agent.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>User-facing outcome message for the model switch triggered by the mode change.</summary>
+    [JsonPropertyName("message")]
+    public string? Message { get; set; }
 
-    /// <summary>Task prompt for the agent.</summary>
-    [JsonPropertyName("prompt")]
-    public string Prompt { get; set; } = string.Empty;
+    /// <summary>Whether applying the mode changed the active model.</summary>
+    [JsonPropertyName("modelChanged")]
+    public bool ModelChanged { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Lifecycle status of the requested mode change.</summary>
+    [JsonPropertyName("status")]
+    public string Status { get; set; } = string.Empty;
+
+    /// <summary>User-facing warning produced while applying the mode change.</summary>
+    [JsonPropertyName("warning")]
+    public string? Warning { get; set; }
 }
 
-/// <summary>Tracked task union returned by task APIs, containing either an agent task or a shell task.</summary>
-/// <remarks>Polymorphic base type discriminated by <c>type</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
-[JsonPolymorphic(
-    TypeDiscriminatorPropertyName = "type",
-    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
-[JsonDerivedType(typeof(TaskInfoAgent), "agent")]
-[JsonDerivedType(typeof(TaskInfoShell), "shell")]
-public partial class TaskInfo
-{
-    /// <summary>The type discriminator.</summary>
-    [JsonPropertyName("type")]
-    public virtual string Type { get; set; } = string.Empty;
-}
-
-
-/// <summary>Tracked background agent task metadata, including IDs, status, timing, agent type, prompt, model, result, and latest response.</summary>
-/// <remarks>The <c>agent</c> variant of <see cref="TaskInfo"/>.</remarks>
+/// <summary>Agent interaction mode to apply to the session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class TaskInfoAgent : TaskInfo
+internal sealed class ModeSetRequest
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "agent";
-
-    /// <summary>ISO 8601 timestamp when the current active period began.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("activeStartedAt")]
-    public DateTimeOffset? ActiveStartedAt { get; set; }
-
-    /// <summary>Accumulated active execution time in milliseconds.</summary>
-    [JsonConverter(typeof(MillisecondsTimeSpanConverter))]
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("activeTimeMs")]
-    public TimeSpan? ActiveTime { get; set; }
-
-    /// <summary>Type of agent running this task.</summary>
-    [JsonPropertyName("agentType")]
-    public required string AgentType { get; set; }
-
-    /// <summary>Whether the task is currently in the original sync wait and can be moved to background mode. False once it is already backgrounded, idle, finished, or no longer has a promotable sync waiter.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("canPromoteToBackground")]
-    public bool? CanPromoteToBackground { get; set; }
-
-    /// <summary>ISO 8601 timestamp when the task finished.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("completedAt")]
-    public DateTimeOffset? CompletedAt { get; set; }
-
-    /// <summary>Short description of the task.</summary>
-    [JsonPropertyName("description")]
-    public required string Description { get; set; }
-
-    /// <summary>Friendly, non-unique name intended for display.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("displayName")]
-    public string? DisplayName { get; set; }
-
-    /// <summary>Error message when the task failed.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("error")]
-    public string? Error { get; set; }
+    /// <summary>Explicit response to a model-switch compaction preflight.</summary>
+    [JsonPropertyName("compactionDecision")]
+    public string? CompactionDecision { get; set; }
 
-    /// <summary>Whether task execution is synchronously awaited or managed in the background.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("executionMode")]
-    public TaskExecutionMode? ExecutionMode { get; set; }
+    /// <summary>Session whose plan-mode base state should be inherited.</summary>
+    [JsonPropertyName("inheritPlanBaseFromSessionId")]
+    public string? InheritPlanBaseFromSessionId { get; set; }
 
-    /// <summary>Unique task identifier.</summary>
-    [JsonPropertyName("id")]
-    public required string Id { get; set; }
+    /// <summary>The session mode the agent is operating in.</summary>
+    [JsonPropertyName("mode")]
+    public SessionMode Mode { get; set; }
 
-    /// <summary>ISO 8601 timestamp when the agent entered idle state.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("idleSince")]
-    public DateTimeOffset? IdleSince { get; set; }
+    /// <summary>Whether the selected plan model should be persisted.</summary>
+    [JsonPropertyName("persistPlanSelection")]
+    public bool? PersistPlanSelection { get; set; }
 
-    /// <summary>Most recent response text from the agent.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("latestResponse")]
-    public string? LatestResponse { get; set; }
+    /// <summary>Settings context used when persisting the selected plan model.</summary>
+    [JsonPropertyName("pickerSettingsContext")]
+    public ModelPickerSettingsContext? PickerSettingsContext { get; set; }
 
-    /// <summary>Requested model override for the task when specified.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("model")]
-    public string? Model { get; set; }
+    /// <summary>Context tier to use with the dedicated plan model.</summary>
+    [JsonPropertyName("planContextTier")]
+    public string? PlanContextTier { get; set; }
 
-    /// <summary>Most recent prompt delivered to the agent. Updated whenever the agent receives a follow-up message.</summary>
-    [JsonPropertyName("prompt")]
-    public required string Prompt { get; set; }
+    /// <summary>Action to perform when leaving plan mode.</summary>
+    [JsonPropertyName("planExitAction")]
+    public string? PlanExitAction { get; set; }
 
-    /// <summary>Runtime model resolved for the task when available.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("resolvedModel")]
-    public string? ResolvedModel { get; set; }
+    /// <summary>Dedicated model to use in plan mode, when configured.</summary>
+    [JsonPropertyName("planModel")]
+    public string? PlanModel { get; set; }
 
-    /// <summary>Result text from the task when available.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("result")]
-    public string? Result { get; set; }
+    /// <summary>Whether a dedicated plan model is configured.</summary>
+    [JsonPropertyName("planModelConfigured")]
+    public bool? PlanModelConfigured { get; set; }
 
-    /// <summary>ISO 8601 timestamp when the task was started.</summary>
-    [JsonPropertyName("startedAt")]
-    public required DateTimeOffset StartedAt { get; set; }
+    /// <summary>Reasoning effort to use with the dedicated plan model.</summary>
+    [JsonPropertyName("planReasoningEffort")]
+    public string? PlanReasoningEffort { get; set; }
 
-    /// <summary>Current lifecycle status of the task.</summary>
-    [JsonPropertyName("status")]
-    public required TaskStatus Status { get; set; }
+    /// <summary>Whether leaving plan mode should restore the session's previous model.</summary>
+    [JsonPropertyName("restorePlanModel")]
+    public bool? RestorePlanModel { get; set; }
 
-    /// <summary>Tool call ID associated with this agent task.</summary>
-    [JsonPropertyName("toolCallId")]
-    public required string ToolCallId { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Tracked shell task metadata, including ID, command, status, timing, attachment/execution mode, log path, and PID.</summary>
-/// <remarks>The <c>shell</c> variant of <see cref="TaskInfo"/>.</remarks>
+/// <summary>The session's friendly name, or null when not yet set.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class TaskInfoShell : TaskInfo
+public sealed class NameGetResult
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "shell";
-
-    /// <summary>Whether the shell runs inside a managed PTY session or as an independent background process.</summary>
-    [JsonPropertyName("attachmentMode")]
-    public required TaskShellInfoAttachmentMode AttachmentMode { get; set; }
-
-    /// <summary>Whether this shell task can be promoted to background mode.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("canPromoteToBackground")]
-    public bool? CanPromoteToBackground { get; set; }
-
-    /// <summary>Command being executed.</summary>
-    [JsonPropertyName("command")]
-    public required string Command { get; set; }
-
-    /// <summary>ISO 8601 timestamp when the task finished.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("completedAt")]
-    public DateTimeOffset? CompletedAt { get; set; }
-
-    /// <summary>Short description of the task.</summary>
-    [JsonPropertyName("description")]
-    public required string Description { get; set; }
-
-    /// <summary>Whether task execution is synchronously awaited or managed in the background.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("executionMode")]
-    public TaskExecutionMode? ExecutionMode { get; set; }
-
-    /// <summary>Unique task identifier.</summary>
-    [JsonPropertyName("id")]
-    public required string Id { get; set; }
-
-    /// <summary>Path to the detached shell log, when available.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("logPath")]
-    public string? LogPath { get; set; }
-
-    /// <summary>Process ID when available.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("pid")]
-    public long? Pid { get; set; }
-
-    /// <summary>ISO 8601 timestamp when the task was started.</summary>
-    [JsonPropertyName("startedAt")]
-    public required DateTimeOffset StartedAt { get; set; }
-
-    /// <summary>Current lifecycle status of the task.</summary>
-    [JsonPropertyName("status")]
-    public required TaskStatus Status { get; set; }
+    /// <summary>The session name (user-set or auto-generated), or null if not yet set.</summary>
+    [JsonPropertyName("name")]
+    public string? Name { get; set; }
 }
 
-/// <summary>Background tasks currently tracked by the session.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class TaskList
+internal sealed class SessionNameGetRequest
 {
-    /// <summary>Currently tracked tasks.</summary>
-    [JsonPropertyName("tasks")]
-    public IList<TaskInfo> Tasks { get => field ??= []; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>New friendly name to apply to the session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionTasksListRequest
+internal sealed class NameSetRequest
 {
+    /// <summary>New session name (1–100 characters, trimmed of leading/trailing whitespace).</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [MaxLength(100)]
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
+
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Refresh metadata for any detached background shells the runtime knows about. Use after a long pause to pick up exit/output state for shells running outside the agent loop.</summary>
+/// <summary>Indicates whether the auto-generated summary was applied as the session's name.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class TasksRefreshResult
+public sealed class NameSetAutoResult
 {
+    /// <summary>Whether the auto-generated summary was persisted. False if the session already has a user-set name, the summary normalized to empty, or the session does not have a workspace.</summary>
+    [JsonPropertyName("applied")]
+    public bool Applied { get; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Auto-generated session summary to apply as the session's name when no user-set name exists.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionTasksRefreshRequest
+internal sealed class NameSetAutoRequest
 {
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Auto-generated session summary. Empty/whitespace-only values are ignored; values are trimmed before persisting.</summary>
+    [JsonPropertyName("summary")]
+    public string Summary { get; set; } = string.Empty;
 }
 
-/// <summary>Wait until all in-flight background tasks (agents + shells) and any follow-up turns scheduled by their completions have settled. Returns when the runtime is fully drained or after an internal timeout (default 10 minutes; configurable via COPILOT_TASK_WAIT_TIMEOUT_SECONDS).</summary>
+/// <summary>Existence, contents, and resolved path of the session plan file.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class TasksWaitForPendingResult
+public sealed class PlanReadResult
 {
+    /// <summary>The content of the plan file, or null if it does not exist.</summary>
+    [JsonPropertyName("content")]
+    public string? Content { get; set; }
+
+    /// <summary>Whether the plan file exists in the workspace.</summary>
+    [JsonPropertyName("exists")]
+    public bool Exists { get; set; }
+
+    /// <summary>Absolute file path of the plan file, or null if workspace is not enabled.</summary>
+    [JsonPropertyName("path")]
+    public string? Path { get; set; }
 }
 
 /// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionTasksWaitForPendingRequest
+internal sealed class SessionPlanReadRequest
 {
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Polymorphic base type discriminated by <c>type</c>.</summary>
-[JsonPolymorphic(
-    TypeDiscriminatorPropertyName = "type",
-    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
-[JsonDerivedType(typeof(TasksGetProgressResultProgressAgent), "agent")]
-[JsonDerivedType(typeof(TasksGetProgressResultProgressShell), "shell")]
-public partial class TasksGetProgressResultProgress
+/// <summary>Replacement contents to write to the session plan file.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class PlanUpdateRequest
 {
-    /// <summary>The type discriminator.</summary>
-    [JsonPropertyName("type")]
-    public virtual string Type { get; set; } = string.Empty;
-}
+    /// <summary>The new content for the plan file.</summary>
+    [JsonPropertyName("content")]
+    public string Content { get; set; } = string.Empty;
 
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-/// <summary>Timestamped display line for task progress output or recent agent activity.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class TaskProgressLine
+internal sealed class SessionPlanDeleteRequest
 {
-    /// <summary>Display message, e.g., "▸ bash", "✓ edit src/foo.ts".</summary>
-    [JsonPropertyName("message")]
-    public string Message { get; set; } = string.Empty;
-
-    /// <summary>ISO 8601 timestamp when this event occurred.</summary>
-    [JsonPropertyName("timestamp")]
-    public DateTimeOffset Timestamp { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Progress snapshot for an agent task, with recent activity lines and optional latest intent.</summary>
-/// <remarks>The <c>agent</c> variant of <see cref="TasksGetProgressResultProgress"/>.</remarks>
-public partial class TasksGetProgressResultProgressAgent : TasksGetProgressResultProgress
+/// <summary>A single todo row read from the session SQL `todos` table. All fields are optional because the SQL schema is best-effort and the agent may not have populated every column.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class PlanSqlTodosRow
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "agent";
-
-    /// <summary>The most recent intent reported by the agent.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("latestIntent")]
-    public string? LatestIntent { get; set; }
+    /// <summary>Todo creation time, as stored by the session SQL schema's `datetime('now')` default: `YYYY-MM-DD HH:MM:SS` in UTC. Lets clients attribute todos to the work item that created them (e.g. scoping a goal's progress to the todos it produced) rather than to the whole session.</summary>
+    [JsonPropertyName("createdAt")]
+    public string? CreatedAt { get; set; }
 
-    /// <summary>Recent tool execution events converted to display lines.</summary>
-    [JsonPropertyName("recentActivity")]
-    public required IList<TaskProgressLine> RecentActivity { get; set; }
-}
+    /// <summary>Todo description.</summary>
+    [JsonPropertyName("description")]
+    public string? Description { get; set; }
 
-/// <summary>Progress snapshot for a shell task, with recent stdout/stderr output and optional process ID.</summary>
-/// <remarks>The <c>shell</c> variant of <see cref="TasksGetProgressResultProgress"/>.</remarks>
-public partial class TasksGetProgressResultProgressShell : TasksGetProgressResultProgress
-{
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "shell";
+    /// <summary>Todo identifier.</summary>
+    [JsonPropertyName("id")]
+    public string? Id { get; set; }
 
-    /// <summary>Process ID when available.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("pid")]
-    public long? Pid { get; set; }
+    /// <summary>Todo status.</summary>
+    [JsonPropertyName("status")]
+    public string? Status { get; set; }
 
-    /// <summary>Recent stdout/stderr lines from the running shell command.</summary>
-    [JsonPropertyName("recentOutput")]
-    public required string RecentOutput { get; set; }
+    /// <summary>Todo title.</summary>
+    [JsonPropertyName("title")]
+    public string? Title { get; set; }
 }
 
-/// <summary>Progress information for the task, or null when no task with that ID is tracked.</summary>
+/// <summary>Todo rows read from the session SQL database. Empty when no session database is available.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class TasksGetProgressResult
+public sealed class PlanReadSqlTodosResult
 {
-    /// <summary>Progress information for the task, discriminated by type. Returns null when no task with this ID is currently tracked.</summary>
-    [JsonPropertyName("progress")]
-    public TasksGetProgressResultProgress? Progress { get; set; }
+    /// <summary>Rows from the session SQL todos table, ordered by creation time with insertion order used to break ties when available and id used for WITHOUT ROWID tables.</summary>
+    [JsonPropertyName("rows")]
+    public IList<PlanSqlTodosRow> Rows { get => field ??= []; set; }
 }
 
-/// <summary>Identifier of the background task to fetch progress for.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class TasksGetProgressRequest
+internal sealed class SessionPlanReadSqlTodosRequest
 {
-    /// <summary>Task identifier (agent ID or shell ID).</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
-
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>The first sync-waiting task that can currently be promoted to background mode.</summary>
+/// <summary>A single dependency edge read from the session SQL `todo_deps` table, indicating that one todo must complete before another.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class TasksGetCurrentPromotableResult
+public sealed class PlanSqlTodoDependency
 {
-    /// <summary>The first sync-waiting task (agent first, then shell) that can currently be promoted to background mode. Omitted if no such task exists. The returned task is guaranteed to have executionMode='sync' and canPromoteToBackground=true at the time of the call.</summary>
-    [JsonPropertyName("task")]
-    public TaskInfo? Task { get; set; }
+    /// <summary>ID of the todo it depends on.</summary>
+    [JsonPropertyName("dependsOn")]
+    public string DependsOn { get; set; } = string.Empty;
+
+    /// <summary>ID of the todo that has the dependency.</summary>
+    [JsonPropertyName("todoId")]
+    public string TodoId { get; set; } = string.Empty;
+}
+
+/// <summary>Todo rows + dependency edges read from the session SQL database.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class PlanReadSqlTodosWithDependenciesResult
+{
+    /// <summary>Edges from the session SQL todo_deps table. Empty when no database, no todo_deps table, or the SELECT failed. Read independently from `rows`, so a broken todo_deps table does not affect the rows result and vice versa.</summary>
+    [JsonPropertyName("dependencies")]
+    public IList<PlanSqlTodoDependency> Dependencies { get => field ??= []; set; }
+
+    /// <summary>Rows from the session SQL todos table, ordered by creation time with insertion order used to break ties when available and id used for WITHOUT ROWID tables. Empty when no database, no todos table, or the SELECT failed.</summary>
+    [JsonPropertyName("rows")]
+    public IList<PlanSqlTodosRow> Rows { get => field ??= []; set; }
 }
 
 /// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionTasksGetCurrentPromotableRequest
+internal sealed class SessionPlanReadSqlTodosWithDependenciesRequest
 {
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether the task was successfully promoted to background mode.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class TasksPromoteToBackgroundResult
+/// <summary>RPC data type for WorkspacesGetWorkspaceResultWorkspace operations.</summary>
+public sealed class WorkspacesGetWorkspaceResultWorkspace
 {
-    /// <summary>Whether the task was successfully promoted to background mode.</summary>
-    [JsonPropertyName("promoted")]
-    public bool Promoted { get; set; }
-}
+    /// <summary>Current Git branch.</summary>
+    [JsonPropertyName("branch")]
+    public string? Branch { get; set; }
 
-/// <summary>Identifier of the task to promote to background mode.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class TasksPromoteToBackgroundRequest
-{
-    /// <summary>Task identifier.</summary>
+    /// <summary>Whether the per-session Chronicle upgrade prompt was dismissed for the workspace.</summary>
+    [JsonPropertyName("chronicle_sync_dismissed")]
+    public bool? ChronicleSyncDismissed { get; set; }
+
+    /// <summary>Name of the client that created the workspace.</summary>
+    [JsonPropertyName("client_name")]
+    public string? ClientName { get; set; }
+
+    /// <summary>Timestamp when the workspace was created.</summary>
+    [JsonPropertyName("created_at")]
+    public DateTimeOffset? CreatedAt { get; set; }
+
+    /// <summary>Current working directory associated with the workspace.</summary>
+    [JsonPropertyName("cwd")]
+    public string? Cwd { get; set; }
+
+    /// <summary>Git repository root associated with the workspace.</summary>
+    [JsonPropertyName("git_root")]
+    public string? GitRoot { get; set; }
+
+    /// <summary>Allowed values for the `WorkspacesWorkspaceDetailsHostType` enumeration.</summary>
+    [JsonPropertyName("host_type")]
+    public WorkspacesWorkspaceDetailsHostType? HostType { get; set; }
+
+    /// <summary>Stable workspace identifier.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
     [JsonPropertyName("id")]
     public string Id { get; set; } = string.Empty;
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Most recent Mission Control event identifier observed for the workspace.</summary>
+    [JsonPropertyName("mc_last_event_id")]
+    public string? McLastEventId { get; set; }
+
+    /// <summary>Mission Control session identifier associated with the workspace.</summary>
+    [JsonPropertyName("mc_session_id")]
+    public string? McSessionId { get; set; }
+
+    /// <summary>Mission Control task identifier associated with the workspace.</summary>
+    [JsonPropertyName("mc_task_id")]
+    public string? McTaskId { get; set; }
+
+    /// <summary>Workspace display name.</summary>
+    [JsonPropertyName("name")]
+    public string? Name { get; set; }
+
+    /// <summary>Whether the workspace session can be steered remotely.</summary>
+    [JsonPropertyName("remote_steerable")]
+    public bool? RemoteSteerable { get; set; }
+
+    /// <summary>Repository identifier associated with the workspace.</summary>
+    [JsonPropertyName("repository")]
+    public string? Repository { get; set; }
+
+    /// <summary>Number of persisted summaries in the workspace.</summary>
+    [JsonPropertyName("summary_count")]
+    public long? SummaryCount { get; set; }
+
+    /// <summary>Timestamp when the workspace was last updated.</summary>
+    [JsonPropertyName("updated_at")]
+    public DateTimeOffset? UpdatedAt { get; set; }
+
+    /// <summary>Whether the workspace name was explicitly chosen by the user.</summary>
+    [JsonPropertyName("user_named")]
+    public bool? UserNamed { get; set; }
 }
 
-/// <summary>The promoted task as it now exists in background mode, omitted if no promotable task was waiting.</summary>
+/// <summary>Current workspace metadata for the session, including its absolute filesystem path when available.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class TasksPromoteCurrentToBackgroundResult
+public sealed class WorkspacesGetWorkspaceResult
 {
-    /// <summary>The promoted task as it now exists in background mode, omitted if no promotable task was waiting. Atomic operation: avoids the race window of getCurrentPromotable + promoteToBackground.</summary>
-    [JsonPropertyName("task")]
-    public TaskInfo? Task { get; set; }
+    /// <summary>Absolute filesystem path to the workspace directory. Omitted when the session has no workspace (e.g. remote sessions).</summary>
+    [JsonPropertyName("path")]
+    public string? Path { get; set; }
+
+    /// <summary>Current workspace metadata, or null if not available.</summary>
+    [JsonPropertyName("workspace")]
+    public WorkspacesGetWorkspaceResultWorkspace? Workspace { get; set; }
 }
 
 /// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionTasksPromoteCurrentToBackgroundRequest
+internal sealed class SessionWorkspacesGetWorkspaceRequest
 {
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether the background task was successfully cancelled.</summary>
+/// <summary>Workspace metadata fields to update.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class TasksCancelResult
+internal sealed class WorkspacesUpdateMetadataRequest
 {
-    /// <summary>Whether the task was successfully cancelled.</summary>
-    [JsonPropertyName("cancelled")]
-    public bool Cancelled { get; set; }
+    /// <summary>Opaque workspace context supplied by the session host.</summary>
+    [JsonPropertyName("context")]
+    public JsonElement? Context { get; set; }
+
+    /// <summary>Optional workspace display name override.</summary>
+    [JsonPropertyName("name")]
+    public string? Name { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Identifier of the background task to cancel.</summary>
+/// <summary>Optional session context used when creating a local workspace.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class TasksCancelRequest
+internal sealed class WorkspacesEnsureRequest
 {
-    /// <summary>Task identifier.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
+    /// <summary>Opaque workspace context supplied by the session host.</summary>
+    [JsonPropertyName("context")]
+    public JsonElement? Context { get; set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether the task was removed. False when the task does not exist or is still running/idle.</summary>
+/// <summary>Relative paths of files stored in the session workspace files directory.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class TasksRemoveResult
+public sealed class WorkspacesListFilesResult
 {
-    /// <summary>Whether the task was removed. Returns false if the task does not exist or is still running/idle (cancel it first).</summary>
-    [JsonPropertyName("removed")]
-    public bool Removed { get; set; }
+    /// <summary>Relative file paths in the workspace files directory.</summary>
+    [JsonPropertyName("files")]
+    public IList<string> Files { get => field ??= []; set; }
 }
 
-/// <summary>Identifier of the completed or cancelled task to remove from tracking.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class TasksRemoveRequest
+internal sealed class SessionWorkspacesListFilesRequest
 {
-    /// <summary>Task identifier.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
-
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether the message was delivered, with an error message when delivery failed.</summary>
+/// <summary>Contents of the requested workspace file as a UTF-8 string.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class TasksSendMessageResult
+public sealed class WorkspacesReadFileResult
 {
-    /// <summary>Error message if delivery failed.</summary>
-    [JsonPropertyName("error")]
-    public string? Error { get; set; }
-
-    /// <summary>Whether the message was successfully delivered or steered.</summary>
-    [JsonPropertyName("sent")]
-    public bool Sent { get; set; }
+    /// <summary>File content as a UTF-8 string.</summary>
+    [JsonPropertyName("content")]
+    public string Content { get; set; } = string.Empty;
 }
 
-/// <summary>Identifier of the target agent task, message content, and optional sender agent ID.</summary>
+/// <summary>Relative path of the workspace file to read.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class TasksSendMessageRequest
+internal sealed class WorkspacesReadFileRequest
 {
-    /// <summary>Agent ID of the sender, if sent on behalf of another agent.</summary>
-    [JsonPropertyName("fromAgentId")]
-    public string? FromAgentId { get; set; }
-
-    /// <summary>Agent task identifier.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
-
-    /// <summary>Message content to send to the agent.</summary>
-    [JsonPropertyName("message")]
-    public string Message { get; set; } = string.Empty;
+    /// <summary>Relative path within the workspace files directory.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Skill metadata available to a session, with name, description, source, enabled/invocable state, path, plugin, and argument hint.</summary>
+/// <summary>Relative path and UTF-8 content for the workspace file to create or overwrite.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class Skill
+internal sealed class WorkspacesCreateFileRequest
 {
-    /// <summary>Optional freeform hint describing the skill's expected arguments, from the `argument-hint` frontmatter field.</summary>
-    [JsonPropertyName("argumentHint")]
-    public string? ArgumentHint { get; set; }
-
-    /// <summary>Canonical slash command name used to invoke the skill, without the leading '/'.</summary>
-    [JsonPropertyName("commandName")]
-    public string? CommandName { get; set; }
-
-    /// <summary>Description of what the skill does.</summary>
-    [JsonPropertyName("description")]
-    public string Description { get; set; } = string.Empty;
-
-    /// <summary>Whether the skill is currently enabled.</summary>
-    [JsonPropertyName("enabled")]
-    public bool Enabled { get; set; }
-
-    /// <summary>Unique identifier for the skill.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>File content to write as a UTF-8 string.</summary>
+    [JsonPropertyName("content")]
+    public string Content { get; set; } = string.Empty;
 
-    /// <summary>Absolute path to the skill file.</summary>
+    /// <summary>Relative path within the workspace files directory.</summary>
     [JsonPropertyName("path")]
-    public string? Path { get; set; }
+    public string Path { get; set; } = string.Empty;
 
-    /// <summary>Name of the plugin that provides the skill, when source is 'plugin'.</summary>
-    [JsonPropertyName("pluginName")]
-    public string? PluginName { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Source location type (e.g., project, personal-copilot, plugin, builtin).</summary>
-    [JsonPropertyName("source")]
-    public SkillSource Source { get; set; }
+/// <summary>Workspace checkpoint metadata with assigned number, human-readable title, and checkpoint filename.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class WorkspacesCheckpoints
+{
+    /// <summary>Filename of the checkpoint within the workspace checkpoints directory.</summary>
+    [JsonPropertyName("filename")]
+    public string Filename { get; set; } = string.Empty;
 
-    /// <summary>Whether the skill can be invoked by the user as a slash command.</summary>
-    [JsonPropertyName("userInvocable")]
-    public bool UserInvocable { get; set; }
+    /// <summary>Checkpoint number assigned by the workspace manager.</summary>
+    [JsonPropertyName("number")]
+    public long Number { get; set; }
+
+    /// <summary>Human-readable checkpoint title.</summary>
+    [JsonPropertyName("title")]
+    public string Title { get; set; } = string.Empty;
 }
 
-/// <summary>Skills available to the session, with their enabled state.</summary>
+/// <summary>Workspace checkpoints in chronological order; empty when the workspace is not enabled.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SkillList
+public sealed class WorkspacesListCheckpointsResult
 {
-    /// <summary>Available skills.</summary>
-    [JsonPropertyName("skills")]
-    public IList<Skill> Skills { get => field ??= []; set; }
+    /// <summary>Workspace checkpoints in chronological order. Empty when workspace is not enabled.</summary>
+    [JsonPropertyName("checkpoints")]
+    public IList<WorkspacesCheckpoints> Checkpoints { get => field ??= []; set; }
 }
 
 /// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionSkillsListRequest
+internal sealed class SessionWorkspacesListCheckpointsRequest
 {
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Skill invocation record with name, path, content, allowed tools, and turn number.</summary>
+/// <summary>Checkpoint content as a UTF-8 string, or null when the checkpoint or workspace is missing.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SkillsInvokedSkill
+public sealed class WorkspacesReadCheckpointResult
 {
-    /// <summary>Tools that should be auto-approved when this skill is active, captured at invocation time.</summary>
-    [JsonPropertyName("allowedTools")]
-    public IList<string>? AllowedTools { get; set; }
-
-    /// <summary>Full content of the skill file.</summary>
+    /// <summary>Checkpoint content as a UTF-8 string, or null when the checkpoint or workspace is missing.</summary>
     [JsonPropertyName("content")]
-    public string Content { get; set; } = string.Empty;
+    public string? Content { get; set; }
+}
 
-    /// <summary>Turn number when the skill was invoked.</summary>
-    [JsonPropertyName("invokedAtTurn")]
-    public long InvokedAtTurn { get; set; }
+/// <summary>Checkpoint number to read.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class WorkspacesReadCheckpointRequest
+{
+    /// <summary>Checkpoint number to read.</summary>
+    [JsonPropertyName("number")]
+    public long Number { get; set; }
 
-    /// <summary>Unique identifier for the skill.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Path to the SKILL.md file.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+/// <summary>Metadata for the persisted summary.</summary>
+public sealed class WorkspacesAddSummaryResultSummary
+{
 }
 
-/// <summary>Skills invoked during this session, ordered by invocation time (most recent last).</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SkillsGetInvokedResult
+/// <summary>Refreshed metadata for the containing workspace.</summary>
+public sealed class WorkspacesAddSummaryResultWorkspace
 {
-    /// <summary>Skills invoked during this session, ordered by invocation time (most recent last).</summary>
-    [JsonPropertyName("skills")]
-    public IList<SkillsInvokedSkill> Skills { get => field ??= []; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Persisted summary metadata and refreshed workspace metadata.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionSkillsGetInvokedRequest
+public sealed class WorkspacesAddSummaryResult
 {
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Metadata for the persisted summary.</summary>
+    [JsonPropertyName("summary")]
+    public WorkspacesAddSummaryResultSummary? Summary { get; set; }
+
+    /// <summary>Refreshed metadata for the containing workspace.</summary>
+    [JsonPropertyName("workspace")]
+    public WorkspacesAddSummaryResultWorkspace? Workspace { get; set; }
 }
 
-/// <summary>Name of the skill to enable for the session.</summary>
+/// <summary>Compaction summary checkpoint to persist.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SkillsEnableRequest
+internal sealed class WorkspacesAddSummaryRequest
 {
-    /// <summary>Name of the skill to enable.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Markdown summary content to persist.</summary>
+    [JsonPropertyName("content")]
+    public string Content { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Summary title shown in checkpoint listings.</summary>
+    [JsonPropertyName("title")]
+    public string Title { get; set; } = string.Empty;
 }
 
-/// <summary>Name of the skill to disable for the session.</summary>
+/// <summary>Rollback point for local workspace summaries.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SkillsDisableRequest
+internal sealed class WorkspacesTruncateSummariesRequest
 {
-    /// <summary>Name of the skill to disable.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Number of newest summaries to keep.</summary>
+    [JsonPropertyName("keepCount")]
+    public long KeepCount { get; set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Diagnostics from reloading skill definitions, with warnings and errors as separate lists.</summary>
+/// <summary>Autopilot objective file content, or null when missing.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SkillsLoadDiagnostics
+public sealed class WorkspacesReadAutopilotObjectiveResult
 {
-    /// <summary>Errors emitted while loading skills (e.g. skills that failed to load entirely).</summary>
-    [JsonPropertyName("errors")]
-    public IList<string> Errors { get => field ??= []; set; }
-
-    /// <summary>Warnings emitted while loading skills (e.g. skills that loaded but had issues).</summary>
-    [JsonPropertyName("warnings")]
-    public IList<string> Warnings { get => field ??= []; set; }
+    /// <summary>Autopilot objective file content, or null when missing.</summary>
+    [JsonPropertyName("content")]
+    public string? Content { get; set; }
 }
 
 /// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionSkillsReloadRequest
+internal sealed class SessionWorkspacesReadAutopilotObjectiveRequest
 {
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Result of writing the autopilot objective file.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionSkillsEnsureLoadedRequest
+public sealed class WorkspacesWriteAutopilotObjectiveResult
+{
+    /// <summary>Filesystem operation performed.</summary>
+    [JsonPropertyName("operation")]
+    public string Operation { get; set; } = string.Empty;
+}
+
+/// <summary>Autopilot objective file content to persist.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class WorkspacesWriteAutopilotObjectiveRequest
 {
+    /// <summary>Autopilot objective file content.</summary>
+    [JsonPropertyName("content")]
+    public string Content { get; set; } = string.Empty;
+
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Recorded MCP server connection failure.</summary>
+/// <summary>Result of deleting the autopilot objective file.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpServerFailureInfo
+public sealed class WorkspacesDeleteAutopilotObjectiveResult
 {
-    /// <summary>Failure message produced when the MCP server connection failed.</summary>
-    [JsonPropertyName("message")]
-    public string Message { get; set; } = string.Empty;
-
-    /// <summary>epoch-ms timestamp at which the failure was recorded.</summary>
-    [JsonPropertyName("timestamp")]
-    public long Timestamp { get; set; }
+    /// <summary>True when a file was deleted.</summary>
+    [JsonPropertyName("deleted")]
+    public bool Deleted { get; set; }
 }
 
-/// <summary>Recorded MCP server pending-auth state.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpServerNeedsAuthInfo
+internal sealed class SessionWorkspacesDeleteAutopilotObjectiveRequest
 {
-    /// <summary>epoch-ms timestamp at which the server signalled it needs authentication.</summary>
-    [JsonPropertyName("timestamp")]
-    public long Timestamp { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Host-level state, omitted when no MCP host is initialized.</summary>
+/// <summary>Whether the autopilot objective file exists.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpHostState
+public sealed class WorkspacesAutopilotObjectiveExistsResult
 {
-    /// <summary>Names of currently-connected MCP clients.</summary>
-    [JsonPropertyName("clients")]
-    public IList<string> Clients { get => field ??= []; set; }
-
-    /// <summary>Configured servers that are explicitly disabled.</summary>
-    [JsonPropertyName("disabledServers")]
-    public IList<string> DisabledServers { get => field ??= []; set; }
-
-    /// <summary>Map of server name to recorded connection failure.</summary>
-    [JsonPropertyName("failedServers")]
-    public IDictionary<string, McpServerFailureInfo> FailedServers { get => field ??= new Dictionary<string, McpServerFailureInfo>(); set; }
-
-    /// <summary>Configured servers filtered out by MCP server policy.</summary>
-    [JsonPropertyName("filteredServers")]
-    public IList<string> FilteredServers { get => field ??= []; set; }
-
-    /// <summary>Whether third-party MCP servers are policy-enabled for this session.</summary>
-    [JsonPropertyName("mcp3pEnabled")]
-    public bool Mcp3pEnabled { get; set; }
-
-    /// <summary>Map of server name to recorded pending-auth state.</summary>
-    [JsonPropertyName("needsAuthServers")]
-    public IDictionary<string, McpServerNeedsAuthInfo> NeedsAuthServers { get => field ??= new Dictionary<string, McpServerNeedsAuthInfo>(); set; }
-
-    /// <summary>Names of servers with in-flight connection attempts.</summary>
-    [JsonPropertyName("pendingConnections")]
-    public IList<string> PendingConnections { get => field ??= []; set; }
+    /// <summary>True when the objective file exists.</summary>
+    [JsonPropertyName("exists")]
+    public bool Exists { get; set; }
 }
 
-/// <summary>MCP server status entry, including config source/plugin source and any connection error.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpServer
+internal sealed class SessionWorkspacesAutopilotObjectiveExistsRequest
 {
-    /// <summary>Error message if the server failed to connect.</summary>
-    [JsonPropertyName("error")]
-    public string? Error { get; set; }
-
-    /// <summary>Server name (config key).</summary>
-    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
-
-    /// <summary>Configuration source: user, workspace, plugin, or builtin.</summary>
-    [JsonPropertyName("source")]
-    public McpServerSource? Source { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Plugin name that provided this server, when source is plugin.</summary>
-    [JsonPropertyName("sourcePlugin")]
-    public string? SourcePlugin { get; set; }
+/// <summary>RPC data type for WorkspacesSaveLargePasteResultSaved operations.</summary>
+public sealed class WorkspacesSaveLargePasteResultSaved
+{
+    /// <summary>Filename within the workspace files directory.</summary>
+    [JsonPropertyName("filename")]
+    public string Filename { get; set; } = string.Empty;
 
-    /// <summary>Plugin version that provided this server, when source is plugin.</summary>
-    [JsonPropertyName("sourcePluginVersion")]
-    public string? SourcePluginVersion { get; set; }
+    /// <summary>Absolute filesystem path to the saved paste file.</summary>
+    [JsonPropertyName("filePath")]
+    public string FilePath { get; set; } = string.Empty;
 
-    /// <summary>Connection status: connected, failed, needs-auth, pending, disabled, stopped, or not_configured.</summary>
-    [JsonPropertyName("status")]
-    public McpServerStatus Status { get; set; }
+    /// <summary>Size of the saved file in bytes.</summary>
+    [JsonPropertyName("sizeBytes")]
+    public long SizeBytes { get; set; }
 }
 
-/// <summary>MCP servers configured for the session, with their connection status and host-level state.</summary>
+/// <summary>Descriptor for the saved paste file, or null when the workspace is unavailable.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpServerList
+public sealed class WorkspacesSaveLargePasteResult
 {
-    /// <summary>Host-level state, omitted when no MCP host is initialized.</summary>
-    [JsonPropertyName("host")]
-    public McpHostState? Host { get; set; }
-
-    /// <summary>Configured MCP servers.</summary>
-    [JsonPropertyName("servers")]
-    public IList<McpServer> Servers { get => field ??= []; set; }
+    /// <summary>Saved-paste descriptor, or null when the workspace is unavailable (e.g. CCA runtime, non-infinite sessions, remote sessions).</summary>
+    [JsonPropertyName("saved")]
+    public WorkspacesSaveLargePasteResultSaved? Saved { get; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Pasted content to save as a UTF-8 file in the session workspace.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionMcpListRequest
+internal sealed class WorkspacesSaveLargePasteRequest
 {
+    /// <summary>Pasted content to save as a UTF-8 file.</summary>
+    [JsonPropertyName("content")]
+    public string Content { get; set; } = string.Empty;
+
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Normalized MCP Apps discovery metadata from a tool's `_meta.ui` block.</summary>
+/// <summary>A single changed file and its unified diff.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpToolUi
+public sealed class WorkspaceDiffFileChange
 {
-    /// <summary>URI of the tool's MCP App resource, typically a `ui://` resource identifier. Use `session.mcp.resources.read` to fetch its HTML and resource metadata.</summary>
-    [JsonPropertyName("resourceUri")]
-    public string? ResourceUri { get; set; }
+    /// <summary>Type of change represented by this file diff.</summary>
+    [JsonPropertyName("changeType")]
+    public WorkspaceDiffFileChangeType ChangeType { get; set; }
 
-    /// <summary>Tool visibility advertised by the server. When absent, MCP Apps defaults apply.</summary>
-    [JsonPropertyName("visibility")]
-    public IList<McpToolUiVisibility>? Visibility { get; set; }
-}
+    /// <summary>Unified diff content for the file. Empty when the diff was truncated.</summary>
+    [JsonPropertyName("diff")]
+    public string Diff { get; set; } = string.Empty;
 
-/// <summary>MCP tool metadata with tool name, optional description, and normalized MCP Apps discovery metadata.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class McpTools
-{
-    /// <summary>Tool description, when provided.</summary>
-    [JsonPropertyName("description")]
-    public string? Description { get; set; }
+    /// <summary>Whether the diff content was omitted because it exceeded the per-file size limit.</summary>
+    [JsonPropertyName("isTruncated")]
+    public bool? IsTruncated { get; set; }
 
-    /// <summary>Tool name.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Original file path for renamed files.</summary>
+    [JsonPropertyName("oldPath")]
+    public string? OldPath { get; set; }
 
-    /// <summary>Normalized MCP Apps discovery metadata. An empty object indicates that a valid `_meta.ui` block was present without recognized fields.</summary>
-    [JsonPropertyName("ui")]
-    public McpToolUi? Ui { get; set; }
+    /// <summary>Path to the changed file, relative to the workspace root when the file lives under it. A file changed outside the workspace root keeps a `../`-relative path, or an absolute path when no relative path exists (for example a different Windows drive).</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
 }
 
-/// <summary>Tools exposed by the connected MCP server. Throws when the server is not connected.</summary>
+/// <summary>Workspace diff result for the requested mode.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpListToolsResult
+public sealed class WorkspaceDiffResult
 {
-    /// <summary>Tools exposed by the server.</summary>
-    [JsonPropertyName("tools")]
-    public IList<McpTools> Tools { get => field ??= []; set; }
-}
+    /// <summary>Default branch used for a branch diff, when branch mode was requested.</summary>
+    [JsonPropertyName("baseBranch")]
+    public string? BaseBranch { get; set; }
 
-/// <summary>Server name whose tool list should be returned.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class McpListToolsRequest
-{
-    /// <summary>Name of the connected MCP server whose tools to list.</summary>
-    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
-    [JsonPropertyName("serverName")]
-    public string ServerName { get; set; } = string.Empty;
+    /// <summary>Changed files and their unified diffs.</summary>
+    [JsonPropertyName("changes")]
+    public IList<WorkspaceDiffFileChange> Changes { get => field ??= []; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Whether the requested diff fell back to unstaged changes, either because branch diff failed or session diff was unavailable.</summary>
+    [JsonPropertyName("isFallback")]
+    public bool IsFallback { get; set; }
+
+    /// <summary>Effective mode used for the returned changes.</summary>
+    [JsonPropertyName("mode")]
+    public WorkspaceDiffMode Mode { get; set; }
+
+    /// <summary>Diff mode requested by the client.</summary>
+    [JsonPropertyName("requestedMode")]
+    public WorkspaceDiffMode RequestedMode { get; set; }
+
+    /// <summary>Why the session diff could not be produced, when applicable. Set only when `session` mode was requested and `isFallback` is true, so a client can tell the permanent `file-change-tracking-disabled` apart from the transient `session-busy`, which the same request answers once the session settles. Never set for `unstaged` or `branch` mode, and never `unsupported-remote-session`: a remote session's captures live on its own host, so a `session`-mode diff is rejected for one rather than answered with a controller-side fallback.</summary>
+    [JsonPropertyName("unavailableReason")]
+    public HistoryRewindUnavailableReason? UnavailableReason { get; set; }
 }
 
-/// <summary>Name of the MCP server to enable for the session.</summary>
+/// <summary>Parameters for computing a workspace diff.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpEnableRequest
+internal sealed class WorkspacesDiffRequest
 {
-    /// <summary>Name of the MCP server to enable.</summary>
-    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
-    [JsonPropertyName("serverName")]
-    public string ServerName { get; set; } = string.Empty;
+    /// <summary>When true, ignore whitespace-only changes (git `--ignore-all-space`). Defaults to false.</summary>
+    [JsonPropertyName("ignoreWhitespace")]
+    public bool? IgnoreWhitespace { get; set; }
+
+    /// <summary>Diff mode requested by the client.</summary>
+    [JsonPropertyName("mode")]
+    public WorkspaceDiffMode Mode { get; set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Name of the MCP server to disable for the session.</summary>
+/// <summary>Characters that, when typed in the composer, should trigger a `completions.request`. Empty when the session has no host-driven completions (e.g. local sessions, or a relay host that does not advertise `completionTriggerCharacters`).</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpDisableRequest
+public sealed class CompletionsGetTriggerCharactersResult
 {
-    /// <summary>Name of the MCP server to disable.</summary>
-    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
-    [JsonPropertyName("serverName")]
-    public string ServerName { get; set; } = string.Empty;
-
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Trigger characters advertised by the host (e.g. `["@", "#"]`). Empty disables host-driven completions for the session.</summary>
+    [JsonPropertyName("triggerCharacters")]
+    public IList<string> TriggerCharacters { get => field ??= []; set; }
 }
 
 /// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionMcpReloadRequest
+internal sealed class SessionCompletionsGetTriggerCharactersRequest
 {
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>MCP server allowed by policy, with server name and optional PII-free explanatory note.</summary>
+/// <summary>A single host-driven completion. Accepting an item replaces `[rangeStart, rangeEnd)` (UTF-16 code units) in the composer with `insertText`; when the range is absent, the active token around the cursor is replaced.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpAllowedServer
+public sealed class SessionCompletionItem
 {
-    /// <summary>Allowed server name.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Text spliced into the composer when the item is accepted.</summary>
+    [JsonPropertyName("insertText")]
+    public string InsertText { get; set; } = string.Empty;
 
-    /// <summary>PII-free note explaining why the server was allowed.</summary>
-    [JsonPropertyName("redactedNote")]
-    public string? RedactedNote { get; set; }
+    /// <summary>Render-kind hint for the picker row (e.g. `"document"`, `"directory"`), derived from the host's display kind.</summary>
+    [JsonPropertyName("kind")]
+    public string? Kind { get; set; }
+
+    /// <summary>Primary display label for the picker row. Falls back to `insertText` when absent.</summary>
+    [JsonPropertyName("label")]
+    public string? Label { get; set; }
+
+    /// <summary>End (exclusive) of the replacement range in `text`, in UTF-16 code units.</summary>
+    [JsonPropertyName("rangeEnd")]
+    public long? RangeEnd { get; set; }
+
+    /// <summary>Start of the replacement range in `text`, in UTF-16 code units.</summary>
+    [JsonPropertyName("rangeStart")]
+    public long? RangeStart { get; set; }
 }
 
-/// <summary>MCP server whose connection attempt failed.</summary>
+/// <summary>Host-driven completion items for the current composer input. Empty when the host returns no items or does not support completions.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpFailedServer
+public sealed class CompletionsRequestResult
 {
-    /// <summary>The captured connection failure detail.</summary>
-    [JsonPropertyName("error")]
-    public string? Error { get; set; }
-
-    /// <summary>The config key of the server that failed to connect.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Completion items in host-ranked order.</summary>
+    [JsonPropertyName("items")]
+    public IList<SessionCompletionItem> Items { get => field ??= []; set; }
 }
 
-/// <summary>MCP server filtered by policy, with name, reason, and optional redacted reason.</summary>
+/// <summary>Request host-driven completions for the current composer input.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpFilteredServer
+internal sealed class CompletionsRequestRequest
 {
-    /// <summary>Deprecated. This field is no longer populated.</summary>
-    [EditorBrowsable(EditorBrowsableState.Never)]
-#if NET5_0_OR_GREATER
-    [Obsolete("This member is deprecated and will be removed in a future version.", DiagnosticId = "GHCP001")]
-#endif
-    [JsonPropertyName("enterpriseName")]
-    public string? EnterpriseName { get; set; }
-
-    /// <summary>Filtered server name.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Cursor offset within `text`, in UTF-16 code units.</summary>
+    [JsonPropertyName("offset")]
+    public long Offset { get; set; }
 
-    /// <summary>Human-readable filter reason.</summary>
-    [JsonPropertyName("reason")]
-    public string Reason { get; set; } = string.Empty;
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 
-    /// <summary>PII-free filter reason.</summary>
-    [JsonPropertyName("redactedReason")]
-    public string? RedactedReason { get; set; }
+    /// <summary>The full composed composer input.</summary>
+    [JsonPropertyName("text")]
+    public string Text { get; set; } = string.Empty;
 }
 
-/// <summary>MCP server startup filtering result.</summary>
+/// <summary>Instruction sources loaded for the session, in merge order.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpStartServersResult
+public sealed class InstructionsGetSourcesResult
 {
-    /// <summary>Non-default servers allowed by policy.</summary>
-    [JsonPropertyName("allowedServers")]
-    public IList<McpAllowedServer>? AllowedServers { get; set; }
-
-    /// <summary>Servers whose connection attempt failed.</summary>
-    [JsonPropertyName("failedServers")]
-    public IList<McpFailedServer>? FailedServers { get; set; }
-
-    /// <summary>Servers filtered out before startup.</summary>
-    [JsonPropertyName("filteredServers")]
-    public IList<McpFilteredServer> FilteredServers { get => field ??= []; set; }
+    /// <summary>Instruction sources for the session.</summary>
+    [JsonPropertyName("sources")]
+    public IList<InstructionSource> Sources { get => field ??= []; set; }
 }
 
-/// <summary>Opaque MCP reload configuration.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpReloadWithConfigRequest
+internal sealed class SessionInstructionsGetSourcesRequest
 {
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>MCP CreateMessageResult payload (with optional 'tools' extension), present when action='success'. Treated as opaque at the schema layer; consumers should construct/consume it per the MCP CreateMessageResult shape.</summary>
+/// <summary>Indicates whether fleet mode was successfully activated.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpExecuteSamplingResult
+public sealed class FleetStartResult
 {
+    /// <summary>Whether fleet mode was successfully activated.</summary>
+    [JsonPropertyName("started")]
+    public bool Started { get; set; }
 }
 
-/// <summary>Outcome of an MCP sampling execution: success result, failure error, or cancellation.</summary>
+/// <summary>Optional user prompt to combine with the fleet orchestration instructions.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpSamplingExecutionResult
+internal sealed class FleetStartRequest
 {
-    /// <summary>Outcome of the sampling inference. 'success' produced a response; 'failure' encountered an error (including agent-side rejection by content filter or criteria); 'cancelled' the caller cancelled this execution via cancelSamplingExecution.</summary>
-    [JsonPropertyName("action")]
-    public McpSamplingExecutionAction Action { get; set; }
-
-    /// <summary>Error description, present when action='failure'.</summary>
-    [JsonPropertyName("error")]
-    public string? Error { get; set; }
+    /// <summary>Optional user prompt to combine with fleet instructions.</summary>
+    [JsonPropertyName("prompt")]
+    public string? Prompt { get; set; }
 
-    /// <summary>MCP CreateMessageResult payload (with optional 'tools' extension), present when action='success'. Treated as opaque at the schema layer; consumers should construct/consume it per the MCP CreateMessageResult shape.</summary>
-    [JsonPropertyName("result")]
-    public McpExecuteSamplingResult? Result { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Raw MCP CreateMessageRequest params, as received in the `sampling.requested` event. Treated as opaque at the schema layer; the runtime converts the embedded MCP messages into the OpenAI chat-completion shape internally.</summary>
+/// <summary>Agents available to the session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpExecuteSamplingRequest
+public sealed class AgentList
 {
+    /// <summary>Available agents.</summary>
+    [JsonPropertyName("agents")]
+    public IList<AgentInfo> Agents { get => field ??= []; set; }
 }
 
-/// <summary>Identifiers and raw MCP CreateMessageRequest params used to run a sampling inference.</summary>
+/// <summary>RPC data type for SessionAgentList operations.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpExecuteSamplingParams
+public sealed class SessionAgentListRequest
 {
-    /// <summary>The original MCP JSON-RPC request ID (string or number). Used by the runtime to correlate the inference with the originating MCP request for telemetry; this is distinct from `requestId` (which is the schema-level cancellation handle).</summary>
-    [JsonPropertyName("mcpRequestId")]
-    public JsonElement McpRequestId { get; set; }
-
-    /// <summary>Raw MCP CreateMessageRequest params, as received in the `sampling.requested` event. Treated as opaque at the schema layer; the runtime converts the embedded MCP messages into the OpenAI chat-completion shape internally.</summary>
-    [JsonPropertyName("request")]
-    public McpExecuteSamplingRequest Request { get => field ??= new(); set; }
-
-    /// <summary>Caller-provided unique identifier for this sampling execution. Use this same ID with cancelSamplingExecution to cancel the in-flight call. Must be unique within the session for the lifetime of the call.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
-
-    /// <summary>Name of the MCP server that initiated the sampling request.</summary>
-    [JsonPropertyName("serverName")]
-    public string ServerName { get; set; } = string.Empty;
+    /// <summary>When true, request the session's configured built-in agents alongside custom agents. Listing applies feature, context, inclusion, exclusion, and user-disabled-agent policy, but does not evaluate transient invocation requirements such as model availability. Built-in metadata may be omitted when the session cannot project it, such as a relay session.</summary>
+    [JsonPropertyName("includeBuiltInAgents")]
+    public bool? IncludeBuiltInAgents { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>When true, request authored base prompt text on each AgentInfo. Prompt text may be omitted when unavailable, such as for agents projected through a relay session.</summary>
+    [JsonPropertyName("includePrompt")]
+    public bool? IncludePrompt { get; set; }
 }
 
-/// <summary>Indicates whether an in-flight sampling execution with the given requestId was found and cancelled.</summary>
+/// <summary>RPC data type for SessionAgentListRequestWithSession operations.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpCancelSamplingExecutionResult
+internal sealed class SessionAgentListRequestWithSession
 {
-    /// <summary>True if an in-flight execution with the given requestId was found and signalled to cancel. False when no such execution is in flight (already completed, never started, or cancelled by another caller).</summary>
-    [JsonPropertyName("cancelled")]
-    public bool Cancelled { get; set; }
-}
+    /// <summary>When true, request the session's configured built-in agents alongside custom agents. Listing applies feature, context, inclusion, exclusion, and user-disabled-agent policy, but does not evaluate transient invocation requirements such as model availability. Built-in metadata may be omitted when the session cannot project it, such as a relay session.</summary>
+    [JsonPropertyName("includeBuiltInAgents")]
+    public bool? IncludeBuiltInAgents { get; set; }
 
-/// <summary>The requestId previously passed to executeSampling that should be cancelled.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class McpCancelSamplingExecutionParams
-{
-    /// <summary>The requestId previously passed to executeSampling that should be cancelled.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
+    /// <summary>When true, request authored base prompt text on each AgentInfo. Prompt text may be omitted when unavailable, such as for agents projected through a relay session.</summary>
+    [JsonPropertyName("includePrompt")]
+    public bool? IncludePrompt { get; set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Env-value mode recorded on the session after the update.</summary>
+/// <summary>An in-memory authored prompt override for an available agent.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpSetEnvValueModeResult
+internal sealed class AgentSetPromptRequest
 {
-    /// <summary>Mode recorded on the session after the update.</summary>
-    [JsonPropertyName("mode")]
-    public McpSetEnvValueModeDetails Mode { get; set; }
-}
+    /// <summary>Stable effective agent id. Plugin namespace separators are normalized.</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
 
-/// <summary>Mode controlling how MCP server env values are resolved (`direct` or `indirect`).</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class McpSetEnvValueModeParams
-{
-    /// <summary>How environment-variable values supplied to MCP servers are resolved. "direct" passes literal string values; "indirect" treats values as references (e.g. names of environment variables on the host) that the runtime resolves before launch. Defaults to the runtime's startup mode; clients that intentionally launch MCP servers with literal values (e.g. CLI prompt mode and ACP) set this to "direct".</summary>
-    [JsonPropertyName("mode")]
-    public McpSetEnvValueModeDetails Mode { get; set; }
+    /// <summary>Replacement authored prompt. Empty text is valid.</summary>
+    [JsonPropertyName("prompt")]
+    public string Prompt { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether the auto-managed `github` MCP server was removed (false when nothing to remove).</summary>
+/// <summary>The currently selected custom agent, or null when using the default agent.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpRemoveGitHubResult
+public sealed class AgentGetCurrentResult
 {
-    /// <summary>True when the auto-managed `github` MCP server was removed; false when no removal happened (e.g. user has explicitly configured a `github` server, or the server was not registered).</summary>
-    [JsonPropertyName("removed")]
-    public bool Removed { get; set; }
+    /// <summary>Currently selected custom agent, or null if using the default agent.</summary>
+    [JsonPropertyName("agent")]
+    public AgentInfo? Agent { get; set; }
 }
 
 /// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionMcpRemoveGitHubRequest
+internal sealed class SessionAgentGetCurrentRequest
 {
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Result of configuring GitHub MCP.</summary>
+/// <summary>The newly selected custom agent.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpConfigureGitHubResult
+public sealed class AgentSelectResult
 {
-    /// <summary>Whether GitHub MCP configuration changed.</summary>
-    [JsonPropertyName("changed")]
-    public bool Changed { get; set; }
+    /// <summary>The newly selected custom agent.</summary>
+    [JsonPropertyName("agent")]
+    public AgentInfo Agent { get => field ??= new(); set; }
 }
 
-/// <summary>Credential-free authentication identity used to configure GitHub MCP.</summary>
+/// <summary>Name of the custom agent to select for subsequent turns.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpConfigureGitHubRequest
+internal sealed class AgentSelectRequest
 {
+    /// <summary>Name of the custom agent to select.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
+
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Server name and optional configuration for an individual MCP server start. Omit `config` for a config-free start-by-name of an already-configured server.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpStartServerRequest
+internal sealed class SessionAgentDeselectRequest
 {
-    /// <summary>MCP server configuration (stdio process or remote HTTP/SSE). Omit to start the server with its already-registered configuration (config-free start-by-name).</summary>
-    [JsonPropertyName("config")]
-    public JsonElement? Config { get; set; }
-
-    /// <summary>Name of the MCP server to start.</summary>
-    [JsonPropertyName("serverName")]
-    public string ServerName { get; set; } = string.Empty;
-
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Server name and optional replacement configuration for an individual MCP server restart. Omit `config` for a config-free restart-by-name of an already-configured server.</summary>
+/// <summary>Custom agents available to the session after reloading definitions from disk.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpRestartServerRequest
+public sealed class AgentReloadResult
 {
-    /// <summary>Replacement MCP server configuration (stdio process or remote HTTP/SSE). Omit to restart the server with its already-registered configuration (config-free restart-by-name).</summary>
-    [JsonPropertyName("config")]
-    public JsonElement? Config { get; set; }
-
-    /// <summary>Name of the MCP server to restart.</summary>
-    [JsonPropertyName("serverName")]
-    public string ServerName { get; set; } = string.Empty;
+    /// <summary>Reloaded custom agents.</summary>
+    [JsonPropertyName("agents")]
+    public IList<AgentInfo> Agents { get => field ??= []; set; }
+}
 
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionAgentReloadRequest
+{
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Server name for an individual MCP server stop.</summary>
+/// <summary>Identifier assigned to the newly started background agent task.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpStopServerRequest
+public sealed class TasksStartAgentResult
 {
-    /// <summary>Name of the MCP server to stop.</summary>
-    [JsonPropertyName("serverName")]
-    public string ServerName { get; set; } = string.Empty;
-
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Generated agent ID for the background task.</summary>
+    [JsonPropertyName("agentId")]
+    public string AgentId { get; set; } = string.Empty;
 }
 
-/// <summary>Registration parameters for an external MCP client.</summary>
+/// <summary>Agent type, prompt, name, and optional description and model override for the new task.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpRegisterExternalClientRequest
+internal sealed class TasksStartAgentRequest
 {
-    /// <summary>Logical server name for the external client.</summary>
-    [JsonPropertyName("serverName")]
-    public string ServerName { get; set; } = string.Empty;
+    /// <summary>Type of agent to start (e.g., 'explore', 'task', 'general-purpose').</summary>
+    [JsonPropertyName("agentType")]
+    public string AgentType { get; set; } = string.Empty;
+
+    /// <summary>Short description of the task.</summary>
+    [JsonPropertyName("description")]
+    public string? Description { get; set; }
+
+    /// <summary>Optional model override.</summary>
+    [JsonPropertyName("model")]
+    public string? Model { get; set; }
+
+    /// <summary>Friendly, non-unique name used when displaying the agent.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
+
+    /// <summary>Task prompt for the agent.</summary>
+    [JsonPropertyName("prompt")]
+    public string Prompt { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Server name identifying the external client to remove.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class McpUnregisterExternalClientRequest
-{
-    /// <summary>Server name of the external client to unregister.</summary>
-    [JsonPropertyName("serverName")]
-    public string ServerName { get; set; } = string.Empty;
-
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
-
-/// <summary>Whether the named MCP server is running.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class McpIsServerRunningResult
-{
-    /// <summary>True if the server has an active client and transport.</summary>
-    [JsonPropertyName("running")]
-    public bool Running { get; set; }
-}
-
-/// <summary>Server name to check running status for.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class McpIsServerRunningRequest
-{
-    /// <summary>Name of the MCP server to check.</summary>
-    [JsonPropertyName("serverName")]
-    public string ServerName { get; set; } = string.Empty;
-
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
-
-/// <summary>Indicates whether the pending MCP OAuth response was accepted.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class McpOauthHandlePendingResult
-{
-    /// <summary>Whether the response was accepted. False if the request was unknown, timed out, or already resolved.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
-}
-
-/// <summary>Host response to the pending OAuth request.</summary>
-/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
+/// <summary>Tracked task union returned by task APIs, containing either an agent task or a shell task.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>type</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
 [JsonPolymorphic(
-    TypeDiscriminatorPropertyName = "kind",
+    TypeDiscriminatorPropertyName = "type",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
-[JsonDerivedType(typeof(McpOauthPendingRequestResponseToken), "token")]
-[JsonDerivedType(typeof(McpOauthPendingRequestResponseCancelled), "cancelled")]
-public partial class McpOauthPendingRequestResponse
+[JsonDerivedType(typeof(TaskInfoAgent), "agent")]
+[JsonDerivedType(typeof(TaskInfoShell), "shell")]
+public partial class TaskInfo
 {
     /// <summary>The type discriminator.</summary>
-    [JsonPropertyName("kind")]
-    public virtual string Kind { get; set; } = string.Empty;
+    [JsonPropertyName("type")]
+    public virtual string Type { get; set; } = string.Empty;
 }
 
 
-/// <summary>The <c>token</c> variant of <see cref="McpOauthPendingRequestResponse"/>.</summary>
+/// <summary>Tracked background agent task metadata, including IDs, status, timing, agent type, prompt, model, result, and latest response.</summary>
+/// <remarks>The <c>agent</c> variant of <see cref="TaskInfo"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public partial class McpOauthPendingRequestResponseToken : McpOauthPendingRequestResponse
+public partial class TaskInfoAgent : TaskInfo
 {
     /// <inheritdoc />
     [JsonIgnore]
-    public override string Kind => "token";
+    public override string Type => "agent";
 
-    /// <summary>Access token acquired by the SDK host.</summary>
-    [JsonPropertyName("accessToken")]
-    public required string AccessToken { get; set; }
+    /// <summary>ISO 8601 timestamp when the current active period began.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("activeStartedAt")]
+    public DateTimeOffset? ActiveStartedAt { get; set; }
 
-    /// <summary>Token lifetime in seconds, if known.</summary>
+    /// <summary>Accumulated active execution time in milliseconds.</summary>
+    [JsonConverter(typeof(MillisecondsTimeSpanConverter))]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("expiresIn")]
-    public long? ExpiresIn { get; set; }
+    [JsonPropertyName("activeTimeMs")]
+    public TimeSpan? ActiveTime { get; set; }
 
-    /// <summary>OAuth token type. Defaults to Bearer when omitted.</summary>
+    /// <summary>Type of agent running this task.</summary>
+    [JsonPropertyName("agentType")]
+    public required string AgentType { get; set; }
+
+    /// <summary>Whether the task is currently in the original sync wait and can be moved to background mode. False once it is already backgrounded, idle, finished, or no longer has a promotable sync waiter.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("tokenType")]
-    public string? TokenType { get; set; }
+    [JsonPropertyName("canPromoteToBackground")]
+    public bool? CanPromoteToBackground { get; set; }
+
+    /// <summary>ISO 8601 timestamp when the task finished.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("completedAt")]
+    public DateTimeOffset? CompletedAt { get; set; }
+
+    /// <summary>Short description of the task.</summary>
+    [JsonPropertyName("description")]
+    public required string Description { get; set; }
+
+    /// <summary>Friendly, non-unique name intended for display.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("displayName")]
+    public string? DisplayName { get; set; }
+
+    /// <summary>Error message when the task failed.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("error")]
+    public string? Error { get; set; }
+
+    /// <summary>Whether task execution is synchronously awaited or managed in the background.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("executionMode")]
+    public TaskExecutionMode? ExecutionMode { get; set; }
+
+    /// <summary>Unique task identifier.</summary>
+    [JsonPropertyName("id")]
+    public required string Id { get; set; }
+
+    /// <summary>ISO 8601 timestamp when the agent entered idle state.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("idleSince")]
+    public DateTimeOffset? IdleSince { get; set; }
+
+    /// <summary>Most recent response text from the agent.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("latestResponse")]
+    public string? LatestResponse { get; set; }
+
+    /// <summary>Requested model override for the task when specified.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("model")]
+    public string? Model { get; set; }
+
+    /// <summary>Most recent prompt delivered to the agent. Updated whenever the agent receives a follow-up message.</summary>
+    [JsonPropertyName("prompt")]
+    public required string Prompt { get; set; }
+
+    /// <summary>Runtime model resolved for the task when available.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("resolvedModel")]
+    public string? ResolvedModel { get; set; }
+
+    /// <summary>Result text from the task when available.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("result")]
+    public string? Result { get; set; }
+
+    /// <summary>ISO 8601 timestamp when the task was started.</summary>
+    [JsonPropertyName("startedAt")]
+    public required DateTimeOffset StartedAt { get; set; }
+
+    /// <summary>Current lifecycle status of the task.</summary>
+    [JsonPropertyName("status")]
+    public required TaskStatus Status { get; set; }
+
+    /// <summary>Tool call ID associated with this agent task.</summary>
+    [JsonPropertyName("toolCallId")]
+    public required string ToolCallId { get; set; }
 }
 
-/// <summary>The <c>cancelled</c> variant of <see cref="McpOauthPendingRequestResponse"/>.</summary>
+/// <summary>Tracked shell task metadata, including ID, command, status, timing, attachment/execution mode, log path, and PID.</summary>
+/// <remarks>The <c>shell</c> variant of <see cref="TaskInfo"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public partial class McpOauthPendingRequestResponseCancelled : McpOauthPendingRequestResponse
+public partial class TaskInfoShell : TaskInfo
 {
     /// <inheritdoc />
     [JsonIgnore]
-    public override string Kind => "cancelled";
+    public override string Type => "shell";
+
+    /// <summary>Whether the shell runs inside a managed PTY session or as an independent background process.</summary>
+    [JsonPropertyName("attachmentMode")]
+    public required TaskShellInfoAttachmentMode AttachmentMode { get; set; }
+
+    /// <summary>Whether this shell task can be promoted to background mode.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("canPromoteToBackground")]
+    public bool? CanPromoteToBackground { get; set; }
+
+    /// <summary>Command being executed.</summary>
+    [JsonPropertyName("command")]
+    public required string Command { get; set; }
+
+    /// <summary>ISO 8601 timestamp when the task finished.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("completedAt")]
+    public DateTimeOffset? CompletedAt { get; set; }
+
+    /// <summary>Short description of the task.</summary>
+    [JsonPropertyName("description")]
+    public required string Description { get; set; }
+
+    /// <summary>Whether task execution is synchronously awaited or managed in the background.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("executionMode")]
+    public TaskExecutionMode? ExecutionMode { get; set; }
+
+    /// <summary>Unique task identifier.</summary>
+    [JsonPropertyName("id")]
+    public required string Id { get; set; }
+
+    /// <summary>Path to the detached shell log, when available.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("logPath")]
+    public string? LogPath { get; set; }
+
+    /// <summary>Process ID when available.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("pid")]
+    public long? Pid { get; set; }
+
+    /// <summary>ISO 8601 timestamp when the task was started.</summary>
+    [JsonPropertyName("startedAt")]
+    public required DateTimeOffset StartedAt { get; set; }
+
+    /// <summary>Current lifecycle status of the task.</summary>
+    [JsonPropertyName("status")]
+    public required TaskStatus Status { get; set; }
 }
 
-/// <summary>Pending MCP OAuth request ID and host-provided token or cancellation response.</summary>
+/// <summary>Background tasks currently tracked by the session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpOauthHandlePendingRequest
+public sealed class TaskList
 {
-    /// <summary>OAuth request identifier from the mcp.oauth_required event.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
-
-    /// <summary>Host response to the pending OAuth request.</summary>
-    [JsonPropertyName("result")]
-    public McpOauthPendingRequestResponse Result { get => field ??= new(); set; }
+    /// <summary>Currently tracked tasks.</summary>
+    [JsonPropertyName("tasks")]
+    public IList<TaskInfo> Tasks { get => field ??= []; set; }
+}
 
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionTasksListRequest
+{
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Identifies the MCP server whose persisted OAuth credentials were updated.</summary>
+/// <summary>Refresh metadata for any detached background shells the runtime knows about. Use after a long pause to pick up exit/output state for shells running outside the agent loop.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpOauthAuthenticationStateChangedRequest
+public sealed class TasksRefreshResult
 {
-    /// <summary>Whether the target session must mint a session-scoped access token instead of reusing a shared access token persisted by another session.</summary>
-    [JsonPropertyName("refreshSessionToken")]
-    public bool? RefreshSessionToken { get; set; }
-
-    /// <summary>Name of the MCP server whose OAuth credentials were updated. Omit only when the host cannot identify the server.</summary>
-    [JsonPropertyName("serverName")]
-    public string? ServerName { get; set; }
+}
 
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionTasksRefreshRequest
+{
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>OAuth authorization URL the caller should open, or empty when cached tokens already authenticated the server.</summary>
+/// <summary>Wait until all in-flight background tasks (agents + shells) and any follow-up turns scheduled by their completions have settled. Returns when the runtime is fully drained or after an internal timeout (default 10 minutes; configurable via COPILOT_TASK_WAIT_TIMEOUT_SECONDS).</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpOauthLoginResult
+public sealed class TasksWaitForPendingResult
 {
-    /// <summary>URL the caller should open in a browser to complete OAuth. Omitted when cached tokens were still valid and no browser interaction was needed — the server is already reconnected in that case. When present, the runtime starts the callback listener before returning and continues the flow in the background; completion is signaled via session.mcp_server_status_changed.</summary>
-    [Url]
-    [StringSyntax(StringSyntaxAttribute.Uri)]
-    [JsonPropertyName("authorizationUrl")]
-    public string? AuthorizationUrl { get; set; }
 }
 
-/// <summary>Remote MCP server name and optional overrides controlling reauthentication, OAuth client display name, callback success-page copy, and static OAuth client selection.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpOauthLoginRequest
+internal sealed class SessionTasksWaitForPendingRequest
 {
-    /// <summary>Optional override for the body text shown on the OAuth loopback callback success page. When omitted, the runtime applies a neutral fallback; callers driving interactive auth should pass surface-specific copy telling the user where to return.</summary>
-    [JsonPropertyName("callbackSuccessMessage")]
-    public string? CallbackSuccessMessage { get; set; }
-
-    /// <summary>Optional OAuth client ID override for this login. When set, the runtime uses this pre-registered static client instead of dynamic client registration.</summary>
-    [JsonPropertyName("clientId")]
-    public string? ClientId { get; set; }
-
-    /// <summary>Optional override for the OAuth client display name shown on the consent screen. Applies to newly registered dynamic clients only — existing registrations keep the name they were created with. When omitted, the runtime applies a neutral fallback; callers driving interactive auth should pass their own surface-specific label so the consent screen matches the product the user sees.</summary>
-    [JsonPropertyName("clientName")]
-    public string? ClientName { get; set; }
-
-    /// <summary>Optional OAuth client secret override for this login. The runtime treats this as an ephemeral host-owned secret, uses it for this authentication attempt and does not persist it.</summary>
-    [JsonPropertyName("clientSecret")]
-    public string? ClientSecret { get; set; }
-
-    /// <summary>When true, clears any cached OAuth token for the server and runs a full new authorization. Use when the user explicitly wants to switch accounts or believes their session is stuck.</summary>
-    [JsonPropertyName("forceReauth")]
-    public bool? ForceReauth { get; set; }
-
-    /// <summary>Optional OAuth grant type override for this login. Defaults to the server configuration, or authorization_code when no grant type is specified.</summary>
-    [JsonPropertyName("grantType")]
-    public McpOauthLoginGrantType? GrantType { get; set; }
-
-    /// <summary>Optional override indicating whether the static OAuth client is public. When false, the runtime treats it as confidential and uses the per-login clientSecret if provided, otherwise retrieving the client secret from the MCP OAuth secret store.</summary>
-    [JsonPropertyName("publicClient")]
-    public bool? PublicClient { get; set; }
-
-    /// <summary>Name of the remote MCP server to authenticate.</summary>
-    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
-    [JsonPropertyName("serverName")]
-    public string ServerName { get; set; } = string.Empty;
-
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Passive MCP OAuth probe result. `authenticated` means the server accepted the probe request while an OAuth-origin access token was attached; it does not prove the server required or independently validated that token. The probe does not make a second unauthenticated request. Failed is an expected probe-domain outcome; JSON-RPC errors are reserved for API-call failures.</summary>
-/// <remarks>Polymorphic base type discriminated by <c>status</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+/// <summary>Polymorphic base type discriminated by <c>type</c>.</summary>
 [JsonPolymorphic(
-    TypeDiscriminatorPropertyName = "status",
+    TypeDiscriminatorPropertyName = "type",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
-[JsonDerivedType(typeof(McpOauthProbeResultNoAuthRequired), "no-auth-required")]
-[JsonDerivedType(typeof(McpOauthProbeResultAuthenticated), "authenticated")]
-[JsonDerivedType(typeof(McpOauthProbeResultNeedsAuth), "needs-auth")]
-[JsonDerivedType(typeof(McpOauthProbeResultFailed), "failed")]
-public partial class McpOauthProbeResult
+[JsonDerivedType(typeof(TasksGetProgressResultProgressAgent), "agent")]
+[JsonDerivedType(typeof(TasksGetProgressResultProgressShell), "shell")]
+public partial class TasksGetProgressResultProgress
 {
     /// <summary>The type discriminator.</summary>
-    [JsonPropertyName("status")]
-    public virtual string Status { get; set; } = string.Empty;
+    [JsonPropertyName("type")]
+    public virtual string Type { get; set; } = string.Empty;
 }
 
 
-/// <summary>The <c>no-auth-required</c> variant of <see cref="McpOauthProbeResult"/>.</summary>
+/// <summary>Timestamped display line for task progress output or recent agent activity.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class McpOauthProbeResultNoAuthRequired : McpOauthProbeResult
+public sealed class TaskProgressLine
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Status => "no-auth-required";
+    /// <summary>Display message, e.g., "▸ bash", "✓ edit src/foo.ts".</summary>
+    [JsonPropertyName("message")]
+    public string Message { get; set; } = string.Empty;
 
-    /// <summary>HTTP response returned by the server.</summary>
-    [JsonPropertyName("httpResponse")]
-    public required McpOauthHttpResponse HttpResponse { get; set; }
+    /// <summary>ISO 8601 timestamp when this event occurred.</summary>
+    [JsonPropertyName("timestamp")]
+    public DateTimeOffset Timestamp { get; set; }
 }
 
-/// <summary>The <c>authenticated</c> variant of <see cref="McpOauthProbeResult"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
-public partial class McpOauthProbeResultAuthenticated : McpOauthProbeResult
+/// <summary>Progress snapshot for an agent task, with recent activity lines and optional latest intent.</summary>
+/// <remarks>The <c>agent</c> variant of <see cref="TasksGetProgressResultProgress"/>.</remarks>
+public partial class TasksGetProgressResultProgressAgent : TasksGetProgressResultProgress
 {
     /// <inheritdoc />
     [JsonIgnore]
-    public override string Status => "authenticated";
+    public override string Type => "agent";
 
-    /// <summary>HTTP response returned by the server.</summary>
-    [JsonPropertyName("httpResponse")]
-    public required McpOauthHttpResponse HttpResponse { get; set; }
+    /// <summary>The most recent intent reported by the agent.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("latestIntent")]
+    public string? LatestIntent { get; set; }
+
+    /// <summary>Recent tool execution events converted to display lines.</summary>
+    [JsonPropertyName("recentActivity")]
+    public required IList<TaskProgressLine> RecentActivity { get; set; }
 }
 
-/// <summary>The <c>needs-auth</c> variant of <see cref="McpOauthProbeResult"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
-public partial class McpOauthProbeResultNeedsAuth : McpOauthProbeResult
+/// <summary>Progress snapshot for a shell task, with recent stdout/stderr output and optional process ID.</summary>
+/// <remarks>The <c>shell</c> variant of <see cref="TasksGetProgressResultProgress"/>.</remarks>
+public partial class TasksGetProgressResultProgressShell : TasksGetProgressResultProgress
 {
     /// <inheritdoc />
     [JsonIgnore]
-    public override string Status => "needs-auth";
-
-    /// <summary>HTTP 401 or 403 response returned by the server.</summary>
-    [JsonPropertyName("httpResponse")]
-    public required McpOauthHttpResponse HttpResponse { get; set; }
-
-    /// <summary>Why authentication is needed.</summary>
-    [JsonPropertyName("reason")]
-    public required McpOauthProbeNeedsAuthReason Reason { get; set; }
+    public override string Type => "shell";
 
-    /// <summary>Parsed WWW-Authenticate challenge parameters, when present and parseable.</summary>
+    /// <summary>Process ID when available.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("wwwAuthenticateParams")]
-    public McpOauthWWWAuthenticateParams? WwwAuthenticateParams { get; set; }
+    [JsonPropertyName("pid")]
+    public long? Pid { get; set; }
+
+    /// <summary>Recent stdout/stderr lines from the running shell command.</summary>
+    [JsonPropertyName("recentOutput")]
+    public required string RecentOutput { get; set; }
 }
 
-/// <summary>The <c>failed</c> variant of <see cref="McpOauthProbeResult"/>.</summary>
+/// <summary>Progress information for the task, or null when no task with that ID is tracked.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class McpOauthProbeResultFailed : McpOauthProbeResult
+public sealed class TasksGetProgressResult
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Status => "failed";
-
-    /// <summary>Human-readable probe failure detail.</summary>
-    [JsonPropertyName("error")]
-    public required string Error { get; set; }
-
-    /// <summary>HTTP response returned by the server, when the probe reached the server and captured the complete response.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("httpResponse")]
-    public McpOauthHttpResponse? HttpResponse { get; set; }
+    /// <summary>Progress information for the task, discriminated by type. Returns null when no task with this ID is currently tracked.</summary>
+    [JsonPropertyName("progress")]
+    public TasksGetProgressResultProgress? Progress { get; set; }
 }
 
-/// <summary>Remote MCP server name for a passive OAuth status probe.</summary>
+/// <summary>Identifier of the background task to fetch progress for.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpOauthProbeRequest
+internal sealed class TasksGetProgressRequest
 {
-    /// <summary>Name of the configured remote MCP server to probe.</summary>
-    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
-    [JsonPropertyName("serverName")]
-    public string ServerName { get; set; } = string.Empty;
+    /// <summary>Task identifier (agent ID or shell ID).</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether the pending MCP OAuth response was accepted.</summary>
+/// <summary>The first sync-waiting task that can currently be promoted to background mode.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpOauthRespondResult
+public sealed class TasksGetCurrentPromotableResult
 {
-    /// <summary>Whether the response was accepted. False if the request was unknown, timed out, or already resolved.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
+    /// <summary>The first sync-waiting task (agent first, then shell) that can currently be promoted to background mode. Omitted if no such task exists. The returned task is guaranteed to have executionMode='sync' and canPromoteToBackground=true at the time of the call.</summary>
+    [JsonPropertyName("task")]
+    public TaskInfo? Task { get; set; }
 }
 
-/// <summary>Pending MCP OAuth request id to respond to.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpOauthRespondRequest
+internal sealed class SessionTasksGetCurrentPromotableRequest
 {
-    /// <summary>OAuth request identifier from the mcp.oauth_required event.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
-
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether the pending MCP headers refresh response was accepted.</summary>
+/// <summary>Indicates whether the task was successfully promoted to background mode.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpHeadersHandlePendingHeadersRefreshRequestResult
+public sealed class TasksPromoteToBackgroundResult
 {
-    /// <summary>Whether the response was accepted. False if the request was unknown, timed out, or already resolved.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
+    /// <summary>Whether the task was successfully promoted to background mode.</summary>
+    [JsonPropertyName("promoted")]
+    public bool Promoted { get; set; }
 }
 
-/// <summary>Host response: supply dynamic headers or decline this refresh.</summary>
-/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
+/// <summary>Identifier of the task to promote to background mode.</summary>
 [Experimental(Diagnostics.Experimental)]
-[JsonPolymorphic(
-    TypeDiscriminatorPropertyName = "kind",
-    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
-[JsonDerivedType(typeof(McpHeadersHandlePendingHeadersRefreshRequestHeaders), "headers")]
-[JsonDerivedType(typeof(McpHeadersHandlePendingHeadersRefreshRequestNone), "none")]
-public partial class McpHeadersHandlePendingHeadersRefreshRequest
+internal sealed class TasksPromoteToBackgroundRequest
 {
-    /// <summary>The type discriminator.</summary>
-    [JsonPropertyName("kind")]
-    public virtual string Kind { get; set; } = string.Empty;
-}
+    /// <summary>Task identifier.</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
 
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-/// <summary>The <c>headers</c> variant of <see cref="McpHeadersHandlePendingHeadersRefreshRequest"/>.</summary>
+/// <summary>The promoted task as it now exists in background mode, omitted if no promotable task was waiting.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class McpHeadersHandlePendingHeadersRefreshRequestHeaders : McpHeadersHandlePendingHeadersRefreshRequest
+public sealed class TasksPromoteCurrentToBackgroundResult
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "headers";
-
-    /// <summary>Headers to overlay onto the MCP request. Dynamic headers override static config headers but do not replace SDK-managed request headers.</summary>
-    [JsonPropertyName("headers")]
-    public required IDictionary<string, string> Headers { get; set; }
+    /// <summary>The promoted task as it now exists in background mode, omitted if no promotable task was waiting. Atomic operation: avoids the race window of getCurrentPromotable + promoteToBackground.</summary>
+    [JsonPropertyName("task")]
+    public TaskInfo? Task { get; set; }
 }
 
-/// <summary>The <c>none</c> variant of <see cref="McpHeadersHandlePendingHeadersRefreshRequest"/>.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class McpHeadersHandlePendingHeadersRefreshRequestNone : McpHeadersHandlePendingHeadersRefreshRequest
+internal sealed class SessionTasksPromoteCurrentToBackgroundRequest
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "none";
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>MCP headers refresh request id and the host response.</summary>
+/// <summary>Indicates whether the background task was successfully cancelled.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpHeadersHandlePendingHeadersRefreshRequestRequest
+public sealed class TasksCancelResult
 {
-    /// <summary>Headers refresh request identifier from mcp.headers_refresh_required.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
+    /// <summary>Whether the task was successfully cancelled.</summary>
+    [JsonPropertyName("cancelled")]
+    public bool Cancelled { get; set; }
+}
 
-    /// <summary>Host response: supply dynamic headers or decline this refresh.</summary>
-    [JsonPropertyName("result")]
-    public McpHeadersHandlePendingHeadersRefreshRequest Result { get => field ??= new(); set; }
+/// <summary>Identifier of the background task to cancel.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class TasksCancelRequest
+{
+    /// <summary>Task identifier.</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>MCP Apps resource content with URI, optional MIME type, text or base64 blob, and resource metadata.</summary>
+/// <summary>Indicates whether the task was removed. False when the task does not exist or is still running/idle.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpAppsResourceContent
+public sealed class TasksRemoveResult
 {
-    /// <summary>Resource-level metadata (CSP, permissions, etc.).</summary>
-    [JsonPropertyName("_meta")]
-    public IDictionary<string, JsonElement>? Meta { get; set; }
-
-    /// <summary>Base64-encoded binary content.</summary>
-    [JsonPropertyName("blob")]
-    public string? Blob { get; set; }
-
-    /// <summary>MIME type of the content.</summary>
-    [JsonPropertyName("mimeType")]
-    public string? MimeType { get; set; }
-
-    /// <summary>Text content (e.g. HTML).</summary>
-    [JsonPropertyName("text")]
-    public string? Text { get; set; }
-
-    /// <summary>The resource URI (typically ui://...).</summary>
-    [JsonPropertyName("uri")]
-    public string Uri { get; set; } = string.Empty;
-}
-
-/// <summary>Resource contents returned by the MCP server.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class McpAppsReadResourceResult
-{
-    /// <summary>Resource contents returned by the server.</summary>
-    [JsonPropertyName("contents")]
-    public IList<McpAppsResourceContent> Contents { get => field ??= []; set; }
+    /// <summary>Whether the task was removed. Returns false if the task does not exist or is still running/idle (cancel it first).</summary>
+    [JsonPropertyName("removed")]
+    public bool Removed { get; set; }
 }
 
-/// <summary>MCP server and resource URI to fetch.</summary>
+/// <summary>Identifier of the completed or cancelled task to remove from tracking.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpAppsReadResourceRequest
+internal sealed class TasksRemoveRequest
 {
-    /// <summary>Name of the MCP server hosting the resource.</summary>
-    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
-    [JsonPropertyName("serverName")]
-    public string ServerName { get; set; } = string.Empty;
+    /// <summary>Task identifier.</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
-
-    /// <summary>Resource URI (typically ui://...).</summary>
-    [JsonPropertyName("uri")]
-    public string Uri { get; set; } = string.Empty;
-}
-
-/// <summary>App-callable tools from the named MCP server.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class McpAppsListToolsResult
-{
-    /// <summary>App-callable tools from the server.</summary>
-    [JsonPropertyName("tools")]
-    public IList<IDictionary<string, JsonElement>> Tools { get => field ??= []; set; }
 }
 
-/// <summary>MCP server to list app-callable tools for.</summary>
+/// <summary>Indicates whether the message was delivered, with an error message when delivery failed.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpAppsListToolsRequest
+public sealed class TasksSendMessageResult
 {
-    /// <summary>**Required.** Server whose ui:// view issued the request. Per SEP-1865 ('callable by the app from this server only'), the call is rejected when this differs from `serverName`, and rejected outright when missing.</summary>
-    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
-    [JsonPropertyName("originServerName")]
-    public string OriginServerName { get; set; } = string.Empty;
-
-    /// <summary>MCP server hosting the app.</summary>
-    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
-    [JsonPropertyName("serverName")]
-    public string ServerName { get; set; } = string.Empty;
+    /// <summary>Error message if delivery failed.</summary>
+    [JsonPropertyName("error")]
+    public string? Error { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Whether the message was successfully delivered or steered.</summary>
+    [JsonPropertyName("sent")]
+    public bool Sent { get; set; }
 }
 
-/// <summary>MCP server, tool name, and arguments to invoke from an MCP App view.</summary>
+/// <summary>Identifier of the target agent task, message content, and optional sender agent ID.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpAppsCallToolRequest
+internal sealed class TasksSendMessageRequest
 {
-    /// <summary>Tool arguments.</summary>
-    [JsonPropertyName("arguments")]
-    public IDictionary<string, JsonElement>? Arguments { get; set; }
+    /// <summary>Agent ID of the sender, if sent on behalf of another agent.</summary>
+    [JsonPropertyName("fromAgentId")]
+    public string? FromAgentId { get; set; }
 
-    /// <summary>**Required.** Server whose ui:// view issued the request. Per SEP-1865 ('callable by the app from this server only'), the call is rejected when this differs from `serverName`, and rejected outright when missing.</summary>
-    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
-    [JsonPropertyName("originServerName")]
-    public string OriginServerName { get; set; } = string.Empty;
+    /// <summary>Agent task identifier.</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
 
-    /// <summary>MCP server hosting the tool.</summary>
-    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
-    [JsonPropertyName("serverName")]
-    public string ServerName { get; set; } = string.Empty;
+    /// <summary>Message content to send to the agent.</summary>
+    [JsonPropertyName("message")]
+    public string Message { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
-
-    /// <summary>MCP tool name.</summary>
-    [JsonPropertyName("toolName")]
-    public string ToolName { get; set; } = string.Empty;
 }
 
-/// <summary>Host context advertised to MCP App guests.</summary>
+/// <summary>Skill metadata available to a session, with name, description, source, enabled/invocable state, path, plugin, and argument hint.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpAppsSetHostContextDetails
+public sealed class Skill
 {
-    /// <summary>Display modes the host supports.</summary>
-    [JsonPropertyName("availableDisplayModes")]
-    public IList<McpAppsSetHostContextDetailsAvailableDisplayMode>? AvailableDisplayModes { get; set; }
+    /// <summary>Optional freeform hint describing the skill's expected arguments, from the `argument-hint` frontmatter field.</summary>
+    [JsonPropertyName("argumentHint")]
+    public string? ArgumentHint { get; set; }
 
-    /// <summary>Current display mode (SEP-1865).</summary>
-    [JsonPropertyName("displayMode")]
-    public McpAppsSetHostContextDetailsDisplayMode? DisplayMode { get; set; }
+    /// <summary>Canonical slash command name used to invoke the skill, without the leading '/'.</summary>
+    [JsonPropertyName("commandName")]
+    public string? CommandName { get; set; }
 
-    /// <summary>BCP-47 locale, e.g. 'en-US'.</summary>
-    [JsonPropertyName("locale")]
-    public string? Locale { get; set; }
+    /// <summary>Description of what the skill does.</summary>
+    [JsonPropertyName("description")]
+    public string Description { get; set; } = string.Empty;
 
-    /// <summary>Platform type for responsive design.</summary>
-    [JsonPropertyName("platform")]
-    public McpAppsSetHostContextDetailsPlatform? Platform { get; set; }
+    /// <summary>Whether the skill is currently enabled.</summary>
+    [JsonPropertyName("enabled")]
+    public bool Enabled { get; set; }
 
-    /// <summary>UI theme preference per SEP-1865.</summary>
-    [JsonPropertyName("theme")]
-    public McpAppsSetHostContextDetailsTheme? Theme { get; set; }
+    /// <summary>Unique identifier for the skill.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
-    /// <summary>IANA timezone, e.g. 'America/New_York'.</summary>
-    [JsonPropertyName("timeZone")]
-    public string? TimeZone { get; set; }
+    /// <summary>Absolute path to the skill file.</summary>
+    [JsonPropertyName("path")]
+    public string? Path { get; set; }
 
-    /// <summary>Host application identifier.</summary>
-    [JsonPropertyName("userAgent")]
-    public string? UserAgent { get; set; }
+    /// <summary>Name of the plugin that provides the skill, when source is 'plugin'.</summary>
+    [JsonPropertyName("pluginName")]
+    public string? PluginName { get; set; }
+
+    /// <summary>Source location type (e.g., project, personal-copilot, plugin, builtin).</summary>
+    [JsonPropertyName("source")]
+    public SkillSource Source { get; set; }
+
+    /// <summary>Whether the skill can be invoked by the user as a slash command.</summary>
+    [JsonPropertyName("userInvocable")]
+    public bool UserInvocable { get; set; }
 }
 
-/// <summary>Host context to advertise to MCP App guests.</summary>
+/// <summary>Skills available to the session, with their enabled state.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpAppsSetHostContextRequest
+public sealed class SkillList
 {
-    /// <summary>Host context advertised to MCP App guests.</summary>
-    [JsonPropertyName("context")]
-    public McpAppsSetHostContextDetails Context { get => field ??= new(); set; }
+    /// <summary>Available skills.</summary>
+    [JsonPropertyName("skills")]
+    public IList<Skill> Skills { get => field ??= []; set; }
+}
 
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionSkillsListRequest
+{
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Current host context.</summary>
+/// <summary>Skill invocation record with name, path, content, allowed tools, and turn number.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpAppsHostContextDetails
+public sealed class SkillsInvokedSkill
 {
-    /// <summary>Display modes the host supports.</summary>
-    [JsonPropertyName("availableDisplayModes")]
-    public IList<McpAppsHostContextDetailsAvailableDisplayMode>? AvailableDisplayModes { get; set; }
-
-    /// <summary>Current display mode (SEP-1865).</summary>
-    [JsonPropertyName("displayMode")]
-    public McpAppsHostContextDetailsDisplayMode? DisplayMode { get; set; }
-
-    /// <summary>BCP-47 locale, e.g. 'en-US'.</summary>
-    [JsonPropertyName("locale")]
-    public string? Locale { get; set; }
+    /// <summary>Tools that should be auto-approved when this skill is active, captured at invocation time.</summary>
+    [JsonPropertyName("allowedTools")]
+    public IList<string>? AllowedTools { get; set; }
 
-    /// <summary>Platform type for responsive design.</summary>
-    [JsonPropertyName("platform")]
-    public McpAppsHostContextDetailsPlatform? Platform { get; set; }
+    /// <summary>Full content of the skill file.</summary>
+    [JsonPropertyName("content")]
+    public string Content { get; set; } = string.Empty;
 
-    /// <summary>UI theme preference per SEP-1865.</summary>
-    [JsonPropertyName("theme")]
-    public McpAppsHostContextDetailsTheme? Theme { get; set; }
+    /// <summary>Turn number when the skill was invoked.</summary>
+    [JsonPropertyName("invokedAtTurn")]
+    public long InvokedAtTurn { get; set; }
 
-    /// <summary>IANA timezone, e.g. 'America/New_York'.</summary>
-    [JsonPropertyName("timeZone")]
-    public string? TimeZone { get; set; }
+    /// <summary>Unique identifier for the skill.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
-    /// <summary>Host application identifier.</summary>
-    [JsonPropertyName("userAgent")]
-    public string? UserAgent { get; set; }
+    /// <summary>Path to the SKILL.md file.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
 }
 
-/// <summary>Current host context advertised to MCP App guests.</summary>
+/// <summary>Skills invoked during this session, ordered by invocation time (most recent last).</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpAppsHostContext
+public sealed class SkillsGetInvokedResult
 {
-    /// <summary>Current host context.</summary>
-    [JsonPropertyName("context")]
-    public McpAppsHostContextDetails Context { get => field ??= new(); set; }
+    /// <summary>Skills invoked during this session, ordered by invocation time (most recent last).</summary>
+    [JsonPropertyName("skills")]
+    public IList<SkillsInvokedSkill> Skills { get => field ??= []; set; }
 }
 
 /// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionMcpAppsGetHostContextRequest
+internal sealed class SessionSkillsGetInvokedRequest
 {
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Capability negotiation snapshot.</summary>
+/// <summary>Name of the skill to enable for the session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpAppsDiagnoseCapability
+internal sealed class SkillsEnableRequest
 {
-    /// <summary>Whether the runtime advertises `extensions.io.modelcontextprotocol/ui` to MCP servers.</summary>
-    [JsonPropertyName("advertised")]
-    public bool Advertised { get; set; }
-
-    /// <summary>Whether the MCP_APPS feature flag (or COPILOT_MCP_APPS env override) is on.</summary>
-    [JsonPropertyName("featureFlagEnabled")]
-    public bool FeatureFlagEnabled { get; set; }
+    /// <summary>Name of the skill to enable.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
-    /// <summary>Whether the session has the `mcp-apps` capability.</summary>
-    [JsonPropertyName("sessionHasMcpApps")]
-    public bool SessionHasMcpApps { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>What the server returned for this session.</summary>
+/// <summary>Name of the skill to disable for the session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpAppsDiagnoseServer
+internal sealed class SkillsDisableRequest
 {
-    /// <summary>Whether the named server is currently connected.</summary>
-    [JsonPropertyName("connected")]
-    public bool Connected { get; set; }
-
-    /// <summary>Up to 5 tool names with `_meta.ui` for quick inspection.</summary>
-    [JsonPropertyName("sampleToolNames")]
-    public IList<string> SampleToolNames { get => field ??= []; set; }
-
-    /// <summary>Total tools returned by the server's tools/list.</summary>
-    [JsonPropertyName("toolCount")]
-    public double ToolCount { get; set; }
+    /// <summary>Name of the skill to disable.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
-    /// <summary>Tools whose `_meta.ui` is populated (resourceUri and/or visibility set).</summary>
-    [JsonPropertyName("toolsWithUiMeta")]
-    public double ToolsWithUiMeta { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Diagnostic snapshot of MCP Apps wiring for the named server.</summary>
+/// <summary>Diagnostics from reloading skill definitions, with warnings and errors as separate lists.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpAppsDiagnoseResult
+public sealed class SkillsLoadDiagnostics
 {
-    /// <summary>Capability negotiation snapshot.</summary>
-    [JsonPropertyName("capability")]
-    public McpAppsDiagnoseCapability Capability { get => field ??= new(); set; }
+    /// <summary>Errors emitted while loading skills (e.g. skills that failed to load entirely).</summary>
+    [JsonPropertyName("errors")]
+    public IList<string> Errors { get => field ??= []; set; }
 
-    /// <summary>What the server returned for this session.</summary>
-    [JsonPropertyName("server")]
-    public McpAppsDiagnoseServer Server { get => field ??= new(); set; }
+    /// <summary>Warnings emitted while loading skills (e.g. skills that loaded but had issues).</summary>
+    [JsonPropertyName("warnings")]
+    public IList<string> Warnings { get => field ??= []; set; }
 }
 
-/// <summary>MCP server to diagnose MCP Apps wiring for.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpAppsDiagnoseRequest
+internal sealed class SessionSkillsReloadRequest
 {
-    /// <summary>MCP server to probe.</summary>
-    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
-    [JsonPropertyName("serverName")]
-    public string ServerName { get; set; } = string.Empty;
-
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>MCP resource content with URI, optional MIME type, text or base64 blob, and resource metadata.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpResourceContent
+internal sealed class SessionSkillsEnsureLoadedRequest
 {
-    /// <summary>Resource-level metadata (CSP, permissions, etc.).</summary>
-    [JsonPropertyName("_meta")]
-    public IDictionary<string, JsonElement>? Meta { get; set; }
-
-    /// <summary>Base64-encoded binary content.</summary>
-    [JsonPropertyName("blob")]
-    public string? Blob { get; set; }
-
-    /// <summary>MIME type of the content.</summary>
-    [JsonPropertyName("mimeType")]
-    public string? MimeType { get; set; }
-
-    /// <summary>Text content (e.g. HTML).</summary>
-    [JsonPropertyName("text")]
-    public string? Text { get; set; }
-
-    /// <summary>The resource URI.</summary>
-    [JsonPropertyName("uri")]
-    public string Uri { get; set; } = string.Empty;
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Resource contents returned by the MCP server.</summary>
+/// <summary>Recorded MCP server connection failure.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpResourcesReadResult
+public sealed class McpServerFailureInfo
 {
-    /// <summary>Resource contents returned by the server.</summary>
-    [JsonPropertyName("contents")]
-    public IList<McpResourceContent> Contents { get => field ??= []; set; }
+    /// <summary>Failure message produced when the MCP server connection failed.</summary>
+    [JsonPropertyName("message")]
+    public string Message { get; set; } = string.Empty;
+
+    /// <summary>epoch-ms timestamp at which the failure was recorded.</summary>
+    [JsonPropertyName("timestamp")]
+    public long Timestamp { get; set; }
 }
 
-/// <summary>MCP server and resource URI to fetch.</summary>
+/// <summary>Recorded MCP server pending-auth state.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpResourcesReadRequest
+public sealed class McpServerNeedsAuthInfo
 {
-    /// <summary>Name of the MCP server hosting the resource.</summary>
-    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
-    [JsonPropertyName("serverName")]
-    public string ServerName { get; set; } = string.Empty;
-
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-
-    /// <summary>Resource URI.</summary>
-    [JsonPropertyName("uri")]
-    public string Uri { get; set; } = string.Empty;
+    /// <summary>epoch-ms timestamp at which the server signalled it needs authentication.</summary>
+    [JsonPropertyName("timestamp")]
+    public long Timestamp { get; set; }
 }
 
-/// <summary>Standard MCP resource annotations plus preserved non-standard annotation fields.</summary>
+/// <summary>Host-level state, omitted when no MCP host is initialized.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpResourceAnnotations
+public sealed class McpHostState
 {
-    /// <summary>Server-provided non-standard annotation fields preserved from the MCP response.</summary>
-    [JsonPropertyName("additionalProperties")]
-    public IDictionary<string, JsonElement>? AdditionalProperties { get; set; }
-
-    /// <summary>Intended audience roles for this resource.</summary>
-    [JsonPropertyName("audience")]
-    public IList<string>? Audience { get; set; }
-
-    /// <summary>Last-modified timestamp hint.</summary>
-    [JsonPropertyName("lastModified")]
-    public string? LastModified { get; set; }
+    /// <summary>Names of currently-connected MCP clients.</summary>
+    [JsonPropertyName("clients")]
+    public IList<string> Clients { get => field ??= []; set; }
 
-    /// <summary>Priority hint for model/client use.</summary>
-    [JsonPropertyName("priority")]
-    public double? Priority { get; set; }
-}
+    /// <summary>Configured servers that are explicitly disabled.</summary>
+    [JsonPropertyName("disabledServers")]
+    public IList<string> DisabledServers { get => field ??= []; set; }
 
-/// <summary>A resource icon descriptor plus preserved non-standard icon fields.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class McpResourceIcon
-{
-    /// <summary>Server-provided non-standard icon fields preserved from the MCP response.</summary>
-    [JsonPropertyName("additionalProperties")]
-    public IDictionary<string, JsonElement>? AdditionalProperties { get; set; }
+    /// <summary>Map of server name to recorded connection failure.</summary>
+    [JsonPropertyName("failedServers")]
+    public IDictionary<string, McpServerFailureInfo> FailedServers { get => field ??= new Dictionary<string, McpServerFailureInfo>(); set; }
 
-    /// <summary>Icon MIME type, when known.</summary>
-    [JsonPropertyName("mimeType")]
-    public string? MimeType { get; set; }
+    /// <summary>Configured servers filtered out by MCP server policy.</summary>
+    [JsonPropertyName("filteredServers")]
+    public IList<string> FilteredServers { get => field ??= []; set; }
 
-    /// <summary>Icon sizes hint.</summary>
-    [JsonPropertyName("sizes")]
-    public string? Sizes { get; set; }
+    /// <summary>Whether third-party MCP servers are policy-enabled for this session.</summary>
+    [JsonPropertyName("mcp3pEnabled")]
+    public bool Mcp3pEnabled { get; set; }
 
-    /// <summary>Icon URI.</summary>
-    [JsonPropertyName("src")]
-    public string Src { get; set; } = string.Empty;
+    /// <summary>Map of server name to recorded pending-auth state.</summary>
+    [JsonPropertyName("needsAuthServers")]
+    public IDictionary<string, McpServerNeedsAuthInfo> NeedsAuthServers { get => field ??= new Dictionary<string, McpServerNeedsAuthInfo>(); set; }
 
-    /// <summary>Theme hint for this icon.</summary>
-    [JsonPropertyName("theme")]
-    public string? Theme { get; set; }
+    /// <summary>Names of servers with in-flight connection attempts.</summary>
+    [JsonPropertyName("pendingConnections")]
+    public IList<string> PendingConnections { get => field ??= []; set; }
 }
 
-/// <summary>An MCP resource descriptor (spec `Resource`): URI, name, and optional title, description, MIME type, size, icons, annotations, and metadata. Server-provided fields outside the standard descriptor shape are exposed under `additionalProperties`.</summary>
+/// <summary>MCP server status entry, including config source/plugin source and any connection error.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpResource
+public sealed class McpServer
 {
-    /// <summary>Resource-level metadata.</summary>
-    [JsonPropertyName("_meta")]
-    public IDictionary<string, JsonElement>? Meta { get; set; }
-
-    /// <summary>Server-provided non-standard descriptor fields preserved from the MCP response.</summary>
-    [JsonPropertyName("additionalProperties")]
-    public IDictionary<string, JsonElement>? AdditionalProperties { get; set; }
-
-    /// <summary>Model/client annotations associated with this resource.</summary>
-    [JsonPropertyName("annotations")]
-    public McpResourceAnnotations? Annotations { get; set; }
-
-    /// <summary>Optional description of what this resource represents.</summary>
-    [JsonPropertyName("description")]
-    public string? Description { get; set; }
-
-    /// <summary>Icons associated with this resource.</summary>
-    [JsonPropertyName("icons")]
-    public IList<McpResourceIcon>? Icons { get; set; }
-
-    /// <summary>MIME type of the resource, if known.</summary>
-    [JsonPropertyName("mimeType")]
-    public string? MimeType { get; set; }
+    /// <summary>Error message if the server failed to connect.</summary>
+    [JsonPropertyName("error")]
+    public string? Error { get; set; }
 
-    /// <summary>The programmatic name of the resource.</summary>
+    /// <summary>Server name (config key).</summary>
+    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
     [JsonPropertyName("name")]
     public string Name { get; set; } = string.Empty;
 
-    /// <summary>Resource size in bytes, when known.</summary>
-    [JsonPropertyName("size")]
-    public long? Size { get; set; }
+    /// <summary>Configuration source: user, workspace, plugin, or builtin.</summary>
+    [JsonPropertyName("source")]
+    public McpServerSource? Source { get; set; }
 
-    /// <summary>Optional human-readable display title.</summary>
-    [JsonPropertyName("title")]
-    public string? Title { get; set; }
+    /// <summary>Plugin name that provided this server, when source is plugin.</summary>
+    [JsonPropertyName("sourcePlugin")]
+    public string? SourcePlugin { get; set; }
 
-    /// <summary>The resource URI (e.g. ui://... or file:///...).</summary>
-    [JsonPropertyName("uri")]
-    public string Uri { get; set; } = string.Empty;
+    /// <summary>Plugin version that provided this server, when source is plugin.</summary>
+    [JsonPropertyName("sourcePluginVersion")]
+    public string? SourcePluginVersion { get; set; }
+
+    /// <summary>Connection status: connected, failed, needs-auth, pending, disabled, stopped, or not_configured.</summary>
+    [JsonPropertyName("status")]
+    public McpServerStatus Status { get; set; }
 }
 
-/// <summary>One page of resources advertised by the named MCP server.</summary>
+/// <summary>MCP servers configured for the session, with their connection status and host-level state.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpResourcesListResult
+public sealed class McpServerList
 {
-    /// <summary>Opaque cursor for the next page, if the server has more resources.</summary>
-    [JsonPropertyName("nextCursor")]
-    public string? NextCursor { get; set; }
+    /// <summary>Host-level state, omitted when no MCP host is initialized.</summary>
+    [JsonPropertyName("host")]
+    public McpHostState? Host { get; set; }
 
-    /// <summary>Resources advertised by the server (proxied MCP `resources/list`).</summary>
-    [JsonPropertyName("resources")]
-    public IList<McpResource> Resources { get => field ??= []; set; }
+    /// <summary>Configured MCP servers.</summary>
+    [JsonPropertyName("servers")]
+    public IList<McpServer> Servers { get => field ??= []; set; }
 }
 
-/// <summary>MCP server whose resources to enumerate.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpResourcesListRequest
+internal sealed class SessionMcpListRequest
 {
-    /// <summary>Opaque MCP pagination cursor from a prior `nextCursor` value.</summary>
-    [JsonPropertyName("cursor")]
-    public string? Cursor { get; set; }
-
-    /// <summary>Name of the MCP server whose resources to enumerate.</summary>
-    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
-    [JsonPropertyName("serverName")]
-    public string ServerName { get; set; } = string.Empty;
-
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>An MCP resource template descriptor (spec `ResourceTemplate`): an RFC 6570 URI template, name, and optional title, description, MIME type, icons, annotations, and metadata. Server-provided fields outside the standard descriptor shape are exposed under `additionalProperties`.</summary>
+/// <summary>Normalized MCP Apps discovery metadata from a tool's `_meta.ui` block.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpResourceTemplate
+public sealed class McpToolUi
 {
-    /// <summary>Resource-template-level metadata.</summary>
-    [JsonPropertyName("_meta")]
-    public IDictionary<string, JsonElement>? Meta { get; set; }
-
-    /// <summary>Server-provided non-standard descriptor fields preserved from the MCP response.</summary>
-    [JsonPropertyName("additionalProperties")]
-    public IDictionary<string, JsonElement>? AdditionalProperties { get; set; }
+    /// <summary>URI of the tool's MCP App resource, typically a `ui://` resource identifier. Use `session.mcp.resources.read` to fetch its HTML and resource metadata.</summary>
+    [JsonPropertyName("resourceUri")]
+    public string? ResourceUri { get; set; }
 
-    /// <summary>Model/client annotations associated with this template.</summary>
-    [JsonPropertyName("annotations")]
-    public McpResourceAnnotations? Annotations { get; set; }
+    /// <summary>Tool visibility advertised by the server. When absent, MCP Apps defaults apply.</summary>
+    [JsonPropertyName("visibility")]
+    public IList<McpToolUiVisibility>? Visibility { get; set; }
+}
 
-    /// <summary>Optional description of what this template is for.</summary>
+/// <summary>MCP tool metadata with tool name, optional description, and normalized MCP Apps discovery metadata.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class McpTools
+{
+    /// <summary>Tool description, when provided.</summary>
     [JsonPropertyName("description")]
     public string? Description { get; set; }
 
-    /// <summary>Icons associated with resources matching this template.</summary>
-    [JsonPropertyName("icons")]
-    public IList<McpResourceIcon>? Icons { get; set; }
-
-    /// <summary>MIME type for resources matching this template, if uniform.</summary>
-    [JsonPropertyName("mimeType")]
-    public string? MimeType { get; set; }
-
-    /// <summary>The programmatic name of the resource template.</summary>
+    /// <summary>Tool name.</summary>
     [JsonPropertyName("name")]
     public string Name { get; set; } = string.Empty;
 
-    /// <summary>Optional human-readable display title.</summary>
-    [JsonPropertyName("title")]
-    public string? Title { get; set; }
+    /// <summary>Normalized MCP Apps discovery metadata. An empty object indicates that a valid `_meta.ui` block was present without recognized fields.</summary>
+    [JsonPropertyName("ui")]
+    public McpToolUi? Ui { get; set; }
+}
 
-    /// <summary>An RFC 6570 URI template for constructing resource URIs.</summary>
-    [JsonPropertyName("uriTemplate")]
-    public string UriTemplate { get; set; } = string.Empty;
+/// <summary>Tools exposed by the connected MCP server. Throws when the server is not connected.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class McpListToolsResult
+{
+    /// <summary>Tools exposed by the server.</summary>
+    [JsonPropertyName("tools")]
+    public IList<McpTools> Tools { get => field ??= []; set; }
 }
 
-/// <summary>One page of resource templates advertised by the named MCP server.</summary>
+/// <summary>Server name whose tool list should be returned.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class McpResourcesListTemplatesResult
+internal sealed class McpListToolsRequest
 {
-    /// <summary>Opaque cursor for the next page, if the server has more resource templates.</summary>
-    [JsonPropertyName("nextCursor")]
-    public string? NextCursor { get; set; }
+    /// <summary>Name of the connected MCP server whose tools to list.</summary>
+    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("serverName")]
+    public string ServerName { get; set; } = string.Empty;
 
-    /// <summary>Resource templates advertised by the server (proxied MCP `resources/templates/list`).</summary>
-    [JsonPropertyName("resourceTemplates")]
-    public IList<McpResourceTemplate> ResourceTemplates { get => field ??= []; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>MCP server whose resource templates to enumerate.</summary>
+/// <summary>Name of the MCP server to enable for the session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class McpResourcesListTemplatesRequest
+internal sealed class McpEnableRequest
 {
-    /// <summary>Opaque MCP pagination cursor from a prior `nextCursor` value.</summary>
-    [JsonPropertyName("cursor")]
-    public string? Cursor { get; set; }
-
-    /// <summary>Name of the MCP server whose resource templates to enumerate.</summary>
+    /// <summary>Name of the MCP server to enable.</summary>
     [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
     [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
     [MinLength(1)]
@@ -8783,8152 +8993,11037 @@ internal sealed class McpResourcesListTemplatesRequest
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Session plugin metadata, with name, marketplace, optional version, and enabled state.</summary>
+/// <summary>Name of the MCP server to disable for the session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class Plugin
+internal sealed class McpDisableRequest
 {
-    /// <summary>Whether the plugin is currently enabled.</summary>
-    [JsonPropertyName("enabled")]
-    public bool Enabled { get; set; }
-
-    /// <summary>Marketplace the plugin came from.</summary>
-    [JsonPropertyName("marketplace")]
-    public string Marketplace { get; set; } = string.Empty;
+    /// <summary>Name of the MCP server to disable.</summary>
+    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("serverName")]
+    public string ServerName { get; set; } = string.Empty;
 
-    /// <summary>Plugin name.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Installed version.</summary>
-    [JsonPropertyName("version")]
-    public string? Version { get; set; }
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionMcpReloadRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Plugins installed for the session, with their enabled state and version metadata.</summary>
+/// <summary>Result of moving in-flight MCP loading to the background.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PluginList
+public sealed class MoveMcpLoadingToBackgroundResult
 {
-    /// <summary>Installed plugins.</summary>
-    [JsonPropertyName("plugins")]
-    public IList<Plugin> Plugins { get => field ??= []; set; }
+    /// <summary>Whether an in-flight MCP load was moved to the background, releasing turns that were waiting on it. False when no MCP load was in flight or the waiting turns had already been released.</summary>
+    [JsonPropertyName("movedToBackground")]
+    public bool MovedToBackground { get; set; }
 }
 
 /// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionPluginsListRequest
+internal sealed class SessionMcpMoveLoadingToBackgroundRequest
 {
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>RPC data type for SessionPluginsReload operations.</summary>
+/// <summary>MCP server allowed by policy, with server name and optional PII-free explanatory note.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionPluginsReloadRequest
+public sealed class McpAllowedServer
 {
-    /// <summary>When true, skip repo-level hooks during the hook reload. Use before folder trust is confirmed; load them post-trust via `sessions.loadDeferredRepoHooks`.</summary>
-    [JsonPropertyName("deferRepoHooks")]
-    public bool? DeferRepoHooks { get; set; }
-
-    /// <summary>Re-run custom-agent discovery after refreshing plugins. Defaults to true.</summary>
-    [JsonPropertyName("reloadCustomAgents")]
-    public bool? ReloadCustomAgents { get; set; }
+    /// <summary>Allowed server name.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
-    /// <summary>Re-discover and relaunch subprocess extensions (including plugin-shipped extensions) after refreshing plugins. Defaults to true. Has no effect when the session has no active extension controller (e.g. extensions were not requested for the session).</summary>
-    [JsonPropertyName("reloadExtensions")]
-    public bool? ReloadExtensions { get; set; }
+    /// <summary>PII-free note explaining why the server was allowed.</summary>
+    [JsonPropertyName("redactedNote")]
+    public string? RedactedNote { get; set; }
+}
 
-    /// <summary>Re-load user, plugin, and (subject to `deferRepoHooks`) repo hooks. Defaults to true. Has no effect when the host has not registered a hook reloader (e.g. remote sessions).</summary>
-    [JsonPropertyName("reloadHooks")]
-    public bool? ReloadHooks { get; set; }
+/// <summary>MCP server whose connection attempt failed.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class McpFailedServer
+{
+    /// <summary>The captured connection failure detail.</summary>
+    [JsonPropertyName("error")]
+    public string? Error { get; set; }
 
-    /// <summary>Reload MCP server connections after refreshing plugins. Defaults to true.</summary>
-    [JsonPropertyName("reloadMcp")]
-    public bool? ReloadMcp { get; set; }
+    /// <summary>The config key of the server that failed to connect.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 }
 
-/// <summary>RPC data type for SessionPluginsReloadRequestWithSession operations.</summary>
+/// <summary>MCP server filtered by policy, with name, reason, and optional redacted reason.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionPluginsReloadRequestWithSession
+public sealed class McpFilteredServer
 {
-    /// <summary>When true, skip repo-level hooks during the hook reload. Use before folder trust is confirmed; load them post-trust via `sessions.loadDeferredRepoHooks`.</summary>
-    [JsonPropertyName("deferRepoHooks")]
-    public bool? DeferRepoHooks { get; set; }
+    /// <summary>Deprecated. This field is no longer populated.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+#if NET5_0_OR_GREATER
+    [Obsolete("This member is deprecated and will be removed in a future version.", DiagnosticId = "GHCP001")]
+#endif
+    [JsonPropertyName("enterpriseName")]
+    public string? EnterpriseName { get; set; }
 
-    /// <summary>Re-run custom-agent discovery after refreshing plugins. Defaults to true.</summary>
-    [JsonPropertyName("reloadCustomAgents")]
-    public bool? ReloadCustomAgents { get; set; }
+    /// <summary>Filtered server name.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
-    /// <summary>Re-discover and relaunch subprocess extensions (including plugin-shipped extensions) after refreshing plugins. Defaults to true. Has no effect when the session has no active extension controller (e.g. extensions were not requested for the session).</summary>
-    [JsonPropertyName("reloadExtensions")]
-    public bool? ReloadExtensions { get; set; }
+    /// <summary>Human-readable filter reason.</summary>
+    [JsonPropertyName("reason")]
+    public string Reason { get; set; } = string.Empty;
 
-    /// <summary>Re-load user, plugin, and (subject to `deferRepoHooks`) repo hooks. Defaults to true. Has no effect when the host has not registered a hook reloader (e.g. remote sessions).</summary>
-    [JsonPropertyName("reloadHooks")]
-    public bool? ReloadHooks { get; set; }
+    /// <summary>PII-free filter reason.</summary>
+    [JsonPropertyName("redactedReason")]
+    public string? RedactedReason { get; set; }
+}
 
-    /// <summary>Reload MCP server connections after refreshing plugins. Defaults to true.</summary>
-    [JsonPropertyName("reloadMcp")]
-    public bool? ReloadMcp { get; set; }
+/// <summary>MCP server startup filtering result.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class McpStartServersResult
+{
+    /// <summary>Non-default servers allowed by policy.</summary>
+    [JsonPropertyName("allowedServers")]
+    public IList<McpAllowedServer>? AllowedServers { get; set; }
+
+    /// <summary>Servers whose connection attempt failed.</summary>
+    [JsonPropertyName("failedServers")]
+    public IList<McpFailedServer>? FailedServers { get; set; }
+
+    /// <summary>Servers filtered out before startup.</summary>
+    [JsonPropertyName("filteredServers")]
+    public IList<McpFilteredServer> FilteredServers { get => field ??= []; set; }
+}
 
+/// <summary>Opaque MCP reload configuration.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class McpReloadWithConfigRequest
+{
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Short-lived, rotating credential the caller must send on every request, in addition to `apiKey` if one is present. Omitted when the endpoint does not require one.</summary>
+/// <summary>MCP CreateMessageResult payload (with optional 'tools' extension), present when action='success'. Treated as opaque at the schema layer; consumers should construct/consume it per the MCP CreateMessageResult shape.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ProviderSessionToken
+public sealed class McpExecuteSamplingResult
 {
-    /// <summary>When the token expires, if known. Callers should refresh by calling `getEndpoint` again before this time, or reactively on any 401/403 response from `baseUrl`.</summary>
-    [JsonPropertyName("expiresAt")]
-    public DateTimeOffset? ExpiresAt { get; set; }
+}
 
-    /// <summary>HTTP header name the token must be sent under.</summary>
-    [JsonPropertyName("header")]
-    public string Header { get; set; } = string.Empty;
+/// <summary>Outcome of an MCP sampling execution: success result, failure error, or cancellation.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class McpSamplingExecutionResult
+{
+    /// <summary>Outcome of the sampling inference. 'success' produced a response; 'failure' encountered an error (including agent-side rejection by content filter or criteria); 'cancelled' the caller cancelled this execution via cancelSamplingExecution.</summary>
+    [JsonPropertyName("action")]
+    public McpSamplingExecutionAction Action { get; set; }
 
-    /// <summary>The model the token is bound to, when applicable. When set, the token is only valid for requests against this model.</summary>
-    [JsonPropertyName("model")]
-    public string? Model { get; set; }
+    /// <summary>Error description, present when action='failure'.</summary>
+    [JsonPropertyName("error")]
+    public string? Error { get; set; }
 
-    /// <summary>The short-lived token value.</summary>
-    [JsonPropertyName("token")]
-    public string Token { get; set; } = string.Empty;
+    /// <summary>MCP CreateMessageResult payload (with optional 'tools' extension), present when action='success'. Treated as opaque at the schema layer; consumers should construct/consume it per the MCP CreateMessageResult shape.</summary>
+    [JsonPropertyName("result")]
+    public McpExecuteSamplingResult? Result { get; set; }
 }
 
-/// <summary>A snapshot of the provider endpoint the session is currently configured to talk to.</summary>
+/// <summary>Raw MCP CreateMessageRequest params, as received in the `sampling.requested` event. Treated as opaque at the schema layer; the runtime converts the embedded MCP messages into the OpenAI chat-completion shape internally.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ProviderEndpoint
+public sealed class McpExecuteSamplingRequest
 {
-    /// <summary>A credential the caller should use with this endpoint. Omitted only when the endpoint accepts unauthenticated requests.</summary>
-    [JsonPropertyName("apiKey")]
-    public string? ApiKey { get; set; }
+}
 
-    /// <summary>Base URL to pass to the LLM client library.</summary>
-    [Url]
-    [StringSyntax(StringSyntaxAttribute.Uri)]
-    [JsonPropertyName("baseUrl")]
-    public string BaseUrl { get; set; } = string.Empty;
-
-    /// <summary>HTTP headers the caller must include on every outbound request.</summary>
-    [JsonPropertyName("headers")]
-    public IDictionary<string, string> Headers { get => field ??= new Dictionary<string, string>(); set; }
+/// <summary>Identifiers and raw MCP CreateMessageRequest params used to run a sampling inference.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class McpExecuteSamplingParams
+{
+    /// <summary>The original MCP JSON-RPC request ID (string or number). Used by the runtime to correlate the inference with the originating MCP request for telemetry; this is distinct from `requestId` (which is the schema-level cancellation handle).</summary>
+    [JsonPropertyName("mcpRequestId")]
+    public JsonElement McpRequestId { get; set; }
 
-    /// <summary>Short-lived, rotating credential the caller must send on every request, in addition to `apiKey` if one is present. Omitted when the endpoint does not require one.</summary>
-    [JsonPropertyName("sessionToken")]
-    public ProviderSessionToken? SessionToken { get; set; }
+    /// <summary>Raw MCP CreateMessageRequest params, as received in the `sampling.requested` event. Treated as opaque at the schema layer; the runtime converts the embedded MCP messages into the OpenAI chat-completion shape internally.</summary>
+    [JsonPropertyName("request")]
+    public McpExecuteSamplingRequest Request { get => field ??= new(); set; }
 
-    /// <summary>Transport to be used for provider requests.</summary>
-    [JsonPropertyName("transport")]
-    public ProviderEndpointTransport? Transport { get; set; }
+    /// <summary>Caller-provided unique identifier for this sampling execution. Use this same ID with cancelSamplingExecution to cancel the in-flight call. Must be unique within the session for the lifetime of the call.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
 
-    /// <summary>Provider family. Matches the `type` field of a BYOK provider config.</summary>
-    [JsonPropertyName("type")]
-    public ProviderEndpointType Type { get; set; }
+    /// <summary>Name of the MCP server that initiated the sampling request.</summary>
+    [JsonPropertyName("serverName")]
+    public string ServerName { get; set; } = string.Empty;
 
-    /// <summary>Wire API to be used, when required for the provider type.</summary>
-    [JsonPropertyName("wireApi")]
-    public ProviderEndpointWireApi? WireApi { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>RPC data type for SessionProviderGetEndpoint operations.</summary>
+/// <summary>Indicates whether an in-flight sampling execution with the given requestId was found and cancelled.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionProviderGetEndpointRequest
+public sealed class McpCancelSamplingExecutionResult
 {
-    /// <summary>Model identifier the caller intends to use against the returned endpoint. Used to pick the correct wire shape. Omit to use whichever model the session is currently using.</summary>
-    [JsonPropertyName("modelId")]
-    public string? ModelId { get; set; }
+    /// <summary>True if an in-flight execution with the given requestId was found and signalled to cancel. False when no such execution is in flight (already completed, never started, or cancelled by another caller).</summary>
+    [JsonPropertyName("cancelled")]
+    public bool Cancelled { get; set; }
 }
 
-/// <summary>RPC data type for SessionProviderGetEndpointRequestWithSession operations.</summary>
+/// <summary>The requestId previously passed to executeSampling that should be cancelled.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionProviderGetEndpointRequestWithSession
+internal sealed class McpCancelSamplingExecutionParams
 {
-    /// <summary>Model identifier the caller intends to use against the returned endpoint. Used to pick the correct wire shape. Omit to use whichever model the session is currently using.</summary>
-    [JsonPropertyName("modelId")]
-    public string? ModelId { get; set; }
+    /// <summary>The requestId previously passed to executeSampling that should be cancelled.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>The selectable model entries synthesized for the models added by this call.</summary>
+/// <summary>Env-value mode recorded on the session after the update.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ProviderAddResult
+public sealed class McpSetEnvValueModeResult
 {
-    /// <summary>Synthesized selectable model entries for the newly added BYOK models, each under its provider-qualified selection id (`provider/id`). Empty when only providers were added.</summary>
-    [JsonPropertyName("models")]
-    public IList<JsonElement> Models { get => field ??= []; set; }
+    /// <summary>Mode recorded on the session after the update.</summary>
+    [JsonPropertyName("mode")]
+    public McpSetEnvValueModeDetails Mode { get; set; }
 }
 
-/// <summary>A BYOK model definition referencing a named provider.</summary>
+/// <summary>Mode controlling how MCP server env values are resolved (`direct` or `indirect`).</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ProviderModelConfig
+internal sealed class McpSetEnvValueModeParams
 {
-    /// <summary>Optional capability overrides (vision, tool_calls, reasoning, etc.).</summary>
-    [JsonPropertyName("capabilities")]
-    public ModelCapabilitiesOverride? Capabilities { get; set; }
-
-    /// <summary>Provider-local model id, unique within its provider. The session-wide selection id (shown in the model list and passed to switchTo) is the provider-qualified `provider/id`.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
-
-    /// <summary>Maximum context window tokens for the model.</summary>
-    [JsonPropertyName("maxContextWindowTokens")]
-    public double? MaxContextWindowTokens { get; set; }
-
-    /// <summary>Maximum output tokens for the model.</summary>
-    [JsonPropertyName("maxOutputTokens")]
-    public double? MaxOutputTokens { get; set; }
-
-    /// <summary>Maximum prompt/input tokens for the model.</summary>
-    [JsonPropertyName("maxPromptTokens")]
-    public double? MaxPromptTokens { get; set; }
-
-    /// <summary>Well-known base model id used for behavior/capability/config lookup. Defaults to `id`.</summary>
-    [JsonPropertyName("modelId")]
-    public string? ModelId { get; set; }
-
-    /// <summary>Display name for model pickers. Defaults to the provider-qualified selection id (`provider/id`).</summary>
-    [JsonPropertyName("name")]
-    public string? Name { get; set; }
-
-    /// <summary>Name of the configured provider that serves this model.</summary>
-    [JsonPropertyName("provider")]
-    public string Provider { get; set; } = string.Empty;
+    /// <summary>How environment-variable values supplied to MCP servers are resolved. "direct" passes literal string values; "indirect" treats values as references (e.g. names of environment variables on the host) that the runtime resolves before launch. Defaults to the runtime's startup mode; clients that intentionally launch MCP servers with literal values (e.g. CLI prompt mode and ACP) set this to "direct".</summary>
+    [JsonPropertyName("mode")]
+    public McpSetEnvValueModeDetails Mode { get; set; }
 
-    /// <summary>The model name sent to the provider API for inference. Defaults to `id`.</summary>
-    [JsonPropertyName("wireModel")]
-    public string? WireModel { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Azure-specific provider options.</summary>
+/// <summary>Indicates whether the auto-managed `github` MCP server was removed (false when nothing to remove).</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ProviderConfigAzure
+public sealed class McpRemoveGitHubResult
 {
-    /// <summary>API version. When set, uses the versioned deployment route. When omitted, uses the GA versionless v1 route.</summary>
-    [JsonPropertyName("apiVersion")]
-    public string? ApiVersion { get; set; }
+    /// <summary>True when the auto-managed `github` MCP server was removed; false when no removal happened (e.g. user has explicitly configured a `github` server, or the server was not registered).</summary>
+    [JsonPropertyName("removed")]
+    public bool Removed { get; set; }
 }
 
-/// <summary>External SDK input for a named custom model provider. Ingested by the native protocol boundary before host dispatch.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class NamedProviderConfig
+internal sealed class SessionMcpRemoveGitHubRequest
 {
-    /// <summary>Static API key used to authenticate provider requests.</summary>
-    [JsonPropertyName("apiKey")]
-    public string? ApiKey { get; set; }
-
-    /// <summary>Azure authentication configuration for the provider.</summary>
-    [JsonPropertyName("azure")]
-    public ProviderConfigAzure? Azure { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Base URL for provider API requests.</summary>
-    [JsonPropertyName("baseUrl")]
-    public string BaseUrl { get; set; } = string.Empty;
+/// <summary>Result of configuring GitHub MCP.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class McpConfigureGitHubResult
+{
+    /// <summary>Whether GitHub MCP configuration changed.</summary>
+    [JsonPropertyName("changed")]
+    public bool Changed { get; set; }
+}
 
-    /// <summary>Static bearer token used to authenticate provider requests.</summary>
-    [JsonPropertyName("bearerToken")]
-    public string? BearerToken { get; set; }
+/// <summary>Credential-free authentication identity used to configure GitHub MCP.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class McpConfigureGitHubRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Whether the host supplies bearer tokens dynamically.</summary>
-    [JsonPropertyName("hasBearerTokenProvider")]
-    public bool? HasBearerTokenProvider { get; set; }
+/// <summary>Server name and optional configuration for an individual MCP server start. Omit `config` for a config-free start-by-name of an already-configured server.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class McpStartServerRequest
+{
+    /// <summary>MCP server configuration (stdio process or remote HTTP/SSE). Omit to start the server with its already-registered configuration (config-free start-by-name).</summary>
+    [JsonPropertyName("config")]
+    public JsonElement? Config { get; set; }
 
-    /// <summary>Additional HTTP headers included with provider requests.</summary>
-    [JsonPropertyName("headers")]
-    public IDictionary<string, string>? Headers { get; set; }
+    /// <summary>Name of the MCP server to start.</summary>
+    [JsonPropertyName("serverName")]
+    public string ServerName { get; set; } = string.Empty;
 
-    /// <summary>Unique provider name used to qualify model selection IDs.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Transport used to communicate with the provider.</summary>
-    [JsonPropertyName("transport")]
-    public ProviderConfigTransport? Transport { get; set; }
+/// <summary>Server name and optional replacement configuration for an individual MCP server restart. Omit `config` for a config-free restart-by-name of an already-configured server.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class McpRestartServerRequest
+{
+    /// <summary>Replacement MCP server configuration (stdio process or remote HTTP/SSE). Omit to restart the server with its already-registered configuration (config-free restart-by-name).</summary>
+    [JsonPropertyName("config")]
+    public JsonElement? Config { get; set; }
 
-    /// <summary>Provider protocol family.</summary>
-    [JsonPropertyName("type")]
-    public ProviderConfigType? Type { get; set; }
+    /// <summary>Name of the MCP server to restart.</summary>
+    [JsonPropertyName("serverName")]
+    public string ServerName { get; set; } = string.Empty;
 
-    /// <summary>Wire API used to communicate with the provider.</summary>
-    [JsonPropertyName("wireApi")]
-    public ProviderConfigWireApi? WireApi { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>BYOK providers and/or models to add to the session's registry at runtime. Both fields are optional; provide providers, models, or both.</summary>
+/// <summary>Server name for an individual MCP server stop.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class ProviderAddRequest
+internal sealed class McpStopServerRequest
 {
-    /// <summary>BYOK model definitions to register. Each must reference a provider that is already registered or included in this same call. Selection ids (`provider/id`) must be unique across the registry.</summary>
-    [JsonPropertyName("models")]
-    public IList<ProviderModelConfig>? Models { get; set; }
-
-    /// <summary>Named BYOK provider connections to register, additive to any providers already in the registry. Each name must be unique across the registry and must not contain '/'.</summary>
-    [JsonPropertyName("providers")]
-    public IList<NamedProviderConfig>? Providers { get; set; }
+    /// <summary>Name of the MCP server to stop.</summary>
+    [JsonPropertyName("serverName")]
+    public string ServerName { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether the session options patch was applied successfully.</summary>
+/// <summary>Registration parameters for an external MCP client.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionUpdateOptionsResult
+internal sealed class McpRegisterExternalClientRequest
 {
-    /// <summary>Number of hooks loaded from installed plugins, returned when installedPlugins is updated.</summary>
-    [JsonPropertyName("pluginHookCount")]
-    public long? PluginHookCount { get; set; }
+    /// <summary>Logical server name for the external client.</summary>
+    [JsonPropertyName("serverName")]
+    public string ServerName { get; set; } = string.Empty;
 
-    /// <summary>Whether the operation succeeded.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Source descriptor for a `session.options.update` content-exclusion rule, with source name and type.</summary>
+/// <summary>Server name identifying the external client to remove.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class OptionsUpdateAdditionalContentExclusionPolicyRuleSource
+internal sealed class McpUnregisterExternalClientRequest
 {
-    /// <summary>Name of the policy source.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Server name of the external client to unregister.</summary>
+    [JsonPropertyName("serverName")]
+    public string ServerName { get; set; } = string.Empty;
 
-    /// <summary>Type of the policy source.</summary>
-    [JsonPropertyName("type")]
-    public string Type { get; set; } = string.Empty;
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Single content-exclusion rule supplied to `session.options.update`, with paths, match conditions, and source.</summary>
+/// <summary>Whether the named MCP server is running.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class OptionsUpdateAdditionalContentExclusionPolicyRule
+public sealed class McpIsServerRunningResult
 {
-    /// <summary>Conditions of which at least one must match.</summary>
-    [JsonPropertyName("ifAnyMatch")]
-    public IList<string>? IfAnyMatch { get; set; }
-
-    /// <summary>Conditions none of which may match.</summary>
-    [JsonPropertyName("ifNoneMatch")]
-    public IList<string>? IfNoneMatch { get; set; }
-
-    /// <summary>Path patterns covered by this rule.</summary>
-    [JsonPropertyName("paths")]
-    public IList<string> Paths { get => field ??= []; set; }
-
-    /// <summary>Source descriptor for a `session.options.update` content-exclusion rule, with source name and type.</summary>
-    [JsonPropertyName("source")]
-    public OptionsUpdateAdditionalContentExclusionPolicyRuleSource Source { get => field ??= new(); set; }
+    /// <summary>True if the server has an active client and transport.</summary>
+    [JsonPropertyName("running")]
+    public bool Running { get; set; }
 }
 
-/// <summary>Content-exclusion policy supplied to `session.options.update`, with rules, last-updated data, and scope.</summary>
+/// <summary>Server name to check running status for.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class OptionsUpdateAdditionalContentExclusionPolicy
+internal sealed class McpIsServerRunningRequest
 {
-    /// <summary>Opaque policy update timestamp supplied by the host.</summary>
-    [JsonPropertyName("last_updated_at")]
-    public JsonElement LastUpdatedAt { get; set; }
-
-    /// <summary>Content-exclusion rules to apply.</summary>
-    [JsonPropertyName("rules")]
-    public IList<OptionsUpdateAdditionalContentExclusionPolicyRule> Rules { get => field ??= []; set; }
+    /// <summary>Name of the MCP server to check.</summary>
+    [JsonPropertyName("serverName")]
+    public string ServerName { get; set; } = string.Empty;
 
-    /// <summary>Allowed values for the `OptionsUpdateAdditionalContentExclusionPolicyScope` enumeration.</summary>
-    [JsonPropertyName("scope")]
-    public OptionsUpdateAdditionalContentExclusionPolicyScope Scope { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Options scoped to the built-in CAPI (Copilot API) provider.</summary>
+/// <summary>Indicates whether the pending MCP OAuth response was accepted.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class CapiSessionOptions
+public sealed class McpOauthHandlePendingResult
 {
-    /// <summary>Whether to use WebSocket transport for the CAPI Responses API. Enabled by default when the model advertises `ws:/responses` support; set to `false` to force the HTTP Responses transport in environments where WebSockets are blocked (e.g. behind a proxy). Setting this to `false` is equivalent to the `COPILOT_CLI_DISABLE_WEBSOCKET_RESPONSES` environment variable.</summary>
-    [JsonPropertyName("enableWebSocketResponses")]
-    public bool? EnableWebSocketResponses { get; set; }
+    /// <summary>Whether the response was accepted. False if the request was unknown, timed out, or already resolved.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-/// <summary>Installed plugin record for a session, with marketplace, version, install time, enabled state, cache path, and source.</summary>
+/// <summary>Host response to the pending OAuth request.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionInstalledPlugin
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "kind",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(McpOauthPendingRequestResponseToken), "token")]
+[JsonDerivedType(typeof(McpOauthPendingRequestResponseCancelled), "cancelled")]
+public partial class McpOauthPendingRequestResponse
 {
-    /// <summary>Path where the plugin is cached locally.</summary>
-    [JsonPropertyName("cache_path")]
-    public string? CachePath { get; set; }
-
-    /// <summary>Whether the plugin is currently enabled.</summary>
-    [JsonPropertyName("enabled")]
-    public bool Enabled { get; set; }
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("kind")]
+    public virtual string Kind { get; set; } = string.Empty;
+}
 
-    /// <summary>Installation timestamp (ISO-8601).</summary>
-    [JsonPropertyName("installed_at")]
-    public string InstalledAt { get; set; } = string.Empty;
 
-    /// <summary>Marketplace the plugin came from (empty string for direct repo installs).</summary>
-    [JsonPropertyName("marketplace")]
-    public string Marketplace { get; set; } = string.Empty;
+/// <summary>The <c>token</c> variant of <see cref="McpOauthPendingRequestResponse"/>.</summary>
+[Experimental(Diagnostics.Experimental)]
+public partial class McpOauthPendingRequestResponseToken : McpOauthPendingRequestResponse
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "token";
 
-    /// <summary>Plugin name.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Access token acquired by the SDK host.</summary>
+    [JsonPropertyName("accessToken")]
+    public required string AccessToken { get; set; }
 
-    /// <summary>Source descriptor for direct repo installs (when marketplace is empty).</summary>
-    [JsonPropertyName("source")]
-    public JsonElement? Source { get; set; }
+    /// <summary>Token lifetime in seconds, if known.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("expiresIn")]
+    public long? ExpiresIn { get; set; }
 
-    /// <summary>Per-plugin source fingerprint (a SHA-256 hash of the plugin's catalog source spec plus its resolved source subtree — NOT a Git commit SHA) captured at marketplace install/update time. Auto-update compares it against the freshly recomputed fingerprint to detect a content change that does not bump the version. Absent for pre-existing installs and for direct (non-marketplace) installs.</summary>
-    [JsonPropertyName("source_sha")]
-    public string? SourceSha { get; set; }
+    /// <summary>OAuth token type. Defaults to Bearer when omitted.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("tokenType")]
+    public string? TokenType { get; set; }
+}
 
-    /// <summary>Installed version, if known.</summary>
-    [JsonPropertyName("version")]
-    public string? Version { get; set; }
+/// <summary>The <c>cancelled</c> variant of <see cref="McpOauthPendingRequestResponse"/>.</summary>
+[Experimental(Diagnostics.Experimental)]
+public partial class McpOauthPendingRequestResponseCancelled : McpOauthPendingRequestResponse
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "cancelled";
 }
 
-/// <summary>Custom model-provider configuration (BYOK).</summary>
+/// <summary>Pending MCP OAuth request ID and host-provided token or cancellation response.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ProviderConfig
+internal sealed class McpOauthHandlePendingRequest
 {
-    /// <summary>API key. Optional for local providers like Ollama.</summary>
-    [JsonPropertyName("apiKey")]
-    public string? ApiKey { get; set; }
+    /// <summary>OAuth request identifier from the mcp.oauth_required event.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
 
-    /// <summary>Azure-specific provider options.</summary>
-    [JsonPropertyName("azure")]
-    public ProviderConfigAzure? Azure { get; set; }
+    /// <summary>Host response to the pending OAuth request.</summary>
+    [JsonPropertyName("result")]
+    public McpOauthPendingRequestResponse Result { get => field ??= new(); set; }
 
-    /// <summary>API endpoint URL.</summary>
-    [JsonPropertyName("baseUrl")]
-    public string BaseUrl { get; set; } = string.Empty;
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Bearer token for authentication. Sets the Authorization header directly. Takes precedence over apiKey when both are set.</summary>
-    [JsonPropertyName("bearerToken")]
-    public string? BearerToken { get; set; }
+/// <summary>Identifies the MCP server whose persisted OAuth credentials were updated.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class McpOauthAuthenticationStateChangedRequest
+{
+    /// <summary>Whether the target session must mint a session-scoped access token instead of reusing a shared access token persisted by another session.</summary>
+    [JsonPropertyName("refreshSessionToken")]
+    public bool? RefreshSessionToken { get; set; }
 
-    /// <summary>When true, the SDK client supplies bearer tokens on demand: the runtime calls the client-session `providerToken.getToken` callback before each request and applies the returned token as an `Authorization: Bearer &lt;token&gt;` header. This is the bearer/OAuth scheme used by Azure AD / managed-identity tokens and provider OAuth access tokens (including Anthropic's), not a provider-specific API-key header such as Anthropic's `x-api-key`. The token-acquiring function itself stays on the SDK side and is never serialized; only this flag crosses the wire. When set alongside `apiKey`/`bearerToken`, the callback takes precedence: the runtime applies the token returned by `providerToken.getToken` as the `Authorization: Bearer` header for each request and does not send the static credential.</summary>
-    [JsonPropertyName("hasBearerTokenProvider")]
-    public bool? HasBearerTokenProvider { get; set; }
+    /// <summary>Name of the MCP server whose OAuth credentials were updated. Omit only when the host cannot identify the server.</summary>
+    [JsonPropertyName("serverName")]
+    public string? ServerName { get; set; }
 
-    /// <summary>Custom HTTP headers to include in all outbound requests to the provider.</summary>
-    [JsonPropertyName("headers")]
-    public IDictionary<string, string>? Headers { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Maximum context window tokens for the model.</summary>
-    [JsonPropertyName("maxContextWindowTokens")]
-    public double? MaxContextWindowTokens { get; set; }
+/// <summary>OAuth authorization URL the caller should open, or empty when cached tokens already authenticated the server.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class McpOauthLoginResult
+{
+    /// <summary>URL the caller should open in a browser to complete OAuth. Omitted when cached tokens were still valid and no browser interaction was needed — the server is already reconnected in that case. When present, the runtime starts the callback listener before returning and continues the flow in the background; completion is signaled via session.mcp_server_status_changed.</summary>
+    [Url]
+    [StringSyntax(StringSyntaxAttribute.Uri)]
+    [JsonPropertyName("authorizationUrl")]
+    public string? AuthorizationUrl { get; set; }
+}
 
-    /// <summary>Maximum output tokens for the model.</summary>
-    [JsonPropertyName("maxOutputTokens")]
-    public double? MaxOutputTokens { get; set; }
+/// <summary>Remote MCP server name and optional overrides controlling reauthentication, OAuth client display name, callback success-page copy, and static OAuth client selection.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class McpOauthLoginRequest
+{
+    /// <summary>Optional override for the body text shown on the OAuth loopback callback success page. When omitted, the runtime applies a neutral fallback; callers driving interactive auth should pass surface-specific copy telling the user where to return.</summary>
+    [JsonPropertyName("callbackSuccessMessage")]
+    public string? CallbackSuccessMessage { get; set; }
 
-    /// <summary>Maximum prompt/input tokens for the model.</summary>
-    [JsonPropertyName("maxPromptTokens")]
-    public double? MaxPromptTokens { get; set; }
+    /// <summary>Optional OAuth client ID override for this login. When set, the runtime uses this pre-registered static client instead of dynamic client registration.</summary>
+    [JsonPropertyName("clientId")]
+    public string? ClientId { get; set; }
 
-    /// <summary>Overrides for model capabilities when they cannot be inferred from modelId.</summary>
-    [JsonPropertyName("modelCapabilities")]
-    public ModelCapabilitiesOverride? ModelCapabilities { get; set; }
+    /// <summary>Optional override for the OAuth client display name shown on the consent screen. Applies to newly registered dynamic clients only — existing registrations keep the name they were created with. When omitted, the runtime applies a neutral fallback; callers driving interactive auth should pass their own surface-specific label so the consent screen matches the product the user sees.</summary>
+    [JsonPropertyName("clientName")]
+    public string? ClientName { get; set; }
 
-    /// <summary>Well-known model ID used for capability lookup. When set, agent behavior config and token limits are inferred from this model.</summary>
-    [JsonPropertyName("modelId")]
-    public string? ModelId { get; set; }
+    /// <summary>Optional OAuth client secret override for this login. The runtime treats this as an ephemeral host-owned secret, uses it for this authentication attempt and does not persist it.</summary>
+    [JsonPropertyName("clientSecret")]
+    public string? ClientSecret { get; set; }
 
-    /// <summary>Provider name used for model and telemetry attribution.</summary>
-    [JsonPropertyName("providerName")]
-    public string? ProviderName { get; set; }
+    /// <summary>When true, clears any cached OAuth token for the server and runs a full new authorization. Use when the user explicitly wants to switch accounts or believes their session is stuck.</summary>
+    [JsonPropertyName("forceReauth")]
+    public bool? ForceReauth { get; set; }
 
-    /// <summary>Provider transport. Defaults to "http".</summary>
-    [JsonPropertyName("transport")]
-    public ProviderConfigTransport? Transport { get; set; }
+    /// <summary>Optional OAuth grant type override for this login. Defaults to the server configuration, or authorization_code when no grant type is specified.</summary>
+    [JsonPropertyName("grantType")]
+    public McpOauthLoginGrantType? GrantType { get; set; }
 
-    /// <summary>Provider type. Defaults to "openai" for generic OpenAI-compatible APIs.</summary>
-    [JsonPropertyName("type")]
-    public ProviderConfigType? Type { get; set; }
+    /// <summary>Optional override indicating whether the static OAuth client is public. When false, the runtime treats it as confidential and uses the per-login clientSecret if provided, otherwise retrieving the client secret from the MCP OAuth secret store.</summary>
+    [JsonPropertyName("publicClient")]
+    public bool? PublicClient { get; set; }
 
-    /// <summary>Wire API format (openai/azure only). Defaults to "completions".</summary>
-    [JsonPropertyName("wireApi")]
-    public ProviderConfigWireApi? WireApi { get; set; }
+    /// <summary>Name of the remote MCP server to authenticate.</summary>
+    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("serverName")]
+    public string ServerName { get; set; } = string.Empty;
 
-    /// <summary>The model identifier sent to the provider API for inference (the "wire" model), as opposed to modelId which is the well-known base.</summary>
-    [JsonPropertyName("wireModel")]
-    public string? WireModel { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Credential-injection capability flags applied while the sandbox is enabled. For the same capability independent of sandboxing, and matched to the credential's GitHub host, see `shell.credentials`; the two are additive.</summary>
+/// <summary>Passive MCP OAuth probe result. `authenticated` means the server accepted the probe request while an OAuth-origin access token was attached; it does not prove the server required or independently validated that token. The probe does not make a second unauthenticated request. Failed is an expected probe-domain outcome; JSON-RPC errors are reserved for API-call failures.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>status</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SandboxConfigAuth
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "status",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(McpOauthProbeResultNoAuthRequired), "no-auth-required")]
+[JsonDerivedType(typeof(McpOauthProbeResultAuthenticated), "authenticated")]
+[JsonDerivedType(typeof(McpOauthProbeResultNeedsAuth), "needs-auth")]
+[JsonDerivedType(typeof(McpOauthProbeResultFailed), "failed")]
+public partial class McpOauthProbeResult
 {
-    /// <summary>Whether to export `GH_TOKEN` so the `gh` CLI authenticates inside the sandbox without the OS keyring the sandbox blocks. Default: false (opt-in).</summary>
-    [JsonPropertyName("gh")]
-    public bool? Gh { get; set; }
-
-    /// <summary>Whether to inject git credentials as an `http.&lt;url&gt;.extraheader` so authenticated HTTPS git works inside the sandbox without the shell-based credential helper the sandbox blocks. github.com is served by the Copilot token; every other forge (Azure DevOps, GitHub Enterprise Server, GitLab, ...) by a credential the host resolves from the user's own helper before the sandbox is applied. Default: false (opt-in).</summary>
-    [JsonPropertyName("git")]
-    public bool? Git { get; set; }
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("status")]
+    public virtual string Status { get; set; } = string.Empty;
 }
 
-/// <summary>macOS seatbelt experimental options.</summary>
+
+/// <summary>The <c>no-auth-required</c> variant of <see cref="McpOauthProbeResult"/>.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SandboxConfigUserPolicyExperimentalSeatbelt
+public partial class McpOauthProbeResultNoAuthRequired : McpOauthProbeResult
 {
-    /// <summary>Whether the macOS seatbelt profile may access the keychain.</summary>
-    [JsonPropertyName("keychainAccess")]
-    public bool? KeychainAccess { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Status => "no-auth-required";
+
+    /// <summary>HTTP response returned by the server.</summary>
+    [JsonPropertyName("httpResponse")]
+    public required McpOauthHttpResponse HttpResponse { get; set; }
 }
 
-/// <summary>Platform-specific experimental policy fields.</summary>
+/// <summary>The <c>authenticated</c> variant of <see cref="McpOauthProbeResult"/>.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SandboxConfigUserPolicyExperimental
+public partial class McpOauthProbeResultAuthenticated : McpOauthProbeResult
 {
-    /// <summary>macOS seatbelt experimental options.</summary>
-    [JsonPropertyName("seatbelt")]
-    public SandboxConfigUserPolicyExperimentalSeatbelt? Seatbelt { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Status => "authenticated";
+
+    /// <summary>HTTP response returned by the server.</summary>
+    [JsonPropertyName("httpResponse")]
+    public required McpOauthHttpResponse HttpResponse { get; set; }
 }
 
-/// <summary>Filesystem rules to merge into the base policy.</summary>
+/// <summary>The <c>needs-auth</c> variant of <see cref="McpOauthProbeResult"/>.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SandboxConfigUserPolicyFilesystem
+public partial class McpOauthProbeResultNeedsAuth : McpOauthProbeResult
 {
-    /// <summary>Whether to clear the policy when the session exits.</summary>
-    [JsonPropertyName("clearPolicyOnExit")]
-    public bool? ClearPolicyOnExit { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Status => "needs-auth";
 
-    /// <summary>Paths explicitly denied.</summary>
-    [JsonPropertyName("deniedPaths")]
-    public IList<string>? DeniedPaths { get; set; }
+    /// <summary>HTTP 401 or 403 response returned by the server.</summary>
+    [JsonPropertyName("httpResponse")]
+    public required McpOauthHttpResponse HttpResponse { get; set; }
 
-    /// <summary>Paths granted read-only access.</summary>
-    [JsonPropertyName("readonlyPaths")]
-    public IList<string>? ReadonlyPaths { get; set; }
+    /// <summary>Why authentication is needed.</summary>
+    [JsonPropertyName("reason")]
+    public required McpOauthProbeNeedsAuthReason Reason { get; set; }
 
-    /// <summary>Paths granted read/write access.</summary>
-    [JsonPropertyName("readwritePaths")]
-    public IList<string>? ReadwritePaths { get; set; }
+    /// <summary>Parsed WWW-Authenticate challenge parameters, when present and parseable.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("wwwAuthenticateParams")]
+    public McpOauthWWWAuthenticateParams? WwwAuthenticateParams { get; set; }
 }
 
-/// <summary>HTTP proxy configuration for sandboxed traffic.</summary>
+/// <summary>The <c>failed</c> variant of <see cref="McpOauthProbeResult"/>.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SandboxConfigUserPolicyNetworkProxy
+public partial class McpOauthProbeResultFailed : McpOauthProbeResult
 {
-    /// <summary>Optional password for proxy authentication, combined with the URL at spawn time. The persisted value may be a literal password, a `${secret:…}` reference resolved from the OS keychain, or a `${VAR}`/`$VAR` environment reference; it is resolved just before the sandboxed process routes through the proxy. The /sandbox dialog stores a real password in the OS keychain and persists only a `${secret:…}` placeholder (never plaintext in settings.json); the field is masked in the dialog and redacted by /settings show.</summary>
-    [JsonPropertyName("password")]
-    public string? Password { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Status => "failed";
 
-    /// <summary>Proxy URL (e.g. http://proxy.example.com:8080). The port is optional and defaults to the scheme's standard port when omitted. Credentials must not be embedded here — a `user:pass@` authority is rejected; put them in the separate `username`/`password` fields. A credential-free http:// loopback URL is routed through the localhost proxy automatically; loopback covers localhost and any *.localhost subdomain, the whole 127.0.0.0/8 range, ::1, and IPv4-mapped loopback (::ffff:127.0.0.1). An https:// URL, or one with a username/password set, is used as-is.</summary>
-    [JsonPropertyName("url")]
-    public string Url { get; set; } = string.Empty;
+    /// <summary>Human-readable probe failure detail.</summary>
+    [JsonPropertyName("error")]
+    public required string Error { get; set; }
 
-    /// <summary>Optional username for proxy authentication. Combined with the URL (and `password`) into `user:pass@host` when the sandboxed process routes through the proxy.</summary>
-    [JsonPropertyName("username")]
-    public string? Username { get; set; }
+    /// <summary>HTTP response returned by the server, when the probe reached the server and captured the complete response.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("httpResponse")]
+    public McpOauthHttpResponse? HttpResponse { get; set; }
 }
 
-/// <summary>Network rules to merge into the base policy.</summary>
+/// <summary>Remote MCP server name for a passive OAuth status probe.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SandboxConfigUserPolicyNetwork
+internal sealed class McpOauthProbeRequest
 {
-    /// <summary>Whether traffic to local/loopback addresses is allowed.</summary>
-    [JsonPropertyName("allowLocalNetwork")]
-    public bool? AllowLocalNetwork { get; set; }
-
-    /// <summary>Whether outbound network traffic is allowed at all.</summary>
-    [JsonPropertyName("allowOutbound")]
-    public bool? AllowOutbound { get; set; }
+    /// <summary>Name of the configured remote MCP server to probe.</summary>
+    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("serverName")]
+    public string ServerName { get; set; } = string.Empty;
 
-    /// <summary>HTTP proxy the sandboxed process routes traffic through. Enforced on Windows and cooperative (honored by well-behaved tools, not strictly enforced) on Linux and macOS. Credentials go in the separate `username`/`password` fields. A credential-free http:// loopback proxy URL is routed through the localhost proxy automatically; an https:// or authenticated loopback URL is used as-is.</summary>
-    [JsonPropertyName("proxy")]
-    public SandboxConfigUserPolicyNetworkProxy? Proxy { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>macOS seatbelt-specific options.</summary>
+/// <summary>Indicates whether the pending MCP OAuth response was accepted.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SandboxConfigUserPolicySeatbelt
+public sealed class McpOauthRespondResult
 {
-    /// <summary>Whether the macOS seatbelt profile may access the keychain.</summary>
-    [JsonPropertyName("keychainAccess")]
-    public bool? KeychainAccess { get; set; }
+    /// <summary>Whether the response was accepted. False if the request was unknown, timed out, or already resolved.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-/// <summary>User-managed sandbox policy fragment merged into the auto-discovered base policy.</summary>
+/// <summary>Pending MCP OAuth request id to respond to.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SandboxConfigUserPolicy
+internal sealed class McpOauthRespondRequest
 {
-    /// <summary>Deprecated legacy location for `seatbelt`; read only when the top-level `seatbelt` is absent.</summary>
-    [JsonPropertyName("experimental")]
-    public SandboxConfigUserPolicyExperimental? Experimental { get; set; }
-
-    /// <summary>Filesystem rules to merge into the base policy.</summary>
-    [JsonPropertyName("filesystem")]
-    public SandboxConfigUserPolicyFilesystem? Filesystem { get; set; }
-
-    /// <summary>Network rules to merge into the base policy.</summary>
-    [JsonPropertyName("network")]
-    public SandboxConfigUserPolicyNetwork? Network { get; set; }
+    /// <summary>OAuth request identifier from the mcp.oauth_required event.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
 
-    /// <summary>macOS seatbelt options to merge into the base policy.</summary>
-    [JsonPropertyName("seatbelt")]
-    public SandboxConfigUserPolicySeatbelt? Seatbelt { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Resolved sandbox configuration.</summary>
+/// <summary>Indicates whether the pending MCP headers refresh response was accepted.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SandboxConfig
+public sealed class McpHeadersHandlePendingHeadersRefreshRequestResult
 {
-    /// <summary>Whether to auto-add the current working directory to readwritePaths. Default: true.</summary>
-    [JsonPropertyName("addCurrentWorkingDirectory")]
-    public bool? AddCurrentWorkingDirectory { get; set; }
+    /// <summary>Whether the response was accepted. False if the request was unknown, timed out, or already resolved.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
+}
 
-    /// <summary>Whether to auto-grant read access to the tool directories discovered on PATH and in toolchain environment variables (GOROOT, CARGO_HOME, JAVA_HOME, VIRTUAL_ENV, and similar), and to common developer-tool caches, registries, and toolchains in their default home locations (cargo, go, npm, Maven, and more), plus read-write access to (and, on Unix, up-front creation of) the scratch caches builds write on every run (go-build, ccache, sccache, Gradle caches, Cargo lock/tracker files), so builds work without extra configuration; a relocated CARGO_HOME additionally gets its Cargo lock files granted read-write. Set to false to disable every grant listed above: user-installed toolchains (rustup, nvm, pyenv, conda, pipx) then need explicit userPolicy.filesystem entries — readonlyPaths to read them, plus readwriteFiles for a relocated CARGO_HOME's .package-cache and .global-cache, which Cargo locks on every build. Only these developer-tool grants are affected: the working directory (see addCurrentWorkingDirectory), temporary storage, session log paths, and system locations follow their own rules and stay granted, so commands still run. Default: true (enabled by default; set to false to opt out).</summary>
-    [JsonPropertyName("allowDevToolAccess")]
-    public bool? AllowDevToolAccess { get; set; }
+/// <summary>Host response: supply dynamic headers or decline this refresh.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "kind",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(McpHeadersHandlePendingHeadersRefreshRequestHeaders), "headers")]
+[JsonDerivedType(typeof(McpHeadersHandlePendingHeadersRefreshRequestNone), "none")]
+public partial class McpHeadersHandlePendingHeadersRefreshRequest
+{
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("kind")]
+    public virtual string Kind { get; set; } = string.Empty;
+}
 
-    /// <summary>Credential-injection capability flags.</summary>
-    [JsonPropertyName("auth")]
-    public SandboxConfigAuth? Auth { get; set; }
 
-    /// <summary>Whether sandboxing is enabled for the session.</summary>
-    [JsonPropertyName("enabled")]
-    public bool Enabled { get; set; }
+/// <summary>The <c>headers</c> variant of <see cref="McpHeadersHandlePendingHeadersRefreshRequest"/>.</summary>
+[Experimental(Diagnostics.Experimental)]
+public partial class McpHeadersHandlePendingHeadersRefreshRequestHeaders : McpHeadersHandlePendingHeadersRefreshRequest
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "headers";
 
-    /// <summary>User-managed sandbox policy fragment merged into the auto-discovered base policy.</summary>
-    [JsonPropertyName("userPolicy")]
-    public SandboxConfigUserPolicy? UserPolicy { get; set; }
+    /// <summary>Headers to overlay onto the MCP request. Dynamic headers override static config headers but do not replace SDK-managed request headers.</summary>
+    [JsonPropertyName("headers")]
+    public required IDictionary<string, string> Headers { get; set; }
 }
 
-/// <summary>
-/// Command-scoped GitHub credential injection for the shell commands an agent runs.
-/// 
-/// Each channel is opt-in and independent, and injection is scoped to the individual command
-/// spawn: the credential is resolved from the session's *current* authentication at every spawn
-/// and reaches only spawns whose script actually invokes `git` or `gh`. Because nothing is
-/// retained between spawns, replacing the session credential (`session.gitHubAuth.setCredentials`)
-/// changes what the next spawned command presents — which seeding a credential into the runtime
-/// process's own environment cannot do, since a child's environment is fixed at `exec`.
-/// 
-/// The credential is matched to the host it authenticates to, so a github.com credential is never
-/// presented to a GitHub Enterprise host and vice versa. Where a channel cannot express that
-/// boundary it injects nothing rather than crossing it -- see `gh` below.
-/// 
-/// This is independent of `sandboxConfig`: it is a decision about which identity the agent
-/// presents, not about what the agent may touch, and it works on every platform whether or not
-/// an OS sandboxing backend is available. `sandboxConfig.auth` remains the sandbox-scoped
-/// spelling and is additive with this one.
-/// </summary>
+/// <summary>The <c>none</c> variant of <see cref="McpHeadersHandlePendingHeadersRefreshRequest"/>.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ShellCredentials
+public partial class McpHeadersHandlePendingHeadersRefreshRequestNone : McpHeadersHandlePendingHeadersRefreshRequest
 {
-    /// <summary>
-    /// Whether to authenticate the agent's `gh` commands as the session's GitHub credential, by
-    /// exporting `GH_TOKEN` to a spawn that runs `gh`. Any inherited `gh` credential is removed from
-    /// spawns that do not, so the credential stays command-scoped.
-    /// 
-    /// Applies to a github.com credential only. `gh` picks its credential variable from the host a
-    /// command targets rather than the one the credential belongs to, and the command can choose that
-    /// target, so `GH_ENTERPRISE_TOKEN` would offer a single-tenant enterprise credential to every
-    /// other enterprise host. A session whose credential is enterprise-scoped therefore runs `gh`
-    /// unauthenticated; its `git` commands are unaffected, because `http.&lt;host&gt;.extraheader` is scoped
-    /// to one host by construction. Default: false (opt-in).
-    /// </summary>
-    [JsonPropertyName("gh")]
-    public bool? Gh { get; set; }
-
-    /// <summary>
-    /// Whether to authenticate the agent's `git` commands as the session's GitHub credential, by
-    /// injecting an `http.&lt;host&gt;.extraheader` (plus `insteadOf` rewrites so SSH-spelled remotes for
-    /// that host use the authenticated HTTPS transport). Applied only to a spawn that runs a
-    /// remote-contacting `git` subcommand. Default: false (opt-in).
-    /// </summary>
-    [JsonPropertyName("git")]
-    public bool? Git { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "none";
 }
 
-/// <summary>A host-provided script sourced before each built-in shell command when its shell target matches the active shell.</summary>
+/// <summary>MCP headers refresh request id and the host response.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ShellInitScript
+internal sealed class McpHeadersHandlePendingHeadersRefreshRequestRequest
 {
-    /// <summary>Path to the script to source.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+    /// <summary>Headers refresh request identifier from mcp.headers_refresh_required.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
 
-    /// <summary>Built-in shell that may source this script.</summary>
-    [JsonPropertyName("shell")]
-    public ShellInitScriptShell Shell { get; set; }
+    /// <summary>Host response: supply dynamic headers or decline this refresh.</summary>
+    [JsonPropertyName("result")]
+    public McpHeadersHandlePendingHeadersRefreshRequest Result { get => field ??= new(); set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Per-session settings for built-in shell tools.</summary>
+/// <summary>MCP Apps resource content with URI, optional MIME type, text or base64 blob, and resource metadata.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ShellOptions
+public sealed class McpAppsResourceContent
 {
-    /// <summary>Command-scoped GitHub credential injection for shell commands.</summary>
-    [JsonPropertyName("credentials")]
-    public ShellCredentials? Credentials { get; set; }
+    /// <summary>Resource-level metadata (CSP, permissions, etc.).</summary>
+    [JsonPropertyName("_meta")]
+    public IDictionary<string, JsonElement>? Meta { get; set; }
 
-    /// <summary>Controls automatic non-interactive profile loading where supported. Explicit initScripts are unaffected.</summary>
-    [JsonPropertyName("initProfile")]
-    public ShellInitProfile? InitProfile { get; set; }
+    /// <summary>Base64-encoded binary content.</summary>
+    [JsonPropertyName("blob")]
+    public string? Blob { get; set; }
 
-    /// <summary>
-    /// Ordered host-provided script paths sourced before each built-in shell command when the
-    /// entry's shell target matches the active shell. Use these for rc files, environment setup scripts,
-    /// or other custom scripts. A script that returns a nonzero status is reported, and later scripts
-    /// and the user command continue while the shell remains running. Because scripts are sourced into
-    /// the command shell, `exit`, `exec`, failures under `set -e`, or other shell-terminating behavior
-    /// can prevent continuation. Script standard output is preserved; Bash script stderr is discarded,
-    /// PowerShell exception messages are replaced, and runtime-generated failure notices omit
-    /// configured script paths. When sandboxing is enabled, each script must already be readable under
-    /// the active sandbox filesystem policy. Pass an empty array to clear the list.
-    /// </summary>
-    [JsonPropertyName("initScripts")]
-    public IList<ShellInitScript>? InitScripts { get; set; }
+    /// <summary>MIME type of the content.</summary>
+    [JsonPropertyName("mimeType")]
+    public string? MimeType { get; set; }
 
-    /// <summary>
-    /// Flags passed to the active built-in shell process on startup, replacing its default flags.
-    /// When omitted, the built-in Bash shell uses `--norc --noprofile`,
-    /// and the built-in PowerShell shell uses `-NoProfile -NoLogo`.
-    /// </summary>
-    [JsonPropertyName("processFlags")]
-    public IList<string>? ProcessFlags { get; set; }
+    /// <summary>Text content (e.g. HTML).</summary>
+    [JsonPropertyName("text")]
+    public string? Text { get; set; }
+
+    /// <summary>The resource URI (typically ui://...).</summary>
+    [JsonPropertyName("uri")]
+    public string Uri { get; set; } = string.Empty;
 }
 
-/// <summary>Patch of mutable session options to apply to the running session.</summary>
+/// <summary>Resource contents returned by the MCP server.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionUpdateOptionsParams
+public sealed class McpAppsReadResourceResult
 {
-    /// <summary>Additional content-exclusion policies to merge into the session's policy set.</summary>
-    [Experimental(Diagnostics.Experimental)]
-    [JsonPropertyName("additionalContentExclusionPolicies")]
-    public IList<OptionsUpdateAdditionalContentExclusionPolicy>? AdditionalContentExclusionPolicies { get; set; }
+    /// <summary>Resource contents returned by the server.</summary>
+    [JsonPropertyName("contents")]
+    public IList<McpAppsResourceContent> Contents { get => field ??= []; set; }
+}
 
-    /// <summary>Runtime context discriminator (e.g., `cli`, `actions`).</summary>
-    [JsonPropertyName("agentContext")]
-    public string? AgentContext { get; set; }
+/// <summary>MCP server and resource URI to fetch.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class McpAppsReadResourceRequest
+{
+    /// <summary>Name of the MCP server hosting the resource.</summary>
+    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("serverName")]
+    public string ServerName { get; set; } = string.Empty;
 
-    /// <summary>Whether to include instructions from every MCP server in the system prompt instead of only allowlisted servers.</summary>
-    [JsonPropertyName("allowAllMcpServerInstructions")]
-    public bool? AllowAllMcpServerInstructions { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 
-    /// <summary>Whether to disable the `ask_user` tool (encourages autonomous behavior).</summary>
-    [JsonPropertyName("askUserDisabled")]
-    public bool? AskUserDisabled { get; set; }
+    /// <summary>Resource URI (typically ui://...).</summary>
+    [JsonPropertyName("uri")]
+    public string Uri { get; set; } = string.Empty;
+}
 
-    /// <summary>Allowlist of tool names available to this session.</summary>
-    [JsonPropertyName("availableTools")]
-    public IList<string>? AvailableTools { get; set; }
+/// <summary>App-callable tools from the named MCP server.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class McpAppsListToolsResult
+{
+    /// <summary>App-callable tools from the server.</summary>
+    [JsonPropertyName("tools")]
+    public IList<IDictionary<string, JsonElement>> Tools { get => field ??= []; set; }
+}
 
-    /// <summary>Options scoped to the built-in CAPI (Copilot API) provider.</summary>
-    [JsonPropertyName("capi")]
-    public CapiSessionOptions? Capi { get; set; }
+/// <summary>MCP server to list app-callable tools for.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class McpAppsListToolsRequest
+{
+    /// <summary>**Required.** Server whose ui:// view issued the request. Per SEP-1865 ('callable by the app from this server only'), the call is rejected when this differs from `serverName`, and rejected outright when missing.</summary>
+    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("originServerName")]
+    public string OriginServerName { get; set; } = string.Empty;
 
-    /// <summary>Identifier of the client driving the session.</summary>
-    [JsonPropertyName("clientName")]
-    public string? ClientName { get; set; }
+    /// <summary>MCP server hosting the app.</summary>
+    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("serverName")]
+    public string ServerName { get; set; } = string.Empty;
 
-    /// <summary>Whether to include the `Co-authored-by` trailer in commit messages.</summary>
-    [JsonPropertyName("coauthorEnabled")]
-    public bool? CoauthorEnabled { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Context tier for models with tiered pricing. The session uses this to derive effective `modelCapabilitiesOverrides` so compaction, truncation, token display, and request limits honor the selected tier.</summary>
-    [JsonPropertyName("contextTier")]
-    public OptionsUpdateContextTier? ContextTier { get; set; }
+/// <summary>MCP server, tool name, and arguments to invoke from an MCP App view.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class McpAppsCallToolRequest
+{
+    /// <summary>Tool arguments.</summary>
+    [JsonPropertyName("arguments")]
+    public IDictionary<string, JsonElement>? Arguments { get; set; }
 
-    /// <summary>Whether to allow auto-mode continuation across turns.</summary>
-    [JsonPropertyName("continueOnAutoMode")]
-    public bool? ContinueOnAutoMode { get; set; }
+    /// <summary>**Required.** Server whose ui:// view issued the request. Per SEP-1865 ('callable by the app from this server only'), the call is rejected when this differs from `serverName`, and rejected outright when missing.</summary>
+    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("originServerName")]
+    public string OriginServerName { get; set; } = string.Empty;
 
-    /// <summary>Override URL for the Copilot API endpoint.</summary>
-    [JsonPropertyName("copilotUrl")]
-    public string? CopilotUrl { get; set; }
+    /// <summary>MCP server hosting the tool.</summary>
+    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("serverName")]
+    public string ServerName { get; set; } = string.Empty;
 
-    /// <summary>Whether to default custom agents to local-only execution.</summary>
-    [JsonPropertyName("customAgentsLocalOnly")]
-    public bool? CustomAgentsLocalOnly { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 
-    /// <summary>Instruction source IDs to exclude from the system prompt.</summary>
-    [JsonPropertyName("disabledInstructionSources")]
-    public IList<string>? DisabledInstructionSources { get; set; }
+    /// <summary>MCP tool name.</summary>
+    [JsonPropertyName("toolName")]
+    public string ToolName { get; set; } = string.Empty;
+}
 
-    /// <summary>Skill IDs that should be excluded from this session.</summary>
-    [JsonPropertyName("disabledSkills")]
-    public IList<string>? DisabledSkills { get; set; }
+/// <summary>Host context advertised to MCP App guests.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class McpAppsSetHostContextDetails
+{
+    /// <summary>Display modes the host supports.</summary>
+    [JsonPropertyName("availableDisplayModes")]
+    public IList<McpAppsSetHostContextDetailsAvailableDisplayMode>? AvailableDisplayModes { get; set; }
 
-    /// <summary>Whether to enable loading of `.github/hooks/` filesystem hooks. Separate from the SDK callback hook mechanism.</summary>
-    [JsonPropertyName("enableFileHooks")]
-    public bool? EnableFileHooks { get; set; }
+    /// <summary>Current display mode (SEP-1865).</summary>
+    [JsonPropertyName("displayMode")]
+    public McpAppsSetHostContextDetailsDisplayMode? DisplayMode { get; set; }
 
-    /// <summary>Whether to enable host git operations (context resolution, child repo scanning, git info in system prompt).</summary>
-    [JsonPropertyName("enableHostGitOperations")]
-    public bool? EnableHostGitOperations { get; set; }
+    /// <summary>BCP-47 locale, e.g. 'en-US'.</summary>
+    [JsonPropertyName("locale")]
+    public string? Locale { get; set; }
 
-    /// <summary>Whether to discover custom instructions on demand after successful file views (AGENTS.md / CLAUDE.md / .github/copilot-instructions.md surfacing). Combined with `skipCustomInstructions`.</summary>
-    [JsonPropertyName("enableOnDemandInstructionDiscovery")]
-    public bool? EnableOnDemandInstructionDiscovery { get; set; }
+    /// <summary>Platform type for responsive design.</summary>
+    [JsonPropertyName("platform")]
+    public McpAppsSetHostContextDetailsPlatform? Platform { get; set; }
 
-    /// <summary>Whether to surface reasoning-summary events from the model.</summary>
-    [JsonPropertyName("enableReasoningSummaries")]
-    public bool? EnableReasoningSummaries { get; set; }
+    /// <summary>UI theme preference per SEP-1865.</summary>
+    [JsonPropertyName("theme")]
+    public McpAppsSetHostContextDetailsTheme? Theme { get; set; }
 
-    /// <summary>Whether shell-script safety heuristics are enabled.</summary>
-    [JsonPropertyName("enableScriptSafety")]
-    public bool? EnableScriptSafety { get; set; }
+    /// <summary>IANA timezone, e.g. 'America/New_York'.</summary>
+    [JsonPropertyName("timeZone")]
+    public string? TimeZone { get; set; }
 
-    /// <summary>Whether to enable cross-session store writes and reads.</summary>
-    [JsonPropertyName("enableSessionStore")]
-    public bool? EnableSessionStore { get; set; }
+    /// <summary>Host application identifier.</summary>
+    [JsonPropertyName("userAgent")]
+    public string? UserAgent { get; set; }
+}
 
-    /// <summary>Whether to enable skill directory scanning and loading. Falls back to enableConfigDiscovery when unset.</summary>
-    [JsonPropertyName("enableSkills")]
-    public bool? EnableSkills { get; set; }
+/// <summary>Host context to advertise to MCP App guests.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class McpAppsSetHostContextRequest
+{
+    /// <summary>Host context advertised to MCP App guests.</summary>
+    [JsonPropertyName("context")]
+    public McpAppsSetHostContextDetails Context { get => field ??= new(); set; }
 
-    /// <summary>Whether to stream model responses.</summary>
-    [JsonPropertyName("enableStreaming")]
-    public bool? EnableStreaming { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>How env values are passed to MCP servers (`direct` inlines literal values; `indirect` resolves at launch).</summary>
-    [JsonPropertyName("envValueMode")]
-    public OptionsUpdateEnvValueMode? EnvValueMode { get; set; }
+/// <summary>Current host context.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class McpAppsHostContextDetails
+{
+    /// <summary>Display modes the host supports.</summary>
+    [JsonPropertyName("availableDisplayModes")]
+    public IList<McpAppsHostContextDetailsAvailableDisplayMode>? AvailableDisplayModes { get; set; }
 
-    /// <summary>Override directory for the session-events log. When unset, the runtime's default events log directory is used.</summary>
-    [JsonPropertyName("eventsLogDirectory")]
-    public string? EventsLogDirectory { get; set; }
+    /// <summary>Current display mode (SEP-1865).</summary>
+    [JsonPropertyName("displayMode")]
+    public McpAppsHostContextDetailsDisplayMode? DisplayMode { get; set; }
 
-    /// <summary>Whether subagent callback events should be forwarded into the session event log sink.</summary>
-    [JsonPropertyName("eventsLogIncludesSubagents")]
-    public bool? EventsLogIncludesSubagents { get; set; }
+    /// <summary>BCP-47 locale, e.g. 'en-US'.</summary>
+    [JsonPropertyName("locale")]
+    public string? Locale { get; set; }
 
-    /// <summary>Built-in subagent names to exclude from this session. Excluded built-ins are hidden from agent discovery and cannot be dispatched unless a custom agent with the same name is available.</summary>
-    [JsonPropertyName("excludedBuiltinAgents")]
-    public IList<string>? ExcludedBuiltinAgents { get; set; }
+    /// <summary>Platform type for responsive design.</summary>
+    [JsonPropertyName("platform")]
+    public McpAppsHostContextDetailsPlatform? Platform { get; set; }
 
-    /// <summary>Denylist of tool names for this session.</summary>
-    [JsonPropertyName("excludedTools")]
-    public IList<string>? ExcludedTools { get; set; }
+    /// <summary>UI theme preference per SEP-1865.</summary>
+    [JsonPropertyName("theme")]
+    public McpAppsHostContextDetailsTheme? Theme { get; set; }
 
-    /// <summary>Map of feature-flag IDs to their boolean enabled state.</summary>
-    [JsonPropertyName("featureFlags")]
-    public IDictionary<string, bool>? FeatureFlags { get; set; }
-
-    /// <summary>Built-in subagent names to include in this session. When specified, only these built-ins are available, subject to runtime availability and exclusions. Custom agents with the same name remain available. Set to null to remove the allowlist restriction.</summary>
-    [JsonPropertyName("includedBuiltinAgents")]
-    public IList<string>? IncludedBuiltinAgents { get; set; }
-
-    /// <summary>Full set of installed plugins for the session. Replaces the existing list; the runtime invalidates the skills cache only when the list materially changes.</summary>
-    [JsonPropertyName("installedPlugins")]
-    public IList<SessionInstalledPlugin>? InstalledPlugins { get; set; }
-
-    /// <summary>Stable integration identifier used for analytics and rate-limit attribution.</summary>
-    [JsonPropertyName("integrationId")]
-    public string? IntegrationId { get; set; }
-
-    /// <summary>Whether experimental capabilities are enabled.</summary>
-    [JsonPropertyName("isExperimentalMode")]
-    public bool? IsExperimentalMode { get; set; }
-
-    /// <summary>Whether interactive shell sessions are logged.</summary>
-    [JsonPropertyName("logInteractiveShells")]
-    public bool? LogInteractiveShells { get; set; }
-
-    /// <summary>Identifier sent to LSP-style integrations.</summary>
-    [JsonPropertyName("lspClientName")]
-    public string? LspClientName { get; set; }
-
-    /// <summary>Whether to expose the `manage_schedule` tool to the agent. The runtime always owns the per-session schedule registry; this flag only controls tool exposure (typically gated to staff users).</summary>
-    [JsonPropertyName("manageScheduleEnabled")]
-    public bool? ManageScheduleEnabled { get; set; }
-
-    /// <summary>Maximum decoded byte size of a single model-facing binary tool result (e.g. an image) persisted inline in session events and re-presented to the model on later turns / resume. Larger results are persisted as a metadata-only marker and shown to the model as a short text note. Defaults to 10 MB.</summary>
-    [JsonPropertyName("maxInlineBinaryBytes")]
-    public long? MaxInlineBinaryBytes { get; set; }
-
-    /// <summary>The model ID to use for assistant turns.</summary>
-    [JsonPropertyName("model")]
-    public string? Model { get; set; }
-
-    /// <summary>Per-property model capability overrides for the selected model.</summary>
-    [JsonPropertyName("modelCapabilitiesOverrides")]
-    public ModelCapabilitiesOverride? ModelCapabilitiesOverrides { get; set; }
-
-    /// <summary>Organization-level custom instructions to inject into the system prompt.</summary>
-    [JsonPropertyName("organizationCustomInstructions")]
-    public string? OrganizationCustomInstructions { get; set; }
-
-    /// <summary>Custom model-provider configuration (BYOK).</summary>
-    [JsonPropertyName("provider")]
-    public ProviderConfig? Provider { get; set; }
-
-    /// <summary>Reasoning effort for the selected model. CAPI values are model-defined and validated against the selected model; BYOK providers may define additional values. When omitted, no effort override is applied.</summary>
-    [JsonPropertyName("reasoningEffort")]
-    public string? ReasoningEffort { get; set; }
-
-    /// <summary>Reasoning summary mode for supported model clients.</summary>
-    [JsonPropertyName("reasoningSummary")]
-    public OptionsUpdateReasoningSummary? ReasoningSummary { get; set; }
-
-    /// <summary>Whether the session is running in an interactive UI.</summary>
-    [JsonPropertyName("runningInInteractiveMode")]
-    public bool? RunningInInteractiveMode { get; set; }
+    /// <summary>IANA timezone, e.g. 'America/New_York'.</summary>
+    [JsonPropertyName("timeZone")]
+    public string? TimeZone { get; set; }
 
-    /// <summary>Resolved sandbox configuration.</summary>
-    [JsonPropertyName("sandboxConfig")]
-    public SandboxConfig? SandboxConfig { get; set; }
+    /// <summary>Host application identifier.</summary>
+    [JsonPropertyName("userAgent")]
+    public string? UserAgent { get; set; }
+}
 
-    /// <summary>Replaces the session's capability set with the given list. Use to enable or disable capabilities mid-session (e.g., remove `memory` for reproducible scripted runs). Omit the field to leave the existing capability set unchanged.</summary>
-    [JsonPropertyName("sessionCapabilities")]
-    public IList<SessionCapability>? SessionCapabilities { get; set; }
+/// <summary>Current host context advertised to MCP App guests.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class McpAppsHostContext
+{
+    /// <summary>Current host context.</summary>
+    [JsonPropertyName("context")]
+    public McpAppsHostContextDetails Context { get => field ??= new(); set; }
+}
 
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionMcpAppsGetHostContextRequest
+{
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Optional session limits. Pass null to clear the session limits.</summary>
-    [JsonPropertyName("sessionLimits")]
-    public SessionLimitsConfig? SessionLimits { get; set; }
-
-    /// <summary>Per-session settings for built-in shell tools.</summary>
-    [JsonPropertyName("shell")]
-    public ShellOptions? Shell { get; set; }
-
-    /// <summary>Use shell.initProfile instead. Shell init profile (`None` or `NonInteractive`).</summary>
-    [EditorBrowsable(EditorBrowsableState.Never)]
-#if NET5_0_OR_GREATER
-    [Obsolete("This member is deprecated and will be removed in a future version.", DiagnosticId = "GHCP001")]
-#endif
-    [JsonPropertyName("shellInitProfile")]
-    public string? ShellInitProfile { get; set; }
-
-    /// <summary>PowerShell process flags applied to built-in and user-requested shell commands.</summary>
-    [JsonPropertyName("shellProcessFlags")]
-    public IList<string>? ShellProcessFlags { get; set; }
+/// <summary>Capability negotiation snapshot.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class McpAppsDiagnoseCapability
+{
+    /// <summary>Whether the runtime advertises `extensions.io.modelcontextprotocol/ui` to MCP servers.</summary>
+    [JsonPropertyName("advertised")]
+    public bool Advertised { get; set; }
 
-    /// <summary>Additional directories to search for skills.</summary>
-    [JsonPropertyName("skillDirectories")]
-    public IList<string>? SkillDirectories { get; set; }
+    /// <summary>Whether the MCP_APPS feature flag (or COPILOT_MCP_APPS env override) is on.</summary>
+    [JsonPropertyName("featureFlagEnabled")]
+    public bool FeatureFlagEnabled { get; set; }
 
-    /// <summary>Whether to skip loading custom instruction sources.</summary>
-    [JsonPropertyName("skipCustomInstructions")]
-    public bool? SkipCustomInstructions { get; set; }
+    /// <summary>Whether the session has the `mcp-apps` capability.</summary>
+    [JsonPropertyName("sessionHasMcpApps")]
+    public bool SessionHasMcpApps { get; set; }
+}
 
-    /// <summary>Whether to skip embedding retrieval pipeline initialization and execution.</summary>
-    [JsonPropertyName("skipEmbeddingRetrieval")]
-    public bool? SkipEmbeddingRetrieval { get; set; }
+/// <summary>What the server returned for this session.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class McpAppsDiagnoseServer
+{
+    /// <summary>Whether the named server is currently connected.</summary>
+    [JsonPropertyName("connected")]
+    public bool Connected { get; set; }
 
-    /// <summary>When true, the selected custom agent's prompt is not injected into the user message (skill context is still injected). Used by automation triggers where the agent prompt is already in the problem statement.</summary>
-    [JsonPropertyName("suppressCustomAgentPrompt")]
-    public bool? SuppressCustomAgentPrompt { get; set; }
+    /// <summary>Up to 5 tool names with `_meta.ui` for quick inspection.</summary>
+    [JsonPropertyName("sampleToolNames")]
+    public IList<string> SampleToolNames { get => field ??= []; set; }
 
-    /// <summary>Controls how availableTools (allowlist) and excludedTools (denylist) combine when both are set.</summary>
-    [JsonPropertyName("toolFilterPrecedence")]
-    public OptionsUpdateToolFilterPrecedence? ToolFilterPrecedence { get; set; }
+    /// <summary>Total tools returned by the server's tools/list.</summary>
+    [JsonPropertyName("toolCount")]
+    public double ToolCount { get; set; }
 
-    /// <summary>Optional path for trajectory output.</summary>
-    [JsonPropertyName("trajectoryFile")]
-    public string? TrajectoryFile { get; set; }
+    /// <summary>Tools whose `_meta.ui` is populated (resourceUri and/or visibility set).</summary>
+    [JsonPropertyName("toolsWithUiMeta")]
+    public double ToolsWithUiMeta { get; set; }
+}
 
-    /// <summary>Output verbosity level for supported models.</summary>
-    [JsonPropertyName("verbosity")]
-    public Verbosity? Verbosity { get; set; }
+/// <summary>Diagnostic snapshot of MCP Apps wiring for the named server.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class McpAppsDiagnoseResult
+{
+    /// <summary>Capability negotiation snapshot.</summary>
+    [JsonPropertyName("capability")]
+    public McpAppsDiagnoseCapability Capability { get => field ??= new(); set; }
 
-    /// <summary>Absolute working-directory path for shell tools.</summary>
-    [JsonPropertyName("workingDirectory")]
-    public string? WorkingDirectory { get; set; }
+    /// <summary>What the server returned for this session.</summary>
+    [JsonPropertyName("server")]
+    public McpAppsDiagnoseServer Server { get => field ??= new(); set; }
 }
 
-/// <summary>Parameters for (re)loading the merged LSP configuration set.</summary>
+/// <summary>MCP server to diagnose MCP Apps wiring for.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class LspInitializeRequest
+internal sealed class McpAppsDiagnoseRequest
 {
-    /// <summary>Force re-initialization even when LSP configs were already loaded for the working directory.</summary>
-    [JsonPropertyName("force")]
-    public bool? Force { get; set; }
-
-    /// <summary>Git root used as the boundary when traversing for project-level LSP configs (supports monorepos).</summary>
-    [JsonPropertyName("gitRoot")]
-    public string? GitRoot { get; set; }
+    /// <summary>MCP server to probe.</summary>
+    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("serverName")]
+    public string ServerName { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
-
-    /// <summary>Working directory used to load project-level LSP configs. Defaults to the session working directory when omitted.</summary>
-    [JsonPropertyName("workingDirectory")]
-    public string? WorkingDirectory { get; set; }
 }
 
-/// <summary>Discovered extension metadata, including source-qualified ID, name, discovery source, status, and optional process ID.</summary>
+/// <summary>MCP resource content with URI, optional MIME type, text or base64 blob, and resource metadata.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class Extension
+public sealed class McpResourceContent
 {
-    /// <summary>Source-qualified ID (e.g., 'project:my-ext', 'user:auth-helper', 'plugin:my-plugin:my-ext').</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
+    /// <summary>Resource-level metadata (CSP, permissions, etc.).</summary>
+    [JsonPropertyName("_meta")]
+    public IDictionary<string, JsonElement>? Meta { get; set; }
 
-    /// <summary>Extension name (directory name).</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Base64-encoded binary content.</summary>
+    [JsonPropertyName("blob")]
+    public string? Blob { get; set; }
 
-    /// <summary>Process ID if the extension is running.</summary>
-    [JsonPropertyName("pid")]
-    public long? Pid { get; set; }
+    /// <summary>MIME type of the content.</summary>
+    [JsonPropertyName("mimeType")]
+    public string? MimeType { get; set; }
 
-    /// <summary>Discovery source: project (.github/extensions/), user (~/.copilot/extensions/), plugin (installed plugin), or session (session-state/&lt;id&gt;/extensions/).</summary>
-    [JsonPropertyName("source")]
-    public ExtensionSource Source { get; set; }
+    /// <summary>Text content (e.g. HTML).</summary>
+    [JsonPropertyName("text")]
+    public string? Text { get; set; }
 
-    /// <summary>Current status: running, disabled, failed, or starting.</summary>
-    [JsonPropertyName("status")]
-    public ExtensionStatus Status { get; set; }
+    /// <summary>The resource URI.</summary>
+    [JsonPropertyName("uri")]
+    public string Uri { get; set; } = string.Empty;
 }
 
-/// <summary>Extensions discovered for the session, with their current status.</summary>
+/// <summary>Resource contents returned by the MCP server.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ExtensionList
+public sealed class McpResourcesReadResult
 {
-    /// <summary>Discovered extensions and their current status.</summary>
-    [JsonPropertyName("extensions")]
-    public IList<Extension> Extensions { get => field ??= []; set; }
+    /// <summary>Resource contents returned by the server.</summary>
+    [JsonPropertyName("contents")]
+    public IList<McpResourceContent> Contents { get => field ??= []; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>MCP server and resource URI to fetch.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionExtensionsListRequest
+internal sealed class McpResourcesReadRequest
 {
+    /// <summary>Name of the MCP server hosting the resource.</summary>
+    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("serverName")]
+    public string ServerName { get; set; } = string.Empty;
+
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Resource URI.</summary>
+    [JsonPropertyName("uri")]
+    public string Uri { get; set; } = string.Empty;
 }
 
-/// <summary>Source-qualified extension identifier to enable for the session.</summary>
+/// <summary>Standard MCP resource annotations plus preserved non-standard annotation fields.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class ExtensionsEnableRequest
+public sealed class McpResourceAnnotations
 {
-    /// <summary>Source-qualified extension ID to enable.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
+    /// <summary>Server-provided non-standard annotation fields preserved from the MCP response.</summary>
+    [JsonPropertyName("additionalProperties")]
+    public IDictionary<string, JsonElement>? AdditionalProperties { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Intended audience roles for this resource.</summary>
+    [JsonPropertyName("audience")]
+    public IList<string>? Audience { get; set; }
 
-/// <summary>Source-qualified extension identifier to disable for the session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class ExtensionsDisableRequest
-{
-    /// <summary>Source-qualified extension ID to disable.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
+    /// <summary>Last-modified timestamp hint.</summary>
+    [JsonPropertyName("lastModified")]
+    public string? LastModified { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Priority hint for model/client use.</summary>
+    [JsonPropertyName("priority")]
+    public double? Priority { get; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>A resource icon descriptor plus preserved non-standard icon fields.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionExtensionsReloadRequest
+public sealed class McpResourceIcon
 {
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Server-provided non-standard icon fields preserved from the MCP response.</summary>
+    [JsonPropertyName("additionalProperties")]
+    public IDictionary<string, JsonElement>? AdditionalProperties { get; set; }
 
-/// <summary>Attachment union accepted by push input, covering files, directories, GitHub objects, blobs, snippets, and extension context.</summary>
-/// <remarks>Polymorphic base type discriminated by <c>type</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
-[JsonPolymorphic(
-    TypeDiscriminatorPropertyName = "type",
-    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
-[JsonDerivedType(typeof(PushAttachmentFile), "file")]
-[JsonDerivedType(typeof(PushAttachmentDirectory), "directory")]
-[JsonDerivedType(typeof(PushAttachmentSelection), "selection")]
-[JsonDerivedType(typeof(PushAttachmentGitHubReference), "github_reference")]
-[JsonDerivedType(typeof(PushAttachmentGitHubCommit), "github_commit")]
-[JsonDerivedType(typeof(PushAttachmentGitHubRelease), "github_release")]
-[JsonDerivedType(typeof(PushAttachmentGitHubActionsJob), "github_actions_job")]
-[JsonDerivedType(typeof(PushAttachmentGitHubRepository), "github_repository")]
-[JsonDerivedType(typeof(PushAttachmentGitHubFileDiff), "github_file_diff")]
-[JsonDerivedType(typeof(PushAttachmentGitHubTreeComparison), "github_tree_comparison")]
-[JsonDerivedType(typeof(PushAttachmentGitHubUrl), "github_url")]
-[JsonDerivedType(typeof(PushAttachmentGitHubFile), "github_file")]
-[JsonDerivedType(typeof(PushAttachmentGitHubSnippet), "github_snippet")]
-[JsonDerivedType(typeof(PushAttachmentBlob), "blob")]
-[JsonDerivedType(typeof(PushAttachmentExtensionContext), "extension_context")]
-public partial class PushAttachment
-{
-    /// <summary>The type discriminator.</summary>
-    [JsonPropertyName("type")]
-    public virtual string Type { get; set; } = string.Empty;
-}
+    /// <summary>Icon MIME type, when known.</summary>
+    [JsonPropertyName("mimeType")]
+    public string? MimeType { get; set; }
 
+    /// <summary>Icon sizes hint.</summary>
+    [JsonPropertyName("sizes")]
+    public string? Sizes { get; set; }
 
-/// <summary>Optional line range to scope the attachment to a specific section of the file.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class PushAttachmentFileLineRange
-{
-    /// <summary>End line number (1-based, inclusive).</summary>
-    [JsonPropertyName("end")]
-    public long End { get; set; }
+    /// <summary>Icon URI.</summary>
+    [JsonPropertyName("src")]
+    public string Src { get; set; } = string.Empty;
 
-    /// <summary>Start line number (1-based).</summary>
-    [JsonPropertyName("start")]
-    public long Start { get; set; }
+    /// <summary>Theme hint for this icon.</summary>
+    [JsonPropertyName("theme")]
+    public string? Theme { get; set; }
 }
 
-/// <summary>File attachment.</summary>
-/// <remarks>The <c>file</c> variant of <see cref="PushAttachment"/>.</remarks>
+/// <summary>An MCP resource descriptor (spec `Resource`): URI, name, and optional title, description, MIME type, size, icons, annotations, and metadata. Server-provided fields outside the standard descriptor shape are exposed under `additionalProperties`.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PushAttachmentFile : PushAttachment
+public sealed class McpResource
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "file";
-
-    /// <summary>User-facing display name for the attachment.</summary>
-    [JsonPropertyName("displayName")]
-    public required string DisplayName { get; set; }
+    /// <summary>Resource-level metadata.</summary>
+    [JsonPropertyName("_meta")]
+    public IDictionary<string, JsonElement>? Meta { get; set; }
 
-    /// <summary>Optional line range to scope the attachment to a specific section of the file.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("lineRange")]
-    public PushAttachmentFileLineRange? LineRange { get; set; }
+    /// <summary>Server-provided non-standard descriptor fields preserved from the MCP response.</summary>
+    [JsonPropertyName("additionalProperties")]
+    public IDictionary<string, JsonElement>? AdditionalProperties { get; set; }
 
-    /// <summary>Absolute file path.</summary>
-    [JsonPropertyName("path")]
-    public required string Path { get; set; }
-}
+    /// <summary>Model/client annotations associated with this resource.</summary>
+    [JsonPropertyName("annotations")]
+    public McpResourceAnnotations? Annotations { get; set; }
 
-/// <summary>Directory attachment.</summary>
-/// <remarks>The <c>directory</c> variant of <see cref="PushAttachment"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
-public partial class PushAttachmentDirectory : PushAttachment
-{
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "directory";
+    /// <summary>Optional description of what this resource represents.</summary>
+    [JsonPropertyName("description")]
+    public string? Description { get; set; }
 
-    /// <summary>User-facing display name for the attachment.</summary>
-    [JsonPropertyName("displayName")]
-    public required string DisplayName { get; set; }
+    /// <summary>Icons associated with this resource.</summary>
+    [JsonPropertyName("icons")]
+    public IList<McpResourceIcon>? Icons { get; set; }
 
-    /// <summary>Absolute directory path.</summary>
-    [JsonPropertyName("path")]
-    public required string Path { get; set; }
-}
+    /// <summary>MIME type of the resource, if known.</summary>
+    [JsonPropertyName("mimeType")]
+    public string? MimeType { get; set; }
 
-/// <summary>End position of the selection.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class PushAttachmentSelectionDetailsEnd
-{
-    /// <summary>End character offset within the line (0-based).</summary>
-    [JsonPropertyName("character")]
-    public long Character { get; set; }
+    /// <summary>The programmatic name of the resource.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
-    /// <summary>End line number (0-based).</summary>
-    [JsonPropertyName("line")]
-    public long Line { get; set; }
-}
+    /// <summary>Resource size in bytes, when known.</summary>
+    [JsonPropertyName("size")]
+    public long? Size { get; set; }
 
-/// <summary>Start position of the selection.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class PushAttachmentSelectionDetailsStart
-{
-    /// <summary>Start character offset within the line (0-based).</summary>
-    [JsonPropertyName("character")]
-    public long Character { get; set; }
+    /// <summary>Optional human-readable display title.</summary>
+    [JsonPropertyName("title")]
+    public string? Title { get; set; }
 
-    /// <summary>Start line number (0-based).</summary>
-    [JsonPropertyName("line")]
-    public long Line { get; set; }
+    /// <summary>The resource URI (e.g. ui://... or file:///...).</summary>
+    [JsonPropertyName("uri")]
+    public string Uri { get; set; } = string.Empty;
 }
 
-/// <summary>Position range of the selection within the file.</summary>
+/// <summary>One page of resources advertised by the named MCP server.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PushAttachmentSelectionDetails
+public sealed class McpResourcesListResult
 {
-    /// <summary>End position of the selection.</summary>
-    [JsonPropertyName("end")]
-    public PushAttachmentSelectionDetailsEnd End { get => field ??= new(); set; }
+    /// <summary>Opaque cursor for the next page, if the server has more resources.</summary>
+    [JsonPropertyName("nextCursor")]
+    public string? NextCursor { get; set; }
 
-    /// <summary>Start position of the selection.</summary>
-    [JsonPropertyName("start")]
-    public PushAttachmentSelectionDetailsStart Start { get => field ??= new(); set; }
+    /// <summary>Resources advertised by the server (proxied MCP `resources/list`).</summary>
+    [JsonPropertyName("resources")]
+    public IList<McpResource> Resources { get => field ??= []; set; }
 }
 
-/// <summary>Code selection attachment from an editor.</summary>
-/// <remarks>The <c>selection</c> variant of <see cref="PushAttachment"/>.</remarks>
+/// <summary>MCP server whose resources to enumerate.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PushAttachmentSelection : PushAttachment
+internal sealed class McpResourcesListRequest
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "selection";
-
-    /// <summary>User-facing display name for the selection.</summary>
-    [JsonPropertyName("displayName")]
-    public required string DisplayName { get; set; }
-
-    /// <summary>Absolute path to the file containing the selection.</summary>
-    [JsonPropertyName("filePath")]
-    public required string FilePath { get; set; }
+    /// <summary>Opaque MCP pagination cursor from a prior `nextCursor` value.</summary>
+    [JsonPropertyName("cursor")]
+    public string? Cursor { get; set; }
 
-    /// <summary>Position range of the selection within the file.</summary>
-    [JsonPropertyName("selection")]
-    public required PushAttachmentSelectionDetails Selection { get; set; }
+    /// <summary>Name of the MCP server whose resources to enumerate.</summary>
+    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("serverName")]
+    public string ServerName { get; set; } = string.Empty;
 
-    /// <summary>The selected text content.</summary>
-    [JsonPropertyName("text")]
-    public required string Text { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>GitHub issue, pull request, or discussion reference.</summary>
-/// <remarks>The <c>github_reference</c> variant of <see cref="PushAttachment"/>.</remarks>
+/// <summary>An MCP resource template descriptor (spec `ResourceTemplate`): an RFC 6570 URI template, name, and optional title, description, MIME type, icons, annotations, and metadata. Server-provided fields outside the standard descriptor shape are exposed under `additionalProperties`.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PushAttachmentGitHubReference : PushAttachment
+public sealed class McpResourceTemplate
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "github_reference";
+    /// <summary>Resource-template-level metadata.</summary>
+    [JsonPropertyName("_meta")]
+    public IDictionary<string, JsonElement>? Meta { get; set; }
 
-    /// <summary>Issue, pull request, or discussion number.</summary>
-    [JsonPropertyName("number")]
-    public required long Number { get; set; }
+    /// <summary>Server-provided non-standard descriptor fields preserved from the MCP response.</summary>
+    [JsonPropertyName("additionalProperties")]
+    public IDictionary<string, JsonElement>? AdditionalProperties { get; set; }
 
-    /// <summary>Type of GitHub reference.</summary>
-    [JsonPropertyName("referenceType")]
-    public required PushAttachmentGitHubReferenceType ReferenceType { get; set; }
+    /// <summary>Model/client annotations associated with this template.</summary>
+    [JsonPropertyName("annotations")]
+    public McpResourceAnnotations? Annotations { get; set; }
 
-    /// <summary>Current state of the referenced item (e.g., open, closed, merged).</summary>
-    [JsonPropertyName("state")]
-    public required string State { get; set; }
+    /// <summary>Optional description of what this template is for.</summary>
+    [JsonPropertyName("description")]
+    public string? Description { get; set; }
 
-    /// <summary>Title of the referenced item.</summary>
-    [JsonPropertyName("title")]
-    public required string Title { get; set; }
-
-    /// <summary>URL to the referenced item on GitHub.</summary>
-    [JsonPropertyName("url")]
-    public required string Url { get; set; }
-}
+    /// <summary>Icons associated with resources matching this template.</summary>
+    [JsonPropertyName("icons")]
+    public IList<McpResourceIcon>? Icons { get; set; }
 
-/// <summary>Pointer to a GitHub repository.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class PushGitHubRepoRef
-{
-    /// <summary>Numeric GitHub repository id.</summary>
-    [JsonPropertyName("id")]
-    public long? Id { get; set; }
+    /// <summary>MIME type for resources matching this template, if uniform.</summary>
+    [JsonPropertyName("mimeType")]
+    public string? MimeType { get; set; }
 
-    /// <summary>Repository name (without owner).</summary>
+    /// <summary>The programmatic name of the resource template.</summary>
     [JsonPropertyName("name")]
     public string Name { get; set; } = string.Empty;
 
-    /// <summary>Repository owner login (user or organization).</summary>
-    [JsonPropertyName("owner")]
-    public string Owner { get; set; } = string.Empty;
+    /// <summary>Optional human-readable display title.</summary>
+    [JsonPropertyName("title")]
+    public string? Title { get; set; }
+
+    /// <summary>An RFC 6570 URI template for constructing resource URIs.</summary>
+    [JsonPropertyName("uriTemplate")]
+    public string UriTemplate { get; set; } = string.Empty;
 }
 
-/// <summary>Pointer to a GitHub commit.</summary>
-/// <remarks>The <c>github_commit</c> variant of <see cref="PushAttachment"/>.</remarks>
+/// <summary>One page of resource templates advertised by the named MCP server.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PushAttachmentGitHubCommit : PushAttachment
+public sealed class McpResourcesListTemplatesResult
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "github_commit";
+    /// <summary>Opaque cursor for the next page, if the server has more resource templates.</summary>
+    [JsonPropertyName("nextCursor")]
+    public string? NextCursor { get; set; }
 
-    /// <summary>First line of the commit message.</summary>
-    [JsonPropertyName("message")]
-    public required string Message { get; set; }
+    /// <summary>Resource templates advertised by the server (proxied MCP `resources/templates/list`).</summary>
+    [JsonPropertyName("resourceTemplates")]
+    public IList<McpResourceTemplate> ResourceTemplates { get => field ??= []; set; }
+}
 
-    /// <summary>Full commit SHA.</summary>
-    [JsonPropertyName("oid")]
-    public required string Oid { get; set; }
+/// <summary>MCP server whose resource templates to enumerate.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class McpResourcesListTemplatesRequest
+{
+    /// <summary>Opaque MCP pagination cursor from a prior `nextCursor` value.</summary>
+    [JsonPropertyName("cursor")]
+    public string? Cursor { get; set; }
 
-    /// <summary>Repository the commit belongs to.</summary>
-    [JsonPropertyName("repo")]
-    public required PushGitHubRepoRef Repo { get; set; }
+    /// <summary>Name of the MCP server whose resource templates to enumerate.</summary>
+    [RegularExpression("^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$")]
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("serverName")]
+    public string ServerName { get; set; } = string.Empty;
 
-    /// <summary>URL to the commit on GitHub.</summary>
-    [JsonPropertyName("url")]
-    public required string Url { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Pointer to a GitHub release.</summary>
-/// <remarks>The <c>github_release</c> variant of <see cref="PushAttachment"/>.</remarks>
+/// <summary>Session plugin metadata, with name, marketplace, optional version, and enabled state.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PushAttachmentGitHubRelease : PushAttachment
+public sealed class Plugin
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "github_release";
-
-    /// <summary>Human-readable release name.</summary>
-    [JsonPropertyName("name")]
-    public required string Name { get; set; }
+    /// <summary>Whether the plugin is currently enabled.</summary>
+    [JsonPropertyName("enabled")]
+    public bool Enabled { get; set; }
 
-    /// <summary>Repository the release belongs to.</summary>
-    [JsonPropertyName("repo")]
-    public required PushGitHubRepoRef Repo { get; set; }
+    /// <summary>Marketplace the plugin came from.</summary>
+    [JsonPropertyName("marketplace")]
+    public string Marketplace { get; set; } = string.Empty;
 
-    /// <summary>Git tag the release is anchored to.</summary>
-    [JsonPropertyName("tagName")]
-    public required string TagName { get; set; }
+    /// <summary>Plugin name.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
-    /// <summary>URL to the release on GitHub.</summary>
-    [JsonPropertyName("url")]
-    public required string Url { get; set; }
+    /// <summary>Installed version.</summary>
+    [JsonPropertyName("version")]
+    public string? Version { get; set; }
 }
 
-/// <summary>Pointer to a GitHub Actions job.</summary>
-/// <remarks>The <c>github_actions_job</c> variant of <see cref="PushAttachment"/>.</remarks>
+/// <summary>Plugins installed for the session, with their enabled state and version metadata.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PushAttachmentGitHubActionsJob : PushAttachment
+public sealed class PluginList
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "github_actions_job";
+    /// <summary>Installed plugins.</summary>
+    [JsonPropertyName("plugins")]
+    public IList<Plugin> Plugins { get => field ??= []; set; }
+}
 
-    /// <summary>Terminal conclusion of the job when finished (e.g., success, failure, cancelled). Absent for in-progress jobs.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("conclusion")]
-    public string? Conclusion { get; set; }
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionPluginsListRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Job id within the workflow run.</summary>
-    [JsonPropertyName("jobId")]
-    public required long JobId { get; set; }
+/// <summary>RPC data type for SessionPluginsReload operations.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionPluginsReloadRequest
+{
+    /// <summary>When true, skip repo-level hooks during the hook reload. Use before folder trust is confirmed; load them post-trust via `sessions.loadDeferredRepoHooks`.</summary>
+    [JsonPropertyName("deferRepoHooks")]
+    public bool? DeferRepoHooks { get; set; }
 
-    /// <summary>Display name of the job.</summary>
-    [JsonPropertyName("jobName")]
-    public required string JobName { get; set; }
+    /// <summary>Re-run custom-agent discovery after refreshing plugins. Defaults to true.</summary>
+    [JsonPropertyName("reloadCustomAgents")]
+    public bool? ReloadCustomAgents { get; set; }
 
-    /// <summary>Repository the workflow run belongs to.</summary>
-    [JsonPropertyName("repo")]
-    public required PushGitHubRepoRef Repo { get; set; }
+    /// <summary>Re-discover and relaunch subprocess extensions (including plugin-shipped extensions) after refreshing plugins. Defaults to true. Has no effect when the session has no active extension controller (e.g. extensions were not requested for the session).</summary>
+    [JsonPropertyName("reloadExtensions")]
+    public bool? ReloadExtensions { get; set; }
 
-    /// <summary>URL to the job on GitHub.</summary>
-    [JsonPropertyName("url")]
-    public required string Url { get; set; }
+    /// <summary>Re-load user, plugin, and (subject to `deferRepoHooks`) repo hooks. Defaults to true. Has no effect when the host has not registered a hook reloader (e.g. remote sessions).</summary>
+    [JsonPropertyName("reloadHooks")]
+    public bool? ReloadHooks { get; set; }
 
-    /// <summary>Display name of the workflow the job ran in.</summary>
-    [JsonPropertyName("workflowName")]
-    public required string WorkflowName { get; set; }
+    /// <summary>Reload MCP server connections after refreshing plugins. Defaults to true.</summary>
+    [JsonPropertyName("reloadMcp")]
+    public bool? ReloadMcp { get; set; }
 }
 
-/// <summary>Pointer to a GitHub repository.</summary>
-/// <remarks>The <c>github_repository</c> variant of <see cref="PushAttachment"/>.</remarks>
+/// <summary>RPC data type for SessionPluginsReloadRequestWithSession operations.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PushAttachmentGitHubRepository : PushAttachment
+internal sealed class SessionPluginsReloadRequestWithSession
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "github_repository";
+    /// <summary>When true, skip repo-level hooks during the hook reload. Use before folder trust is confirmed; load them post-trust via `sessions.loadDeferredRepoHooks`.</summary>
+    [JsonPropertyName("deferRepoHooks")]
+    public bool? DeferRepoHooks { get; set; }
 
-    /// <summary>Short description of the repository.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("description")]
-    public string? Description { get; set; }
+    /// <summary>Re-run custom-agent discovery after refreshing plugins. Defaults to true.</summary>
+    [JsonPropertyName("reloadCustomAgents")]
+    public bool? ReloadCustomAgents { get; set; }
 
-    /// <summary>Git ref this attachment is anchored at (branch, tag, or commit). When absent the default branch is implied.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("ref")]
-    public string? Ref { get; set; }
+    /// <summary>Re-discover and relaunch subprocess extensions (including plugin-shipped extensions) after refreshing plugins. Defaults to true. Has no effect when the session has no active extension controller (e.g. extensions were not requested for the session).</summary>
+    [JsonPropertyName("reloadExtensions")]
+    public bool? ReloadExtensions { get; set; }
 
-    /// <summary>Repository pointer.</summary>
-    [JsonPropertyName("repo")]
-    public required PushGitHubRepoRef Repo { get; set; }
+    /// <summary>Re-load user, plugin, and (subject to `deferRepoHooks`) repo hooks. Defaults to true. Has no effect when the host has not registered a hook reloader (e.g. remote sessions).</summary>
+    [JsonPropertyName("reloadHooks")]
+    public bool? ReloadHooks { get; set; }
 
-    /// <summary>URL to the repository on GitHub.</summary>
-    [JsonPropertyName("url")]
-    public required string Url { get; set; }
+    /// <summary>Reload MCP server connections after refreshing plugins. Defaults to true.</summary>
+    [JsonPropertyName("reloadMcp")]
+    public bool? ReloadMcp { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>One side of a file diff (head or base).</summary>
+/// <summary>Short-lived, rotating credential the caller must send on every request, in addition to `apiKey` if one is present. Omitted when the endpoint does not require one.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PushAttachmentGitHubFileDiffSide
+public sealed class ProviderSessionToken
 {
-    /// <summary>Repository-relative path to the file.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+    /// <summary>When the token expires, if known. Callers should refresh by calling `getEndpoint` again before this time, or reactively on any 401/403 response from `baseUrl`.</summary>
+    [JsonPropertyName("expiresAt")]
+    public DateTimeOffset? ExpiresAt { get; set; }
 
-    /// <summary>Git ref (branch, tag, or commit SHA) the file is read at.</summary>
-    [JsonPropertyName("ref")]
-    public string Ref { get; set; } = string.Empty;
+    /// <summary>HTTP header name the token must be sent under.</summary>
+    [JsonPropertyName("header")]
+    public string Header { get; set; } = string.Empty;
 
-    /// <summary>Repository the file lives in.</summary>
-    [JsonPropertyName("repo")]
-    public PushGitHubRepoRef Repo { get => field ??= new(); set; }
+    /// <summary>The model the token is bound to, when applicable. When set, the token is only valid for requests against this model.</summary>
+    [JsonPropertyName("model")]
+    public string? Model { get; set; }
+
+    /// <summary>The short-lived token value.</summary>
+    [JsonPropertyName("token")]
+    public string Token { get; set; } = string.Empty;
 }
 
-/// <summary>Pointer to a single-file diff. At least one of `head` and `base` must be present.</summary>
-/// <remarks>The <c>github_file_diff</c> variant of <see cref="PushAttachment"/>.</remarks>
+/// <summary>A snapshot of the provider endpoint the session is currently configured to talk to.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PushAttachmentGitHubFileDiff : PushAttachment
+public sealed class ProviderEndpoint
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "github_file_diff";
+    /// <summary>A credential the caller should use with this endpoint. Omitted only when the endpoint accepts unauthenticated requests.</summary>
+    [JsonPropertyName("apiKey")]
+    public string? ApiKey { get; set; }
 
-    /// <summary>File location on the base side of the diff. Absent for additions.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("base")]
-    public PushAttachmentGitHubFileDiffSide? Base { get; set; }
+    /// <summary>Base URL to pass to the LLM client library.</summary>
+    [Url]
+    [StringSyntax(StringSyntaxAttribute.Uri)]
+    [JsonPropertyName("baseUrl")]
+    public string BaseUrl { get; set; } = string.Empty;
 
-    /// <summary>File location on the head side of the diff. Absent for deletions.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("head")]
-    public PushAttachmentGitHubFileDiffSide? Head { get; set; }
+    /// <summary>HTTP headers the caller must include on every outbound request.</summary>
+    [JsonPropertyName("headers")]
+    public IDictionary<string, string> Headers { get => field ??= new Dictionary<string, string>(); set; }
 
-    /// <summary>URL to the diff on GitHub (e.g., a commit, compare, or PR-file URL).</summary>
-    [JsonPropertyName("url")]
-    public required string Url { get; set; }
+    /// <summary>Short-lived, rotating credential the caller must send on every request, in addition to `apiKey` if one is present. Omitted when the endpoint does not require one.</summary>
+    [JsonPropertyName("sessionToken")]
+    public ProviderSessionToken? SessionToken { get; set; }
+
+    /// <summary>Transport to be used for provider requests.</summary>
+    [JsonPropertyName("transport")]
+    public ProviderEndpointTransport? Transport { get; set; }
+
+    /// <summary>Provider family. Matches the `type` field of a BYOK provider config.</summary>
+    [JsonPropertyName("type")]
+    public ProviderEndpointType Type { get; set; }
+
+    /// <summary>Wire API to be used, when required for the provider type.</summary>
+    [JsonPropertyName("wireApi")]
+    public ProviderEndpointWireApi? WireApi { get; set; }
 }
 
-/// <summary>One side of a tree comparison (head or base).</summary>
+/// <summary>RPC data type for SessionProviderGetEndpoint operations.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PushAttachmentGitHubTreeComparisonSide
+public sealed class SessionProviderGetEndpointRequest
 {
-    /// <summary>Repository the revision belongs to.</summary>
-    [JsonPropertyName("repo")]
-    public PushGitHubRepoRef Repo { get => field ??= new(); set; }
-
-    /// <summary>Git revision (branch, tag, or commit SHA).</summary>
-    [JsonPropertyName("revision")]
-    public string Revision { get; set; } = string.Empty;
+    /// <summary>Model identifier the caller intends to use against the returned endpoint. Used to pick the correct wire shape. Omit to use whichever model the session is currently using.</summary>
+    [JsonPropertyName("modelId")]
+    public string? ModelId { get; set; }
 }
 
-/// <summary>Pointer to a comparison between two git revisions.</summary>
-/// <remarks>The <c>github_tree_comparison</c> variant of <see cref="PushAttachment"/>.</remarks>
+/// <summary>RPC data type for SessionProviderGetEndpointRequestWithSession operations.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PushAttachmentGitHubTreeComparison : PushAttachment
+internal sealed class SessionProviderGetEndpointRequestWithSession
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "github_tree_comparison";
-
-    /// <summary>Base side of the comparison.</summary>
-    [JsonPropertyName("base")]
-    public required PushAttachmentGitHubTreeComparisonSide Base { get; set; }
-
-    /// <summary>Head side of the comparison.</summary>
-    [JsonPropertyName("head")]
-    public required PushAttachmentGitHubTreeComparisonSide Head { get; set; }
+    /// <summary>Model identifier the caller intends to use against the returned endpoint. Used to pick the correct wire shape. Omit to use whichever model the session is currently using.</summary>
+    [JsonPropertyName("modelId")]
+    public string? ModelId { get; set; }
 
-    /// <summary>URL to the comparison on GitHub.</summary>
-    [JsonPropertyName("url")]
-    public required string Url { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Generic GitHub URL reference.</summary>
-/// <remarks>The <c>github_url</c> variant of <see cref="PushAttachment"/>.</remarks>
+/// <summary>The selectable model entries synthesized for the models added by this call.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PushAttachmentGitHubUrl : PushAttachment
+public sealed class ProviderAddResult
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "github_url";
-
-    /// <summary>URL to the GitHub resource.</summary>
-    [JsonPropertyName("url")]
-    public required string Url { get; set; }
+    /// <summary>Synthesized selectable model entries for the newly added BYOK models, each under its provider-qualified selection id (`provider/id`). Empty when only providers were added.</summary>
+    [JsonPropertyName("models")]
+    public IList<JsonElement> Models { get => field ??= []; set; }
 }
 
-/// <summary>Pointer to a file in a GitHub repository at a specific ref.</summary>
-/// <remarks>The <c>github_file</c> variant of <see cref="PushAttachment"/>.</remarks>
+/// <summary>A BYOK model definition referencing a named provider.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PushAttachmentGitHubFile : PushAttachment
+public sealed class ProviderModelConfig
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "github_file";
-
-    /// <summary>Repository-relative path to the file.</summary>
-    [JsonPropertyName("path")]
-    public required string Path { get; set; }
+    /// <summary>Optional capability overrides (vision, tool_calls, reasoning, etc.).</summary>
+    [JsonPropertyName("capabilities")]
+    public ModelCapabilitiesOverride? Capabilities { get; set; }
 
-    /// <summary>Git ref the file is read at (branch, tag, or commit SHA).</summary>
-    [JsonPropertyName("ref")]
-    public required string Ref { get; set; }
+    /// <summary>Provider-local model id, unique within its provider. The session-wide selection id (shown in the model list and passed to switchTo) is the provider-qualified `provider/id`.</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
 
-    /// <summary>Repository the file lives in.</summary>
-    [JsonPropertyName("repo")]
-    public required PushGitHubRepoRef Repo { get; set; }
+    /// <summary>Maximum context window tokens for the model.</summary>
+    [JsonPropertyName("maxContextWindowTokens")]
+    public double? MaxContextWindowTokens { get; set; }
 
-    /// <summary>URL to the file on GitHub.</summary>
-    [JsonPropertyName("url")]
-    public required string Url { get; set; }
-}
+    /// <summary>Maximum output tokens for the model.</summary>
+    [JsonPropertyName("maxOutputTokens")]
+    public double? MaxOutputTokens { get; set; }
 
-/// <summary>Pointer to a line range inside a file in a GitHub repository.</summary>
-/// <remarks>The <c>github_snippet</c> variant of <see cref="PushAttachment"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
-public partial class PushAttachmentGitHubSnippet : PushAttachment
-{
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "github_snippet";
+    /// <summary>Maximum prompt/input tokens for the model.</summary>
+    [JsonPropertyName("maxPromptTokens")]
+    public double? MaxPromptTokens { get; set; }
 
-    /// <summary>Line range the snippet covers.</summary>
-    [JsonPropertyName("lineRange")]
-    public required PushAttachmentFileLineRange LineRange { get; set; }
+    /// <summary>Well-known base model id used for behavior/capability/config lookup. Defaults to `id`.</summary>
+    [JsonPropertyName("modelId")]
+    public string? ModelId { get; set; }
 
-    /// <summary>Repository-relative path to the file.</summary>
-    [JsonPropertyName("path")]
-    public required string Path { get; set; }
+    /// <summary>Display name for model pickers. Defaults to the provider-qualified selection id (`provider/id`).</summary>
+    [JsonPropertyName("name")]
+    public string? Name { get; set; }
 
-    /// <summary>Git ref the file is read at (branch, tag, or commit SHA).</summary>
-    [JsonPropertyName("ref")]
-    public required string Ref { get; set; }
+    /// <summary>Name of the configured provider that serves this model.</summary>
+    [JsonPropertyName("provider")]
+    public string Provider { get; set; } = string.Empty;
 
-    /// <summary>Repository the file lives in.</summary>
-    [JsonPropertyName("repo")]
-    public required PushGitHubRepoRef Repo { get; set; }
+    /// <summary>The model name sent to the provider API for inference. Defaults to `id`.</summary>
+    [JsonPropertyName("wireModel")]
+    public string? WireModel { get; set; }
+}
 
-    /// <summary>URL to the snippet on GitHub (with line anchor).</summary>
-    [JsonPropertyName("url")]
-    public required string Url { get; set; }
+/// <summary>Azure-specific provider options.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class ProviderConfigAzure
+{
+    /// <summary>API version. When set, uses the versioned deployment route. When omitted, uses the GA versionless v1 route.</summary>
+    [JsonPropertyName("apiVersion")]
+    public string? ApiVersion { get; set; }
 }
 
-/// <summary>Blob attachment with inline base64-encoded data.</summary>
-/// <remarks>The <c>blob</c> variant of <see cref="PushAttachment"/>.</remarks>
+/// <summary>External SDK input for a named custom model provider. Ingested by the native protocol boundary before host dispatch.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PushAttachmentBlob : PushAttachment
+public sealed class NamedProviderConfig
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "blob";
+    /// <summary>Static API key used to authenticate provider requests.</summary>
+    [JsonPropertyName("apiKey")]
+    public string? ApiKey { get; set; }
 
-    /// <summary>Base64-encoded content.</summary>
-    [Base64String]
-    [JsonPropertyName("data")]
-    public required string Data { get; set; }
+    /// <summary>Azure authentication configuration for the provider.</summary>
+    [JsonPropertyName("azure")]
+    public ProviderConfigAzure? Azure { get; set; }
 
-    /// <summary>User-facing display name for the attachment.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("displayName")]
-    public string? DisplayName { get; set; }
+    /// <summary>Base URL for provider API requests.</summary>
+    [JsonPropertyName("baseUrl")]
+    public string BaseUrl { get; set; } = string.Empty;
 
-    /// <summary>MIME type of the inline data.</summary>
-    [JsonPropertyName("mimeType")]
-    public required string MimeType { get; set; }
-}
+    /// <summary>Static bearer token used to authenticate provider requests.</summary>
+    [JsonPropertyName("bearerToken")]
+    public string? BearerToken { get; set; }
 
-/// <summary>Slim input shape for extension_context attachments; identity fields are runtime-derived.</summary>
-/// <remarks>The <c>extension_context</c> variant of <see cref="PushAttachment"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
-public partial class PushAttachmentExtensionContext : PushAttachment
-{
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "extension_context";
+    /// <summary>Whether the host supplies bearer tokens dynamically.</summary>
+    [JsonPropertyName("hasBearerTokenProvider")]
+    public bool? HasBearerTokenProvider { get; set; }
 
-    /// <summary>Caller-supplied JSON payload (required, may be null but not undefined).</summary>
-    [JsonPropertyName("payload")]
-    public required JsonElement Payload { get; set; }
+    /// <summary>Additional HTTP headers included with provider requests.</summary>
+    [JsonPropertyName("headers")]
+    public IDictionary<string, string>? Headers { get; set; }
 
-    /// <summary>Human-readable composer pill label.</summary>
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
-    [JsonPropertyName("title")]
-    public required string Title { get; set; }
-}
+    /// <summary>Unique provider name used to qualify model selection IDs.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
-/// <summary>Parameters for session.extensions.sendAttachmentsToMessage.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SendAttachmentsToMessageParams
-{
-    /// <summary>Attachments to push into the next user-message turn. extension_context entries take the slim shape; standard variants take their full AttachmentSchema shape.</summary>
-    [JsonPropertyName("attachments")]
-    public IList<PushAttachment> Attachments { get => field ??= []; set; }
+    /// <summary>Transport used to communicate with the provider.</summary>
+    [JsonPropertyName("transport")]
+    public ProviderConfigTransport? Transport { get; set; }
 
-    /// <summary>Optional canvas instance binding the push for provenance. When supplied, the runtime resolves the canvas, verifies it is owned by the calling extension, and stamps canvasId/instanceId onto each extension_context entry. When omitted, no resolution runs and those fields stay unset on the attachment.</summary>
-    [JsonPropertyName("instanceId")]
-    public string? InstanceId { get; set; }
+    /// <summary>Provider protocol family.</summary>
+    [JsonPropertyName("type")]
+    public ProviderConfigType? Type { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Wire API used to communicate with the provider.</summary>
+    [JsonPropertyName("wireApi")]
+    public ProviderConfigWireApi? WireApi { get; set; }
 }
 
-/// <summary>A tool name and arguments to execute through the session's native invocation pipeline.</summary>
+/// <summary>BYOK providers and/or models to add to the session's registry at runtime. Both fields are optional; provide providers, models, or both.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class ToolsExecuteRequest
+internal sealed class ProviderAddRequest
 {
-    /// <summary>Arguments supplied to the tool.</summary>
-    [JsonPropertyName("arguments")]
-    public JsonElement Arguments { get; set; }
+    /// <summary>BYOK model definitions to register. Each must reference a provider that is already registered or included in this same call. Selection ids (`provider/id`) must be unique across the registry.</summary>
+    [JsonPropertyName("models")]
+    public IList<ProviderModelConfig>? Models { get; set; }
 
-    /// <summary>Name of the currently offered tool to execute.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Named BYOK provider connections to register, additive to any providers already in the registry. Each name must be unique across the registry and must not contain '/'.</summary>
+    [JsonPropertyName("providers")]
+    public IList<NamedProviderConfig>? Providers { get; set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
-
-    /// <summary>Optional identifier used to correlate this invocation with its tool call.</summary>
-    [JsonPropertyName("toolCallId")]
-    public string? ToolCallId { get; set; }
 }
 
-/// <summary>Custom grammar input format accepted by a built-in tool.</summary>
+/// <summary>Indicates whether the session options patch was applied successfully.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class BuiltinToolFormat
+public sealed class SessionUpdateOptionsResult
 {
-    /// <summary>Grammar definition accepted by the tool.</summary>
-    [JsonPropertyName("definition")]
-    public string Definition { get; set; } = string.Empty;
-
-    /// <summary>Grammar syntax used by the format definition.</summary>
-    [JsonPropertyName("syntax")]
-    public string Syntax { get; set; } = string.Empty;
+    /// <summary>Number of hooks loaded from installed plugins, returned when installedPlugins is updated.</summary>
+    [JsonPropertyName("pluginHookCount")]
+    public long? PluginHookCount { get; set; }
 
-    /// <summary>Custom input-format discriminator.</summary>
-    [JsonPropertyName("type")]
-    public BuiltinToolFormatType Type { get; set; }
+    /// <summary>Whether the operation succeeded.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-/// <summary>JSON Schema object accepted by a built-in tool.</summary>
+/// <summary>Source descriptor for a `session.options.update` content-exclusion rule, with source name and type.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class BuiltinToolInputSchema
+public sealed class OptionsUpdateAdditionalContentExclusionPolicyRuleSource
 {
-    /// <summary>Root type of the tool input schema.</summary>
+    /// <summary>Name of the policy source.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
+
+    /// <summary>Type of the policy source.</summary>
     [JsonPropertyName("type")]
-    public BuiltinToolInputSchemaType Type { get; set; }
+    public string Type { get; set; } = string.Empty;
 }
 
-/// <summary>Rust-owned metadata and input schema for a built-in tool.</summary>
+/// <summary>Single content-exclusion rule supplied to `session.options.update`, with paths, match conditions, and source.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class BuiltinToolDescriptor
+public sealed class OptionsUpdateAdditionalContentExclusionPolicyRule
 {
-    /// <summary>Model-facing description of the tool's behavior.</summary>
-    [JsonPropertyName("description")]
-    public string Description { get; set; } = string.Empty;
-
-    /// <summary>Optional custom input format used instead of a JSON Schema.</summary>
-    [JsonPropertyName("format")]
-    public BuiltinToolFormat? Format { get; set; }
-
-    /// <summary>Whether the tool provides a specialized intention summary.</summary>
-    [JsonPropertyName("hasSummariseIntention")]
-    public bool HasSummariseIntention { get; set; }
-
-    /// <summary>JSON Schema for the tool input, or null when the tool uses a custom format.</summary>
-    [JsonPropertyName("inputSchema")]
-    public BuiltinToolInputSchema? InputSchema { get; set; }
+    /// <summary>Conditions of which at least one must match.</summary>
+    [JsonPropertyName("ifAnyMatch")]
+    public IList<string>? IfAnyMatch { get; set; }
 
-    /// <summary>Optional supplemental usage instructions for the tool.</summary>
-    [JsonPropertyName("instructions")]
-    public string? Instructions { get; set; }
+    /// <summary>Conditions none of which may match.</summary>
+    [JsonPropertyName("ifNoneMatch")]
+    public IList<string>? IfNoneMatch { get; set; }
 
-    /// <summary>Whether the tool executes commands in a terminal.</summary>
-    [JsonPropertyName("isTerminal")]
-    public bool IsTerminal { get; set; }
+    /// <summary>Path patterns covered by this rule.</summary>
+    [JsonPropertyName("paths")]
+    public IList<string> Paths { get => field ??= []; set; }
 
-    /// <summary>Stable name used to invoke the built-in tool.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Source descriptor for a `session.options.update` content-exclusion rule, with source name and type.</summary>
+    [JsonPropertyName("source")]
+    public OptionsUpdateAdditionalContentExclusionPolicyRuleSource Source { get => field ??= new(); set; }
+}
 
-    /// <summary>Policy describing which tool metadata may be recorded without obfuscation.</summary>
-    [JsonPropertyName("safeForTelemetry")]
-    public JsonElement SafeForTelemetry { get; set; }
+/// <summary>Content-exclusion policy supplied to `session.options.update`, with rules, last-updated data, and scope.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class OptionsUpdateAdditionalContentExclusionPolicy
+{
+    /// <summary>Opaque policy update timestamp supplied by the host.</summary>
+    [JsonPropertyName("last_updated_at")]
+    public JsonElement LastUpdatedAt { get; set; }
 
-    /// <summary>Optional human-readable title for the tool.</summary>
-    [JsonPropertyName("title")]
-    public string? Title { get; set; }
+    /// <summary>Content-exclusion rules to apply.</summary>
+    [JsonPropertyName("rules")]
+    public IList<OptionsUpdateAdditionalContentExclusionPolicyRule> Rules { get => field ??= []; set; }
 
-    /// <summary>Optional tool category discriminator.</summary>
-    [JsonPropertyName("type")]
-    public string? Type { get; set; }
+    /// <summary>Allowed values for the `OptionsUpdateAdditionalContentExclusionPolicyScope` enumeration.</summary>
+    [JsonPropertyName("scope")]
+    public OptionsUpdateAdditionalContentExclusionPolicyScope Scope { get; set; }
 }
 
-/// <summary>Rust-owned built-in tool descriptors for the session.</summary>
+/// <summary>Options scoped to the built-in CAPI (Copilot API) provider.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ToolsGetBuiltinDescriptorsResult
+public sealed class CapiSessionOptions
 {
-    /// <summary>Built-in tool descriptors materialized for the session.</summary>
-    [JsonPropertyName("tools")]
-    public IList<BuiltinToolDescriptor> Tools { get => field ??= []; set; }
+    /// <summary>Whether to use WebSocket transport for the CAPI Responses API. Enabled by default when the model advertises `ws:/responses` support; set to `false` to force the HTTP Responses transport in environments where WebSockets are blocked (e.g. behind a proxy). Setting this to `false` is equivalent to the `COPILOT_CLI_DISABLE_WEBSOCKET_RESPONSES` environment variable.</summary>
+    [JsonPropertyName("enableWebSocketResponses")]
+    public bool? EnableWebSocketResponses { get; set; }
 }
 
-/// <summary>Shell-specific names and description lines used to materialize built-in shell tool descriptors.</summary>
+/// <summary>Installed plugin record for a session, with marketplace, version, install time, enabled state, cache path, and source.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ToolsShellDescriptorConfig
+public sealed class SessionInstalledPlugin
 {
-    /// <summary>Additional model-facing shell description lines.</summary>
-    [JsonPropertyName("descriptionLines")]
-    public IList<string> DescriptionLines { get => field ??= []; set; }
+    /// <summary>Path where the plugin is cached locally.</summary>
+    [JsonPropertyName("cache_path")]
+    public string? CachePath { get; set; }
 
-    /// <summary>Human-readable shell name.</summary>
-    [JsonPropertyName("displayName")]
-    public string DisplayName { get; set; } = string.Empty;
+    /// <summary>Whether the plugin is currently enabled.</summary>
+    [JsonPropertyName("enabled")]
+    public bool Enabled { get; set; }
 
-    /// <summary>Tool name used to list active shells.</summary>
-    [JsonPropertyName("listShellsToolName")]
-    public string ListShellsToolName { get; set; } = string.Empty;
+    /// <summary>Installation timestamp (ISO-8601).</summary>
+    [JsonPropertyName("installed_at")]
+    public string InstalledAt { get; set; } = string.Empty;
 
-    /// <summary>Tool name used to read shell output.</summary>
-    [JsonPropertyName("readShellToolName")]
-    public string ReadShellToolName { get; set; } = string.Empty;
+    /// <summary>Marketplace the plugin came from (empty string for direct repo installs).</summary>
+    [JsonPropertyName("marketplace")]
+    public string Marketplace { get; set; } = string.Empty;
 
-    /// <summary>Tool name used to start shell commands.</summary>
-    [JsonPropertyName("shellToolName")]
-    public string ShellToolName { get; set; } = string.Empty;
+    /// <summary>Plugin name.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
-    /// <summary>Stable shell type identifier.</summary>
-    [JsonPropertyName("shellType")]
-    public string ShellType { get; set; } = string.Empty;
+    /// <summary>Source descriptor for direct repo installs (when marketplace is empty).</summary>
+    [JsonPropertyName("source")]
+    public JsonElement? Source { get; set; }
 
-    /// <summary>Tool name used to stop shell commands.</summary>
-    [JsonPropertyName("stopShellToolName")]
-    public string StopShellToolName { get; set; } = string.Empty;
+    /// <summary>Per-plugin source fingerprint (a SHA-256 hash of the plugin's catalog source spec plus its resolved source subtree — NOT a Git commit SHA) captured at marketplace install/update time. Auto-update compares it against the freshly recomputed fingerprint to detect a content change that does not bump the version. Absent for pre-existing installs and for direct (non-marketplace) installs.</summary>
+    [JsonPropertyName("source_sha")]
+    public string? SourceSha { get; set; }
+
+    /// <summary>Installed version, if known.</summary>
+    [JsonPropertyName("version")]
+    public string? Version { get; set; }
 }
 
-/// <summary>Options controlling how Rust-owned built-in tool descriptors are materialized.</summary>
+/// <summary>Custom model-provider configuration (BYOK).</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class ToolsGetBuiltinDescriptorsRequest
+public sealed class ProviderConfig
 {
-    /// <summary>Whether background task completion notifications are enabled.</summary>
-    [JsonPropertyName("backgroundTaskNotificationsEnabled")]
-    public bool? BackgroundTaskNotificationsEnabled { get; set; }
+    /// <summary>API key. Optional for local providers like Ollama.</summary>
+    [JsonPropertyName("apiKey")]
+    public string? ApiKey { get; set; }
 
-    /// <summary>Whether tool descriptors should include authoring metadata.</summary>
-    [JsonPropertyName("includeAuthor")]
-    public bool? IncludeAuthor { get; set; }
+    /// <summary>Azure-specific provider options.</summary>
+    [JsonPropertyName("azure")]
+    public ProviderConfigAzure? Azure { get; set; }
 
-    /// <summary>Whether line numbers should be omitted from the view tool descriptor.</summary>
-    [JsonPropertyName("noViewLineNumbers")]
-    public bool? NoViewLineNumbers { get; set; }
+    /// <summary>API endpoint URL.</summary>
+    [JsonPropertyName("baseUrl")]
+    public string BaseUrl { get; set; } = string.Empty;
 
-    /// <summary>Whether descriptors should favor fewer user-intervention prompts.</summary>
-    [JsonPropertyName("reduceUserIntervention")]
-    public bool? ReduceUserIntervention { get; set; }
+    /// <summary>Bearer token for authentication. Sets the Authorization header directly. Takes precedence over apiKey when both are set.</summary>
+    [JsonPropertyName("bearerToken")]
+    public string? BearerToken { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>When true, the SDK client supplies bearer tokens on demand: the runtime calls the client-session `providerToken.getToken` callback before each request and applies the returned token as an `Authorization: Bearer &lt;token&gt;` header. This is the bearer/OAuth scheme used by Azure AD / managed-identity tokens and provider OAuth access tokens (including Anthropic's), not a provider-specific API-key header such as Anthropic's `x-api-key`. The token-acquiring function itself stays on the SDK side and is never serialized; only this flag crosses the wire. When set alongside `apiKey`/`bearerToken`, the callback takes precedence: the runtime applies the token returned by `providerToken.getToken` as the `Authorization: Bearer` header for each request and does not send the static credential.</summary>
+    [JsonPropertyName("hasBearerTokenProvider")]
+    public bool? HasBearerTokenProvider { get; set; }
 
-    /// <summary>Whether shell commands may only run asynchronously.</summary>
-    [JsonPropertyName("shellAsyncOnlyEnabled")]
-    public bool? ShellAsyncOnlyEnabled { get; set; }
+    /// <summary>Custom HTTP headers to include in all outbound requests to the provider.</summary>
+    [JsonPropertyName("headers")]
+    public IDictionary<string, string>? Headers { get; set; }
 
-    /// <summary>Shell-specific names and description lines for shell tools.</summary>
-    [JsonPropertyName("shellConfig")]
-    public ToolsShellDescriptorConfig? ShellConfig { get; set; }
+    /// <summary>Maximum context window tokens for the model.</summary>
+    [JsonPropertyName("maxContextWindowTokens")]
+    public double? MaxContextWindowTokens { get; set; }
 
-    /// <summary>Whether the configured shell supports PowerShell 7 syntax.</summary>
-    [JsonPropertyName("shellSupportsPowerShell7Syntax")]
-    public bool? ShellSupportsPowerShell7Syntax { get; set; }
+    /// <summary>Maximum output tokens for the model.</summary>
+    [JsonPropertyName("maxOutputTokens")]
+    public double? MaxOutputTokens { get; set; }
 
-    /// <summary>Default shell timeout in milliseconds.</summary>
-    [JsonPropertyName("shellTimeoutMs")]
-    public double? ShellTimeoutMs { get; set; }
+    /// <summary>Maximum prompt/input tokens for the model.</summary>
+    [JsonPropertyName("maxPromptTokens")]
+    public double? MaxPromptTokens { get; set; }
 
-    /// <summary>Whether semantic skill lookup is available.</summary>
-    [JsonPropertyName("skillEmbeddingEnabled")]
-    public bool? SkillEmbeddingEnabled { get; set; }
-}
+    /// <summary>Overrides for model capabilities when they cannot be inferred from modelId.</summary>
+    [JsonPropertyName("modelCapabilities")]
+    public ModelCapabilitiesOverride? ModelCapabilities { get; set; }
 
-/// <summary>Task completion notification with summary from the agent.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class TaskCompleteData
-{
-    /// <summary>Active autopilot objective ID evaluated by the completion reviewer.</summary>
-    [JsonPropertyName("objectiveId")]
-    public long? ObjectiveId { get; set; }
+    /// <summary>Well-known model ID used for capability lookup. When set, agent behavior config and token limits are inferred from this model.</summary>
+    [JsonPropertyName("modelId")]
+    public string? ModelId { get; set; }
 
-    /// <summary>Semantic completion decision. Absent on legacy events and invalid tool calls.</summary>
-    [JsonPropertyName("outcome")]
-    public TaskCompletionOutcome? Outcome { get; set; }
+    /// <summary>Provider name used for model and telemetry attribution.</summary>
+    [JsonPropertyName("providerName")]
+    public string? ProviderName { get; set; }
 
-    /// <summary>Label-safe runtime rationale for the completion decision (e.g. a cancellation or pause/resume downgrade), when one applies. Reviewer-authored rationale is intentionally omitted here because this event has no IFC label channel; the reviewer's findings remain available through its own labeled sub-agent events.</summary>
-    [JsonPropertyName("reason")]
-    public string? Reason { get; set; }
+    /// <summary>Provider transport. Defaults to "http".</summary>
+    [JsonPropertyName("transport")]
+    public ProviderConfigTransport? Transport { get; set; }
 
-    /// <summary>Whether the task was accepted as complete. False when validation failed or completion was rejected or blocked by the reviewer.</summary>
-    [JsonPropertyName("success")]
-    public bool? Success { get; set; }
+    /// <summary>Provider type. Defaults to "openai" for generic OpenAI-compatible APIs.</summary>
+    [JsonPropertyName("type")]
+    public ProviderConfigType? Type { get; set; }
 
-    /// <summary>Summary of the completed task, provided by the agent.</summary>
-    [JsonPropertyName("summary")]
-    public string? Summary { get; set; }
-}
+    /// <summary>Wire API format (openai/azure only). Defaults to "completions".</summary>
+    [JsonPropertyName("wireApi")]
+    public ProviderConfigWireApi? WireApi { get; set; }
 
-/// <summary>Binary result returned by a tool for the model.</summary>
+    /// <summary>The model identifier sent to the provider API for inference (the "wire" model), as opposed to modelId which is the well-known base.</summary>
+    [JsonPropertyName("wireModel")]
+    public string? WireModel { get; set; }
+}
+
+/// <summary>Credential-injection capability flags applied while the sandbox is enabled. For the same capability independent of sandboxing, and matched to the credential's GitHub host, see `shell.credentials`; the two are additive.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ExternalToolTextResultForLlmBinaryResultsForLlm
+public sealed class SandboxConfigAuth
 {
-    /// <summary>Base64-encoded binary data.</summary>
-    [Base64String]
-    [JsonPropertyName("data")]
-    public string Data { get; set; } = string.Empty;
-
-    /// <summary>Human-readable description of the binary data.</summary>
-    [JsonPropertyName("description")]
-    public string? Description { get; set; }
-
-    /// <summary>Optional metadata from the producing tool.</summary>
-    [JsonPropertyName("metadata")]
-    public IDictionary<string, JsonElement>? Metadata { get; set; }
-
-    /// <summary>MIME type of the binary data.</summary>
-    [JsonPropertyName("mimeType")]
-    public string MimeType { get; set; } = string.Empty;
+    /// <summary>Whether to export `GH_TOKEN` so the `gh` CLI authenticates inside the sandbox without the OS keyring the sandbox blocks. Default: false (opt-in).</summary>
+    [JsonPropertyName("gh")]
+    public bool? Gh { get; set; }
 
-    /// <summary>Binary result type discriminator. Use "image" for images and "resource" for other binary data.</summary>
-    [JsonPropertyName("type")]
-    public ExternalToolTextResultForLlmBinaryResultsForLlmType Type { get; set; }
+    /// <summary>Whether to inject git credentials as an `http.&lt;url&gt;.extraheader` so authenticated HTTPS git works inside the sandbox without the shell-based credential helper the sandbox blocks. github.com is served by the Copilot token; every other forge (Azure DevOps, GitHub Enterprise Server, GitLab, ...) by a credential the host resolves from the user's own helper before the sandbox is applied. Default: false (opt-in).</summary>
+    [JsonPropertyName("git")]
+    public bool? Git { get; set; }
 }
 
-/// <summary>A content block within a tool result, which may be text, terminal output, image, audio, or a resource.</summary>
-/// <remarks>Polymorphic base type discriminated by <c>type</c>.</remarks>
+/// <summary>macOS seatbelt experimental options.</summary>
 [Experimental(Diagnostics.Experimental)]
-[JsonPolymorphic(
-    TypeDiscriminatorPropertyName = "type",
-    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
-[JsonDerivedType(typeof(ExternalToolTextResultForLlmContentText), "text")]
-[JsonDerivedType(typeof(ExternalToolTextResultForLlmContentTerminal), "terminal")]
-[JsonDerivedType(typeof(ExternalToolTextResultForLlmContentShellExit), "shell_exit")]
-[JsonDerivedType(typeof(ExternalToolTextResultForLlmContentImage), "image")]
-[JsonDerivedType(typeof(ExternalToolTextResultForLlmContentAudio), "audio")]
-[JsonDerivedType(typeof(ExternalToolTextResultForLlmContentResourceLink), "resource_link")]
-[JsonDerivedType(typeof(ExternalToolTextResultForLlmContentResource), "resource")]
-public partial class ExternalToolTextResultForLlmContent
+public sealed class SandboxConfigUserPolicyExperimentalSeatbelt
 {
-    /// <summary>The type discriminator.</summary>
-    [JsonPropertyName("type")]
-    public virtual string Type { get; set; } = string.Empty;
+    /// <summary>Whether the macOS seatbelt profile may access the keychain.</summary>
+    [JsonPropertyName("keychainAccess")]
+    public bool? KeychainAccess { get; set; }
 }
 
-
-/// <summary>Plain text content block.</summary>
-/// <remarks>The <c>text</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
+/// <summary>Platform-specific experimental policy fields.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class ExternalToolTextResultForLlmContentText : ExternalToolTextResultForLlmContent
+public sealed class SandboxConfigUserPolicyExperimental
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "text";
-
-    /// <summary>The text content.</summary>
-    [JsonPropertyName("text")]
-    public required string Text { get; set; }
+    /// <summary>macOS seatbelt experimental options.</summary>
+    [JsonPropertyName("seatbelt")]
+    public SandboxConfigUserPolicyExperimentalSeatbelt? Seatbelt { get; set; }
 }
 
-/// <summary>Terminal/shell output content block with optional exit code and working directory.</summary>
-/// <remarks>The <c>terminal</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
+/// <summary>Filesystem rules to merge into the base policy.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class ExternalToolTextResultForLlmContentTerminal : ExternalToolTextResultForLlmContent
+public sealed class SandboxConfigUserPolicyFilesystem
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "terminal";
+    /// <summary>Whether to clear the policy when the session exits.</summary>
+    [JsonPropertyName("clearPolicyOnExit")]
+    public bool? ClearPolicyOnExit { get; set; }
 
-    /// <summary>Working directory where the command was executed.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("cwd")]
-    public string? Cwd { get; set; }
+    /// <summary>Paths explicitly denied.</summary>
+    [JsonPropertyName("deniedPaths")]
+    public IList<string>? DeniedPaths { get; set; }
 
-    /// <summary>Process exit code, if the command has completed.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("exitCode")]
-    public long? ExitCode { get; set; }
+    /// <summary>Paths granted read-only access.</summary>
+    [JsonPropertyName("readonlyPaths")]
+    public IList<string>? ReadonlyPaths { get; set; }
 
-    /// <summary>Terminal/shell output text.</summary>
-    [JsonPropertyName("text")]
-    public required string Text { get; set; }
+    /// <summary>Paths granted read/write access.</summary>
+    [JsonPropertyName("readwritePaths")]
+    public IList<string>? ReadwritePaths { get; set; }
 }
 
-/// <summary>Shell command exit metadata with optional output preview.</summary>
-/// <remarks>The <c>shell_exit</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
+/// <summary>HTTP proxy configuration for sandboxed traffic.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class ExternalToolTextResultForLlmContentShellExit : ExternalToolTextResultForLlmContent
+public sealed class SandboxConfigUserPolicyNetworkProxy
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "shell_exit";
-
-    /// <summary>Working directory where the shell command was executed.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("cwd")]
-    public string? Cwd { get; set; }
-
-    /// <summary>Exit code from the completed shell command.</summary>
-    [JsonPropertyName("exitCode")]
-    public required long ExitCode { get; set; }
-
-    /// <summary>Output associated with this shell command, if available. May be partial, truncated, or a preview; not guaranteed to be full output.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("outputPreview")]
-    public string? OutputPreview { get; set; }
+    /// <summary>Optional password for proxy authentication, combined with the URL at spawn time. The persisted value may be a literal password, a `${secret:…}` reference resolved from the OS keychain, or a `${VAR}`/`$VAR` environment reference; it is resolved just before the sandboxed process routes through the proxy. The /sandbox dialog stores a real password in the OS keychain and persists only a `${secret:…}` placeholder (never plaintext in settings.json); the field is masked in the dialog and redacted by /settings show.</summary>
+    [JsonPropertyName("password")]
+    public string? Password { get; set; }
 
-    /// <summary>Whether outputPreview is known to be incomplete or truncated.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("outputTruncated")]
-    public bool? OutputTruncated { get; set; }
+    /// <summary>Proxy URL (e.g. http://proxy.example.com:8080). The port is optional and defaults to the scheme's standard port when omitted. Credentials must not be embedded here — a `user:pass@` authority is rejected; put them in the separate `username`/`password` fields. A credential-free http:// loopback URL is routed through the localhost proxy automatically; loopback covers localhost and any *.localhost subdomain, the whole 127.0.0.0/8 range, ::1, and IPv4-mapped loopback (::ffff:127.0.0.1). An https:// URL, or one with a username/password set, is used as-is.</summary>
+    [JsonPropertyName("url")]
+    public string Url { get; set; } = string.Empty;
 
-    /// <summary>Shell id, as assigned by Copilot runtime.</summary>
-    [JsonPropertyName("shellId")]
-    public required string ShellId { get; set; }
+    /// <summary>Optional username for proxy authentication. Combined with the URL (and `password`) into `user:pass@host` when the sandboxed process routes through the proxy.</summary>
+    [JsonPropertyName("username")]
+    public string? Username { get; set; }
 }
 
-/// <summary>Image content block with base64-encoded data.</summary>
-/// <remarks>The <c>image</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
+/// <summary>Network rules to merge into the base policy.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class ExternalToolTextResultForLlmContentImage : ExternalToolTextResultForLlmContent
+public sealed class SandboxConfigUserPolicyNetwork
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "image";
+    /// <summary>Whether traffic to local/loopback addresses is allowed.</summary>
+    [JsonPropertyName("allowLocalNetwork")]
+    public bool? AllowLocalNetwork { get; set; }
 
-    /// <summary>Base64-encoded image data.</summary>
-    [Base64String]
-    [JsonPropertyName("data")]
-    public required string Data { get; set; }
+    /// <summary>Whether outbound network traffic is allowed at all.</summary>
+    [JsonPropertyName("allowOutbound")]
+    public bool? AllowOutbound { get; set; }
 
-    /// <summary>MIME type of the image (e.g., image/png, image/jpeg).</summary>
-    [JsonPropertyName("mimeType")]
-    public required string MimeType { get; set; }
+    /// <summary>HTTP proxy the sandboxed process routes traffic through. Enforced on Windows and cooperative (honored by well-behaved tools, not strictly enforced) on Linux and macOS. Credentials go in the separate `username`/`password` fields. A credential-free http:// loopback proxy URL is routed through the localhost proxy automatically; an https:// or authenticated loopback URL is used as-is.</summary>
+    [JsonPropertyName("proxy")]
+    public SandboxConfigUserPolicyNetworkProxy? Proxy { get; set; }
 }
 
-/// <summary>Audio content block with base64-encoded data.</summary>
-/// <remarks>The <c>audio</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
+/// <summary>macOS seatbelt-specific options.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class ExternalToolTextResultForLlmContentAudio : ExternalToolTextResultForLlmContent
+public sealed class SandboxConfigUserPolicySeatbelt
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "audio";
-
-    /// <summary>Base64-encoded audio data.</summary>
-    [Base64String]
-    [JsonPropertyName("data")]
-    public required string Data { get; set; }
-
-    /// <summary>MIME type of the audio (e.g., audio/wav, audio/mpeg).</summary>
-    [JsonPropertyName("mimeType")]
-    public required string MimeType { get; set; }
+    /// <summary>Whether the macOS seatbelt profile may access the keychain.</summary>
+    [JsonPropertyName("keychainAccess")]
+    public bool? KeychainAccess { get; set; }
 }
 
-/// <summary>Icon image for a resource.</summary>
+/// <summary>User-managed sandbox policy fragment merged into the auto-discovered base policy.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ExternalToolTextResultForLlmContentResourceLinkIcon
+public sealed class SandboxConfigUserPolicy
 {
-    /// <summary>MIME type of the icon image.</summary>
-    [JsonPropertyName("mimeType")]
-    public string? MimeType { get; set; }
+    /// <summary>Deprecated legacy location for `seatbelt`; read only when the top-level `seatbelt` is absent.</summary>
+    [JsonPropertyName("experimental")]
+    public SandboxConfigUserPolicyExperimental? Experimental { get; set; }
 
-    /// <summary>Available icon sizes (e.g., ['16x16', '32x32']).</summary>
-    [JsonPropertyName("sizes")]
-    public IList<string>? Sizes { get; set; }
+    /// <summary>Filesystem rules to merge into the base policy.</summary>
+    [JsonPropertyName("filesystem")]
+    public SandboxConfigUserPolicyFilesystem? Filesystem { get; set; }
 
-    /// <summary>URL or path to the icon image.</summary>
-    [JsonPropertyName("src")]
-    public string Src { get; set; } = string.Empty;
+    /// <summary>Network rules to merge into the base policy.</summary>
+    [JsonPropertyName("network")]
+    public SandboxConfigUserPolicyNetwork? Network { get; set; }
 
-    /// <summary>Theme variant this icon is intended for.</summary>
-    [JsonPropertyName("theme")]
-    public ExternalToolTextResultForLlmContentResourceLinkIconTheme? Theme { get; set; }
+    /// <summary>macOS seatbelt options to merge into the base policy.</summary>
+    [JsonPropertyName("seatbelt")]
+    public SandboxConfigUserPolicySeatbelt? Seatbelt { get; set; }
 }
 
-/// <summary>Resource link content block referencing an external resource.</summary>
-/// <remarks>The <c>resource_link</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
+/// <summary>Resolved sandbox configuration.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class ExternalToolTextResultForLlmContentResourceLink : ExternalToolTextResultForLlmContent
+public sealed class SandboxConfig
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "resource_link";
-
-    /// <summary>Human-readable description of the resource.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("description")]
-    public string? Description { get; set; }
+    /// <summary>Whether to auto-add the current working directory to readwritePaths. Default: true.</summary>
+    [JsonPropertyName("addCurrentWorkingDirectory")]
+    public bool? AddCurrentWorkingDirectory { get; set; }
 
-    /// <summary>Icons associated with this resource.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("icons")]
-    public IList<ExternalToolTextResultForLlmContentResourceLinkIcon>? Icons { get; set; }
+    /// <summary>Whether to auto-grant read access to the tool directories discovered on PATH and in toolchain environment variables (GOROOT, CARGO_HOME, JAVA_HOME, VIRTUAL_ENV, and similar), and to common developer-tool caches, registries, and toolchains in their default home locations (cargo, go, npm, Maven, and more), plus read-write access to (and, on Unix, up-front creation of) the scratch caches builds write on every run (go-build, ccache, sccache, Gradle caches, Cargo lock/tracker files), so builds work without extra configuration; a relocated CARGO_HOME additionally gets its Cargo lock files granted read-write. Set to false to disable every grant listed above: user-installed toolchains (rustup, nvm, pyenv, conda, pipx) then need explicit userPolicy.filesystem entries — readonlyPaths to read them, plus readwriteFiles for a relocated CARGO_HOME's .package-cache and .global-cache, which Cargo locks on every build. Only these developer-tool grants are affected: the working directory (see addCurrentWorkingDirectory), temporary storage, session log paths, and system locations follow their own rules and stay granted, so commands still run. Default: true (enabled by default; set to false to opt out).</summary>
+    [JsonPropertyName("allowDevToolAccess")]
+    public bool? AllowDevToolAccess { get; set; }
 
-    /// <summary>MIME type of the resource content.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("mimeType")]
-    public string? MimeType { get; set; }
+    /// <summary>Credential-injection capability flags.</summary>
+    [JsonPropertyName("auth")]
+    public SandboxConfigAuth? Auth { get; set; }
 
-    /// <summary>Resource name identifier.</summary>
-    [JsonPropertyName("name")]
-    public required string Name { get; set; }
+    /// <summary>Whether sandboxing is enabled for the session.</summary>
+    [JsonPropertyName("enabled")]
+    public bool Enabled { get; set; }
 
-    /// <summary>Size of the resource in bytes.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("size")]
-    public long? Size { get; set; }
+    /// <summary>User-managed sandbox policy fragment merged into the auto-discovered base policy.</summary>
+    [JsonPropertyName("userPolicy")]
+    public SandboxConfigUserPolicy? UserPolicy { get; set; }
+}
 
-    /// <summary>Human-readable display title for the resource.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("title")]
-    public string? Title { get; set; }
-
-    /// <summary>URI identifying the resource.</summary>
-    [JsonPropertyName("uri")]
-    public required string Uri { get; set; }
-}
-
-/// <summary>Embedded resource content block with inline text or binary data.</summary>
-/// <remarks>The <c>resource</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
+/// <summary>
+/// Command-scoped GitHub credential injection for the shell commands an agent runs.
+/// 
+/// Each channel is opt-in and independent, and injection is scoped to the individual command
+/// spawn: the credential is resolved from the session's *current* authentication at every spawn
+/// and reaches only spawns whose script actually invokes `git` or `gh`. Because nothing is
+/// retained between spawns, replacing the session credential (`session.gitHubAuth.setCredentials`)
+/// changes what the next spawned command presents — which seeding a credential into the runtime
+/// process's own environment cannot do, since a child's environment is fixed at `exec`.
+/// 
+/// The credential is matched to the host it authenticates to, so a github.com credential is never
+/// presented to a GitHub Enterprise host and vice versa. Where a channel cannot express that
+/// boundary it injects nothing rather than crossing it -- see `gh` below.
+/// 
+/// This is independent of `sandboxConfig`: it is a decision about which identity the agent
+/// presents, not about what the agent may touch, and it works on every platform whether or not
+/// an OS sandboxing backend is available. `sandboxConfig.auth` remains the sandbox-scoped
+/// spelling and is additive with this one.
+/// </summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class ExternalToolTextResultForLlmContentResource : ExternalToolTextResultForLlmContent
+public sealed class ShellCredentials
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Type => "resource";
+    /// <summary>
+    /// Whether to authenticate the agent's `gh` commands as the session's GitHub credential, by
+    /// exporting `GH_TOKEN` to a spawn that runs `gh`. Any inherited `gh` credential is removed from
+    /// spawns that do not, so the credential stays command-scoped.
+    /// 
+    /// Applies to a github.com credential only. `gh` picks its credential variable from the host a
+    /// command targets rather than the one the credential belongs to, and the command can choose that
+    /// target, so `GH_ENTERPRISE_TOKEN` would offer a single-tenant enterprise credential to every
+    /// other enterprise host. A session whose credential is enterprise-scoped therefore runs `gh`
+    /// unauthenticated; its `git` commands are unaffected, because `http.&lt;host&gt;.extraheader` is scoped
+    /// to one host by construction. Default: false (opt-in).
+    /// </summary>
+    [JsonPropertyName("gh")]
+    public bool? Gh { get; set; }
 
-    /// <summary>The embedded resource contents, either text or base64-encoded binary.</summary>
-    [JsonPropertyName("resource")]
-    public required JsonElement Resource { get; set; }
+    /// <summary>
+    /// Whether to authenticate the agent's `git` commands as the session's GitHub credential, by
+    /// injecting an `http.&lt;host&gt;.extraheader` (plus `insteadOf` rewrites so SSH-spelled remotes for
+    /// that host use the authenticated HTTPS transport). Applied only to a spawn that runs a
+    /// remote-contacting `git` subcommand. Default: false (opt-in).
+    /// </summary>
+    [JsonPropertyName("git")]
+    public bool? Git { get; set; }
 }
 
-/// <summary>A message injected by a tool result.</summary>
+/// <summary>A host-provided script sourced before each built-in shell command when its shell target matches the active shell.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ToolResultNewMessage
+public sealed class ShellInitScript
 {
-    /// <summary>Message content to inject after the tool result.</summary>
-    [JsonPropertyName("content")]
-    public string Content { get; set; } = string.Empty;
+    /// <summary>Path to the script to source.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
 
-    /// <summary>Source attributed to the injected message.</summary>
-    [JsonPropertyName("source")]
-    public string Source { get; set; } = string.Empty;
+    /// <summary>Built-in shell that may source this script.</summary>
+    [JsonPropertyName("shell")]
+    public ShellInitScriptShell Shell { get; set; }
 }
 
-/// <summary>RPC data type for TaskCompletionDecision operations.</summary>
+/// <summary>Per-session settings for built-in shell tools.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class TaskCompletionDecision
+public sealed class ShellOptions
 {
-    /// <summary>Objective eligibility token captured when the decision was evaluated.</summary>
-    [JsonPropertyName("completionEligibilityToken")]
-    public long? CompletionEligibilityToken { get; set; }
-
-    /// <summary>Whether completion was accepted after the reviewer-rejection budget was exhausted.</summary>
-    [JsonPropertyName("completionRejectionBudgetExhausted")]
-    public bool? CompletionRejectionBudgetExhausted { get; set; }
-
-    /// <summary>Active autopilot objective evaluated by the completion reviewer.</summary>
-    [JsonPropertyName("objectiveId")]
-    public long? ObjectiveId { get; set; }
-
-    /// <summary>Semantic result of evaluating the task completion request.</summary>
-    [JsonPropertyName("outcome")]
-    public TaskCompletionOutcome Outcome { get; set; }
+    /// <summary>Command-scoped GitHub credential injection for shell commands.</summary>
+    [JsonPropertyName("credentials")]
+    public ShellCredentials? Credentials { get; set; }
 
-    /// <summary>Rationale for the completion decision, when one is available.</summary>
-    [JsonPropertyName("reason")]
-    public string? Reason { get; set; }
+    /// <summary>Controls automatic non-interactive profile loading where supported. Explicit initScripts are unaffected.</summary>
+    [JsonPropertyName("initProfile")]
+    public ShellInitProfile? InitProfile { get; set; }
 
-    /// <summary>Whether the rationale was derived from completion-reviewer output.</summary>
-    [JsonPropertyName("reviewerDerived")]
-    public bool? ReviewerDerived { get; set; }
+    /// <summary>
+    /// Ordered host-provided script paths sourced before each built-in shell command when the
+    /// entry's shell target matches the active shell. Use these for rc files, environment setup scripts,
+    /// or other custom scripts. A script that returns a nonzero status is reported, and later scripts
+    /// and the user command continue while the shell remains running. Because scripts are sourced into
+    /// the command shell, `exit`, `exec`, failures under `set -e`, or other shell-terminating behavior
+    /// can prevent continuation. Script standard output is preserved; Bash script stderr is discarded,
+    /// PowerShell exception messages are replaced, and runtime-generated failure notices omit
+    /// configured script paths. When sandboxing is enabled, each script must already be readable under
+    /// the active sandbox filesystem policy. Pass an empty array to clear the list.
+    /// </summary>
+    [JsonPropertyName("initScripts")]
+    public IList<ShellInitScript>? InitScripts { get; set; }
 
-    /// <summary>Information-flow metadata captured from the completion reviewer.</summary>
-    [JsonPropertyName("reviewerResultMeta")]
-    public JsonElement? ReviewerResultMeta { get; set; }
+    /// <summary>
+    /// Flags passed to the active built-in shell process on startup, replacing its default flags.
+    /// When omitted, the built-in Bash shell uses `--norc --noprofile`,
+    /// and the built-in PowerShell shell uses `-NoProfile -NoLogo`.
+    /// </summary>
+    [JsonPropertyName("processFlags")]
+    public IList<string>? ProcessFlags { get; set; }
 }
 
-/// <summary>Expanded canonical result returned by a session tool.</summary>
+/// <summary>Patch of mutable session options to apply to the running session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ToolResultExpanded
+internal sealed class SessionUpdateOptionsParams
 {
-    /// <summary>Base64-encoded binary results returned to the model.</summary>
-    [JsonPropertyName("binaryResultsForLlm")]
-    public IList<ExternalToolTextResultForLlmBinaryResultsForLlm>? BinaryResultsForLlm { get; set; }
+    /// <summary>Additional content-exclusion policies to merge into the session's policy set.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonPropertyName("additionalContentExclusionPolicies")]
+    public IList<OptionsUpdateAdditionalContentExclusionPolicy>? AdditionalContentExclusionPolicies { get; set; }
 
-    /// <summary>Sources returned by the tool that the model may cite.</summary>
-    [JsonPropertyName("citableSources")]
-    public IList<JsonElement>? CitableSources { get; set; }
+    /// <summary>Runtime context discriminator (e.g., `cli`, `actions`).</summary>
+    [JsonPropertyName("agentContext")]
+    public string? AgentContext { get; set; }
 
-    /// <summary>Structured content blocks returned to the model.</summary>
-    [JsonPropertyName("contents")]
-    public IList<ExternalToolTextResultForLlmContent>? Contents { get; set; }
+    /// <summary>Whether to include instructions from every MCP server in the system prompt instead of only allowlisted servers.</summary>
+    [JsonPropertyName("allowAllMcpServerInstructions")]
+    public bool? AllowAllMcpServerInstructions { get; set; }
 
-    /// <summary>Error message for an unsuccessful execution.</summary>
-    [JsonPropertyName("error")]
-    public string? Error { get; set; }
+    /// <summary>Whether to disable the `ask_user` tool (encourages autonomous behavior).</summary>
+    [JsonPropertyName("askUserDisabled")]
+    public bool? AskUserDisabled { get; set; }
 
-    /// <summary>Metadata propagated with the tool result, including information-flow labels.</summary>
-    [JsonPropertyName("mcpMeta")]
-    public IDictionary<string, JsonElement>? McpMeta { get; set; }
+    /// <summary>Allowlist of tool names available to this session.</summary>
+    [JsonPropertyName("availableTools")]
+    public IList<string>? AvailableTools { get; set; }
 
-    /// <summary>Messages to inject after the tool result.</summary>
-    [JsonPropertyName("newMessages")]
-    public IList<ToolResultNewMessage>? NewMessages { get; set; }
+    /// <summary>Options scoped to the built-in CAPI (Copilot API) provider.</summary>
+    [JsonPropertyName("capi")]
+    public CapiSessionOptions? Capi { get; set; }
 
-    /// <summary>Whether post-tool-use failure hooks have already processed this result.</summary>
-    [JsonPropertyName("postToolUseFailureHooksProcessed")]
-    public bool? PostToolUseFailureHooksProcessed { get; set; }
+    /// <summary>Identifier of the client driving the session.</summary>
+    [JsonPropertyName("clientName")]
+    public string? ClientName { get; set; }
 
-    /// <summary>Execution outcome classification.</summary>
-    [JsonPropertyName("resultType")]
-    public ToolResultType ResultType { get; set; }
+    /// <summary>Whether to include the `Co-authored-by` trailer in commit messages.</summary>
+    [JsonPropertyName("coauthorEnabled")]
+    public bool? CoauthorEnabled { get; set; }
 
-    /// <summary>Detailed log content available for session display.</summary>
-    [JsonPropertyName("sessionLog")]
-    public string? SessionLog { get; set; }
+    /// <summary>Context tier for models with tiered pricing. The session uses this to derive effective `modelCapabilitiesOverrides` so compaction, truncation, token display, and request limits honor the selected tier.</summary>
+    [JsonPropertyName("contextTier")]
+    public OptionsUpdateContextTier? ContextTier { get; set; }
 
-    /// <summary>Skill invocation metadata produced by the tool.</summary>
-    [JsonPropertyName("skillInvocation")]
-    public JsonElement? SkillInvocation { get; set; }
+    /// <summary>Whether to allow auto-mode continuation across turns.</summary>
+    [JsonPropertyName("continueOnAutoMode")]
+    public bool? ContinueOnAutoMode { get; set; }
 
-    /// <summary>Whether large-output post-processing should be skipped.</summary>
-    [JsonPropertyName("skipLargeOutputProcessing")]
-    public bool? SkipLargeOutputProcessing { get; set; }
+    /// <summary>Override URL for the Copilot API endpoint.</summary>
+    [JsonPropertyName("copilotUrl")]
+    public string? CopilotUrl { get; set; }
 
-    /// <summary>Structured result content in addition to the model-facing text.</summary>
-    [JsonPropertyName("structuredContent")]
-    public JsonElement? StructuredContent { get; set; }
+    /// <summary>Whether to default custom agents to local-only execution.</summary>
+    [JsonPropertyName("customAgentsLocalOnly")]
+    public bool? CustomAgentsLocalOnly { get; set; }
 
-    /// <summary>Completion-review decision produced by the task-completion tool.</summary>
-    [JsonPropertyName("taskCompletionDecision")]
-    public TaskCompletionDecision? TaskCompletionDecision { get; set; }
+    /// <summary>Instruction source IDs to exclude from the system prompt.</summary>
+    [JsonPropertyName("disabledInstructionSources")]
+    public IList<string>? DisabledInstructionSources { get; set; }
 
-    /// <summary>Text result returned to the model.</summary>
-    [JsonPropertyName("textResultForLlm")]
-    public string TextResultForLlm { get; set; } = string.Empty;
+    /// <summary>Skill IDs that should be excluded from this session.</summary>
+    [JsonPropertyName("disabledSkills")]
+    public IList<string>? DisabledSkills { get; set; }
 
-    /// <summary>Deferred tool names made available by this result.</summary>
-    [JsonPropertyName("toolReferences")]
-    public IList<string>? ToolReferences { get; set; }
+    /// <summary>Whether to enable loading of `.github/hooks/` filesystem hooks. Separate from the SDK callback hook mechanism.</summary>
+    [JsonPropertyName("enableFileHooks")]
+    public bool? EnableFileHooks { get; set; }
 
-    /// <summary>Tool-specific telemetry payload.</summary>
-    [JsonPropertyName("toolTelemetry")]
-    public JsonElement? ToolTelemetry { get; set; }
+    /// <summary>Whether to enable host git operations (context resolution, child repo scanning, git info in system prompt).</summary>
+    [JsonPropertyName("enableHostGitOperations")]
+    public bool? EnableHostGitOperations { get; set; }
 
-    /// <summary>Optional UI resource produced by the tool.</summary>
-    [JsonPropertyName("uiResource")]
-    public JsonElement? UiResource { get; set; }
-}
+    /// <summary>Whether to discover custom instructions on demand after successful file views (AGENTS.md / CLAUDE.md / .github/copilot-instructions.md surfacing). Combined with `skipCustomInstructions`.</summary>
+    [JsonPropertyName("enableOnDemandInstructionDiscovery")]
+    public bool? EnableOnDemandInstructionDiscovery { get; set; }
 
-/// <summary>Task-completion tool arguments and final result used to build a label-safe session event payload.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class ToolsTaskCompleteEventDataRequest
-{
-    /// <summary>Final expanded result returned by the task_complete tool.</summary>
-    [JsonPropertyName("finalResult")]
-    public ToolResultExpanded FinalResult { get => field ??= new(); set; }
+    /// <summary>Whether to surface reasoning-summary events from the model.</summary>
+    [JsonPropertyName("enableReasoningSummaries")]
+    public bool? EnableReasoningSummaries { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Whether shell-script safety heuristics are enabled.</summary>
+    [JsonPropertyName("enableScriptSafety")]
+    public bool? EnableScriptSafety { get; set; }
 
-    /// <summary>Arguments supplied to the completed task_complete tool call.</summary>
-    [JsonPropertyName("toolArgs")]
-    public JsonElement ToolArgs { get; set; }
-}
+    /// <summary>Whether to enable cross-session store writes and reads.</summary>
+    [JsonPropertyName("enableSessionStore")]
+    public bool? EnableSessionStore { get; set; }
 
-/// <summary>Indicates whether the external tool call result was handled successfully.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class HandlePendingToolCallResult
-{
-    /// <summary>Whether the tool call result was handled successfully.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
-}
+    /// <summary>Whether to enable skill directory scanning and loading. Falls back to enableConfigDiscovery when unset.</summary>
+    [JsonPropertyName("enableSkills")]
+    public bool? EnableSkills { get; set; }
 
-/// <summary>Pending external tool call request ID, with the tool result or an error describing why it failed.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class HandlePendingToolCallRequest
-{
-    /// <summary>Error message if the tool call failed.</summary>
-    [JsonPropertyName("error")]
-    public string? Error { get; set; }
+    /// <summary>Whether to stream model responses.</summary>
+    [JsonPropertyName("enableStreaming")]
+    public bool? EnableStreaming { get; set; }
 
-    /// <summary>Request ID of the pending tool call.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
+    /// <summary>How env values are passed to MCP servers (`direct` inlines literal values; `indirect` resolves at launch).</summary>
+    [JsonPropertyName("envValueMode")]
+    public OptionsUpdateEnvValueMode? EnvValueMode { get; set; }
 
-    /// <summary>Tool call result (string or expanded result object).</summary>
-    [JsonPropertyName("result")]
-    public JsonElement? Result { get; set; }
+    /// <summary>Override directory for the session-events log. When unset, the runtime's default events log directory is used.</summary>
+    [JsonPropertyName("eventsLogDirectory")]
+    public string? EventsLogDirectory { get; set; }
+
+    /// <summary>Whether subagent callback events should be forwarded into the session event log sink.</summary>
+    [JsonPropertyName("eventsLogIncludesSubagents")]
+    public bool? EventsLogIncludesSubagents { get; set; }
+
+    /// <summary>Built-in subagent names to exclude from this session. Excluded built-ins are hidden from agent discovery and cannot be dispatched unless a custom agent with the same name is available.</summary>
+    [JsonPropertyName("excludedBuiltinAgents")]
+    public IList<string>? ExcludedBuiltinAgents { get; set; }
+
+    /// <summary>Denylist of tool names for this session.</summary>
+    [JsonPropertyName("excludedTools")]
+    public IList<string>? ExcludedTools { get; set; }
+
+    /// <summary>Map of feature-flag IDs to their boolean enabled state.</summary>
+    [JsonPropertyName("featureFlags")]
+    public IDictionary<string, bool>? FeatureFlags { get; set; }
+
+    /// <summary>Built-in subagent names to include in this session. When specified, only these built-ins are available, subject to runtime availability and exclusions. Custom agents with the same name remain available. Set to null to remove the allowlist restriction.</summary>
+    [JsonPropertyName("includedBuiltinAgents")]
+    public IList<string>? IncludedBuiltinAgents { get; set; }
+
+    /// <summary>Full set of installed plugins for the session. Replaces the existing list; the runtime invalidates the skills cache only when the list materially changes.</summary>
+    [JsonPropertyName("installedPlugins")]
+    public IList<SessionInstalledPlugin>? InstalledPlugins { get; set; }
+
+    /// <summary>Stable integration identifier used for analytics and rate-limit attribution.</summary>
+    [JsonPropertyName("integrationId")]
+    public string? IntegrationId { get; set; }
+
+    /// <summary>Whether experimental capabilities are enabled.</summary>
+    [JsonPropertyName("isExperimentalMode")]
+    public bool? IsExperimentalMode { get; set; }
+
+    /// <summary>Whether interactive shell sessions are logged.</summary>
+    [JsonPropertyName("logInteractiveShells")]
+    public bool? LogInteractiveShells { get; set; }
+
+    /// <summary>Identifier sent to LSP-style integrations.</summary>
+    [JsonPropertyName("lspClientName")]
+    public string? LspClientName { get; set; }
+
+    /// <summary>Whether to expose the `manage_schedule` tool to the agent. The runtime always owns the per-session schedule registry; this flag only controls tool exposure (typically gated to staff users).</summary>
+    [JsonPropertyName("manageScheduleEnabled")]
+    public bool? ManageScheduleEnabled { get; set; }
+
+    /// <summary>Maximum decoded byte size of a single model-facing binary tool result (e.g. an image) persisted inline in session events and re-presented to the model on later turns / resume. Larger results are persisted as a metadata-only marker and shown to the model as a short text note. Defaults to 10 MB.</summary>
+    [JsonPropertyName("maxInlineBinaryBytes")]
+    public long? MaxInlineBinaryBytes { get; set; }
+
+    /// <summary>The model ID to use for assistant turns.</summary>
+    [JsonPropertyName("model")]
+    public string? Model { get; set; }
+
+    /// <summary>Per-property model capability overrides for the selected model.</summary>
+    [JsonPropertyName("modelCapabilitiesOverrides")]
+    public ModelCapabilitiesOverride? ModelCapabilitiesOverrides { get; set; }
+
+    /// <summary>Organization-level custom instructions to inject into the system prompt.</summary>
+    [JsonPropertyName("organizationCustomInstructions")]
+    public string? OrganizationCustomInstructions { get; set; }
+
+    /// <summary>Custom model-provider configuration (BYOK).</summary>
+    [JsonPropertyName("provider")]
+    public ProviderConfig? Provider { get; set; }
+
+    /// <summary>Reasoning effort for the selected model. CAPI values are model-defined and validated against the selected model; BYOK providers may define additional values. When omitted, no effort override is applied.</summary>
+    [JsonPropertyName("reasoningEffort")]
+    public string? ReasoningEffort { get; set; }
+
+    /// <summary>Reasoning summary mode for supported model clients.</summary>
+    [JsonPropertyName("reasoningSummary")]
+    public OptionsUpdateReasoningSummary? ReasoningSummary { get; set; }
+
+    /// <summary>Whether the session is running in an interactive UI.</summary>
+    [JsonPropertyName("runningInInteractiveMode")]
+    public bool? RunningInInteractiveMode { get; set; }
+
+    /// <summary>Resolved sandbox configuration.</summary>
+    [JsonPropertyName("sandboxConfig")]
+    public SandboxConfig? SandboxConfig { get; set; }
+
+    /// <summary>Replaces the session's capability set with the given list. Use to enable or disable capabilities mid-session (e.g., remove `memory` for reproducible scripted runs). Omit the field to leave the existing capability set unchanged.</summary>
+    [JsonPropertyName("sessionCapabilities")]
+    public IList<SessionCapability>? SessionCapabilities { get; set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
-}
 
-/// <summary>Resolve, build, and validate the runtime tool list for this session. Subagent sessions and consumer flows that need an initialized tool set before `send` invoke this. Default base-class implementation is a no-op for sessions that don't support tool validation.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class ToolsInitializeAndValidateResult
-{
+    /// <summary>Optional session limits. Pass null to clear the session limits.</summary>
+    [JsonPropertyName("sessionLimits")]
+    public SessionLimitsConfig? SessionLimits { get; set; }
+
+    /// <summary>Per-session settings for built-in shell tools.</summary>
+    [JsonPropertyName("shell")]
+    public ShellOptions? Shell { get; set; }
+
+    /// <summary>Use shell.initProfile instead. Shell init profile (`None` or `NonInteractive`).</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+#if NET5_0_OR_GREATER
+    [Obsolete("This member is deprecated and will be removed in a future version.", DiagnosticId = "GHCP001")]
+#endif
+    [JsonPropertyName("shellInitProfile")]
+    public string? ShellInitProfile { get; set; }
+
+    /// <summary>PowerShell process flags applied to built-in and user-requested shell commands.</summary>
+    [JsonPropertyName("shellProcessFlags")]
+    public IList<string>? ShellProcessFlags { get; set; }
+
+    /// <summary>Additional directories to search for skills.</summary>
+    [JsonPropertyName("skillDirectories")]
+    public IList<string>? SkillDirectories { get; set; }
+
+    /// <summary>Whether to skip loading custom instruction sources.</summary>
+    [JsonPropertyName("skipCustomInstructions")]
+    public bool? SkipCustomInstructions { get; set; }
+
+    /// <summary>Whether to skip embedding retrieval pipeline initialization and execution.</summary>
+    [JsonPropertyName("skipEmbeddingRetrieval")]
+    public bool? SkipEmbeddingRetrieval { get; set; }
+
+    /// <summary>When true, the selected custom agent's prompt is not injected into the user message (skill context is still injected). Used by automation triggers where the agent prompt is already in the problem statement.</summary>
+    [JsonPropertyName("suppressCustomAgentPrompt")]
+    public bool? SuppressCustomAgentPrompt { get; set; }
+
+    /// <summary>Controls how availableTools (allowlist) and excludedTools (denylist) combine when both are set.</summary>
+    [JsonPropertyName("toolFilterPrecedence")]
+    public OptionsUpdateToolFilterPrecedence? ToolFilterPrecedence { get; set; }
+
+    /// <summary>Optional path for trajectory output.</summary>
+    [JsonPropertyName("trajectoryFile")]
+    public string? TrajectoryFile { get; set; }
+
+    /// <summary>Output verbosity level for supported models.</summary>
+    [JsonPropertyName("verbosity")]
+    public Verbosity? Verbosity { get; set; }
+
+    /// <summary>Absolute working-directory path for shell tools.</summary>
+    [JsonPropertyName("workingDirectory")]
+    public string? WorkingDirectory { get; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Parameters for (re)loading the merged LSP configuration set.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionToolsInitializeAndValidateRequest
+internal sealed class LspInitializeRequest
 {
+    /// <summary>Force re-initialization even when LSP configs were already loaded for the working directory.</summary>
+    [JsonPropertyName("force")]
+    public bool? Force { get; set; }
+
+    /// <summary>Git root used as the boundary when traversing for project-level LSP configs (supports monorepos).</summary>
+    [JsonPropertyName("gitRoot")]
+    public string? GitRoot { get; set; }
+
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Working directory used to load project-level LSP configs. Defaults to the session working directory when omitted.</summary>
+    [JsonPropertyName("workingDirectory")]
+    public string? WorkingDirectory { get; set; }
 }
 
-/// <summary>Lightweight metadata for a currently initialized session tool.</summary>
+/// <summary>Discovered extension metadata, including source-qualified ID, name, discovery source, status, and optional process ID.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class CurrentToolMetadata
+public sealed class Extension
 {
-    /// <summary>Whether the tool is loaded on demand via tool search.</summary>
-    [JsonPropertyName("deferLoading")]
-    public bool? DeferLoading { get; set; }
-
-    /// <summary>Tool description.</summary>
-    [JsonPropertyName("description")]
-    public string Description { get; set; } = string.Empty;
-
-    /// <summary>JSON Schema for tool input.</summary>
-    [JsonPropertyName("input_schema")]
-    public IDictionary<string, JsonElement>? InputSchema { get; set; }
-
-    /// <summary>MCP server name for MCP-backed tools.</summary>
-    [JsonPropertyName("mcpServerName")]
-    public string? McpServerName { get; set; }
-
-    /// <summary>Raw MCP tool name for MCP-backed tools.</summary>
-    [JsonPropertyName("mcpToolName")]
-    public string? McpToolName { get; set; }
+    /// <summary>Source-qualified ID (e.g., 'project:my-ext', 'user:auth-helper', 'plugin:my-plugin:my-ext').</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
 
-    /// <summary>Model-facing tool name.</summary>
+    /// <summary>Extension name (directory name).</summary>
     [JsonPropertyName("name")]
     public string Name { get; set; } = string.Empty;
 
-    /// <summary>Optional MCP/config namespaced tool name.</summary>
-    [JsonPropertyName("namespacedName")]
-    public string? NamespacedName { get; set; }
+    /// <summary>Process ID if the extension is running.</summary>
+    [JsonPropertyName("pid")]
+    public long? Pid { get; set; }
+
+    /// <summary>Discovery source: project (.github/extensions/), user (~/.copilot/extensions/), plugin (installed plugin), or session (session-state/&lt;id&gt;/extensions/).</summary>
+    [JsonPropertyName("source")]
+    public ExtensionSource Source { get; set; }
+
+    /// <summary>Current status: running, disabled, failed, or starting.</summary>
+    [JsonPropertyName("status")]
+    public ExtensionStatus Status { get; set; }
 }
 
-/// <summary>Current lightweight tool metadata snapshot for the session.</summary>
+/// <summary>Extensions discovered for the session, with their current status.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ToolsGetCurrentMetadataResult
+public sealed class ExtensionList
 {
-    /// <summary>Current tool metadata, or null when tools have not been initialized yet.</summary>
-    [JsonPropertyName("tools")]
-    public IList<CurrentToolMetadata>? Tools { get; set; }
+    /// <summary>Discovered extensions and their current status.</summary>
+    [JsonPropertyName("extensions")]
+    public IList<Extension> Extensions { get => field ??= []; set; }
 }
 
 /// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionToolsGetCurrentMetadataRequest
+internal sealed class SessionExtensionsListRequest
 {
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Empty result after replacing the calling connection's externally implemented tools.</summary>
+/// <summary>Source-qualified extension identifier to enable for the session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ToolsSetResult
+internal sealed class ExtensionsEnableRequest
 {
-}
+    /// <summary>Source-qualified extension ID to enable.</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
 
-/// <summary>Serializable definition of a caller-implemented tool whose execution is handled over the SDK connection.</summary>
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Source-qualified extension identifier to disable for the session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ProtocolExternalToolDefinition
+internal sealed class ExtensionsDisableRequest
 {
-    /// <summary>Tool-loading deferral policy.</summary>
-    [JsonPropertyName("defer")]
-    public ProtocolExternalToolDefer? Defer { get; set; }
-
-    /// <summary>Model-visible explanation of what the tool does.</summary>
-    [JsonPropertyName("description")]
-    public string Description { get; set; } = string.Empty;
-
-    /// <summary>Whether the tool executes commands in a terminal.</summary>
-    [JsonPropertyName("isTerminal")]
-    public bool? IsTerminal { get; set; }
-
-    /// <summary>Optional caller-defined metadata associated with the tool.</summary>
-    [JsonPropertyName("metadata")]
-    public IDictionary<string, JsonElement>? Metadata { get; set; }
-
-    /// <summary>Unique model-visible tool name.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
-
-    /// <summary>Whether this definition replaces a built-in tool with the same name.</summary>
-    [JsonPropertyName("overridesBuiltInTool")]
-    public bool? OverridesBuiltInTool { get; set; }
-
-    /// <summary>JSON Schema describing the tool's input arguments.</summary>
-    [JsonPropertyName("parameters")]
-    public IDictionary<string, JsonElement>? Parameters { get; set; }
-
-    /// <summary>Whether execution bypasses the normal tool permission prompt.</summary>
-    [JsonPropertyName("skipPermission")]
-    public bool? SkipPermission { get; set; }
+    /// <summary>Source-qualified extension ID to disable.</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
 
-    /// <summary>Optional human-readable display title.</summary>
-    [JsonPropertyName("title")]
-    public string? Title { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Complete externally implemented tool list for the calling connection. An empty list removes every tool previously supplied by that connection.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class ToolsSetRequest
+internal sealed class SessionExtensionsReloadRequest
 {
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
-
-    /// <summary>Complete replacement list for the calling connection.</summary>
-    [JsonPropertyName("tools")]
-    public IList<ProtocolExternalToolDefinition> Tools { get => field ??= []; set; }
 }
 
-/// <summary>Empty result after applying subagent settings.</summary>
+/// <summary>Attachment union accepted by push input, covering files, directories, GitHub objects, blobs, snippets, and extension context.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>type</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ToolsUpdateSubagentSettingsResult
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "type",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(PushAttachmentFile), "file")]
+[JsonDerivedType(typeof(PushAttachmentDirectory), "directory")]
+[JsonDerivedType(typeof(PushAttachmentSelection), "selection")]
+[JsonDerivedType(typeof(PushAttachmentGitHubReference), "github_reference")]
+[JsonDerivedType(typeof(PushAttachmentGitHubCommit), "github_commit")]
+[JsonDerivedType(typeof(PushAttachmentGitHubRelease), "github_release")]
+[JsonDerivedType(typeof(PushAttachmentGitHubActionsJob), "github_actions_job")]
+[JsonDerivedType(typeof(PushAttachmentGitHubRepository), "github_repository")]
+[JsonDerivedType(typeof(PushAttachmentGitHubFileDiff), "github_file_diff")]
+[JsonDerivedType(typeof(PushAttachmentGitHubTreeComparison), "github_tree_comparison")]
+[JsonDerivedType(typeof(PushAttachmentGitHubUrl), "github_url")]
+[JsonDerivedType(typeof(PushAttachmentGitHubFile), "github_file")]
+[JsonDerivedType(typeof(PushAttachmentGitHubSnippet), "github_snippet")]
+[JsonDerivedType(typeof(PushAttachmentBlob), "blob")]
+[JsonDerivedType(typeof(PushAttachmentExtensionContext), "extension_context")]
+public partial class PushAttachment
 {
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("type")]
+    public virtual string Type { get; set; } = string.Empty;
 }
 
-/// <summary>Subagent model, reasoning effort, and context tier settings.</summary>
+
+/// <summary>Optional line range to scope the attachment to a specific section of the file.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SubagentSettingsEntry
+public sealed class PushAttachmentFileLineRange
 {
-    /// <summary>Context tier override for matching subagents.</summary>
-    [JsonPropertyName("contextTier")]
-    public SubagentSettingsEntryContextTier? ContextTier { get; set; }
-
-    /// <summary>Reasoning effort override for matching subagents.</summary>
-    [JsonPropertyName("effortLevel")]
-    public string? EffortLevel { get; set; }
+    /// <summary>End line number (1-based, inclusive).</summary>
+    [JsonPropertyName("end")]
+    public long End { get; set; }
 
-    /// <summary>Model override for matching subagents.</summary>
-    [JsonPropertyName("model")]
-    public string? Model { get; set; }
+    /// <summary>Start line number (1-based).</summary>
+    [JsonPropertyName("start")]
+    public long Start { get; set; }
 }
 
-/// <summary>Configured per-agent subagent overrides.</summary>
-public sealed class UpdateSubagentSettingsRequestSubagents
+/// <summary>File attachment.</summary>
+/// <remarks>The <c>file</c> variant of <see cref="PushAttachment"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PushAttachmentFile : PushAttachment
 {
-    /// <summary>Per-agent settings keyed by subagent agent_type.</summary>
-    [JsonPropertyName("agents")]
-    public IDictionary<string, SubagentSettingsEntry>? Agents { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "file";
 
-    /// <summary>Names of subagents the user has turned off; they cannot be dispatched.</summary>
-    [JsonPropertyName("disabledSubagents")]
-    public IList<string>? DisabledSubagents { get; set; }
+    /// <summary>User-facing display name for the attachment.</summary>
+    [JsonPropertyName("displayName")]
+    public required string DisplayName { get; set; }
 
-    /// <summary>Maximum number of subagents that can run concurrently; applies to usage-based billing users only.</summary>
-    [JsonPropertyName("maxConcurrency")]
-    public int? MaxConcurrency { get; set; }
+    /// <summary>Optional line range to scope the attachment to a specific section of the file.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("lineRange")]
+    public PushAttachmentFileLineRange? LineRange { get; set; }
 
-    /// <summary>Maximum subagent nesting depth; applies to usage-based billing users only.</summary>
-    [JsonPropertyName("maxDepth")]
-    public int? MaxDepth { get; set; }
+    /// <summary>Absolute file path.</summary>
+    [JsonPropertyName("path")]
+    public required string Path { get; set; }
 }
 
-/// <summary>Subagent settings to apply to the current session.</summary>
+/// <summary>Directory attachment.</summary>
+/// <remarks>The <c>directory</c> variant of <see cref="PushAttachment"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class UpdateSubagentSettingsRequest
+public partial class PushAttachmentDirectory : PushAttachment
 {
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "directory";
 
-    /// <summary>Subagent settings to apply, or null to clear the live session override.</summary>
-    [JsonPropertyName("subagents")]
-    public UpdateSubagentSettingsRequestSubagents? Subagents { get; set; }
+    /// <summary>User-facing display name for the attachment.</summary>
+    [JsonPropertyName("displayName")]
+    public required string DisplayName { get; set; }
+
+    /// <summary>Absolute directory path.</summary>
+    [JsonPropertyName("path")]
+    public required string Path { get; set; }
 }
 
-/// <summary>RPC data type for SessionCommandsList operations.</summary>
+/// <summary>End position of the selection.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionCommandsListRequest
+public sealed class PushAttachmentSelectionDetailsEnd
 {
-    /// <summary>Include runtime built-in commands.</summary>
-    [JsonPropertyName("includeBuiltins")]
-    public bool? IncludeBuiltins { get; set; }
-
-    /// <summary>Include commands registered by protocol clients, including SDK clients and extensions.</summary>
-    [JsonPropertyName("includeClientCommands")]
-    public bool? IncludeClientCommands { get; set; }
+    /// <summary>End character offset within the line (0-based).</summary>
+    [JsonPropertyName("character")]
+    public long Character { get; set; }
 
-    /// <summary>Include enabled user-invocable skills and commands.</summary>
-    [JsonPropertyName("includeSkills")]
-    public bool? IncludeSkills { get; set; }
+    /// <summary>End line number (0-based).</summary>
+    [JsonPropertyName("line")]
+    public long Line { get; set; }
 }
 
-/// <summary>RPC data type for SessionCommandsListRequestWithSession operations.</summary>
+/// <summary>Start position of the selection.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionCommandsListRequestWithSession
+public sealed class PushAttachmentSelectionDetailsStart
 {
-    /// <summary>Include runtime built-in commands.</summary>
-    [JsonPropertyName("includeBuiltins")]
-    public bool? IncludeBuiltins { get; set; }
-
-    /// <summary>Include commands registered by protocol clients, including SDK clients and extensions.</summary>
-    [JsonPropertyName("includeClientCommands")]
-    public bool? IncludeClientCommands { get; set; }
-
-    /// <summary>Include enabled user-invocable skills and commands.</summary>
-    [JsonPropertyName("includeSkills")]
-    public bool? IncludeSkills { get; set; }
+    /// <summary>Start character offset within the line (0-based).</summary>
+    [JsonPropertyName("character")]
+    public long Character { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Start line number (0-based).</summary>
+    [JsonPropertyName("line")]
+    public long Line { get; set; }
 }
 
-/// <summary>Result of invoking the slash command (text output, prompt to send to the agent, completion, or subcommand selection).</summary>
-/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
+/// <summary>Position range of the selection within the file.</summary>
 [Experimental(Diagnostics.Experimental)]
-[JsonPolymorphic(
-    TypeDiscriminatorPropertyName = "kind",
-    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
-[JsonDerivedType(typeof(SlashCommandInvocationResultText), "text")]
-[JsonDerivedType(typeof(SlashCommandInvocationResultAgentPrompt), "agent-prompt")]
-[JsonDerivedType(typeof(SlashCommandInvocationResultCompleted), "completed")]
-[JsonDerivedType(typeof(SlashCommandInvocationResultSelectSubcommand), "select-subcommand")]
-[JsonDerivedType(typeof(SlashCommandInvocationResultAddTimelineEntry), "add-timeline-entry")]
-[JsonDerivedType(typeof(SlashCommandInvocationResultShowDialog), "show-dialog")]
-[JsonDerivedType(typeof(SlashCommandInvocationResultSetModel), "set-model")]
-[JsonDerivedType(typeof(SlashCommandInvocationResultSetPlanModel), "set-plan-model")]
-public partial class SlashCommandInvocationResult
+public sealed class PushAttachmentSelectionDetails
 {
-    /// <summary>The type discriminator.</summary>
-    [JsonPropertyName("kind")]
-    public virtual string Kind { get; set; } = string.Empty;
-}
+    /// <summary>End position of the selection.</summary>
+    [JsonPropertyName("end")]
+    public PushAttachmentSelectionDetailsEnd End { get => field ??= new(); set; }
 
+    /// <summary>Start position of the selection.</summary>
+    [JsonPropertyName("start")]
+    public PushAttachmentSelectionDetailsStart Start { get => field ??= new(); set; }
+}
 
-/// <summary>Slash-command invocation result containing text output plus Markdown/ANSI rendering flags.</summary>
-/// <remarks>The <c>text</c> variant of <see cref="SlashCommandInvocationResult"/>.</remarks>
+/// <summary>Code selection attachment from an editor.</summary>
+/// <remarks>The <c>selection</c> variant of <see cref="PushAttachment"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public partial class SlashCommandInvocationResultText : SlashCommandInvocationResult
+public partial class PushAttachmentSelection : PushAttachment
 {
     /// <inheritdoc />
     [JsonIgnore]
-    public override string Kind => "text";
+    public override string Type => "selection";
 
-    /// <summary>Whether text contains Markdown.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("markdown")]
-    public bool? Markdown { get; set; }
+    /// <summary>User-facing display name for the selection.</summary>
+    [JsonPropertyName("displayName")]
+    public required string DisplayName { get; set; }
 
-    /// <summary>Whether ANSI sequences should be preserved.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("preserveAnsi")]
-    public bool? PreserveAnsi { get; set; }
+    /// <summary>Absolute path to the file containing the selection.</summary>
+    [JsonPropertyName("filePath")]
+    public required string FilePath { get; set; }
 
-    /// <summary>True when the invocation mutated user runtime settings; consumers caching settings should refresh.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("runtimeSettingsChanged")]
-    public bool? RuntimeSettingsChanged { get; set; }
+    /// <summary>Position range of the selection within the file.</summary>
+    [JsonPropertyName("selection")]
+    public required PushAttachmentSelectionDetails Selection { get; set; }
 
-    /// <summary>Text output for the client to render.</summary>
+    /// <summary>The selected text content.</summary>
     [JsonPropertyName("text")]
     public required string Text { get; set; }
 }
 
-/// <summary>Slash-command invocation result that submits an agent prompt, with display prompt, optional mode, optional user-facing notice, and settings-change flag.</summary>
-/// <remarks>The <c>agent-prompt</c> variant of <see cref="SlashCommandInvocationResult"/>.</remarks>
+/// <summary>GitHub issue, pull request, or discussion reference.</summary>
+/// <remarks>The <c>github_reference</c> variant of <see cref="PushAttachment"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public partial class SlashCommandInvocationResultAgentPrompt : SlashCommandInvocationResult
+public partial class PushAttachmentGitHubReference : PushAttachment
 {
     /// <inheritdoc />
     [JsonIgnore]
-    public override string Kind => "agent-prompt";
+    public override string Type => "github_reference";
 
-    /// <summary>Prompt text to display to the user.</summary>
-    [JsonPropertyName("displayPrompt")]
-    public required string DisplayPrompt { get; set; }
+    /// <summary>Issue, pull request, or discussion number.</summary>
+    [JsonPropertyName("number")]
+    public required long Number { get; set; }
 
-    /// <summary>Optional target session mode for the agent prompt.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("mode")]
-    public SessionMode? Mode { get; set; }
+    /// <summary>Type of GitHub reference.</summary>
+    [JsonPropertyName("referenceType")]
+    public required PushAttachmentGitHubReferenceType ReferenceType { get; set; }
 
-    /// <summary>Optional user-facing notice to show before the prompt is submitted.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("notice")]
-    public string? Notice { get; set; }
+    /// <summary>Current state of the referenced item (e.g., open, closed, merged).</summary>
+    [JsonPropertyName("state")]
+    public required string State { get; set; }
 
-    /// <summary>Prompt to submit to the agent.</summary>
-    [JsonPropertyName("prompt")]
-    public required string Prompt { get; set; }
+    /// <summary>Title of the referenced item.</summary>
+    [JsonPropertyName("title")]
+    public required string Title { get; set; }
 
-    /// <summary>True when the invocation mutated user runtime settings; consumers caching settings should refresh.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("runtimeSettingsChanged")]
-    public bool? RuntimeSettingsChanged { get; set; }
+    /// <summary>URL to the referenced item on GitHub.</summary>
+    [JsonPropertyName("url")]
+    public required string Url { get; set; }
 }
 
-/// <summary>Slash-command invocation result indicating completion, with optional message and settings-change flag.</summary>
-/// <remarks>The <c>completed</c> variant of <see cref="SlashCommandInvocationResult"/>.</remarks>
+/// <summary>Pointer to a GitHub repository.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class SlashCommandInvocationResultCompleted : SlashCommandInvocationResult
+public sealed class PushGitHubRepoRef
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "completed";
+    /// <summary>Numeric GitHub repository id.</summary>
+    [JsonPropertyName("id")]
+    public long? Id { get; set; }
 
-    /// <summary>Optional user-facing message describing the completed command.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("message")]
-    public string? Message { get; set; }
+    /// <summary>Repository name (without owner).</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
-    /// <summary>True when the invocation mutated user runtime settings; consumers caching settings should refresh.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("runtimeSettingsChanged")]
-    public bool? RuntimeSettingsChanged { get; set; }
+    /// <summary>Repository owner login (user or organization).</summary>
+    [JsonPropertyName("owner")]
+    public string Owner { get; set; } = string.Empty;
 }
 
-/// <summary>Selectable slash-command subcommand option with name, description, and optional group label.</summary>
+/// <summary>Pointer to a GitHub commit.</summary>
+/// <remarks>The <c>github_commit</c> variant of <see cref="PushAttachment"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SlashCommandSelectSubcommandOption
+public partial class PushAttachmentGitHubCommit : PushAttachment
 {
-    /// <summary>Human-readable description of the subcommand.</summary>
-    [JsonPropertyName("description")]
-    public string Description { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "github_commit";
 
-    /// <summary>Optional group label for organizing options.</summary>
-    [JsonPropertyName("group")]
-    public string? Group { get; set; }
+    /// <summary>First line of the commit message.</summary>
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
 
-    /// <summary>Subcommand name to invoke.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Full commit SHA.</summary>
+    [JsonPropertyName("oid")]
+    public required string Oid { get; set; }
+
+    /// <summary>Repository the commit belongs to.</summary>
+    [JsonPropertyName("repo")]
+    public required PushGitHubRepoRef Repo { get; set; }
+
+    /// <summary>URL to the commit on GitHub.</summary>
+    [JsonPropertyName("url")]
+    public required string Url { get; set; }
 }
 
-/// <summary>Slash-command invocation result asking the client to present subcommand options for a parent command.</summary>
-/// <remarks>The <c>select-subcommand</c> variant of <see cref="SlashCommandInvocationResult"/>.</remarks>
+/// <summary>Pointer to a GitHub release.</summary>
+/// <remarks>The <c>github_release</c> variant of <see cref="PushAttachment"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public partial class SlashCommandInvocationResultSelectSubcommand : SlashCommandInvocationResult
+public partial class PushAttachmentGitHubRelease : PushAttachment
 {
     /// <inheritdoc />
     [JsonIgnore]
-    public override string Kind => "select-subcommand";
+    public override string Type => "github_release";
 
-    /// <summary>Parent command name that requires subcommand selection.</summary>
-    [JsonPropertyName("command")]
-    public required string Command { get; set; }
+    /// <summary>Human-readable release name.</summary>
+    [JsonPropertyName("name")]
+    public required string Name { get; set; }
 
-    /// <summary>Available subcommand options for the client to present.</summary>
-    [JsonPropertyName("options")]
-    public required IList<SlashCommandSelectSubcommandOption> Options { get; set; }
+    /// <summary>Repository the release belongs to.</summary>
+    [JsonPropertyName("repo")]
+    public required PushGitHubRepoRef Repo { get; set; }
 
-    /// <summary>True when the invocation mutated user runtime settings; consumers caching settings should refresh.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("runtimeSettingsChanged")]
-    public bool? RuntimeSettingsChanged { get; set; }
+    /// <summary>Git tag the release is anchored to.</summary>
+    [JsonPropertyName("tagName")]
+    public required string TagName { get; set; }
 
-    /// <summary>Human-readable title for the selection UI.</summary>
-    [JsonPropertyName("title")]
-    public required string Title { get; set; }
+    /// <summary>URL to the release on GitHub.</summary>
+    [JsonPropertyName("url")]
+    public required string Url { get; set; }
 }
 
-/// <summary>RPC data type for SlashCommandTimelineEntry operations.</summary>
+/// <summary>Pointer to a GitHub Actions job.</summary>
+/// <remarks>The <c>github_actions_job</c> variant of <see cref="PushAttachment"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SlashCommandTimelineEntry
+public partial class PushAttachmentGitHubActionsJob : PushAttachment
 {
-    /// <summary>Text displayed for the timeline entry.</summary>
-    [JsonPropertyName("text")]
-    public string Text { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "github_actions_job";
 
-    /// <summary>Timeline entry presentation type.</summary>
-    [JsonPropertyName("type")]
-    public string Type { get; set; } = string.Empty;
+    /// <summary>Terminal conclusion of the job when finished (e.g., success, failure, cancelled). Absent for in-progress jobs.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("conclusion")]
+    public string? Conclusion { get; set; }
 
-    /// <summary>Optional URL associated with the timeline entry.</summary>
+    /// <summary>Job id within the workflow run.</summary>
+    [JsonPropertyName("jobId")]
+    public required long JobId { get; set; }
+
+    /// <summary>Display name of the job.</summary>
+    [JsonPropertyName("jobName")]
+    public required string JobName { get; set; }
+
+    /// <summary>Repository the workflow run belongs to.</summary>
+    [JsonPropertyName("repo")]
+    public required PushGitHubRepoRef Repo { get; set; }
+
+    /// <summary>URL to the job on GitHub.</summary>
     [JsonPropertyName("url")]
-    public string? Url { get; set; }
+    public required string Url { get; set; }
+
+    /// <summary>Display name of the workflow the job ran in.</summary>
+    [JsonPropertyName("workflowName")]
+    public required string WorkflowName { get; set; }
 }
 
-/// <summary>The <c>add-timeline-entry</c> variant of <see cref="SlashCommandInvocationResult"/>.</summary>
+/// <summary>Pointer to a GitHub repository.</summary>
+/// <remarks>The <c>github_repository</c> variant of <see cref="PushAttachment"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public partial class SlashCommandInvocationResultAddTimelineEntry : SlashCommandInvocationResult
+public partial class PushAttachmentGitHubRepository : PushAttachment
 {
     /// <inheritdoc />
     [JsonIgnore]
-    public override string Kind => "add-timeline-entry";
-
-    /// <summary>Timeline entry the host should append.</summary>
-    [JsonPropertyName("entry")]
-    public required SlashCommandTimelineEntry Entry { get; set; }
+    public override string Type => "github_repository";
 
-    /// <summary>Optional text the host should prefill into the input editor.</summary>
+    /// <summary>Short description of the repository.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("prefillInput")]
-    public string? PrefillInput { get; set; }
+    [JsonPropertyName("description")]
+    public string? Description { get; set; }
 
-    /// <summary>Whether command execution changed persisted runtime settings.</summary>
+    /// <summary>Git ref this attachment is anchored at (branch, tag, or commit). When absent the default branch is implied.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("runtimeSettingsChanged")]
-    public bool? RuntimeSettingsChanged { get; set; }
+    [JsonPropertyName("ref")]
+    public string? Ref { get; set; }
+
+    /// <summary>Repository pointer.</summary>
+    [JsonPropertyName("repo")]
+    public required PushGitHubRepoRef Repo { get; set; }
+
+    /// <summary>URL to the repository on GitHub.</summary>
+    [JsonPropertyName("url")]
+    public required string Url { get; set; }
 }
 
-/// <summary>RPC data type for SlashCommandModelPickerDialog operations.</summary>
+/// <summary>One side of a file diff (head or base).</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SlashCommandModelPickerDialog
+public sealed class PushAttachmentGitHubFileDiffSide
 {
-    /// <summary>Discriminator for a model-picker dialog.</summary>
-    [JsonPropertyName("kind")]
-    public string Kind { get; set; } = string.Empty;
-
-    /// <summary>Model that should be enabled before it can be selected.</summary>
-    [JsonPropertyName("modelToEnable")]
-    public string? ModelToEnable { get; set; }
+    /// <summary>Repository-relative path to the file.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
 
-    /// <summary>Settings scope the picker should modify.</summary>
-    [JsonPropertyName("scope")]
-    public string? Scope { get; set; }
+    /// <summary>Git ref (branch, tag, or commit SHA) the file is read at.</summary>
+    [JsonPropertyName("ref")]
+    public string Ref { get; set; } = string.Empty;
 
-    /// <summary>Model-selection target represented by the picker.</summary>
-    [JsonPropertyName("target")]
-    public string? Target { get; set; }
+    /// <summary>Repository the file lives in.</summary>
+    [JsonPropertyName("repo")]
+    public PushGitHubRepoRef Repo { get => field ??= new(); set; }
 }
 
-/// <summary>The <c>show-dialog</c> variant of <see cref="SlashCommandInvocationResult"/>.</summary>
+/// <summary>Pointer to a single-file diff. At least one of `head` and `base` must be present.</summary>
+/// <remarks>The <c>github_file_diff</c> variant of <see cref="PushAttachment"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public partial class SlashCommandInvocationResultShowDialog : SlashCommandInvocationResult
+public partial class PushAttachmentGitHubFileDiff : PushAttachment
 {
     /// <inheritdoc />
     [JsonIgnore]
-    public override string Kind => "show-dialog";
+    public override string Type => "github_file_diff";
 
-    /// <summary>Dialog the host should display.</summary>
-    [JsonPropertyName("dialog")]
-    public required SlashCommandModelPickerDialog Dialog { get; set; }
+    /// <summary>File location on the base side of the diff. Absent for additions.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("base")]
+    public PushAttachmentGitHubFileDiffSide? Base { get; set; }
 
-    /// <summary>Whether command execution changed persisted runtime settings.</summary>
+    /// <summary>File location on the head side of the diff. Absent for deletions.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("runtimeSettingsChanged")]
-    public bool? RuntimeSettingsChanged { get; set; }
-}
+    [JsonPropertyName("head")]
+    public PushAttachmentGitHubFileDiffSide? Head { get; set; }
 
-/// <summary>User-settings snapshot to restore if the host cancels the model switch.</summary>
-public sealed class SlashCommandInvocationResultSetModelRevertOnCancel
-{
+    /// <summary>URL to the diff on GitHub (e.g., a commit, compare, or PR-file URL).</summary>
+    [JsonPropertyName("url")]
+    public required string Url { get; set; }
 }
 
-/// <summary>The <c>set-model</c> variant of <see cref="SlashCommandInvocationResult"/>.</summary>
+/// <summary>One side of a tree comparison (head or base).</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class SlashCommandInvocationResultSetModel : SlashCommandInvocationResult
+public sealed class PushAttachmentGitHubTreeComparisonSide
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "set-model";
-
-    /// <summary>Model selected by the command.</summary>
-    [JsonPropertyName("model")]
-    public required string Model { get; set; }
-
-    /// <summary>Reasoning effort selected for the model.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("reasoningEffort")]
-    public string? ReasoningEffort { get; set; }
+    /// <summary>Repository the revision belongs to.</summary>
+    [JsonPropertyName("repo")]
+    public PushGitHubRepoRef Repo { get => field ??= new(); set; }
 
-    /// <summary>Repository settings scope modified by the command.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("repoScope")]
-    public string? RepoScope { get; set; }
+    /// <summary>Git revision (branch, tag, or commit SHA).</summary>
+    [JsonPropertyName("revision")]
+    public string Revision { get; set; } = string.Empty;
+}
 
-    /// <summary>User-settings snapshot to restore if the host cancels the model switch.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("revertOnCancel")]
-    public SlashCommandInvocationResultSetModelRevertOnCancel? RevertOnCancel { get; set; }
+/// <summary>Pointer to a comparison between two git revisions.</summary>
+/// <remarks>The <c>github_tree_comparison</c> variant of <see cref="PushAttachment"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PushAttachmentGitHubTreeComparison : PushAttachment
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "github_tree_comparison";
 
-    /// <summary>Whether command execution changed persisted runtime settings.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("runtimeSettingsChanged")]
-    public bool? RuntimeSettingsChanged { get; set; }
+    /// <summary>Base side of the comparison.</summary>
+    [JsonPropertyName("base")]
+    public required PushAttachmentGitHubTreeComparisonSide Base { get; set; }
 
-    /// <summary>Settings scope modified by the command.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("scope")]
-    public string? Scope { get; set; }
+    /// <summary>Head side of the comparison.</summary>
+    [JsonPropertyName("head")]
+    public required PushAttachmentGitHubTreeComparisonSide Head { get; set; }
 
-    /// <summary>User-facing warning produced while selecting the model.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("warning")]
-    public string? Warning { get; set; }
+    /// <summary>URL to the comparison on GitHub.</summary>
+    [JsonPropertyName("url")]
+    public required string Url { get; set; }
 }
 
-/// <summary>The <c>set-plan-model</c> variant of <see cref="SlashCommandInvocationResult"/>.</summary>
+/// <summary>Generic GitHub URL reference.</summary>
+/// <remarks>The <c>github_url</c> variant of <see cref="PushAttachment"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public partial class SlashCommandInvocationResultSetPlanModel : SlashCommandInvocationResult
+public partial class PushAttachmentGitHubUrl : PushAttachment
 {
     /// <inheritdoc />
     [JsonIgnore]
-    public override string Kind => "set-plan-model";
-
-    /// <summary>User-facing confirmation message for the plan-model selection.</summary>
-    [JsonPropertyName("message")]
-    public required string Message { get; set; }
-
-    /// <summary>Dedicated model selected for plan mode.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("planModel")]
-    public string? PlanModel { get; set; }
+    public override string Type => "github_url";
 
-    /// <summary>Whether command execution changed persisted runtime settings.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("runtimeSettingsChanged")]
-    public bool? RuntimeSettingsChanged { get; set; }
+    /// <summary>URL to the GitHub resource.</summary>
+    [JsonPropertyName("url")]
+    public required string Url { get; set; }
 }
 
-/// <summary>Slash command name and optional raw input string to invoke.</summary>
+/// <summary>Pointer to a file in a GitHub repository at a specific ref.</summary>
+/// <remarks>The <c>github_file</c> variant of <see cref="PushAttachment"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class CommandsInvokeRequest
+public partial class PushAttachmentGitHubFile : PushAttachment
 {
-    /// <summary>Raw input after the command name.</summary>
-    [JsonPropertyName("input")]
-    public string? Input { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "github_file";
 
-    /// <summary>Command name. Leading slashes are stripped and the name is matched case-insensitively.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>Repository-relative path to the file.</summary>
+    [JsonPropertyName("path")]
+    public required string Path { get; set; }
 
-    /// <summary>Optional client surface that initiated the invocation.</summary>
-    [JsonPropertyName("origin")]
-    public CommandsInvocationOrigin? Origin { get; set; }
+    /// <summary>Git ref the file is read at (branch, tag, or commit SHA).</summary>
+    [JsonPropertyName("ref")]
+    public required string Ref { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Repository the file lives in.</summary>
+    [JsonPropertyName("repo")]
+    public required PushGitHubRepoRef Repo { get; set; }
+
+    /// <summary>URL to the file on GitHub.</summary>
+    [JsonPropertyName("url")]
+    public required string Url { get; set; }
 }
 
-/// <summary>Whether finalizing the invocation effect succeeded, and the failure reason when it did not.</summary>
+/// <summary>Pointer to a line range inside a file in a GitHub repository.</summary>
+/// <remarks>The <c>github_snippet</c> variant of <see cref="PushAttachment"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class CommandsFinalizeInvocationEffectResult
+public partial class PushAttachmentGitHubSnippet : PushAttachment
 {
-    /// <summary>Failure reason when the invocation effect could not be finalized.</summary>
-    [JsonPropertyName("error")]
-    public string? Error { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "github_snippet";
 
-    /// <summary>Whether the pending invocation effect was finalized successfully.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
-}
+    /// <summary>Line range the snippet covers.</summary>
+    [JsonPropertyName("lineRange")]
+    public required PushAttachmentFileLineRange LineRange { get; set; }
 
-/// <summary>The slash-command result object that produced the pending effect, echoed back unchanged.</summary>
-public sealed class CommandsFinalizeInvocationEffectRequestEffect
-{
-}
+    /// <summary>Repository-relative path to the file.</summary>
+    [JsonPropertyName("path")]
+    public required string Path { get; set; }
 
-/// <summary>The pending slash-command invocation effect to finalize, plus whether the host applied or cancelled it.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class CommandsFinalizeInvocationEffectRequest
-{
-    /// <summary>The slash-command result object that produced the pending effect, echoed back unchanged.</summary>
-    [JsonPropertyName("effect")]
-    public CommandsFinalizeInvocationEffectRequestEffect Effect { get => field ??= new(); set; }
+    /// <summary>Git ref the file is read at (branch, tag, or commit SHA).</summary>
+    [JsonPropertyName("ref")]
+    public required string Ref { get; set; }
 
-    /// <summary>Whether the host applied or cancelled the pending invocation effect.</summary>
-    [JsonPropertyName("outcome")]
-    public CommandsInvocationEffectOutcome Outcome { get; set; }
+    /// <summary>Repository the file lives in.</summary>
+    [JsonPropertyName("repo")]
+    public required PushGitHubRepoRef Repo { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>URL to the snippet on GitHub (with line anchor).</summary>
+    [JsonPropertyName("url")]
+    public required string Url { get; set; }
 }
 
-/// <summary>Indicates whether the pending client-handled command was completed successfully.</summary>
+/// <summary>Blob attachment with inline base64-encoded data.</summary>
+/// <remarks>The <c>blob</c> variant of <see cref="PushAttachment"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class CommandsHandlePendingCommandResult
+public partial class PushAttachmentBlob : PushAttachment
 {
-    /// <summary>Whether the command was handled successfully.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
-}
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "blob";
 
-/// <summary>Pending command request ID and an optional error if the client handler failed.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class CommandsHandlePendingCommandRequest
-{
-    /// <summary>Error message if the command handler failed.</summary>
-    [JsonPropertyName("error")]
-    public string? Error { get; set; }
+    /// <summary>Base64-encoded content.</summary>
+    [Base64String]
+    [JsonPropertyName("data")]
+    public required string Data { get; set; }
 
-    /// <summary>Request ID from the command invocation event.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
+    /// <summary>User-facing display name for the attachment.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("displayName")]
+    public string? DisplayName { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>MIME type of the inline data.</summary>
+    [JsonPropertyName("mimeType")]
+    public required string MimeType { get; set; }
 }
 
-/// <summary>Error message produced while executing the command, if any.</summary>
+/// <summary>Slim input shape for extension_context attachments; identity fields are runtime-derived.</summary>
+/// <remarks>The <c>extension_context</c> variant of <see cref="PushAttachment"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ExecuteCommandResult
+public partial class PushAttachmentExtensionContext : PushAttachment
 {
-    /// <summary>Error message produced while executing the command, if any. Omitted when the handler succeeded.</summary>
-    [JsonPropertyName("error")]
-    public string? Error { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "extension_context";
+
+    /// <summary>Caller-supplied JSON payload (required, may be null but not undefined).</summary>
+    [JsonPropertyName("payload")]
+    public required JsonElement Payload { get; set; }
+
+    /// <summary>Human-readable composer pill label.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("title")]
+    public required string Title { get; set; }
 }
 
-/// <summary>Slash command name and argument string to execute synchronously.</summary>
+/// <summary>Parameters for session.extensions.sendAttachmentsToMessage.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class ExecuteCommandParams
+internal sealed class SendAttachmentsToMessageParams
 {
-    /// <summary>Argument string to pass to the command (empty string if none).</summary>
-    [JsonPropertyName("args")]
-    public string Args { get; set; } = string.Empty;
+    /// <summary>Attachments to push into the next user-message turn. extension_context entries take the slim shape; standard variants take their full AttachmentSchema shape.</summary>
+    [JsonPropertyName("attachments")]
+    public IList<PushAttachment> Attachments { get => field ??= []; set; }
 
-    /// <summary>Name of the slash command to invoke (without the leading '/').</summary>
-    [JsonPropertyName("commandName")]
-    public string CommandName { get; set; } = string.Empty;
+    /// <summary>Optional canvas instance binding the push for provenance. When supplied, the runtime resolves the canvas, verifies it is owned by the calling extension, and stamps canvasId/instanceId onto each extension_context entry. When omitted, no resolution runs and those fields stay unset on the attachment.</summary>
+    [JsonPropertyName("instanceId")]
+    public string? InstanceId { get; set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether the command was accepted into the local execution queue.</summary>
+/// <summary>A tool name and arguments to execute through the session's native invocation pipeline.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class EnqueueCommandResult
+internal sealed class ToolsExecuteRequest
 {
-    /// <summary>True when the command was accepted into the local execution queue. False when the call targets a session that does not support local command queueing (e.g. remote sessions).</summary>
-    [JsonPropertyName("queued")]
-    public bool Queued { get; set; }
-}
+    /// <summary>Arguments supplied to the tool.</summary>
+    [JsonPropertyName("arguments")]
+    public JsonElement Arguments { get; set; }
 
-/// <summary>Slash-prefixed command string to enqueue for FIFO processing.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class EnqueueCommandParams
-{
-    /// <summary>Slash-prefixed command string to enqueue, e.g. '/compact' or '/model gpt-4'. Queued FIFO with any in-flight items; if the session is idle, processing kicks off immediately.</summary>
-    [JsonPropertyName("command")]
-    public string Command { get; set; } = string.Empty;
+    /// <summary>Name of the currently offered tool to execute.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
-}
 
-/// <summary>Indicates whether the queued-command response was matched to a pending request.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class CommandsRespondToQueuedCommandResult
-{
-    /// <summary>Whether a pending queued command with the given request ID was found and resolved. False when the request was already resolved, cancelled, or unknown.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
-}
-
-/// <summary>Result of the queued command execution.</summary>
-/// <remarks>Data type discriminated by <c>handled</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
-public partial class QueuedCommandResult
-{
-    /// <summary>The boolean discriminator.</summary>
-    [JsonPropertyName("handled")]
-    public bool Handled { get; set; }
-
-    /// <summary>When true, the runtime will not process subsequent queued commands until a new request comes in.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("stopProcessingQueue")]
-    public bool? StopProcessingQueue { get; set; }
+    /// <summary>Optional identifier used to correlate this invocation with its tool call.</summary>
+    [JsonPropertyName("toolCallId")]
+    public string? ToolCallId { get; set; }
 }
 
-/// <summary>Queued-command request ID and the result indicating whether the host executed it (and whether to stop processing further queued commands).</summary>
+/// <summary>Custom grammar input format accepted by a built-in tool.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class CommandsRespondToQueuedCommandRequest
+public sealed class BuiltinToolFormat
 {
-    /// <summary>Request ID from the `command.queued` event the host is responding to.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
+    /// <summary>Grammar definition accepted by the tool.</summary>
+    [JsonPropertyName("definition")]
+    public string Definition { get; set; } = string.Empty;
 
-    /// <summary>Result of the queued command execution.</summary>
-    [JsonPropertyName("result")]
-    public QueuedCommandResult Result { get => field ??= new(); set; }
+    /// <summary>Grammar syntax used by the format definition.</summary>
+    [JsonPropertyName("syntax")]
+    public string Syntax { get; set; } = string.Empty;
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Custom input-format discriminator.</summary>
+    [JsonPropertyName("type")]
+    public BuiltinToolFormatType Type { get; set; }
 }
 
-/// <summary>Telemetry engagement ID for the session, when available.</summary>
+/// <summary>JSON Schema object accepted by a built-in tool.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionTelemetryEngagement
+public sealed class BuiltinToolInputSchema
 {
-    /// <summary>Current telemetry engagement ID, when available.</summary>
-    [JsonPropertyName("engagementId")]
-    public string? EngagementId { get; set; }
+    /// <summary>Root type of the tool input schema.</summary>
+    [JsonPropertyName("type")]
+    public BuiltinToolInputSchemaType Type { get; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Rust-owned metadata and input schema for a built-in tool.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionTelemetryGetEngagementIdRequest
+public sealed class BuiltinToolDescriptor
 {
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Model-facing description of the tool's behavior.</summary>
+    [JsonPropertyName("description")]
+    public string Description { get; set; } = string.Empty;
 
-/// <summary>Feature override key/value pairs to attach to subsequent telemetry events from this session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class TelemetrySetFeatureOverridesRequest
-{
-    /// <summary>Override key/value pairs to attach to subsequent telemetry events from this session. Replaces any previously-set overrides.</summary>
-    [JsonPropertyName("features")]
-    public IDictionary<string, string> Features { get => field ??= new Dictionary<string, string>(); set; }
+    /// <summary>Optional custom input format used instead of a JSON Schema.</summary>
+    [JsonPropertyName("format")]
+    public BuiltinToolFormat? Format { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Whether the tool provides a specialized intention summary.</summary>
+    [JsonPropertyName("hasSummariseIntention")]
+    public bool HasSummariseIntention { get; set; }
 
-/// <summary>Completed transient query. Ordered chunks and the terminal outcome are also delivered through `ui.ephemeral_query` session events while it runs.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class UIEphemeralQueryResult
-{
-    /// <summary>Answer returned by the model.</summary>
-    [JsonPropertyName("answer")]
-    public string Answer { get; set; } = string.Empty;
-}
+    /// <summary>JSON Schema for the tool input, or null when the tool uses a custom format.</summary>
+    [JsonPropertyName("inputSchema")]
+    public BuiltinToolInputSchema? InputSchema { get; set; }
 
-/// <summary>Transient question to answer without adding it to conversation history.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class UIEphemeralQueryRequest
-{
-    /// <summary>Question to answer from the current conversation context.</summary>
-    [JsonPropertyName("question")]
-    public string Question { get; set; } = string.Empty;
+    /// <summary>Optional supplemental usage instructions for the tool.</summary>
+    [JsonPropertyName("instructions")]
+    public string? Instructions { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Whether the tool executes commands in a terminal.</summary>
+    [JsonPropertyName("isTerminal")]
+    public bool IsTerminal { get; set; }
 
-/// <summary>MCP response metadata.</summary>
-public sealed class UIElicitationResponseMeta
-{
-}
+    /// <summary>Stable name used to invoke the built-in tool.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
-/// <summary>The elicitation response (accept with form values, decline, or cancel).</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class UIElicitationResponse
-{
-    /// <summary>MCP response metadata.</summary>
-    [JsonPropertyName("_meta")]
-    public UIElicitationResponseMeta? Meta { get; set; }
+    /// <summary>Policy describing which tool metadata may be recorded without obfuscation.</summary>
+    [JsonPropertyName("safeForTelemetry")]
+    public JsonElement SafeForTelemetry { get; set; }
 
-    /// <summary>The user's response: accept (submitted), decline (rejected), or cancel (dismissed).</summary>
-    [JsonPropertyName("action")]
-    public UIElicitationResponseAction Action { get; set; }
+    /// <summary>Optional human-readable title for the tool.</summary>
+    [JsonPropertyName("title")]
+    public string? Title { get; set; }
 
-    /// <summary>The form values submitted by the user (present when action is 'accept').</summary>
-    [JsonPropertyName("content")]
-    public IDictionary<string, JsonElement>? Content { get; set; }
+    /// <summary>Optional tool category discriminator.</summary>
+    [JsonPropertyName("type")]
+    public string? Type { get; set; }
 }
 
-/// <summary>MCP request metadata.</summary>
-public sealed class UIElicitationRequestMeta
+/// <summary>Rust-owned built-in tool descriptors for the session.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class ToolsGetBuiltinDescriptorsResult
 {
+    /// <summary>Built-in tool descriptors materialized for the session.</summary>
+    [JsonPropertyName("tools")]
+    public IList<BuiltinToolDescriptor> Tools { get => field ??= []; set; }
 }
 
-/// <summary>JSON Schema describing the form fields to present to the user.</summary>
+/// <summary>Shell-specific names and description lines used to materialize built-in shell tool descriptors.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class UIElicitationSchema
+public sealed class ToolsShellDescriptorConfig
 {
-    /// <summary>Form field definitions, keyed by field name.</summary>
-    [JsonPropertyName("properties")]
-    public IDictionary<string, JsonElement> Properties { get => field ??= new Dictionary<string, JsonElement>(); set; }
+    /// <summary>Additional model-facing shell description lines.</summary>
+    [JsonPropertyName("descriptionLines")]
+    public IList<string> DescriptionLines { get => field ??= []; set; }
 
-    /// <summary>List of required field names.</summary>
-    [JsonPropertyName("required")]
-    public IList<string>? Required { get; set; }
+    /// <summary>Human-readable shell name.</summary>
+    [JsonPropertyName("displayName")]
+    public string DisplayName { get; set; } = string.Empty;
 
-    /// <summary>Schema type indicator (always 'object').</summary>
-    [JsonPropertyName("type")]
-    public string Type { get; set; } = string.Empty;
-}
+    /// <summary>Tool name used to list active shells.</summary>
+    [JsonPropertyName("listShellsToolName")]
+    public string ListShellsToolName { get; set; } = string.Empty;
 
-/// <summary>Metadata controlling an MCP task's lifetime.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class McpTaskMetadata
-{
-    /// <summary>Task time-to-live.</summary>
-    [JsonPropertyName("ttl")]
-    public long? Ttl { get; set; }
+    /// <summary>Tool name used to read shell output.</summary>
+    [JsonPropertyName("readShellToolName")]
+    public string ReadShellToolName { get; set; } = string.Empty;
+
+    /// <summary>Tool name used to start shell commands.</summary>
+    [JsonPropertyName("shellToolName")]
+    public string ShellToolName { get; set; } = string.Empty;
+
+    /// <summary>Stable shell type identifier.</summary>
+    [JsonPropertyName("shellType")]
+    public string ShellType { get; set; } = string.Empty;
+
+    /// <summary>Tool name used to stop shell commands.</summary>
+    [JsonPropertyName("stopShellToolName")]
+    public string StopShellToolName { get; set; } = string.Empty;
 }
 
-/// <summary>Prompt message and JSON schema describing the form fields to elicit from the user.</summary>
+/// <summary>Options controlling how Rust-owned built-in tool descriptors are materialized.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class UIElicitationRequest
+internal sealed class ToolsGetBuiltinDescriptorsRequest
 {
-    /// <summary>MCP request metadata.</summary>
-    [JsonPropertyName("_meta")]
-    public UIElicitationRequestMeta? Meta { get; set; }
+    /// <summary>Whether background task completion notifications are enabled.</summary>
+    [JsonPropertyName("backgroundTaskNotificationsEnabled")]
+    public bool? BackgroundTaskNotificationsEnabled { get; set; }
 
-    /// <summary>Message describing what information is needed from the user.</summary>
-    [JsonPropertyName("message")]
-    public string Message { get; set; } = string.Empty;
+    /// <summary>Whether tool descriptors should include authoring metadata.</summary>
+    [JsonPropertyName("includeAuthor")]
+    public bool? IncludeAuthor { get; set; }
 
-    /// <summary>Elicitation mode. Omitted and form are equivalent for structured elicitation.</summary>
-    [JsonPropertyName("mode")]
-    public McpElicitationFormMode? Mode { get; set; }
+    /// <summary>Whether line numbers should be omitted from the view tool descriptor.</summary>
+    [JsonPropertyName("noViewLineNumbers")]
+    public bool? NoViewLineNumbers { get; set; }
 
-    /// <summary>JSON Schema describing the form fields to present to the user.</summary>
-    [JsonPropertyName("requestedSchema")]
-    public UIElicitationSchema RequestedSchema { get => field ??= new(); set; }
+    /// <summary>Whether descriptors should favor fewer user-intervention prompts.</summary>
+    [JsonPropertyName("reduceUserIntervention")]
+    public bool? ReduceUserIntervention { get; set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 
-    /// <summary>MCP task metadata.</summary>
-    [JsonPropertyName("task")]
-    public McpTaskMetadata? Task { get; set; }
-}
+    /// <summary>Whether shell commands may only run asynchronously.</summary>
+    [JsonPropertyName("shellAsyncOnlyEnabled")]
+    public bool? ShellAsyncOnlyEnabled { get; set; }
 
-/// <summary>Indicates whether the elicitation response was accepted; false if it was already resolved by another client.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class UIElicitationResult
-{
-    /// <summary>Whether the response was accepted. False if the request was already resolved by another client.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
+    /// <summary>Shell-specific names and description lines for shell tools.</summary>
+    [JsonPropertyName("shellConfig")]
+    public ToolsShellDescriptorConfig? ShellConfig { get; set; }
+
+    /// <summary>Whether the configured shell supports PowerShell 7 syntax.</summary>
+    [JsonPropertyName("shellSupportsPowerShell7Syntax")]
+    public bool? ShellSupportsPowerShell7Syntax { get; set; }
+
+    /// <summary>Default shell timeout in milliseconds.</summary>
+    [JsonPropertyName("shellTimeoutMs")]
+    public double? ShellTimeoutMs { get; set; }
+
+    /// <summary>Whether semantic skill lookup is available.</summary>
+    [JsonPropertyName("skillEmbeddingEnabled")]
+    public bool? SkillEmbeddingEnabled { get; set; }
 }
 
-/// <summary>Pending elicitation request ID and the user's response (accept/decline/cancel + form values).</summary>
+/// <summary>Task completion notification with summary from the agent.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class UIHandlePendingElicitationRequest
+public sealed class TaskCompleteData
 {
-    /// <summary>The unique request ID from the elicitation.requested event.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
+    /// <summary>Active autopilot objective ID evaluated by the completion reviewer.</summary>
+    [JsonPropertyName("objectiveId")]
+    public long? ObjectiveId { get; set; }
 
-    /// <summary>The elicitation response (accept with form values, decline, or cancel).</summary>
-    [JsonPropertyName("result")]
-    public UIElicitationResponse Result { get => field ??= new(); set; }
+    /// <summary>Semantic completion decision. Absent on legacy events and invalid tool calls.</summary>
+    [JsonPropertyName("outcome")]
+    public TaskCompletionOutcome? Outcome { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Label-safe runtime rationale for the completion decision (e.g. a cancellation or pause/resume downgrade), when one applies. Reviewer-authored rationale is intentionally omitted here because this event has no IFC label channel; the reviewer's findings remain available through its own labeled sub-agent events.</summary>
+    [JsonPropertyName("reason")]
+    public string? Reason { get; set; }
 
-/// <summary>Indicates whether the pending UI request was resolved by this call.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class UIHandlePendingResult
-{
-    /// <summary>True if the request was still pending and was resolved by this call. False if the request ID was unknown, already resolved by another client (e.g. GitHub), expired, or otherwise no longer pending.</summary>
+    /// <summary>Whether the task was accepted as complete. False when validation failed or completion was rejected or blocked by the reviewer.</summary>
     [JsonPropertyName("success")]
-    public bool Success { get; set; }
+    public bool? Success { get; set; }
+
+    /// <summary>Summary of the completed task, provided by the agent.</summary>
+    [JsonPropertyName("summary")]
+    public string? Summary { get; set; }
 }
 
-/// <summary>User response for a pending user-input request, with answer text and whether it was typed freeform.</summary>
+/// <summary>Binary result returned by a tool for the model.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class UIUserInputResponse
+public sealed class ExternalToolTextResultForLlmBinaryResultsForLlm
 {
-    /// <summary>The user's answer text.</summary>
-    [JsonPropertyName("answer")]
-    public string Answer { get; set; } = string.Empty;
+    /// <summary>Base64-encoded binary data.</summary>
+    [Base64String]
+    [JsonPropertyName("data")]
+    public string Data { get; set; } = string.Empty;
 
-    /// <summary>True if the user typed a freeform response, false if they selected a presented choice. Used by telemetry to differentiate between free text input and choice selection.</summary>
-    [JsonPropertyName("wasFreeform")]
-    public bool WasFreeform { get; set; }
-}
+    /// <summary>Human-readable description of the binary data.</summary>
+    [JsonPropertyName("description")]
+    public string? Description { get; set; }
 
-/// <summary>Request ID of a pending `user_input.requested` event and the user's response.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class UIHandlePendingUserInputRequest
-{
-    /// <summary>The unique request ID from the user_input.requested event.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
+    /// <summary>Optional metadata from the producing tool.</summary>
+    [JsonPropertyName("metadata")]
+    public IDictionary<string, JsonElement>? Metadata { get; set; }
 
-    /// <summary>User response for a pending user-input request, with answer text and whether it was typed freeform.</summary>
-    [JsonPropertyName("response")]
-    public UIUserInputResponse Response { get => field ??= new(); set; }
+    /// <summary>MIME type of the binary data.</summary>
+    [JsonPropertyName("mimeType")]
+    public string MimeType { get; set; } = string.Empty;
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Binary result type discriminator. Use "image" for images and "resource" for other binary data.</summary>
+    [JsonPropertyName("type")]
+    public ExternalToolTextResultForLlmBinaryResultsForLlmType Type { get; set; }
 }
 
-/// <summary>Optional sampling result payload. Omit to reject/cancel the sampling request without providing a result.</summary>
+/// <summary>A content block within a tool result, which may be text, terminal output, image, audio, or a resource.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>type</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class UIHandlePendingSamplingResponse
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "type",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(ExternalToolTextResultForLlmContentText), "text")]
+[JsonDerivedType(typeof(ExternalToolTextResultForLlmContentTerminal), "terminal")]
+[JsonDerivedType(typeof(ExternalToolTextResultForLlmContentShellExit), "shell_exit")]
+[JsonDerivedType(typeof(ExternalToolTextResultForLlmContentImage), "image")]
+[JsonDerivedType(typeof(ExternalToolTextResultForLlmContentAudio), "audio")]
+[JsonDerivedType(typeof(ExternalToolTextResultForLlmContentResourceLink), "resource_link")]
+[JsonDerivedType(typeof(ExternalToolTextResultForLlmContentResource), "resource")]
+public partial class ExternalToolTextResultForLlmContent
 {
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("type")]
+    public virtual string Type { get; set; } = string.Empty;
 }
 
-/// <summary>Request ID of a pending `sampling.requested` event and an optional sampling result payload (omit to reject).</summary>
+
+/// <summary>Plain text content block.</summary>
+/// <remarks>The <c>text</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class UIHandlePendingSamplingRequest
+public partial class ExternalToolTextResultForLlmContentText : ExternalToolTextResultForLlmContent
 {
-    /// <summary>The unique request ID from the sampling.requested event.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
-
-    /// <summary>Optional sampling result payload. Omit to reject/cancel the sampling request without providing a result.</summary>
-    [JsonPropertyName("response")]
-    public UIHandlePendingSamplingResponse? Response { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "text";
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>The text content.</summary>
+    [JsonPropertyName("text")]
+    public required string Text { get; set; }
 }
 
-/// <summary>Request ID of a pending `auto_mode_switch.requested` event and the user's response.</summary>
+/// <summary>Terminal/shell output content block with optional exit code and working directory.</summary>
+/// <remarks>The <c>terminal</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class UIHandlePendingAutoModeSwitchRequest
+public partial class ExternalToolTextResultForLlmContentTerminal : ExternalToolTextResultForLlmContent
 {
-    /// <summary>The unique request ID from the auto_mode_switch.requested event.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "terminal";
 
-    /// <summary>User's choice for auto-mode switching: yes (allow this turn), yes_always (allow + persist as setting), or no (decline).</summary>
-    [JsonPropertyName("response")]
-    public UIAutoModeSwitchResponse Response { get; set; }
+    /// <summary>Working directory where the command was executed.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("cwd")]
+    public string? Cwd { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Process exit code, if the command has completed.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("exitCode")]
+    public long? ExitCode { get; set; }
+
+    /// <summary>Terminal/shell output text.</summary>
+    [JsonPropertyName("text")]
+    public required string Text { get; set; }
 }
 
-/// <summary>The user's selected action for an exhausted session limit.</summary>
+/// <summary>Shell command exit metadata with optional output preview.</summary>
+/// <remarks>The <c>shell_exit</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class UISessionLimitsExhaustedResponse
+public partial class ExternalToolTextResultForLlmContentShellExit : ExternalToolTextResultForLlmContent
 {
-    /// <summary>Action selected by the user.</summary>
-    [JsonPropertyName("action")]
-    public UISessionLimitsExhaustedResponseAction Action { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "shell_exit";
 
-    /// <summary>AI Credits to add to the current max when action is 'add'.</summary>
-    [JsonPropertyName("additionalAiCredits")]
-    public double? AdditionalAiCredits { get; set; }
+    /// <summary>Working directory where the shell command was executed.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("cwd")]
+    public string? Cwd { get; set; }
 
-    /// <summary>New absolute max AI Credits when action is 'set'.</summary>
-    [JsonPropertyName("maxAiCredits")]
-    public double? MaxAiCredits { get; set; }
-}
+    /// <summary>Exit code from the completed shell command.</summary>
+    [JsonPropertyName("exitCode")]
+    public required long ExitCode { get; set; }
 
-/// <summary>Request ID of a pending `session_limits_exhausted.requested` event and the user's selected limit action.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class UIHandlePendingSessionLimitsExhaustedRequest
-{
-    /// <summary>The unique request ID from the session_limits_exhausted.requested event.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
+    /// <summary>Output associated with this shell command, if available. May be partial, truncated, or a preview; not guaranteed to be full output.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("outputPreview")]
+    public string? OutputPreview { get; set; }
 
-    /// <summary>The selected session-limit action.</summary>
-    [JsonPropertyName("response")]
-    public UISessionLimitsExhaustedResponse Response { get => field ??= new(); set; }
+    /// <summary>Whether outputPreview is known to be incomplete or truncated.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("outputTruncated")]
+    public bool? OutputTruncated { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Shell id, as assigned by Copilot runtime.</summary>
+    [JsonPropertyName("shellId")]
+    public required string ShellId { get; set; }
 }
 
-/// <summary>User response for a pending exit-plan-mode request, with approval state, selected action, auto-approve flag, and feedback.</summary>
+/// <summary>Image content block with base64-encoded data.</summary>
+/// <remarks>The <c>image</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class UIExitPlanModeResponse
+public partial class ExternalToolTextResultForLlmContentImage : ExternalToolTextResultForLlmContent
 {
-    /// <summary>Whether the plan was approved.</summary>
-    [JsonPropertyName("approved")]
-    public bool Approved { get; set; }
-
-    /// <summary>Whether subsequent edits should be auto-approved without confirmation.</summary>
-    [JsonPropertyName("autoApproveEdits")]
-    public bool? AutoApproveEdits { get; set; }
-
-    /// <summary>When true, the agent is instructed to end its turn without starting implementation so the client can restore the session model and auto-submit a fresh implementation turn on it. Set only when a distinct plan configuration (a different model, reasoning effort, or context tier) actually ran the planning turn.</summary>
-    [JsonPropertyName("deferImplementation")]
-    public bool? DeferImplementation { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "image";
 
-    /// <summary>Feedback from the user when they declined the plan or requested changes.</summary>
-    [JsonPropertyName("feedback")]
-    public string? Feedback { get; set; }
+    /// <summary>Base64-encoded image data.</summary>
+    [Base64String]
+    [JsonPropertyName("data")]
+    public required string Data { get; set; }
 
-    /// <summary>The action the user selected. Defaults to 'autopilot' when autoApproveEdits is true, otherwise 'interactive'.</summary>
-    [JsonPropertyName("selectedAction")]
-    public UIExitPlanModeAction? SelectedAction { get; set; }
+    /// <summary>MIME type of the image (e.g., image/png, image/jpeg).</summary>
+    [JsonPropertyName("mimeType")]
+    public required string MimeType { get; set; }
 }
 
-/// <summary>Request ID of a pending `exit_plan_mode.requested` event and the user's response.</summary>
+/// <summary>Audio content block with base64-encoded data.</summary>
+/// <remarks>The <c>audio</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class UIHandlePendingExitPlanModeRequest
+public partial class ExternalToolTextResultForLlmContentAudio : ExternalToolTextResultForLlmContent
 {
-    /// <summary>The unique request ID from the exit_plan_mode.requested event.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "audio";
 
-    /// <summary>User response for a pending exit-plan-mode request, with approval state, selected action, auto-approve flag, and feedback.</summary>
-    [JsonPropertyName("response")]
-    public UIExitPlanModeResponse Response { get => field ??= new(); set; }
+    /// <summary>Base64-encoded audio data.</summary>
+    [Base64String]
+    [JsonPropertyName("data")]
+    public required string Data { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>MIME type of the audio (e.g., audio/wav, audio/mpeg).</summary>
+    [JsonPropertyName("mimeType")]
+    public required string MimeType { get; set; }
 }
 
-/// <summary>Register an in-process handler for `auto_mode_switch.requested` events. The caller still attaches the actual listener via the standard event-subscription mechanism; this registration solely tells the server bridge to skip its own dispatch (so a remote client doesn't race the in-process handler for the same requestId).</summary>
+/// <summary>Icon image for a resource.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class UIRegisterDirectAutoModeSwitchHandlerResult
+public sealed class ExternalToolTextResultForLlmContentResourceLinkIcon
 {
-    /// <summary>Opaque handle representing the registration. Pass this same handle to `unregisterDirectAutoModeSwitchHandler` when the in-process handler is no longer active. Multiple registrations are reference-counted; the server bridge will only dispatch auto-mode-switch requests when no handles are active.</summary>
-    [JsonPropertyName("handle")]
-    public string Handle { get; set; } = string.Empty;
-}
+    /// <summary>MIME type of the icon image.</summary>
+    [JsonPropertyName("mimeType")]
+    public string? MimeType { get; set; }
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionUiRegisterDirectAutoModeSwitchHandlerRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Available icon sizes (e.g., ['16x16', '32x32']).</summary>
+    [JsonPropertyName("sizes")]
+    public IList<string>? Sizes { get; set; }
 
-/// <summary>Indicates whether the handle was active and the registration count was decremented.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class UIUnregisterDirectAutoModeSwitchHandlerResult
-{
-    /// <summary>True if the handle was active and decremented the counter; false if the handle was unknown.</summary>
-    [JsonPropertyName("unregistered")]
-    public bool Unregistered { get; set; }
+    /// <summary>URL or path to the icon image.</summary>
+    [JsonPropertyName("src")]
+    public string Src { get; set; } = string.Empty;
+
+    /// <summary>Theme variant this icon is intended for.</summary>
+    [JsonPropertyName("theme")]
+    public ExternalToolTextResultForLlmContentResourceLinkIconTheme? Theme { get; set; }
 }
 
-/// <summary>Opaque handle previously returned by `registerDirectAutoModeSwitchHandler` to release.</summary>
+/// <summary>Resource link content block referencing an external resource.</summary>
+/// <remarks>The <c>resource_link</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class UIUnregisterDirectAutoModeSwitchHandlerRequest
+public partial class ExternalToolTextResultForLlmContentResourceLink : ExternalToolTextResultForLlmContent
 {
-    /// <summary>Handle previously returned by `registerDirectAutoModeSwitchHandler`.</summary>
-    [JsonPropertyName("handle")]
-    public string Handle { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "resource_link";
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Human-readable description of the resource.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("description")]
+    public string? Description { get; set; }
 
-/// <summary>Indicates whether the operation succeeded.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class PermissionsConfigureResult
-{
-    /// <summary>Whether the operation succeeded.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
-}
+    /// <summary>Icons associated with this resource.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("icons")]
+    public IList<ExternalToolTextResultForLlmContentResourceLinkIcon>? Icons { get; set; }
 
-/// <summary>Source descriptor for a `session.permissions.configure` content-exclusion rule, with source name and type.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class PermissionsConfigureAdditionalContentExclusionPolicyRuleSource
-{
-    /// <summary>Name of the policy source.</summary>
+    /// <summary>MIME type of the resource content.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("mimeType")]
+    public string? MimeType { get; set; }
+
+    /// <summary>Resource name identifier.</summary>
     [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    public required string Name { get; set; }
 
-    /// <summary>Type of the policy source.</summary>
-    [JsonPropertyName("type")]
-    public string Type { get; set; } = string.Empty;
+    /// <summary>Size of the resource in bytes.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("size")]
+    public long? Size { get; set; }
+
+    /// <summary>Human-readable display title for the resource.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("title")]
+    public string? Title { get; set; }
+
+    /// <summary>URI identifying the resource.</summary>
+    [JsonPropertyName("uri")]
+    public required string Uri { get; set; }
 }
 
-/// <summary>Single content-exclusion rule supplied to `session.permissions.configure`, with paths, match conditions, and source.</summary>
+/// <summary>Embedded resource content block with inline text or binary data.</summary>
+/// <remarks>The <c>resource</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PermissionsConfigureAdditionalContentExclusionPolicyRule
+public partial class ExternalToolTextResultForLlmContentResource : ExternalToolTextResultForLlmContent
 {
-    /// <summary>Conditions of which at least one must match.</summary>
-    [JsonPropertyName("ifAnyMatch")]
-    public IList<string>? IfAnyMatch { get; set; }
-
-    /// <summary>Conditions none of which may match.</summary>
-    [JsonPropertyName("ifNoneMatch")]
-    public IList<string>? IfNoneMatch { get; set; }
-
-    /// <summary>Path patterns covered by this rule.</summary>
-    [JsonPropertyName("paths")]
-    public IList<string> Paths { get => field ??= []; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Type => "resource";
 
-    /// <summary>Source descriptor for a `session.permissions.configure` content-exclusion rule, with source name and type.</summary>
-    [JsonPropertyName("source")]
-    public PermissionsConfigureAdditionalContentExclusionPolicyRuleSource Source { get => field ??= new(); set; }
+    /// <summary>The embedded resource contents, either text or base64-encoded binary.</summary>
+    [JsonPropertyName("resource")]
+    public required JsonElement Resource { get; set; }
 }
 
-/// <summary>Content-exclusion policy supplied to `session.permissions.configure`, with rules, last-updated data, and scope.</summary>
+/// <summary>A message injected by a tool result.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PermissionsConfigureAdditionalContentExclusionPolicy
+public sealed class ToolResultNewMessage
 {
-    /// <summary>Opaque policy update timestamp supplied by the host.</summary>
-    [JsonPropertyName("last_updated_at")]
-    public JsonElement LastUpdatedAt { get; set; }
-
-    /// <summary>Content-exclusion rules to apply.</summary>
-    [JsonPropertyName("rules")]
-    public IList<PermissionsConfigureAdditionalContentExclusionPolicyRule> Rules { get => field ??= []; set; }
+    /// <summary>Message content to inject after the tool result.</summary>
+    [JsonPropertyName("content")]
+    public string Content { get; set; } = string.Empty;
 
-    /// <summary>Allowed values for the `PermissionsConfigureAdditionalContentExclusionPolicyScope` enumeration.</summary>
-    [JsonPropertyName("scope")]
-    public PermissionsConfigureAdditionalContentExclusionPolicyScope Scope { get; set; }
+    /// <summary>Source attributed to the injected message.</summary>
+    [JsonPropertyName("source")]
+    public string Source { get; set; } = string.Empty;
 }
 
-/// <summary>If specified, replaces the session's path-permission policy. The runtime constructs the appropriate PathManager based on these inputs (rooted at the session's working directory). Omit to leave the current path policy unchanged.</summary>
+/// <summary>RPC data type for TaskCompletionDecision operations.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PermissionPathsConfig
+public sealed class TaskCompletionDecision
 {
-    /// <summary>Additional directories to allow tool access to (in addition to the session's working directory). When `unrestricted` is true, these are still pre-populated on the UnrestrictedPathManager so they remain visible via getDirectories() (e.g. for @-mention completion).</summary>
-    [JsonPropertyName("additionalDirectories")]
-    public IList<string>? AdditionalDirectories { get; set; }
+    /// <summary>Objective eligibility token captured when the decision was evaluated.</summary>
+    [JsonPropertyName("completionEligibilityToken")]
+    public long? CompletionEligibilityToken { get; set; }
 
-    /// <summary>Whether to include the system temp directory in the allowed list (defaults to true). Ignored when `unrestricted` is true.</summary>
-    [JsonPropertyName("includeTempDirectory")]
-    public bool? IncludeTempDirectory { get; set; }
+    /// <summary>Whether completion was accepted after the reviewer-rejection budget was exhausted.</summary>
+    [JsonPropertyName("completionRejectionBudgetExhausted")]
+    public bool? CompletionRejectionBudgetExhausted { get; set; }
 
-    /// <summary>If true, the runtime allows access to all paths without prompting. Equivalent to constructing an UnrestrictedPathManager.</summary>
-    [JsonPropertyName("unrestricted")]
-    public bool? Unrestricted { get; set; }
+    /// <summary>Active autopilot objective evaluated by the completion reviewer.</summary>
+    [JsonPropertyName("objectiveId")]
+    public long? ObjectiveId { get; set; }
 
-    /// <summary>Workspace root path (special-cased to be allowed even before the directory exists). Ignored when `unrestricted` is true.</summary>
-    [JsonPropertyName("workspacePath")]
-    public string? WorkspacePath { get; set; }
-}
+    /// <summary>Semantic result of evaluating the task completion request.</summary>
+    [JsonPropertyName("outcome")]
+    public TaskCompletionOutcome Outcome { get; set; }
 
-/// <summary>If specified, replaces the session's approved/denied permission rules. Omit to leave the current rules unchanged.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class PermissionRulesSet
-{
-    /// <summary>Rules that auto-approve matching requests.</summary>
-    [JsonPropertyName("approved")]
-    public IList<PermissionRule> Approved { get => field ??= []; set; }
+    /// <summary>Rationale for the completion decision, when one is available.</summary>
+    [JsonPropertyName("reason")]
+    public string? Reason { get; set; }
 
-    /// <summary>Rules that auto-deny matching requests.</summary>
-    [JsonPropertyName("denied")]
-    public IList<PermissionRule> Denied { get => field ??= []; set; }
+    /// <summary>Whether the rationale was derived from completion-reviewer output.</summary>
+    [JsonPropertyName("reviewerDerived")]
+    public bool? ReviewerDerived { get; set; }
+
+    /// <summary>Information-flow metadata captured from the completion reviewer.</summary>
+    [JsonPropertyName("reviewerResultMeta")]
+    public JsonElement? ReviewerResultMeta { get; set; }
 }
 
-/// <summary>If specified, replaces the session's URL-permission policy. The runtime constructs a fresh DefaultUrlManager based on these inputs. Omit to leave the current URL policy unchanged.</summary>
+/// <summary>Expanded canonical result returned by a session tool.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PermissionUrlsConfig
+public sealed class ToolResultExpanded
 {
-    /// <summary>Initial list of allowed URL/domain patterns. Patterns may include path components. Ignored when `unrestricted` is true.</summary>
-    [JsonPropertyName("initialAllowed")]
-    public IList<string>? InitialAllowed { get; set; }
+    /// <summary>Base64-encoded binary results returned to the model.</summary>
+    [JsonPropertyName("binaryResultsForLlm")]
+    public IList<ExternalToolTextResultForLlmBinaryResultsForLlm>? BinaryResultsForLlm { get; set; }
 
-    /// <summary>If true, the runtime allows access to all URLs without prompting. Initial allow-list is ignored when this is true.</summary>
-    [JsonPropertyName("unrestricted")]
-    public bool? Unrestricted { get; set; }
-}
+    /// <summary>Sources returned by the tool that the model may cite.</summary>
+    [JsonPropertyName("citableSources")]
+    public IList<JsonElement>? CitableSources { get; set; }
 
-/// <summary>Patch of permission policy fields to apply (omit a field to leave it unchanged).</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class PermissionsConfigureParams
-{
-    /// <summary>If specified, replaces the host-supplied GitHub Content Exclusion policies on the session (combined with natively-discovered policies when evaluating tool/file access). Omit to leave the current policies unchanged.</summary>
-    [JsonPropertyName("additionalContentExclusionPolicies")]
-    public IList<PermissionsConfigureAdditionalContentExclusionPolicy>? AdditionalContentExclusionPolicies { get; set; }
+    /// <summary>Structured content blocks returned to the model.</summary>
+    [JsonPropertyName("contents")]
+    public IList<ExternalToolTextResultForLlmContent>? Contents { get; set; }
 
-    /// <summary>If specified, sets whether path/URL read permission requests are auto-approved. Omit to leave the current value unchanged.</summary>
-    [JsonPropertyName("approveAllReadPermissionRequests")]
-    public bool? ApproveAllReadPermissionRequests { get; set; }
+    /// <summary>Error message for an unsuccessful execution.</summary>
+    [JsonPropertyName("error")]
+    public string? Error { get; set; }
 
-    /// <summary>If specified, sets whether tool permission requests are auto-approved without prompting. Omit to leave the current value unchanged.</summary>
-    [JsonPropertyName("approveAllToolPermissionRequests")]
-    public bool? ApproveAllToolPermissionRequests { get; set; }
+    /// <summary>Metadata propagated with the tool result, including information-flow labels.</summary>
+    [JsonPropertyName("mcpMeta")]
+    public IDictionary<string, JsonElement>? McpMeta { get; set; }
 
-    /// <summary>If specified, replaces the session's path-permission policy. The runtime constructs the appropriate PathManager based on these inputs (rooted at the session's working directory). Omit to leave the current path policy unchanged.</summary>
-    [JsonPropertyName("paths")]
-    public PermissionPathsConfig? Paths { get; set; }
+    /// <summary>Messages to inject after the tool result.</summary>
+    [JsonPropertyName("newMessages")]
+    public IList<ToolResultNewMessage>? NewMessages { get; set; }
 
-    /// <summary>If specified, replaces the session's approved/denied permission rules. Omit to leave the current rules unchanged.</summary>
-    [JsonPropertyName("rules")]
-    public PermissionRulesSet? Rules { get; set; }
+    /// <summary>Whether post-tool-use failure hooks have already processed this result.</summary>
+    [JsonPropertyName("postToolUseFailureHooksProcessed")]
+    public bool? PostToolUseFailureHooksProcessed { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Execution outcome classification.</summary>
+    [JsonPropertyName("resultType")]
+    public ToolResultType ResultType { get; set; }
 
-    /// <summary>If specified, replaces the session's URL-permission policy. The runtime constructs a fresh DefaultUrlManager based on these inputs. Omit to leave the current URL policy unchanged.</summary>
-    [JsonPropertyName("urls")]
-    public PermissionUrlsConfig? Urls { get; set; }
-}
+    /// <summary>Detailed log content available for session display.</summary>
+    [JsonPropertyName("sessionLog")]
+    public string? SessionLog { get; set; }
 
-/// <summary>Indicates whether the permission decision was applied; false when the request was already resolved.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class PermissionRequestResult
-{
-    /// <summary>Whether the permission request was handled successfully.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
-}
+    /// <summary>Skill invocation metadata produced by the tool.</summary>
+    [JsonPropertyName("skillInvocation")]
+    public JsonElement? SkillInvocation { get; set; }
 
-/// <summary>Optional informational context describing how and where the permission decision was made. This does not affect permission behavior.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class PermissionDecisionContext
-{
-    /// <summary>Disposition of the permission request as observed by the responding client.</summary>
-    [JsonPropertyName("outcome")]
-    public PermissionDecisionOutcome Outcome { get; set; }
+    /// <summary>Whether large-output post-processing should be skipped.</summary>
+    [JsonPropertyName("skipLargeOutputProcessing")]
+    public bool? SkipLargeOutputProcessing { get; set; }
 
-    /// <summary>Controlled reason or actor responsible for the response.</summary>
-    [JsonPropertyName("source")]
-    public PermissionDecisionSource Source { get; set; }
+    /// <summary>Structured result content in addition to the model-facing text.</summary>
+    [JsonPropertyName("structuredContent")]
+    public JsonElement? StructuredContent { get; set; }
 
-    /// <summary>Client surface that submitted the response.</summary>
-    [JsonPropertyName("surface")]
-    public PermissionDecisionSurface Surface { get; set; }
-}
+    /// <summary>Completion-review decision produced by the task-completion tool.</summary>
+    [JsonPropertyName("taskCompletionDecision")]
+    public TaskCompletionDecision? TaskCompletionDecision { get; set; }
 
-/// <summary>The client's response to the pending permission prompt.</summary>
-/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
-[JsonPolymorphic(
-    TypeDiscriminatorPropertyName = "kind",
-    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
-[JsonDerivedType(typeof(PermissionDecisionApproveOnce), "approve-once")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForSession), "approve-for-session")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForLocation), "approve-for-location")]
-[JsonDerivedType(typeof(PermissionDecisionApprovePermanently), "approve-permanently")]
-[JsonDerivedType(typeof(PermissionDecisionReject), "reject")]
-[JsonDerivedType(typeof(PermissionDecisionUserNotAvailable), "user-not-available")]
-[JsonDerivedType(typeof(PermissionDecisionApproved), "approved")]
-[JsonDerivedType(typeof(PermissionDecisionApprovedForSession), "approved-for-session")]
-[JsonDerivedType(typeof(PermissionDecisionApprovedForLocation), "approved-for-location")]
-[JsonDerivedType(typeof(PermissionDecisionCancelled), "cancelled")]
-[JsonDerivedType(typeof(PermissionDecisionDeniedByRules), "denied-by-rules")]
-[JsonDerivedType(typeof(PermissionDecisionDeniedNoApprovalRuleAndCouldNotRequestFromUser), "denied-no-approval-rule-and-could-not-request-from-user")]
-[JsonDerivedType(typeof(PermissionDecisionDeniedInteractivelyByUser), "denied-interactively-by-user")]
-[JsonDerivedType(typeof(PermissionDecisionDeniedByContentExclusionPolicy), "denied-by-content-exclusion-policy")]
-[JsonDerivedType(typeof(PermissionDecisionDeniedByPermissionRequestHook), "denied-by-permission-request-hook")]
-public partial class PermissionDecision
-{
-    /// <summary>The type discriminator.</summary>
-    [JsonPropertyName("kind")]
-    public virtual string Kind { get; set; } = string.Empty;
-}
+    /// <summary>Text result returned to the model.</summary>
+    [JsonPropertyName("textResultForLlm")]
+    public string TextResultForLlm { get; set; } = string.Empty;
 
+    /// <summary>Deferred tool names made available by this result.</summary>
+    [JsonPropertyName("toolReferences")]
+    public IList<string>? ToolReferences { get; set; }
 
-/// <summary>Permission-decision request variant to approve only the current permission request.</summary>
-/// <remarks>The <c>approve-once</c> variant of <see cref="PermissionDecision"/>.</remarks>
+    /// <summary>Tool-specific telemetry payload.</summary>
+    [JsonPropertyName("toolTelemetry")]
+    public JsonElement? ToolTelemetry { get; set; }
+
+    /// <summary>Optional UI resource produced by the tool.</summary>
+    [JsonPropertyName("uiResource")]
+    public JsonElement? UiResource { get; set; }
+}
+
+/// <summary>Task-completion tool arguments and final result used to build a label-safe session event payload.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveOnce : PermissionDecision
+internal sealed class ToolsTaskCompleteEventDataRequest
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "approve-once";
+    /// <summary>Final expanded result returned by the task_complete tool.</summary>
+    [JsonPropertyName("finalResult")]
+    public ToolResultExpanded FinalResult { get => field ??= new(); set; }
 
-    /// <summary>True only when a host surfaced this request to a user who approved it.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("approvedInteractively")]
-    public bool? ApprovedInteractively { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Arguments supplied to the completed task_complete tool call.</summary>
+    [JsonPropertyName("toolArgs")]
+    public JsonElement ToolArgs { get; set; }
 }
 
-/// <summary>Session-scoped approval to remember (tool prompts only; omitted for path/url prompts).</summary>
-/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
+/// <summary>Indicates whether the external tool call result was handled successfully.</summary>
 [Experimental(Diagnostics.Experimental)]
-[JsonPolymorphic(
-    TypeDiscriminatorPropertyName = "kind",
-    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
-[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalCommands), "commands")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalRead), "read")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalWrite), "write")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalMcp), "mcp")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalMcpSampling), "mcp-sampling")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalMemory), "memory")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalCustomTool), "custom-tool")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalExtensionManagement), "extension-management")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalFactory), "factory")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalExtensionPermissionAccess), "extension-permission-access")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalExtensionEnvAccess), "extension-env-access")]
-public partial class PermissionDecisionApproveForSessionApproval
+public sealed class HandlePendingToolCallResult
 {
-    /// <summary>The type discriminator.</summary>
-    [JsonPropertyName("kind")]
-    public virtual string Kind { get; set; } = string.Empty;
+    /// <summary>Whether the tool call result was handled successfully.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-
-/// <summary>Session-scoped approval details for specific command identifiers.</summary>
-/// <remarks>The <c>commands</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
+/// <summary>Pending external tool call request ID, with the tool result or an error describing why it failed.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForSessionApprovalCommands : PermissionDecisionApproveForSessionApproval
+internal sealed class HandlePendingToolCallRequest
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "commands";
+    /// <summary>Error message if the tool call failed.</summary>
+    [JsonPropertyName("error")]
+    public string? Error { get; set; }
 
-    /// <summary>Command identifiers covered by this approval.</summary>
-    [JsonPropertyName("commandIdentifiers")]
-    public required IList<string> CommandIdentifiers { get; set; }
+    /// <summary>Request ID of the pending tool call.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
+
+    /// <summary>Tool call result (string or expanded result object).</summary>
+    [JsonPropertyName("result")]
+    public JsonElement? Result { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Session-scoped approval details for read-only filesystem operations.</summary>
-/// <remarks>The <c>read</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
+/// <summary>Resolve, build, and validate the runtime tool list for this session. Subagent sessions and consumer flows that need an initialized tool set before `send` invoke this. Default base-class implementation is a no-op for sessions that don't support tool validation.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForSessionApprovalRead : PermissionDecisionApproveForSessionApproval
+public sealed class ToolsInitializeAndValidateResult
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "read";
 }
 
-/// <summary>Session-scoped approval details for filesystem write operations.</summary>
-/// <remarks>The <c>write</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForSessionApprovalWrite : PermissionDecisionApproveForSessionApproval
+internal sealed class SessionToolsInitializeAndValidateRequest
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "write";
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Session-scoped approval details for an MCP server tool, or all tools on the server when `toolName` is null.</summary>
-/// <remarks>The <c>mcp</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
+/// <summary>Lightweight metadata for a currently initialized session tool.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForSessionApprovalMcp : PermissionDecisionApproveForSessionApproval
+public sealed class CurrentToolMetadata
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "mcp";
+    /// <summary>Whether the tool is loaded on demand via tool search.</summary>
+    [JsonPropertyName("deferLoading")]
+    public bool? DeferLoading { get; set; }
 
-    /// <summary>MCP server name.</summary>
-    [JsonPropertyName("serverName")]
-    public required string ServerName { get; set; }
+    /// <summary>Tool description.</summary>
+    [JsonPropertyName("description")]
+    public string Description { get; set; } = string.Empty;
 
-    /// <summary>MCP tool name, or null to cover every tool on the server.</summary>
-    [JsonPropertyName("toolName")]
-    public string? ToolName { get; set; }
-}
+    /// <summary>JSON Schema for tool input.</summary>
+    [JsonPropertyName("input_schema")]
+    public IDictionary<string, JsonElement>? InputSchema { get; set; }
 
-/// <summary>Session-scoped approval details for MCP sampling requests from a server.</summary>
-/// <remarks>The <c>mcp-sampling</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForSessionApprovalMcpSampling : PermissionDecisionApproveForSessionApproval
-{
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "mcp-sampling";
+    /// <summary>MCP server name for MCP-backed tools.</summary>
+    [JsonPropertyName("mcpServerName")]
+    public string? McpServerName { get; set; }
 
-    /// <summary>MCP server name.</summary>
-    [JsonPropertyName("serverName")]
-    public required string ServerName { get; set; }
+    /// <summary>Raw MCP tool name for MCP-backed tools.</summary>
+    [JsonPropertyName("mcpToolName")]
+    public string? McpToolName { get; set; }
+
+    /// <summary>Model-facing tool name.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
+
+    /// <summary>Optional MCP/config namespaced tool name.</summary>
+    [JsonPropertyName("namespacedName")]
+    public string? NamespacedName { get; set; }
 }
 
-/// <summary>Session-scoped approval details for writes to long-term memory.</summary>
-/// <remarks>The <c>memory</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
+/// <summary>Current lightweight tool metadata snapshot for the session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForSessionApprovalMemory : PermissionDecisionApproveForSessionApproval
+public sealed class ToolsGetCurrentMetadataResult
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "memory";
+    /// <summary>Current tool metadata, or null when tools have not been initialized yet.</summary>
+    [JsonPropertyName("tools")]
+    public IList<CurrentToolMetadata>? Tools { get; set; }
 }
 
-/// <summary>Session-scoped approval details for a custom tool, keyed by tool name.</summary>
-/// <remarks>The <c>custom-tool</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForSessionApprovalCustomTool : PermissionDecisionApproveForSessionApproval
+internal sealed class SessionToolsGetCurrentMetadataRequest
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "custom-tool";
-
-    /// <summary>Custom tool name.</summary>
-    [JsonPropertyName("toolName")]
-    public required string ToolName { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Session-scoped approval details for extension-management operations, optionally narrowed by operation.</summary>
-/// <remarks>The <c>extension-management</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
+/// <summary>Empty result after replacing the calling connection's externally implemented tools.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForSessionApprovalExtensionManagement : PermissionDecisionApproveForSessionApproval
+public sealed class ToolsSetResult
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "extension-management";
-
-    /// <summary>Optional operation identifier; when omitted, the approval covers all extension management operations.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("operation")]
-    public string? Operation { get; set; }
 }
 
-/// <summary>Session-scoped factory approval, optionally narrowed by approval key.</summary>
-/// <remarks>The <c>factory</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
+/// <summary>Serializable definition of a caller-implemented tool whose execution is handled over the SDK connection.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForSessionApprovalFactory : PermissionDecisionApproveForSessionApproval
+public sealed class ProtocolExternalToolDefinition
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "factory";
+    /// <summary>Tool-loading deferral policy.</summary>
+    [JsonPropertyName("defer")]
+    public ProtocolExternalToolDefer? Defer { get; set; }
 
-    /// <summary>Optional factory operation name or canonical approval key; when omitted, the approval covers all factory operations.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("approvalKey")]
-    public string? ApprovalKey { get; set; }
-}
+    /// <summary>Model-visible explanation of what the tool does.</summary>
+    [JsonPropertyName("description")]
+    public string Description { get; set; } = string.Empty;
 
-/// <summary>Session-scoped approval details for an extension's permission-gated capability access, keyed by extension name.</summary>
-/// <remarks>The <c>extension-permission-access</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForSessionApprovalExtensionPermissionAccess : PermissionDecisionApproveForSessionApproval
-{
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "extension-permission-access";
+    /// <summary>Whether the tool executes commands in a terminal.</summary>
+    [JsonPropertyName("isTerminal")]
+    public bool? IsTerminal { get; set; }
 
-    /// <summary>Extension name.</summary>
-    [JsonPropertyName("extensionName")]
-    public required string ExtensionName { get; set; }
-}
+    /// <summary>Optional caller-defined metadata associated with the tool.</summary>
+    [JsonPropertyName("metadata")]
+    public IDictionary<string, JsonElement>? Metadata { get; set; }
 
-/// <summary>Session-scoped approval details for an extension's access to sensitive environment variables, keyed by extension name and the exact set of variable names.</summary>
-/// <remarks>The <c>extension-env-access</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForSessionApprovalExtensionEnvAccess : PermissionDecisionApproveForSessionApproval
-{
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "extension-env-access";
+    /// <summary>Unique model-visible tool name.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
-    /// <summary>Names of the sensitive environment variables this approval covers. Values are never persisted.</summary>
-    [JsonPropertyName("environmentVariables")]
-    public required IList<string> EnvironmentVariables { get; set; }
+    /// <summary>Whether this definition replaces a built-in tool with the same name.</summary>
+    [JsonPropertyName("overridesBuiltInTool")]
+    public bool? OverridesBuiltInTool { get; set; }
 
-    /// <summary>Extension name.</summary>
-    [JsonPropertyName("extensionName")]
-    public required string ExtensionName { get; set; }
+    /// <summary>JSON Schema describing the tool's input arguments.</summary>
+    [JsonPropertyName("parameters")]
+    public IDictionary<string, JsonElement>? Parameters { get; set; }
+
+    /// <summary>Whether execution bypasses the normal tool permission prompt.</summary>
+    [JsonPropertyName("skipPermission")]
+    public bool? SkipPermission { get; set; }
+
+    /// <summary>Optional human-readable display title.</summary>
+    [JsonPropertyName("title")]
+    public string? Title { get; set; }
 }
 
-/// <summary>Permission-decision request variant to approve for the rest of the session, with optional tool approval or URL domain.</summary>
-/// <remarks>The <c>approve-for-session</c> variant of <see cref="PermissionDecision"/>.</remarks>
+/// <summary>Complete externally implemented tool list for the calling connection. An empty list removes every tool previously supplied by that connection.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForSession : PermissionDecision
+internal sealed class ToolsSetRequest
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "approve-for-session";
-
-    /// <summary>Session-scoped approval to remember (tool prompts only; omitted for path/url prompts).</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("approval")]
-    public PermissionDecisionApproveForSessionApproval? Approval { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 
-    /// <summary>URL domain to approve for the rest of the session (URL prompts only).</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("domain")]
-    public string? Domain { get; set; }
+    /// <summary>Complete replacement list for the calling connection.</summary>
+    [JsonPropertyName("tools")]
+    public IList<ProtocolExternalToolDefinition> Tools { get => field ??= []; set; }
 }
 
-/// <summary>Approval to persist for this location.</summary>
-/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
+/// <summary>Empty result after applying subagent settings.</summary>
 [Experimental(Diagnostics.Experimental)]
-[JsonPolymorphic(
-    TypeDiscriminatorPropertyName = "kind",
-    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
-[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalCommands), "commands")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalRead), "read")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalWrite), "write")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalMcp), "mcp")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalMcpSampling), "mcp-sampling")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalMemory), "memory")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalCustomTool), "custom-tool")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalExtensionManagement), "extension-management")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalFactory), "factory")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalExtensionPermissionAccess), "extension-permission-access")]
-[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalExtensionEnvAccess), "extension-env-access")]
-public partial class PermissionDecisionApproveForLocationApproval
+public sealed class ToolsUpdateSubagentSettingsResult
 {
-    /// <summary>The type discriminator.</summary>
-    [JsonPropertyName("kind")]
-    public virtual string Kind { get; set; } = string.Empty;
 }
 
-
-/// <summary>Location-scoped approval details for specific command identifiers.</summary>
-/// <remarks>The <c>commands</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
+/// <summary>Subagent model, reasoning effort, and context tier settings.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForLocationApprovalCommands : PermissionDecisionApproveForLocationApproval
+public sealed class SubagentSettingsEntry
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "commands";
+    /// <summary>Context tier override for matching subagents.</summary>
+    [JsonPropertyName("contextTier")]
+    public SubagentSettingsEntryContextTier? ContextTier { get; set; }
 
-    /// <summary>Command identifiers covered by this approval.</summary>
-    [JsonPropertyName("commandIdentifiers")]
-    public required IList<string> CommandIdentifiers { get; set; }
+    /// <summary>Reasoning effort override for matching subagents.</summary>
+    [JsonPropertyName("effortLevel")]
+    public string? EffortLevel { get; set; }
+
+    /// <summary>Model override for matching subagents.</summary>
+    [JsonPropertyName("model")]
+    public string? Model { get; set; }
 }
 
-/// <summary>Location-scoped approval details for read-only filesystem operations.</summary>
-/// <remarks>The <c>read</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForLocationApprovalRead : PermissionDecisionApproveForLocationApproval
+/// <summary>Configured per-agent subagent overrides.</summary>
+public sealed class UpdateSubagentSettingsRequestSubagents
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "read";
+    /// <summary>Per-agent settings keyed by subagent agent_type.</summary>
+    [JsonPropertyName("agents")]
+    public IDictionary<string, SubagentSettingsEntry>? Agents { get; set; }
+
+    /// <summary>Names of subagents the user has turned off; they cannot be dispatched.</summary>
+    [JsonPropertyName("disabledSubagents")]
+    public IList<string>? DisabledSubagents { get; set; }
+
+    /// <summary>Maximum number of subagents that can run concurrently; applies to usage-based billing users only.</summary>
+    [JsonPropertyName("maxConcurrency")]
+    public int? MaxConcurrency { get; set; }
+
+    /// <summary>Maximum subagent nesting depth; applies to usage-based billing users only.</summary>
+    [JsonPropertyName("maxDepth")]
+    public int? MaxDepth { get; set; }
 }
 
-/// <summary>Location-scoped approval details for filesystem write operations.</summary>
-/// <remarks>The <c>write</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
+/// <summary>Subagent settings to apply to the current session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForLocationApprovalWrite : PermissionDecisionApproveForLocationApproval
+internal sealed class UpdateSubagentSettingsRequest
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "write";
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Subagent settings to apply, or null to clear the live session override.</summary>
+    [JsonPropertyName("subagents")]
+    public UpdateSubagentSettingsRequestSubagents? Subagents { get; set; }
 }
 
-/// <summary>Location-scoped approval details for an MCP server tool, or all tools on the server when `toolName` is null.</summary>
-/// <remarks>The <c>mcp</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
+/// <summary>RPC data type for SessionCommandsList operations.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForLocationApprovalMcp : PermissionDecisionApproveForLocationApproval
+public sealed class SessionCommandsListRequest
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "mcp";
+    /// <summary>Include runtime built-in commands.</summary>
+    [JsonPropertyName("includeBuiltins")]
+    public bool? IncludeBuiltins { get; set; }
 
-    /// <summary>MCP server name.</summary>
-    [JsonPropertyName("serverName")]
-    public required string ServerName { get; set; }
+    /// <summary>Include commands registered by protocol clients, including SDK clients and extensions.</summary>
+    [JsonPropertyName("includeClientCommands")]
+    public bool? IncludeClientCommands { get; set; }
 
-    /// <summary>MCP tool name, or null to cover every tool on the server.</summary>
-    [JsonPropertyName("toolName")]
-    public string? ToolName { get; set; }
+    /// <summary>Include enabled user-invocable skills and commands.</summary>
+    [JsonPropertyName("includeSkills")]
+    public bool? IncludeSkills { get; set; }
 }
 
-/// <summary>Location-scoped approval details for MCP sampling requests from a server.</summary>
-/// <remarks>The <c>mcp-sampling</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
+/// <summary>RPC data type for SessionCommandsListRequestWithSession operations.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForLocationApprovalMcpSampling : PermissionDecisionApproveForLocationApproval
+internal sealed class SessionCommandsListRequestWithSession
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "mcp-sampling";
+    /// <summary>Include runtime built-in commands.</summary>
+    [JsonPropertyName("includeBuiltins")]
+    public bool? IncludeBuiltins { get; set; }
 
-    /// <summary>MCP server name.</summary>
-    [JsonPropertyName("serverName")]
-    public required string ServerName { get; set; }
-}
+    /// <summary>Include commands registered by protocol clients, including SDK clients and extensions.</summary>
+    [JsonPropertyName("includeClientCommands")]
+    public bool? IncludeClientCommands { get; set; }
 
-/// <summary>Location-scoped approval details for writes to long-term memory.</summary>
-/// <remarks>The <c>memory</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForLocationApprovalMemory : PermissionDecisionApproveForLocationApproval
-{
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "memory";
+    /// <summary>Include enabled user-invocable skills and commands.</summary>
+    [JsonPropertyName("includeSkills")]
+    public bool? IncludeSkills { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Location-scoped approval details for a custom tool, keyed by tool name.</summary>
-/// <remarks>The <c>custom-tool</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
+/// <summary>Result of invoking the slash command (text output, prompt to send to the agent, completion, or subcommand selection).</summary>
+/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForLocationApprovalCustomTool : PermissionDecisionApproveForLocationApproval
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "kind",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(SlashCommandInvocationResultText), "text")]
+[JsonDerivedType(typeof(SlashCommandInvocationResultAgentPrompt), "agent-prompt")]
+[JsonDerivedType(typeof(SlashCommandInvocationResultCompleted), "completed")]
+[JsonDerivedType(typeof(SlashCommandInvocationResultSelectSubcommand), "select-subcommand")]
+[JsonDerivedType(typeof(SlashCommandInvocationResultAddTimelineEntry), "add-timeline-entry")]
+[JsonDerivedType(typeof(SlashCommandInvocationResultShowDialog), "show-dialog")]
+[JsonDerivedType(typeof(SlashCommandInvocationResultSetModel), "set-model")]
+[JsonDerivedType(typeof(SlashCommandInvocationResultSetPlanModel), "set-plan-model")]
+public partial class SlashCommandInvocationResult
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "custom-tool";
-
-    /// <summary>Custom tool name.</summary>
-    [JsonPropertyName("toolName")]
-    public required string ToolName { get; set; }
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("kind")]
+    public virtual string Kind { get; set; } = string.Empty;
 }
 
-/// <summary>Location-scoped approval details for extension-management operations, optionally narrowed by operation.</summary>
-/// <remarks>The <c>extension-management</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
+
+/// <summary>Slash-command invocation result containing text output plus Markdown/ANSI rendering flags.</summary>
+/// <remarks>The <c>text</c> variant of <see cref="SlashCommandInvocationResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForLocationApprovalExtensionManagement : PermissionDecisionApproveForLocationApproval
+public partial class SlashCommandInvocationResultText : SlashCommandInvocationResult
 {
     /// <inheritdoc />
     [JsonIgnore]
-    public override string Kind => "extension-management";
+    public override string Kind => "text";
 
-    /// <summary>Optional operation identifier; when omitted, the approval covers all extension management operations.</summary>
+    /// <summary>Whether text contains Markdown.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("operation")]
-    public string? Operation { get; set; }
-}
+    [JsonPropertyName("markdown")]
+    public bool? Markdown { get; set; }
 
-/// <summary>Location-scoped factory approval, optionally narrowed by approval key.</summary>
-/// <remarks>The <c>factory</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForLocationApprovalFactory : PermissionDecisionApproveForLocationApproval
-{
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "factory";
+    /// <summary>Whether ANSI sequences should be preserved.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("preserveAnsi")]
+    public bool? PreserveAnsi { get; set; }
 
-    /// <summary>Optional factory operation name or canonical approval key; when omitted, the approval covers all factory operations.</summary>
+    /// <summary>True when the invocation mutated user runtime settings; consumers caching settings should refresh.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("approvalKey")]
-    public string? ApprovalKey { get; set; }
+    [JsonPropertyName("runtimeSettingsChanged")]
+    public bool? RuntimeSettingsChanged { get; set; }
+
+    /// <summary>Text output for the client to render.</summary>
+    [JsonPropertyName("text")]
+    public required string Text { get; set; }
 }
 
-/// <summary>Location-scoped approval details for an extension's permission-gated capability access, keyed by extension name.</summary>
-/// <remarks>The <c>extension-permission-access</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
+/// <summary>Slash-command invocation result that submits an agent prompt, with display prompt, optional mode, optional user-facing notice, and settings-change flag.</summary>
+/// <remarks>The <c>agent-prompt</c> variant of <see cref="SlashCommandInvocationResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForLocationApprovalExtensionPermissionAccess : PermissionDecisionApproveForLocationApproval
+public partial class SlashCommandInvocationResultAgentPrompt : SlashCommandInvocationResult
 {
     /// <inheritdoc />
     [JsonIgnore]
-    public override string Kind => "extension-permission-access";
+    public override string Kind => "agent-prompt";
 
-    /// <summary>Extension name.</summary>
-    [JsonPropertyName("extensionName")]
-    public required string ExtensionName { get; set; }
-}
+    /// <summary>Prompt text to display to the user.</summary>
+    [JsonPropertyName("displayPrompt")]
+    public required string DisplayPrompt { get; set; }
 
-/// <summary>Location-scoped approval details for an extension's access to sensitive environment variables, keyed by extension name and the exact set of variable names.</summary>
-/// <remarks>The <c>extension-env-access</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForLocationApprovalExtensionEnvAccess : PermissionDecisionApproveForLocationApproval
-{
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "extension-env-access";
+    /// <summary>Optional target session mode for the agent prompt.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("mode")]
+    public SessionMode? Mode { get; set; }
 
-    /// <summary>Names of the sensitive environment variables this approval covers. Values are never persisted.</summary>
-    [JsonPropertyName("environmentVariables")]
-    public required IList<string> EnvironmentVariables { get; set; }
+    /// <summary>Optional user-facing notice to show before the prompt is submitted.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("notice")]
+    public string? Notice { get; set; }
 
-    /// <summary>Extension name.</summary>
-    [JsonPropertyName("extensionName")]
-    public required string ExtensionName { get; set; }
+    /// <summary>Prompt to submit to the agent.</summary>
+    [JsonPropertyName("prompt")]
+    public required string Prompt { get; set; }
+
+    /// <summary>True when the invocation mutated user runtime settings; consumers caching settings should refresh.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("runtimeSettingsChanged")]
+    public bool? RuntimeSettingsChanged { get; set; }
 }
 
-/// <summary>Permission-decision request variant to approve and persist a permission for a project location, with approval details and location key.</summary>
-/// <remarks>The <c>approve-for-location</c> variant of <see cref="PermissionDecision"/>.</remarks>
+/// <summary>Slash-command invocation result indicating completion, with optional message and settings-change flag.</summary>
+/// <remarks>The <c>completed</c> variant of <see cref="SlashCommandInvocationResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproveForLocation : PermissionDecision
+public partial class SlashCommandInvocationResultCompleted : SlashCommandInvocationResult
 {
     /// <inheritdoc />
     [JsonIgnore]
-    public override string Kind => "approve-for-location";
+    public override string Kind => "completed";
 
-    /// <summary>Approval to persist for this location.</summary>
-    [JsonPropertyName("approval")]
-    public required PermissionDecisionApproveForLocationApproval Approval { get; set; }
+    /// <summary>Optional user-facing message describing the completed command.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("message")]
+    public string? Message { get; set; }
 
-    /// <summary>Location key (git root or cwd) to persist the approval to.</summary>
-    [JsonPropertyName("locationKey")]
-    public required string LocationKey { get; set; }
+    /// <summary>True when the invocation mutated user runtime settings; consumers caching settings should refresh.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("runtimeSettingsChanged")]
+    public bool? RuntimeSettingsChanged { get; set; }
 }
 
-/// <summary>Permission-decision request variant to permanently approve a URL domain across sessions.</summary>
-/// <remarks>The <c>approve-permanently</c> variant of <see cref="PermissionDecision"/>.</remarks>
+/// <summary>Selectable slash-command subcommand option with name, description, and optional group label.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApprovePermanently : PermissionDecision
+public sealed class SlashCommandSelectSubcommandOption
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "approve-permanently";
+    /// <summary>Human-readable description of the subcommand.</summary>
+    [JsonPropertyName("description")]
+    public string Description { get; set; } = string.Empty;
 
-    /// <summary>URL domain to approve permanently.</summary>
-    [JsonPropertyName("domain")]
-    public required string Domain { get; set; }
+    /// <summary>Optional group label for organizing options.</summary>
+    [JsonPropertyName("group")]
+    public string? Group { get; set; }
+
+    /// <summary>Subcommand name to invoke.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 }
 
-/// <summary>Permission-decision request variant to reject a pending permission request, with optional feedback.</summary>
-/// <remarks>The <c>reject</c> variant of <see cref="PermissionDecision"/>.</remarks>
+/// <summary>Slash-command invocation result asking the client to present subcommand options for a parent command.</summary>
+/// <remarks>The <c>select-subcommand</c> variant of <see cref="SlashCommandInvocationResult"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionReject : PermissionDecision
+public partial class SlashCommandInvocationResultSelectSubcommand : SlashCommandInvocationResult
 {
     /// <inheritdoc />
     [JsonIgnore]
-    public override string Kind => "reject";
+    public override string Kind => "select-subcommand";
 
-    /// <summary>Optional feedback explaining the rejection.</summary>
+    /// <summary>Parent command name that requires subcommand selection.</summary>
+    [JsonPropertyName("command")]
+    public required string Command { get; set; }
+
+    /// <summary>Available subcommand options for the client to present.</summary>
+    [JsonPropertyName("options")]
+    public required IList<SlashCommandSelectSubcommandOption> Options { get; set; }
+
+    /// <summary>True when the invocation mutated user runtime settings; consumers caching settings should refresh.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("feedback")]
-    public string? Feedback { get; set; }
-}
+    [JsonPropertyName("runtimeSettingsChanged")]
+    public bool? RuntimeSettingsChanged { get; set; }
 
-/// <summary>Permission-decision variant indicating no user was available to confirm the request.</summary>
-/// <remarks>The <c>user-not-available</c> variant of <see cref="PermissionDecision"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionUserNotAvailable : PermissionDecision
-{
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "user-not-available";
+    /// <summary>Human-readable title for the selection UI.</summary>
+    [JsonPropertyName("title")]
+    public required string Title { get; set; }
 }
 
-/// <summary>Permission-decision variant indicating the request was approved.</summary>
-/// <remarks>The <c>approved</c> variant of <see cref="PermissionDecision"/>.</remarks>
+/// <summary>RPC data type for SlashCommandTimelineEntry operations.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApproved : PermissionDecision
+public sealed class SlashCommandTimelineEntry
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "approved";
+    /// <summary>Text displayed for the timeline entry.</summary>
+    [JsonPropertyName("text")]
+    public string Text { get; set; } = string.Empty;
+
+    /// <summary>Timeline entry presentation type.</summary>
+    [JsonPropertyName("type")]
+    public string Type { get; set; } = string.Empty;
+
+    /// <summary>Optional URL associated with the timeline entry.</summary>
+    [JsonPropertyName("url")]
+    public string? Url { get; set; }
 }
 
-/// <summary>Permission-decision variant indicating approval was remembered for the session, with approval details.</summary>
-/// <remarks>The <c>approved-for-session</c> variant of <see cref="PermissionDecision"/>.</remarks>
+/// <summary>The <c>add-timeline-entry</c> variant of <see cref="SlashCommandInvocationResult"/>.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApprovedForSession : PermissionDecision
+public partial class SlashCommandInvocationResultAddTimelineEntry : SlashCommandInvocationResult
 {
     /// <inheritdoc />
     [JsonIgnore]
-    public override string Kind => "approved-for-session";
+    public override string Kind => "add-timeline-entry";
 
-    /// <summary>The approval to add as a session-scoped rule.</summary>
-    [JsonPropertyName("approval")]
-    public required UserToolSessionApproval Approval { get; set; }
+    /// <summary>Timeline entry the host should append.</summary>
+    [JsonPropertyName("entry")]
+    public required SlashCommandTimelineEntry Entry { get; set; }
+
+    /// <summary>Optional text the host should prefill into the input editor.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("prefillInput")]
+    public string? PrefillInput { get; set; }
+
+    /// <summary>Whether command execution changed persisted runtime settings.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("runtimeSettingsChanged")]
+    public bool? RuntimeSettingsChanged { get; set; }
 }
 
-/// <summary>Permission-decision variant indicating approval was persisted for a project location, with approval details and location key.</summary>
-/// <remarks>The <c>approved-for-location</c> variant of <see cref="PermissionDecision"/>.</remarks>
+/// <summary>RPC data type for SlashCommandModelPickerDialog operations.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionApprovedForLocation : PermissionDecision
+public sealed class SlashCommandModelPickerDialog
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "approved-for-location";
+    /// <summary>Discriminator for a model-picker dialog.</summary>
+    [JsonPropertyName("kind")]
+    public string Kind { get; set; } = string.Empty;
 
-    /// <summary>The approval to persist for this location.</summary>
-    [JsonPropertyName("approval")]
-    public required UserToolSessionApproval Approval { get; set; }
+    /// <summary>Model that should be enabled before it can be selected.</summary>
+    [JsonPropertyName("modelToEnable")]
+    public string? ModelToEnable { get; set; }
 
-    /// <summary>The location key (git root or cwd) to persist the approval to.</summary>
-    [JsonPropertyName("locationKey")]
-    public required string LocationKey { get; set; }
+    /// <summary>Settings scope the picker should modify.</summary>
+    [JsonPropertyName("scope")]
+    public string? Scope { get; set; }
+
+    /// <summary>Model-selection target represented by the picker.</summary>
+    [JsonPropertyName("target")]
+    public string? Target { get; set; }
 }
 
-/// <summary>Permission-decision variant indicating the request was cancelled before use, with an optional reason.</summary>
-/// <remarks>The <c>cancelled</c> variant of <see cref="PermissionDecision"/>.</remarks>
+/// <summary>The <c>show-dialog</c> variant of <see cref="SlashCommandInvocationResult"/>.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionCancelled : PermissionDecision
+public partial class SlashCommandInvocationResultShowDialog : SlashCommandInvocationResult
 {
     /// <inheritdoc />
     [JsonIgnore]
-    public override string Kind => "cancelled";
+    public override string Kind => "show-dialog";
 
-    /// <summary>Optional explanation of why the request was cancelled.</summary>
+    /// <summary>Dialog the host should display.</summary>
+    [JsonPropertyName("dialog")]
+    public required SlashCommandModelPickerDialog Dialog { get; set; }
+
+    /// <summary>Whether command execution changed persisted runtime settings.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("reason")]
-    public string? Reason { get; set; }
+    [JsonPropertyName("runtimeSettingsChanged")]
+    public bool? RuntimeSettingsChanged { get; set; }
 }
 
-/// <summary>Permission-decision variant indicating explicit denial by permission rules, with the matching rules.</summary>
-/// <remarks>The <c>denied-by-rules</c> variant of <see cref="PermissionDecision"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionDeniedByRules : PermissionDecision
+/// <summary>User-settings snapshot to restore if the host cancels the model switch.</summary>
+public sealed class SlashCommandInvocationResultSetModelRevertOnCancel
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "denied-by-rules";
-
-    /// <summary>Rules that denied the request.</summary>
-    [JsonPropertyName("rules")]
-    public required IList<PermissionRule> Rules { get; set; }
 }
 
-/// <summary>Permission-decision variant indicating no approval rule matched and user confirmation was unavailable.</summary>
-/// <remarks>The <c>denied-no-approval-rule-and-could-not-request-from-user</c> variant of <see cref="PermissionDecision"/>.</remarks>
+/// <summary>The <c>set-model</c> variant of <see cref="SlashCommandInvocationResult"/>.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionDeniedNoApprovalRuleAndCouldNotRequestFromUser : PermissionDecision
+public partial class SlashCommandInvocationResultSetModel : SlashCommandInvocationResult
 {
     /// <inheritdoc />
     [JsonIgnore]
-    public override string Kind => "denied-no-approval-rule-and-could-not-request-from-user";
-}
+    public override string Kind => "set-model";
 
-/// <summary>Permission-decision variant indicating the user denied an interactive prompt, with optional feedback and force-reject flag.</summary>
-/// <remarks>The <c>denied-interactively-by-user</c> variant of <see cref="PermissionDecision"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionDeniedInteractivelyByUser : PermissionDecision
-{
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "denied-interactively-by-user";
+    /// <summary>Model selected by the command.</summary>
+    [JsonPropertyName("model")]
+    public required string Model { get; set; }
 
-    /// <summary>Optional feedback from the user explaining the denial.</summary>
+    /// <summary>Reasoning effort selected for the model.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("feedback")]
-    public string? Feedback { get; set; }
+    [JsonPropertyName("reasoningEffort")]
+    public string? ReasoningEffort { get; set; }
 
-    /// <summary>Whether to force-reject the current agent turn.</summary>
+    /// <summary>Repository settings scope modified by the command.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("forceReject")]
-    public bool? ForceReject { get; set; }
-}
+    [JsonPropertyName("repoScope")]
+    public string? RepoScope { get; set; }
 
-/// <summary>Permission-decision variant indicating denial by content-exclusion policy, with path and message.</summary>
-/// <remarks>The <c>denied-by-content-exclusion-policy</c> variant of <see cref="PermissionDecision"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionDeniedByContentExclusionPolicy : PermissionDecision
-{
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "denied-by-content-exclusion-policy";
+    /// <summary>User-settings snapshot to restore if the host cancels the model switch.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("revertOnCancel")]
+    public SlashCommandInvocationResultSetModelRevertOnCancel? RevertOnCancel { get; set; }
 
-    /// <summary>Human-readable explanation of why the path was excluded.</summary>
-    [JsonPropertyName("message")]
-    public required string Message { get; set; }
+    /// <summary>Whether command execution changed persisted runtime settings.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("runtimeSettingsChanged")]
+    public bool? RuntimeSettingsChanged { get; set; }
 
-    /// <summary>File path that triggered the exclusion.</summary>
-    [JsonPropertyName("path")]
-    public required string Path { get; set; }
+    /// <summary>Settings scope modified by the command.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("scope")]
+    public string? Scope { get; set; }
+
+    /// <summary>User-facing warning produced while selecting the model.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("warning")]
+    public string? Warning { get; set; }
 }
 
-/// <summary>Permission-decision variant indicating denial by a permission request hook, with optional message and interrupt flag.</summary>
-/// <remarks>The <c>denied-by-permission-request-hook</c> variant of <see cref="PermissionDecision"/>.</remarks>
+/// <summary>The <c>set-plan-model</c> variant of <see cref="SlashCommandInvocationResult"/>.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionDecisionDeniedByPermissionRequestHook : PermissionDecision
+public partial class SlashCommandInvocationResultSetPlanModel : SlashCommandInvocationResult
 {
     /// <inheritdoc />
     [JsonIgnore]
-    public override string Kind => "denied-by-permission-request-hook";
+    public override string Kind => "set-plan-model";
 
-    /// <summary>Whether to interrupt the current agent turn.</summary>
+    /// <summary>User-facing confirmation message for the plan-model selection.</summary>
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
+
+    /// <summary>Dedicated model selected for plan mode.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("interrupt")]
-    public bool? Interrupt { get; set; }
+    [JsonPropertyName("planModel")]
+    public string? PlanModel { get; set; }
 
-    /// <summary>Optional message from the hook explaining the denial.</summary>
+    /// <summary>Whether command execution changed persisted runtime settings.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("message")]
-    public string? Message { get; set; }
+    [JsonPropertyName("runtimeSettingsChanged")]
+    public bool? RuntimeSettingsChanged { get; set; }
 }
 
-/// <summary>Pending permission request ID and the decision to apply (approve/reject and scope).</summary>
+/// <summary>Slash command name and optional raw input string to invoke.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PermissionDecisionRequest
+internal sealed class CommandsInvokeRequest
 {
-    /// <summary>Optional informational context describing how and where this response was made. Omit it to preserve legacy behavior without attributing an origin.</summary>
-    [JsonPropertyName("decisionContext")]
-    public PermissionDecisionContext? DecisionContext { get; set; }
+    /// <summary>Raw input after the command name.</summary>
+    [JsonPropertyName("input")]
+    public string? Input { get; set; }
 
-    /// <summary>Request ID of the pending permission request.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
+    /// <summary>Command name. Leading slashes are stripped and the name is matched case-insensitively.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
 
-    /// <summary>The client's response to the pending permission prompt.</summary>
-    [JsonPropertyName("result")]
-    public PermissionDecision Result { get => field ??= new(); set; }
+    /// <summary>Optional client surface that initiated the invocation.</summary>
+    [JsonPropertyName("origin")]
+    public CommandsInvocationOrigin? Origin { get; set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Pending permission prompt reconstructed from event history, with request ID and user-facing prompt details.</summary>
+/// <summary>Whether finalizing the invocation effect succeeded, and the failure reason when it did not.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PendingPermissionRequest
+internal sealed class CommandsFinalizeInvocationEffectResult
 {
-    /// <summary>The user-facing permission prompt details (commands, write, read, mcp, url, memory, custom-tool, path, hook).</summary>
-    [JsonPropertyName("request")]
-    public PermissionPromptRequest Request { get; set; } = null!;
+    /// <summary>Failure reason when the invocation effect could not be finalized.</summary>
+    [JsonPropertyName("error")]
+    public string? Error { get; set; }
 
-    /// <summary>Unique identifier for the pending permission request.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
+    /// <summary>Whether the pending invocation effect was finalized successfully.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-/// <summary>List of pending permission requests reconstructed from event history.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class PendingPermissionRequestList
+/// <summary>The slash-command result object that produced the pending effect, echoed back unchanged.</summary>
+public sealed class CommandsFinalizeInvocationEffectRequestEffect
 {
-    /// <summary>Pending permission prompts reconstructed from the session's event history. Equivalent to the set of `permission.requested` events that have not yet been followed by a matching `permission.completed` event. Used by clients (e.g. the CLI) to hydrate UI for prompts that were emitted before the client attached to the session.</summary>
-    [JsonPropertyName("items")]
-    public IList<PendingPermissionRequest> Items { get => field ??= []; set; }
 }
 
-/// <summary>No parameters; returns currently-pending permission requests for the session.</summary>
+/// <summary>The pending slash-command invocation effect to finalize, plus whether the host applied or cancelled it.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PermissionsPendingRequestsRequest
+internal sealed class CommandsFinalizeInvocationEffectRequest
 {
+    /// <summary>The slash-command result object that produced the pending effect, echoed back unchanged.</summary>
+    [JsonPropertyName("effect")]
+    public CommandsFinalizeInvocationEffectRequestEffect Effect { get => field ??= new(); set; }
+
+    /// <summary>Whether the host applied or cancelled the pending invocation effect.</summary>
+    [JsonPropertyName("outcome")]
+    public CommandsInvocationEffectOutcome Outcome { get; set; }
+
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether the operation succeeded.</summary>
+/// <summary>Indicates whether the pending client-handled command was completed successfully.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PermissionsSetApproveAllResult
+public sealed class CommandsHandlePendingCommandResult
 {
-    /// <summary>Whether the operation succeeded.</summary>
+    /// <summary>Whether the command was handled successfully.</summary>
     [JsonPropertyName("success")]
     public bool Success { get; set; }
 }
 
-/// <summary>Allow-all toggle for tool permission requests, with an optional telemetry source.</summary>
+/// <summary>Pending command request ID and an optional error if the client handler failed.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PermissionsSetApproveAllRequest
+internal sealed class CommandsHandlePendingCommandRequest
 {
-    /// <summary>Whether to auto-approve all tool permission requests.</summary>
-    [JsonPropertyName("enabled")]
-    public bool Enabled { get; set; }
+    /// <summary>Error message if the command handler failed.</summary>
+    [JsonPropertyName("error")]
+    public string? Error { get; set; }
+
+    /// <summary>Request ID from the command invocation event.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
-
-    /// <summary>Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers.</summary>
-    [JsonPropertyName("source")]
-    public PermissionsSetApproveAllSource? Source { get; set; }
 }
 
-/// <summary>Indicates whether the operation succeeded and reports the post-mutation state.</summary>
+/// <summary>Error message produced while executing the command, if any.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class AllowAllPermissionSetResult
+public sealed class ExecuteCommandResult
 {
-    /// <summary>Authoritative full allow-all state after the mutation.</summary>
-    [JsonPropertyName("enabled")]
-    public bool Enabled { get; set; }
-
-    /// <summary>Authoritative allow-all mode after the mutation.</summary>
-    [JsonPropertyName("mode")]
-    public PermissionsAllowAllMode? Mode { get; set; }
-
-    /// <summary>Whether the operation succeeded.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
+    /// <summary>Error message produced while executing the command, if any. Omitted when the handler succeeded.</summary>
+    [JsonPropertyName("error")]
+    public string? Error { get; set; }
 }
 
-/// <summary>Allow-all mode to apply for the session.</summary>
+/// <summary>Slash command name and argument string to execute synchronously.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PermissionsSetAllowAllRequest
+internal sealed class ExecuteCommandParams
 {
-    /// <summary>Legacy full allow-all toggle. Prefer `mode`; when `mode` is omitted, `enabled: true` is treated as `mode: "on"` and any other value is treated as `mode: "off"`.</summary>
-    [JsonPropertyName("enabled")]
-    public bool? Enabled { get; set; }
-
-    /// <summary>Allow-all mode to apply. `on` enables full allow-all; `auto` enables advisory LLM auto-approval; `off` disables both.</summary>
-    [JsonPropertyName("mode")]
-    public PermissionsAllowAllMode? Mode { get; set; }
+    /// <summary>Argument string to pass to the command (empty string if none).</summary>
+    [JsonPropertyName("args")]
+    public string Args { get; set; } = string.Empty;
 
-    /// <summary>Optional model id for the `auto` mode auto-approval LLM judging. Only meaningful when `mode` is `auto`; ignored otherwise. When omitted, the session resolves a default judge model: `gpt-5.5` for CAPI sessions and the session's active model for BYOK sessions.</summary>
-    [JsonPropertyName("model")]
-    public string? Model { get; set; }
+    /// <summary>Name of the slash command to invoke (without the leading '/').</summary>
+    [JsonPropertyName("commandName")]
+    public string CommandName { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
-
-    /// <summary>Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers.</summary>
-    [JsonPropertyName("source")]
-    public PermissionsSetAllowAllSource? Source { get; set; }
 }
 
-/// <summary>Current allow-all permission mode.</summary>
+/// <summary>Indicates whether the command was accepted into the local execution queue.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class AllowAllPermissionState
+public sealed class EnqueueCommandResult
 {
-    /// <summary>Whether full allow-all permissions are currently active.</summary>
-    [JsonPropertyName("enabled")]
-    public bool Enabled { get; set; }
-
-    /// <summary>Current allow-all mode.</summary>
-    [JsonPropertyName("mode")]
-    public PermissionsAllowAllMode? Mode { get; set; }
+    /// <summary>True when the command was accepted into the local execution queue. False when the call targets a session that does not support local command queueing (e.g. remote sessions).</summary>
+    [JsonPropertyName("queued")]
+    public bool Queued { get; set; }
 }
 
-/// <summary>No parameters.</summary>
+/// <summary>Slash-prefixed command string to enqueue for FIFO processing.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PermissionsGetAllowAllRequest
+internal sealed class EnqueueCommandParams
 {
+    /// <summary>Slash-prefixed command string to enqueue, e.g. '/compact' or '/model gpt-4'. Queued FIFO with any in-flight items; if the session is idle, processing kicks off immediately.</summary>
+    [JsonPropertyName("command")]
+    public string Command { get; set; } = string.Empty;
+
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether the operation succeeded.</summary>
+/// <summary>Indicates whether the queued-command response was matched to a pending request.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PermissionsModifyRulesResult
+public sealed class CommandsRespondToQueuedCommandResult
 {
-    /// <summary>Whether the operation succeeded.</summary>
+    /// <summary>Whether a pending queued command with the given request ID was found and resolved. False when the request was already resolved, cancelled, or unknown.</summary>
     [JsonPropertyName("success")]
     public bool Success { get; set; }
 }
 
-/// <summary>Scope and add/remove instructions for modifying session- or location-scoped permission rules.</summary>
+/// <summary>Result of the queued command execution.</summary>
+/// <remarks>Data type discriminated by <c>handled</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PermissionsModifyRulesParams
+public partial class QueuedCommandResult
 {
-    /// <summary>Rules to add to the scope. Applied before `remove`/`removeAll`.</summary>
-    [JsonPropertyName("add")]
-    public IList<PermissionRule>? Add { get; set; }
+    /// <summary>The boolean discriminator.</summary>
+    [JsonPropertyName("handled")]
+    public bool Handled { get; set; }
 
-    /// <summary>Specific rules to remove from the scope. Ignored when `removeAll` is true.</summary>
-    [JsonPropertyName("remove")]
-    public IList<PermissionRule>? Remove { get; set; }
+    /// <summary>When true, the runtime will not process subsequent queued commands until a new request comes in.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("stopProcessingQueue")]
+    public bool? StopProcessingQueue { get; set; }
+}
 
-    /// <summary>When true, removes every rule currently in the scope (after any `add` is applied). Useful for clearing the location scope wholesale.</summary>
-    [JsonPropertyName("removeAll")]
-    public bool? RemoveAll { get; set; }
+/// <summary>Queued-command request ID and the result indicating whether the host executed it (and whether to stop processing further queued commands).</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class CommandsRespondToQueuedCommandRequest
+{
+    /// <summary>Request ID from the `command.queued` event the host is responding to.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
 
-    /// <summary>Whether the change applies to ephemeral session-scoped rules (cleared at session end) or to location-scoped rules persisted via the location-permissions config file.</summary>
-    [JsonPropertyName("scope")]
-    public PermissionsModifyRulesScope Scope { get; set; }
+    /// <summary>Result of the queued command execution.</summary>
+    [JsonPropertyName("result")]
+    public QueuedCommandResult Result { get => field ??= new(); set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether the operation succeeded.</summary>
+/// <summary>Telemetry engagement ID for the session, when available.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PermissionsSetRequiredResult
+public sealed class SessionTelemetryEngagement
 {
-    /// <summary>Whether the operation succeeded.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
+    /// <summary>Current telemetry engagement ID, when available.</summary>
+    [JsonPropertyName("engagementId")]
+    public string? EngagementId { get; set; }
 }
 
-/// <summary>Toggles whether permission prompts should be bridged into session events for this client.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PermissionsSetRequiredRequest
+internal sealed class SessionTelemetryGetEngagementIdRequest
 {
-    /// <summary>Whether the client wants `permission.requested` events bridged from the session-owned permission service. CLI clients that render prompt UI set this to `true` for as long as their listener is mounted; headless callers leave it unset (the default is `false`).</summary>
-    [JsonPropertyName("required")]
-    public bool Required { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Feature override key/value pairs to attach to subsequent telemetry events from this session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class TelemetrySetFeatureOverridesRequest
+{
+    /// <summary>Override key/value pairs to attach to subsequent telemetry events from this session. Replaces any previously-set overrides.</summary>
+    [JsonPropertyName("features")]
+    public IDictionary<string, string> Features { get => field ??= new Dictionary<string, string>(); set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether the operation succeeded.</summary>
+/// <summary>Completed transient query. Ordered chunks and the terminal outcome are also delivered through `ui.ephemeral_query` session events while it runs.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PermissionsResetSessionApprovalsResult
+public sealed class UIEphemeralQueryResult
 {
-    /// <summary>Whether the operation succeeded.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
+    /// <summary>Answer returned by the model.</summary>
+    [JsonPropertyName("answer")]
+    public string Answer { get; set; } = string.Empty;
 }
 
-/// <summary>Clears session-scoped tool permission approvals, and optionally the location-scoped ones.</summary>
+/// <summary>Transient question to answer without adding it to conversation history.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PermissionsResetSessionApprovalsRequest
+internal sealed class UIEphemeralQueryRequest
 {
-    /// <summary>Whether location-scoped approvals are cleared too. Defaults to `true`.</summary>
-    [JsonPropertyName("includeLocation")]
-    public bool? IncludeLocation { get; set; }
+    /// <summary>Question to answer from the current conversation context.</summary>
+    [JsonPropertyName("question")]
+    public string Question { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether the operation succeeded.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class PermissionsNotifyPromptShownResult
+/// <summary>MCP response metadata.</summary>
+public sealed class UIElicitationResponseMeta
 {
-    /// <summary>Whether the operation succeeded.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
 }
 
-/// <summary>Notification payload describing the permission prompt that the client just rendered.</summary>
+/// <summary>The elicitation response (accept with form values, decline, or cancel).</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PermissionPromptShownNotification
+public sealed class UIElicitationResponse
 {
-    /// <summary>Human-readable description of the prompt the user is being asked to approve. Used by the runtime to fire the registered `permission_prompt` notification hook (e.g. terminal bell, desktop notification).</summary>
-    [JsonPropertyName("message")]
-    public string Message { get; set; } = string.Empty;
+    /// <summary>MCP response metadata.</summary>
+    [JsonPropertyName("_meta")]
+    public UIElicitationResponseMeta? Meta { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>The user's response: accept (submitted), decline (rejected), or cancel (dismissed).</summary>
+    [JsonPropertyName("action")]
+    public UIElicitationResponseAction Action { get; set; }
+
+    /// <summary>The form values submitted by the user (present when action is 'accept').</summary>
+    [JsonPropertyName("content")]
+    public IDictionary<string, JsonElement>? Content { get; set; }
 }
 
-/// <summary>Snapshot of the session's allow-listed directories and primary working directory.</summary>
+/// <summary>MCP request metadata.</summary>
+public sealed class UIElicitationRequestMeta
+{
+}
+
+/// <summary>JSON Schema describing the form fields to present to the user.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PermissionPathsList
+public sealed class UIElicitationSchema
 {
-    /// <summary>All directories currently allowed for tool access on this session.</summary>
-    [JsonPropertyName("directories")]
-    public IList<string> Directories { get => field ??= []; set; }
+    /// <summary>Form field definitions, keyed by field name.</summary>
+    [JsonPropertyName("properties")]
+    public IDictionary<string, JsonElement> Properties { get => field ??= new Dictionary<string, JsonElement>(); set; }
 
-    /// <summary>The primary working directory for this session.</summary>
-    [JsonPropertyName("primary")]
-    public string Primary { get; set; } = string.Empty;
+    /// <summary>List of required field names.</summary>
+    [JsonPropertyName("required")]
+    public IList<string>? Required { get; set; }
+
+    /// <summary>Schema type indicator (always 'object').</summary>
+    [JsonPropertyName("type")]
+    public string Type { get; set; } = string.Empty;
 }
 
-/// <summary>No parameters; returns the session's allow-listed directories.</summary>
+/// <summary>Metadata controlling an MCP task's lifetime.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PermissionsPathsListRequest
+public sealed class McpTaskMetadata
+{
+    /// <summary>Task time-to-live.</summary>
+    [JsonPropertyName("ttl")]
+    public long? Ttl { get; set; }
+}
+
+/// <summary>Prompt message and JSON schema describing the form fields to elicit from the user.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class UIElicitationRequest
 {
+    /// <summary>MCP request metadata.</summary>
+    [JsonPropertyName("_meta")]
+    public UIElicitationRequestMeta? Meta { get; set; }
+
+    /// <summary>Message describing what information is needed from the user.</summary>
+    [JsonPropertyName("message")]
+    public string Message { get; set; } = string.Empty;
+
+    /// <summary>Elicitation mode. Omitted and form are equivalent for structured elicitation.</summary>
+    [JsonPropertyName("mode")]
+    public McpElicitationFormMode? Mode { get; set; }
+
+    /// <summary>JSON Schema describing the form fields to present to the user.</summary>
+    [JsonPropertyName("requestedSchema")]
+    public UIElicitationSchema RequestedSchema { get => field ??= new(); set; }
+
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>MCP task metadata.</summary>
+    [JsonPropertyName("task")]
+    public McpTaskMetadata? Task { get; set; }
 }
 
-/// <summary>Indicates whether the operation succeeded.</summary>
+/// <summary>Indicates whether the elicitation response was accepted; false if it was already resolved by another client.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PermissionsPathsAddResult
+public sealed class UIElicitationResult
 {
-    /// <summary>Whether the operation succeeded.</summary>
+    /// <summary>Whether the response was accepted. False if the request was already resolved by another client.</summary>
     [JsonPropertyName("success")]
     public bool Success { get; set; }
 }
 
-/// <summary>Directory path to add to the session's allowed directories.</summary>
+/// <summary>Pending elicitation request ID and the user's response (accept/decline/cancel + form values).</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PermissionPathsAddParams
+internal sealed class UIHandlePendingElicitationRequest
 {
-    /// <summary>Directory to add to the allow-list. The runtime resolves and validates the path before adding.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+    /// <summary>The unique request ID from the elicitation.requested event.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
+
+    /// <summary>The elicitation response (accept with form values, decline, or cancel).</summary>
+    [JsonPropertyName("result")]
+    public UIElicitationResponse Result { get => field ??= new(); set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether the operation succeeded.</summary>
+/// <summary>Indicates whether the pending UI request was resolved by this call.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PermissionsPathsUpdatePrimaryResult
+public sealed class UIHandlePendingResult
 {
-    /// <summary>Whether the operation succeeded.</summary>
+    /// <summary>True if the request was still pending and was resolved by this call. False if the request ID was unknown, already resolved by another client (e.g. GitHub), expired, or otherwise no longer pending.</summary>
     [JsonPropertyName("success")]
     public bool Success { get; set; }
 }
 
-/// <summary>Directory path to set as the session's new primary working directory.</summary>
+/// <summary>User response for a pending user-input request, with answer text and whether it was typed freeform.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PermissionPathsUpdatePrimaryParams
+public sealed class UIUserInputResponse
 {
-    /// <summary>Directory to set as the new primary working directory for the session's permission policy.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+    /// <summary>The user's answer text.</summary>
+    [JsonPropertyName("answer")]
+    public string Answer { get; set; } = string.Empty;
+
+    /// <summary>True if the user typed a freeform response, false if they selected a presented choice. Used by telemetry to differentiate between free text input and choice selection.</summary>
+    [JsonPropertyName("wasFreeform")]
+    public bool WasFreeform { get; set; }
+}
+
+/// <summary>Request ID of a pending `user_input.requested` event and the user's response.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class UIHandlePendingUserInputRequest
+{
+    /// <summary>The unique request ID from the user_input.requested event.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
+
+    /// <summary>User response for a pending user-input request, with answer text and whether it was typed freeform.</summary>
+    [JsonPropertyName("response")]
+    public UIUserInputResponse Response { get => field ??= new(); set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether the supplied path is within the session's allowed directories.</summary>
+/// <summary>Optional sampling result payload. Omit to reject/cancel the sampling request without providing a result.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PermissionPathsAllowedCheckResult
+public sealed class UIHandlePendingSamplingResponse
 {
-    /// <summary>Whether the path is within the session's allowed directories.</summary>
-    [JsonPropertyName("allowed")]
-    public bool Allowed { get; set; }
 }
 
-/// <summary>Path to evaluate against the session's allowed directories.</summary>
+/// <summary>Request ID of a pending `sampling.requested` event and an optional sampling result payload (omit to reject).</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PermissionPathsAllowedCheckParams
+internal sealed class UIHandlePendingSamplingRequest
 {
-    /// <summary>Path to check against the session's allowed directories.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+    /// <summary>The unique request ID from the sampling.requested event.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
+
+    /// <summary>Optional sampling result payload. Omit to reject/cancel the sampling request without providing a result.</summary>
+    [JsonPropertyName("response")]
+    public UIHandlePendingSamplingResponse? Response { get; set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether the supplied path is within the session's workspace directory.</summary>
+/// <summary>Request ID of a pending `auto_mode_switch.requested` event and the user's response.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PermissionPathsWorkspaceCheckResult
+internal sealed class UIHandlePendingAutoModeSwitchRequest
 {
-    /// <summary>Whether the path is within the session workspace directory.</summary>
-    [JsonPropertyName("allowed")]
-    public bool Allowed { get; set; }
-}
+    /// <summary>The unique request ID from the auto_mode_switch.requested event.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
 
-/// <summary>Path to evaluate against the session's workspace (primary) directory.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class PermissionPathsWorkspaceCheckParams
-{
-    /// <summary>Path to check against the session workspace directory.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+    /// <summary>User's choice for auto-mode switching: yes (allow this turn), yes_always (allow + persist as setting), or no (decline).</summary>
+    [JsonPropertyName("response")]
+    public UIAutoModeSwitchResponse Response { get; set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Resolved location-permissions key and type.</summary>
+/// <summary>The user's selected action for an exhausted session limit.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PermissionLocationResolveResult
+public sealed class UISessionLimitsExhaustedResponse
 {
-    /// <summary>Location key used in the location-permissions store.</summary>
-    [JsonPropertyName("locationKey")]
-    public string LocationKey { get; set; } = string.Empty;
+    /// <summary>Action selected by the user.</summary>
+    [JsonPropertyName("action")]
+    public UISessionLimitsExhaustedResponseAction Action { get; set; }
 
-    /// <summary>Whether the location is a git repo or directory.</summary>
-    [JsonPropertyName("locationType")]
-    public PermissionLocationType LocationType { get; set; }
+    /// <summary>AI Credits to add to the current max when action is 'add'.</summary>
+    [JsonPropertyName("additionalAiCredits")]
+    public double? AdditionalAiCredits { get; set; }
+
+    /// <summary>New absolute max AI Credits when action is 'set'.</summary>
+    [JsonPropertyName("maxAiCredits")]
+    public double? MaxAiCredits { get; set; }
 }
 
-/// <summary>Working directory to resolve into a location-permissions key.</summary>
+/// <summary>Request ID of a pending `session_limits_exhausted.requested` event and the user's selected limit action.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PermissionLocationResolveParams
+internal sealed class UIHandlePendingSessionLimitsExhaustedRequest
 {
+    /// <summary>The unique request ID from the session_limits_exhausted.requested event.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
+
+    /// <summary>The selected session-limit action.</summary>
+    [JsonPropertyName("response")]
+    public UISessionLimitsExhaustedResponse Response { get => field ??= new(); set; }
+
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
-
-    /// <summary>Working directory whose permission location should be resolved.</summary>
-    [JsonPropertyName("workingDirectory")]
-    public string WorkingDirectory { get; set; } = string.Empty;
 }
 
-/// <summary>Summary of persisted location permissions applied to the session.</summary>
+/// <summary>User response for a pending exit-plan-mode request, with approval state, selected action, auto-approve flag, and feedback.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PermissionLocationApplyResult
+public sealed class UIExitPlanModeResponse
 {
-    /// <summary>Number of persisted allowed directories added to the live path manager.</summary>
-    [JsonPropertyName("appliedDirectoryCount")]
-    public long AppliedDirectoryCount { get; set; }
-
-    /// <summary>Number of location-scoped rules added to the live permission service.</summary>
-    [JsonPropertyName("appliedRuleCount")]
-    public long AppliedRuleCount { get; set; }
+    /// <summary>Whether the plan was approved.</summary>
+    [JsonPropertyName("approved")]
+    public bool Approved { get; set; }
 
-    /// <summary>Location-scoped rules applied to the live permission service.</summary>
-    [JsonPropertyName("appliedRules")]
-    public IList<PermissionRule> AppliedRules { get => field ??= []; set; }
+    /// <summary>Whether subsequent edits should be auto-approved without confirmation.</summary>
+    [JsonPropertyName("autoApproveEdits")]
+    public bool? AutoApproveEdits { get; set; }
 
-    /// <summary>Whether a different location was applied since the previous apply call.</summary>
-    [JsonPropertyName("changed")]
-    public bool Changed { get; set; }
+    /// <summary>When true, the agent is instructed to end its turn without starting implementation so the client can restore the session model and auto-submit a fresh implementation turn on it. Set only when a distinct plan configuration (a different model, reasoning effort, or context tier) actually ran the planning turn.</summary>
+    [JsonPropertyName("deferImplementation")]
+    public bool? DeferImplementation { get; set; }
 
-    /// <summary>Location key used in the location-permissions store.</summary>
-    [JsonPropertyName("locationKey")]
-    public string LocationKey { get; set; } = string.Empty;
+    /// <summary>Feedback from the user when they declined the plan or requested changes.</summary>
+    [JsonPropertyName("feedback")]
+    public string? Feedback { get; set; }
 
-    /// <summary>Whether the location is a git repo or directory.</summary>
-    [JsonPropertyName("locationType")]
-    public PermissionLocationType LocationType { get; set; }
+    /// <summary>The action the user selected. Defaults to 'autopilot' when autoApproveEdits is true, otherwise 'interactive'.</summary>
+    [JsonPropertyName("selectedAction")]
+    public UIExitPlanModeAction? SelectedAction { get; set; }
 }
 
-/// <summary>Working directory to load persisted location permissions for.</summary>
+/// <summary>Request ID of a pending `exit_plan_mode.requested` event and the user's response.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PermissionLocationApplyParams
+internal sealed class UIHandlePendingExitPlanModeRequest
 {
+    /// <summary>The unique request ID from the exit_plan_mode.requested event.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
+
+    /// <summary>User response for a pending exit-plan-mode request, with approval state, selected action, auto-approve flag, and feedback.</summary>
+    [JsonPropertyName("response")]
+    public UIExitPlanModeResponse Response { get => field ??= new(); set; }
+
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
-
-    /// <summary>Working directory whose persisted location permissions should be applied.</summary>
-    [JsonPropertyName("workingDirectory")]
-    public string WorkingDirectory { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether the operation succeeded.</summary>
+/// <summary>Register an in-process handler for `auto_mode_switch.requested` events. The caller still attaches the actual listener via the standard event-subscription mechanism; this registration solely tells the server bridge to skip its own dispatch (so a remote client doesn't race the in-process handler for the same requestId).</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PermissionsLocationsAddToolApprovalResult
+public sealed class UIRegisterDirectAutoModeSwitchHandlerResult
 {
-    /// <summary>Whether the operation succeeded.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
+    /// <summary>Opaque handle representing the registration. Pass this same handle to `unregisterDirectAutoModeSwitchHandler` when the in-process handler is no longer active. Multiple registrations are reference-counted; the server bridge will only dispatch auto-mode-switch requests when no handles are active.</summary>
+    [JsonPropertyName("handle")]
+    public string Handle { get; set; } = string.Empty;
 }
 
-/// <summary>Tool approval to persist and apply.</summary>
-/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-[JsonPolymorphic(
-    TypeDiscriminatorPropertyName = "kind",
-    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
-[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsCommands), "commands")]
-[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsRead), "read")]
-[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsWrite), "write")]
-[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsMcp), "mcp")]
-[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsMcpSampling), "mcp-sampling")]
-[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsMemory), "memory")]
-[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsCustomTool), "custom-tool")]
-[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsExtensionManagement), "extension-management")]
-[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsFactory), "factory")]
-[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsExtensionPermissionAccess), "extension-permission-access")]
-[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsExtensionEnvAccess), "extension-env-access")]
-public partial class PermissionsLocationsAddToolApprovalDetails
+internal sealed class SessionUiRegisterDirectAutoModeSwitchHandlerRequest
 {
-    /// <summary>The type discriminator.</summary>
-    [JsonPropertyName("kind")]
-    public virtual string Kind { get; set; } = string.Empty;
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
+/// <summary>Indicates whether the handle was active and the registration count was decremented.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class UIUnregisterDirectAutoModeSwitchHandlerResult
+{
+    /// <summary>True if the handle was active and decremented the counter; false if the handle was unknown.</summary>
+    [JsonPropertyName("unregistered")]
+    public bool Unregistered { get; set; }
+}
 
-/// <summary>Location-persisted tool approval details for specific command identifiers.</summary>
-/// <remarks>The <c>commands</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
+/// <summary>Opaque handle previously returned by `registerDirectAutoModeSwitchHandler` to release.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionsLocationsAddToolApprovalDetailsCommands : PermissionsLocationsAddToolApprovalDetails
+internal sealed class UIUnregisterDirectAutoModeSwitchHandlerRequest
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "commands";
+    /// <summary>Handle previously returned by `registerDirectAutoModeSwitchHandler`.</summary>
+    [JsonPropertyName("handle")]
+    public string Handle { get; set; } = string.Empty;
 
-    /// <summary>Command identifiers covered by this approval.</summary>
-    [JsonPropertyName("commandIdentifiers")]
-    public required IList<string> CommandIdentifiers { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Location-persisted tool approval details for read-only filesystem operations.</summary>
-/// <remarks>The <c>read</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
+/// <summary>Indicates whether the operation succeeded.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionsLocationsAddToolApprovalDetailsRead : PermissionsLocationsAddToolApprovalDetails
+public sealed class PermissionsConfigureResult
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "read";
+    /// <summary>Whether the operation succeeded.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-/// <summary>Location-persisted tool approval details for filesystem write operations.</summary>
-/// <remarks>The <c>write</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
+/// <summary>Source descriptor for a `session.permissions.configure` content-exclusion rule, with source name and type.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionsLocationsAddToolApprovalDetailsWrite : PermissionsLocationsAddToolApprovalDetails
+public sealed class PermissionsConfigureAdditionalContentExclusionPolicyRuleSource
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "write";
+    /// <summary>Name of the policy source.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
+
+    /// <summary>Type of the policy source.</summary>
+    [JsonPropertyName("type")]
+    public string Type { get; set; } = string.Empty;
 }
 
-/// <summary>Location-persisted tool approval details for an MCP server tool, or all tools when `toolName` is null.</summary>
-/// <remarks>The <c>mcp</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
+/// <summary>Single content-exclusion rule supplied to `session.permissions.configure`, with paths, match conditions, and source.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionsLocationsAddToolApprovalDetailsMcp : PermissionsLocationsAddToolApprovalDetails
+public sealed class PermissionsConfigureAdditionalContentExclusionPolicyRule
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "mcp";
+    /// <summary>Conditions of which at least one must match.</summary>
+    [JsonPropertyName("ifAnyMatch")]
+    public IList<string>? IfAnyMatch { get; set; }
 
-    /// <summary>MCP server name.</summary>
-    [JsonPropertyName("serverName")]
-    public required string ServerName { get; set; }
+    /// <summary>Conditions none of which may match.</summary>
+    [JsonPropertyName("ifNoneMatch")]
+    public IList<string>? IfNoneMatch { get; set; }
 
-    /// <summary>MCP tool name, or null to cover every tool on the server.</summary>
-    [JsonPropertyName("toolName")]
-    public string? ToolName { get; set; }
+    /// <summary>Path patterns covered by this rule.</summary>
+    [JsonPropertyName("paths")]
+    public IList<string> Paths { get => field ??= []; set; }
+
+    /// <summary>Source descriptor for a `session.permissions.configure` content-exclusion rule, with source name and type.</summary>
+    [JsonPropertyName("source")]
+    public PermissionsConfigureAdditionalContentExclusionPolicyRuleSource Source { get => field ??= new(); set; }
 }
 
-/// <summary>Location-persisted tool approval details for MCP sampling requests from a server.</summary>
-/// <remarks>The <c>mcp-sampling</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
+/// <summary>Content-exclusion policy supplied to `session.permissions.configure`, with rules, last-updated data, and scope.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionsLocationsAddToolApprovalDetailsMcpSampling : PermissionsLocationsAddToolApprovalDetails
+public sealed class PermissionsConfigureAdditionalContentExclusionPolicy
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "mcp-sampling";
+    /// <summary>Opaque policy update timestamp supplied by the host.</summary>
+    [JsonPropertyName("last_updated_at")]
+    public JsonElement LastUpdatedAt { get; set; }
 
-    /// <summary>MCP server name.</summary>
-    [JsonPropertyName("serverName")]
-    public required string ServerName { get; set; }
+    /// <summary>Content-exclusion rules to apply.</summary>
+    [JsonPropertyName("rules")]
+    public IList<PermissionsConfigureAdditionalContentExclusionPolicyRule> Rules { get => field ??= []; set; }
+
+    /// <summary>Allowed values for the `PermissionsConfigureAdditionalContentExclusionPolicyScope` enumeration.</summary>
+    [JsonPropertyName("scope")]
+    public PermissionsConfigureAdditionalContentExclusionPolicyScope Scope { get; set; }
 }
 
-/// <summary>Location-persisted tool approval details for writes to long-term memory.</summary>
-/// <remarks>The <c>memory</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
+/// <summary>If specified, replaces the session's path-permission policy. The runtime constructs the appropriate PathManager based on these inputs (rooted at the session's working directory). Omit to leave the current path policy unchanged.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionsLocationsAddToolApprovalDetailsMemory : PermissionsLocationsAddToolApprovalDetails
+public sealed class PermissionPathsConfig
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "memory";
+    /// <summary>Additional directories to allow tool access to (in addition to the session's working directory). When `unrestricted` is true, these are still pre-populated on the UnrestrictedPathManager so they remain visible via getDirectories() (e.g. for @-mention completion).</summary>
+    [JsonPropertyName("additionalDirectories")]
+    public IList<string>? AdditionalDirectories { get; set; }
+
+    /// <summary>Whether to include the system temp directory in the allowed list (defaults to true). Ignored when `unrestricted` is true.</summary>
+    [JsonPropertyName("includeTempDirectory")]
+    public bool? IncludeTempDirectory { get; set; }
+
+    /// <summary>If true, the runtime allows access to all paths without prompting. Equivalent to constructing an UnrestrictedPathManager.</summary>
+    [JsonPropertyName("unrestricted")]
+    public bool? Unrestricted { get; set; }
+
+    /// <summary>Workspace root path (special-cased to be allowed even before the directory exists). Ignored when `unrestricted` is true.</summary>
+    [JsonPropertyName("workspacePath")]
+    public string? WorkspacePath { get; set; }
 }
 
-/// <summary>Location-persisted tool approval details for a custom tool, keyed by tool name.</summary>
-/// <remarks>The <c>custom-tool</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
+/// <summary>If specified, replaces the session's approved/denied permission rules. Omit to leave the current rules unchanged.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionsLocationsAddToolApprovalDetailsCustomTool : PermissionsLocationsAddToolApprovalDetails
+public sealed class PermissionRulesSet
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "custom-tool";
+    /// <summary>Rules that auto-approve matching requests.</summary>
+    [JsonPropertyName("approved")]
+    public IList<PermissionRule> Approved { get => field ??= []; set; }
 
-    /// <summary>Custom tool name.</summary>
-    [JsonPropertyName("toolName")]
-    public required string ToolName { get; set; }
+    /// <summary>Rules that auto-deny matching requests.</summary>
+    [JsonPropertyName("denied")]
+    public IList<PermissionRule> Denied { get => field ??= []; set; }
 }
 
-/// <summary>Location-persisted tool approval details for extension-management operations, optionally narrowed by operation.</summary>
-/// <remarks>The <c>extension-management</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
+/// <summary>If specified, replaces the session's URL-permission policy. The runtime constructs a fresh DefaultUrlManager based on these inputs. Omit to leave the current URL policy unchanged.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionsLocationsAddToolApprovalDetailsExtensionManagement : PermissionsLocationsAddToolApprovalDetails
+public sealed class PermissionUrlsConfig
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "extension-management";
+    /// <summary>Initial list of allowed URL/domain patterns. Patterns may include path components. Ignored when `unrestricted` is true.</summary>
+    [JsonPropertyName("initialAllowed")]
+    public IList<string>? InitialAllowed { get; set; }
 
-    /// <summary>Optional operation identifier; when omitted, the approval covers all extension management operations.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("operation")]
-    public string? Operation { get; set; }
+    /// <summary>If true, the runtime allows access to all URLs without prompting. Initial allow-list is ignored when this is true.</summary>
+    [JsonPropertyName("unrestricted")]
+    public bool? Unrestricted { get; set; }
 }
 
-/// <summary>Location-persisted factory approval, optionally narrowed by approval key.</summary>
-/// <remarks>The <c>factory</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
+/// <summary>Patch of permission policy fields to apply (omit a field to leave it unchanged).</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionsLocationsAddToolApprovalDetailsFactory : PermissionsLocationsAddToolApprovalDetails
+internal sealed class PermissionsConfigureParams
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "factory";
+    /// <summary>If specified, replaces the host-supplied GitHub Content Exclusion policies on the session (combined with natively-discovered policies when evaluating tool/file access). Omit to leave the current policies unchanged.</summary>
+    [JsonPropertyName("additionalContentExclusionPolicies")]
+    public IList<PermissionsConfigureAdditionalContentExclusionPolicy>? AdditionalContentExclusionPolicies { get; set; }
 
-    /// <summary>Optional factory operation name or canonical approval key; when omitted, the approval covers all factory operations.</summary>
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("approvalKey")]
-    public string? ApprovalKey { get; set; }
-}
+    /// <summary>If specified, sets whether path/URL read permission requests are auto-approved. Omit to leave the current value unchanged.</summary>
+    [JsonPropertyName("approveAllReadPermissionRequests")]
+    public bool? ApproveAllReadPermissionRequests { get; set; }
 
-/// <summary>Location-persisted tool approval details for an extension's permission-gated capability access, keyed by extension name.</summary>
-/// <remarks>The <c>extension-permission-access</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
-public partial class PermissionsLocationsAddToolApprovalDetailsExtensionPermissionAccess : PermissionsLocationsAddToolApprovalDetails
-{
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "extension-permission-access";
+    /// <summary>If specified, sets whether tool permission requests are auto-approved without prompting. Omit to leave the current value unchanged.</summary>
+    [JsonPropertyName("approveAllToolPermissionRequests")]
+    public bool? ApproveAllToolPermissionRequests { get; set; }
 
-    /// <summary>Extension name.</summary>
-    [JsonPropertyName("extensionName")]
-    public required string ExtensionName { get; set; }
+    /// <summary>If specified, replaces the session's path-permission policy. The runtime constructs the appropriate PathManager based on these inputs (rooted at the session's working directory). Omit to leave the current path policy unchanged.</summary>
+    [JsonPropertyName("paths")]
+    public PermissionPathsConfig? Paths { get; set; }
+
+    /// <summary>If specified, replaces the session's approved/denied permission rules. Omit to leave the current rules unchanged.</summary>
+    [JsonPropertyName("rules")]
+    public PermissionRulesSet? Rules { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>If specified, replaces the session's URL-permission policy. The runtime constructs a fresh DefaultUrlManager based on these inputs. Omit to leave the current URL policy unchanged.</summary>
+    [JsonPropertyName("urls")]
+    public PermissionUrlsConfig? Urls { get; set; }
 }
 
-/// <summary>Location-persisted tool approval details for an extension's access to sensitive environment variables, keyed by extension name and the exact set of variable names.</summary>
-/// <remarks>The <c>extension-env-access</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
+/// <summary>Indicates whether the permission decision was applied; false when the request was already resolved.</summary>
 [Experimental(Diagnostics.Experimental)]
-public partial class PermissionsLocationsAddToolApprovalDetailsExtensionEnvAccess : PermissionsLocationsAddToolApprovalDetails
+public sealed class PermissionRequestResult
 {
-    /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "extension-env-access";
-
-    /// <summary>Names of the sensitive environment variables this approval covers. Values are never persisted.</summary>
-    [JsonPropertyName("environmentVariables")]
-    public required IList<string> EnvironmentVariables { get; set; }
-
-    /// <summary>Extension name.</summary>
-    [JsonPropertyName("extensionName")]
-    public required string ExtensionName { get; set; }
+    /// <summary>Whether the permission request was handled successfully.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-/// <summary>Location-scoped tool approval to persist.</summary>
+/// <summary>Optional informational context describing how and where the permission decision was made. This does not affect permission behavior.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PermissionLocationAddToolApprovalParams
+public sealed class PermissionDecisionContext
 {
-    /// <summary>Tool approval to persist and apply.</summary>
-    [JsonPropertyName("approval")]
-    public PermissionsLocationsAddToolApprovalDetails Approval { get => field ??= new(); set; }
+    /// <summary>Disposition of the permission request as observed by the responding client.</summary>
+    [JsonPropertyName("outcome")]
+    public PermissionDecisionOutcome Outcome { get; set; }
 
-    /// <summary>Location key (git root or cwd) to persist the approval to.</summary>
-    [JsonPropertyName("locationKey")]
-    public string LocationKey { get; set; } = string.Empty;
+    /// <summary>Controlled reason or actor responsible for the response.</summary>
+    [JsonPropertyName("source")]
+    public PermissionDecisionSource Source { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Client surface that submitted the response.</summary>
+    [JsonPropertyName("surface")]
+    public PermissionDecisionSurface Surface { get; set; }
 }
 
-/// <summary>Folder trust check result.</summary>
+/// <summary>The client's response to the pending permission prompt.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class FolderTrustCheckResult
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "kind",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(PermissionDecisionApproveOnce), "approve-once")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForSession), "approve-for-session")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForLocation), "approve-for-location")]
+[JsonDerivedType(typeof(PermissionDecisionApprovePermanently), "approve-permanently")]
+[JsonDerivedType(typeof(PermissionDecisionReject), "reject")]
+[JsonDerivedType(typeof(PermissionDecisionUserNotAvailable), "user-not-available")]
+[JsonDerivedType(typeof(PermissionDecisionApproved), "approved")]
+[JsonDerivedType(typeof(PermissionDecisionApprovedForSession), "approved-for-session")]
+[JsonDerivedType(typeof(PermissionDecisionApprovedForLocation), "approved-for-location")]
+[JsonDerivedType(typeof(PermissionDecisionCancelled), "cancelled")]
+[JsonDerivedType(typeof(PermissionDecisionDeniedByRules), "denied-by-rules")]
+[JsonDerivedType(typeof(PermissionDecisionDeniedNoApprovalRuleAndCouldNotRequestFromUser), "denied-no-approval-rule-and-could-not-request-from-user")]
+[JsonDerivedType(typeof(PermissionDecisionDeniedInteractivelyByUser), "denied-interactively-by-user")]
+[JsonDerivedType(typeof(PermissionDecisionDeniedByContentExclusionPolicy), "denied-by-content-exclusion-policy")]
+[JsonDerivedType(typeof(PermissionDecisionDeniedByPermissionRequestHook), "denied-by-permission-request-hook")]
+public partial class PermissionDecision
 {
-    /// <summary>Whether the folder is trusted.</summary>
-    [JsonPropertyName("trusted")]
-    public bool Trusted { get; set; }
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("kind")]
+    public virtual string Kind { get; set; } = string.Empty;
 }
 
-/// <summary>Folder path to check for trust.</summary>
+
+/// <summary>Permission-decision request variant to approve only the current permission request.</summary>
+/// <remarks>The <c>approve-once</c> variant of <see cref="PermissionDecision"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class FolderTrustCheckParams
+public partial class PermissionDecisionApproveOnce : PermissionDecision
 {
-    /// <summary>Folder path to check.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "approve-once";
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>True only when a host surfaced this request to a user who approved it.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("approvedInteractively")]
+    public bool? ApprovedInteractively { get; set; }
 }
 
-/// <summary>Indicates whether the operation succeeded.</summary>
+/// <summary>Session-scoped approval to remember (tool prompts only; omitted for path/url prompts).</summary>
+/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PermissionsFolderTrustAddTrustedResult
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "kind",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalCommands), "commands")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalRead), "read")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalWrite), "write")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalMcp), "mcp")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalMcpSampling), "mcp-sampling")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalMemory), "memory")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalCustomTool), "custom-tool")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalExtensionManagement), "extension-management")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalFactory), "factory")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalExtensionPermissionAccess), "extension-permission-access")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForSessionApprovalExtensionEnvAccess), "extension-env-access")]
+public partial class PermissionDecisionApproveForSessionApproval
 {
-    /// <summary>Whether the operation succeeded.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("kind")]
+    public virtual string Kind { get; set; } = string.Empty;
 }
 
-/// <summary>Folder path to add to trusted folders.</summary>
+
+/// <summary>Session-scoped approval details for specific command identifiers.</summary>
+/// <remarks>The <c>commands</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class FolderTrustAddParams
+public partial class PermissionDecisionApproveForSessionApprovalCommands : PermissionDecisionApproveForSessionApproval
 {
-    /// <summary>Folder path to mark as trusted.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "commands";
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Command identifiers covered by this approval.</summary>
+    [JsonPropertyName("commandIdentifiers")]
+    public required IList<string> CommandIdentifiers { get; set; }
 }
 
-/// <summary>Indicates whether the operation succeeded.</summary>
+/// <summary>Session-scoped approval details for read-only filesystem operations.</summary>
+/// <remarks>The <c>read</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class PermissionsUrlsSetUnrestrictedModeResult
+public partial class PermissionDecisionApproveForSessionApprovalRead : PermissionDecisionApproveForSessionApproval
 {
-    /// <summary>Whether the operation succeeded.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "read";
 }
 
-/// <summary>Whether the URL-permission policy should run in unrestricted mode.</summary>
+/// <summary>Session-scoped approval details for filesystem write operations.</summary>
+/// <remarks>The <c>write</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class PermissionUrlsSetUnrestrictedModeParams
+public partial class PermissionDecisionApproveForSessionApprovalWrite : PermissionDecisionApproveForSessionApproval
 {
-    /// <summary>Whether to allow access to all URLs without prompting. Toggles the runtime's URL-permission policy in place.</summary>
-    [JsonPropertyName("enabled")]
-    public bool Enabled { get; set; }
-
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "write";
 }
 
-/// <summary>The repository the remote session targets.</summary>
+/// <summary>Session-scoped approval details for an MCP server tool, or all tools on the server when `toolName` is null.</summary>
+/// <remarks>The <c>mcp</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class MetadataSnapshotRemoteMetadataRepository
+public partial class PermissionDecisionApproveForSessionApprovalMcp : PermissionDecisionApproveForSessionApproval
 {
-    /// <summary>The branch the remote session is operating on.</summary>
-    [JsonPropertyName("branch")]
-    public string Branch { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "mcp";
 
-    /// <summary>The GitHub repository name (without owner).</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>MCP server name.</summary>
+    [JsonPropertyName("serverName")]
+    public required string ServerName { get; set; }
 
-    /// <summary>The GitHub owner (user or organization) of the target repository.</summary>
-    [JsonPropertyName("owner")]
-    public string Owner { get; set; } = string.Empty;
+    /// <summary>MCP tool name, or null to cover every tool on the server.</summary>
+    [JsonPropertyName("toolName")]
+    public string? ToolName { get; set; }
 }
 
-/// <summary>Remote-session-specific metadata. Populated only when `isRemote` is true. Fields are immutable for the lifetime of the session.</summary>
+/// <summary>Session-scoped approval details for MCP sampling requests from a server.</summary>
+/// <remarks>The <c>mcp-sampling</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class MetadataSnapshotRemoteMetadata
+public partial class PermissionDecisionApproveForSessionApprovalMcpSampling : PermissionDecisionApproveForSessionApproval
 {
-    /// <summary>The pull request number the remote session is associated with, if any.</summary>
-    [JsonPropertyName("pullRequestNumber")]
-    public long? PullRequestNumber { get; set; }
-
-    /// <summary>The repository the remote session targets.</summary>
-    [JsonPropertyName("repository")]
-    public MetadataSnapshotRemoteMetadataRepository Repository { get => field ??= new(); set; }
-
-    /// <summary>The original resource identifier (task ID or PR node ID), preserved across event-replay reconstructions. Falls back to `sessionId` when absent.</summary>
-    [JsonPropertyName("resourceId")]
-    public string? ResourceId { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "mcp-sampling";
 
-    /// <summary>Whether the remote task originated from Copilot Coding Agent (cca) or a CLI `--remote` invocation.</summary>
-    [JsonPropertyName("taskType")]
-    public MetadataSnapshotRemoteMetadataTaskType? TaskType { get; set; }
+    /// <summary>MCP server name.</summary>
+    [JsonPropertyName("serverName")]
+    public required string ServerName { get; set; }
 }
 
-/// <summary>Public-facing projection of workspace metadata for SDK / TUI consumers.</summary>
-public sealed class SessionMetadataSnapshotWorkspace
+/// <summary>Session-scoped approval details for writes to long-term memory.</summary>
+/// <remarks>The <c>memory</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionApproveForSessionApprovalMemory : PermissionDecisionApproveForSessionApproval
 {
-    /// <summary>Branch checked out at session start, if any.</summary>
-    [JsonPropertyName("branch")]
-    public string? Branch { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "memory";
+}
 
-    /// <summary>ISO 8601 timestamp when the workspace was created.</summary>
-    [JsonPropertyName("created_at")]
-    public DateTimeOffset? CreatedAt { get; set; }
-
-    /// <summary>Current working directory at session start.</summary>
-    [JsonPropertyName("cwd")]
-    public string? Cwd { get; set; }
-
-    /// <summary>Resolved git root for cwd, if any.</summary>
-    [JsonPropertyName("git_root")]
-    public string? GitRoot { get; set; }
-
-    /// <summary>Repository host type, if known.</summary>
-    [JsonPropertyName("host_type")]
-    public WorkspaceSummaryHostType? HostType { get; set; }
-
-    /// <summary>Workspace identifier (1:1 with sessionId).</summary>
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
-
-    /// <summary>Display name for the session, if set.</summary>
-    [JsonPropertyName("name")]
-    public string? Name { get; set; }
+/// <summary>Session-scoped approval details for a custom tool, keyed by tool name.</summary>
+/// <remarks>The <c>custom-tool</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionApproveForSessionApprovalCustomTool : PermissionDecisionApproveForSessionApproval
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "custom-tool";
 
-    /// <summary>Repository identifier in 'owner/repo' or 'org/project/repo' format, if any.</summary>
-    [JsonPropertyName("repository")]
-    public string? Repository { get; set; }
+    /// <summary>Custom tool name.</summary>
+    [JsonPropertyName("toolName")]
+    public required string ToolName { get; set; }
+}
 
-    /// <summary>ISO 8601 timestamp when the workspace was last updated.</summary>
-    [JsonPropertyName("updated_at")]
-    public DateTimeOffset? UpdatedAt { get; set; }
+/// <summary>Session-scoped approval details for extension-management operations, optionally narrowed by operation.</summary>
+/// <remarks>The <c>extension-management</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionApproveForSessionApprovalExtensionManagement : PermissionDecisionApproveForSessionApproval
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "extension-management";
 
-    /// <summary>Whether the display name was explicitly set by the user.</summary>
-    [JsonPropertyName("user_named")]
-    public bool? UserNamed { get; set; }
+    /// <summary>Optional operation identifier; when omitted, the approval covers all extension management operations.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("operation")]
+    public string? Operation { get; set; }
 }
 
-/// <summary>Point-in-time snapshot of slow-changing session identifier and state fields.</summary>
+/// <summary>Session-scoped factory approval, optionally narrowed by approval key.</summary>
+/// <remarks>The <c>factory</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionMetadataSnapshot
+public partial class PermissionDecisionApproveForSessionApprovalFactory : PermissionDecisionApproveForSessionApproval
 {
-    /// <summary>True when the session was detected to be in use by another process at construction time. Local consumers may surface a confirmation prompt before fully attaching. Always false for new sessions.</summary>
-    [JsonPropertyName("alreadyInUse")]
-    public bool AlreadyInUse { get; set; }
-
-    /// <summary>Runtime client name associated with the session (telemetry identifier).</summary>
-    [JsonPropertyName("clientName")]
-    public string? ClientName { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "factory";
 
-    /// <summary>The current agent mode for this session (e.g., 'interactive', 'plan', 'autopilot').</summary>
-    [JsonPropertyName("currentMode")]
-    public MetadataSnapshotCurrentMode CurrentMode { get; set; }
+    /// <summary>Optional factory operation name or canonical approval key; when omitted, the approval covers all factory operations.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("approvalKey")]
+    public string? ApprovalKey { get; set; }
+}
 
-    /// <summary>User-provided name supplied at session construction (via `--name`), if any. Immutable after construction.</summary>
-    [JsonPropertyName("initialName")]
-    public string? InitialName { get; set; }
+/// <summary>Session-scoped approval details for an extension's permission-gated capability access, keyed by extension name.</summary>
+/// <remarks>The <c>extension-permission-access</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionApproveForSessionApprovalExtensionPermissionAccess : PermissionDecisionApproveForSessionApproval
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "extension-permission-access";
 
-    /// <summary>Whether this is a remote session (i.e., one whose runtime executes elsewhere and is steered through this process).</summary>
-    [JsonPropertyName("isRemote")]
-    public bool IsRemote { get; set; }
+    /// <summary>Extension name.</summary>
+    [JsonPropertyName("extensionName")]
+    public required string ExtensionName { get; set; }
+}
 
-    /// <summary>ISO 8601 timestamp of when the session's persisted state was last modified on disk. For new sessions, equals startTime. For resumed sessions, reflects the previous modification time at construction.</summary>
-    [JsonPropertyName("modifiedTime")]
-    public DateTimeOffset ModifiedTime { get; set; }
+/// <summary>Session-scoped approval details for an extension's access to sensitive environment variables, keyed by extension name and the exact set of variable names.</summary>
+/// <remarks>The <c>extension-env-access</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionApproveForSessionApprovalExtensionEnvAccess : PermissionDecisionApproveForSessionApproval
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "extension-env-access";
 
-    /// <summary>Remote-session-specific metadata. Populated only when `isRemote` is true. Fields are immutable for the lifetime of the session.</summary>
-    [JsonPropertyName("remoteMetadata")]
-    public MetadataSnapshotRemoteMetadata? RemoteMetadata { get; set; }
+    /// <summary>Names of the sensitive environment variables this approval covers. Values are never persisted.</summary>
+    [JsonPropertyName("environmentVariables")]
+    public required IList<string> EnvironmentVariables { get; set; }
 
-    /// <summary>Currently selected model identifier, if any.</summary>
-    [JsonPropertyName("selectedModel")]
-    public string? SelectedModel { get; set; }
+    /// <summary>Extension name.</summary>
+    [JsonPropertyName("extensionName")]
+    public required string ExtensionName { get; set; }
+}
 
-    /// <summary>The unique identifier of the session.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+/// <summary>Permission-decision request variant to approve for the rest of the session, with optional tool approval or URL domain.</summary>
+/// <remarks>The <c>approve-for-session</c> variant of <see cref="PermissionDecision"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionApproveForSession : PermissionDecision
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "approve-for-session";
 
-    /// <summary>Current session limits, or null when no limits are active.</summary>
-    [JsonPropertyName("sessionLimits")]
-    public SessionLimitsConfig? SessionLimits { get; set; }
+    /// <summary>Session-scoped approval to remember (tool prompts only; omitted for path/url prompts).</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("approval")]
+    public PermissionDecisionApproveForSessionApproval? Approval { get; set; }
 
-    /// <summary>ISO 8601 timestamp of when the session started.</summary>
-    [JsonPropertyName("startTime")]
-    public DateTimeOffset StartTime { get; set; }
+    /// <summary>URL domain to approve for the rest of the session (URL prompts only).</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("domain")]
+    public string? Domain { get; set; }
+}
 
-    /// <summary>Short human-readable summary of the session, if known. Omitted when no summary has been generated.</summary>
-    [JsonPropertyName("summary")]
-    public string? Summary { get; set; }
+/// <summary>Approval to persist for this location.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "kind",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalCommands), "commands")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalRead), "read")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalWrite), "write")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalMcp), "mcp")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalMcpSampling), "mcp-sampling")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalMemory), "memory")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalCustomTool), "custom-tool")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalExtensionManagement), "extension-management")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalFactory), "factory")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalExtensionPermissionAccess), "extension-permission-access")]
+[JsonDerivedType(typeof(PermissionDecisionApproveForLocationApprovalExtensionEnvAccess), "extension-env-access")]
+public partial class PermissionDecisionApproveForLocationApproval
+{
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("kind")]
+    public virtual string Kind { get; set; } = string.Empty;
+}
 
-    /// <summary>Absolute path to the session's current working directory.</summary>
-    [JsonPropertyName("workingDirectory")]
-    public string WorkingDirectory { get; set; } = string.Empty;
 
-    /// <summary>Public-facing workspace metadata for this session, or null if the session has no associated workspace. Excludes runtime-internal fields (GitHub IDs, summary count, internal flags).</summary>
-    [JsonPropertyName("workspace")]
-    public SessionMetadataSnapshotWorkspace? Workspace { get; set; }
+/// <summary>Location-scoped approval details for specific command identifiers.</summary>
+/// <remarks>The <c>commands</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionApproveForLocationApprovalCommands : PermissionDecisionApproveForLocationApproval
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "commands";
 
-    /// <summary>Absolute path to the session's workspace directory on disk, or null if the session has no associated workspace.</summary>
-    [JsonPropertyName("workspacePath")]
-    public string? WorkspacePath { get; set; }
+    /// <summary>Command identifiers covered by this approval.</summary>
+    [JsonPropertyName("commandIdentifiers")]
+    public required IList<string> CommandIdentifiers { get; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Location-scoped approval details for read-only filesystem operations.</summary>
+/// <remarks>The <c>read</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionMetadataSnapshotRequest
+public partial class PermissionDecisionApproveForLocationApprovalRead : PermissionDecisionApproveForLocationApproval
 {
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "read";
 }
 
-/// <summary>Indicates whether the local session is currently processing a turn or background continuation.</summary>
+/// <summary>Location-scoped approval details for filesystem write operations.</summary>
+/// <remarks>The <c>write</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class MetadataIsProcessingResult
+public partial class PermissionDecisionApproveForLocationApprovalWrite : PermissionDecisionApproveForLocationApproval
 {
-    /// <summary>Whether the session is currently processing user/agent messages. False for non-local sessions (which don't run a local agentic loop). Reflects an in-flight turn or background continuation.</summary>
-    [JsonPropertyName("processing")]
-    public bool Processing { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "write";
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Location-scoped approval details for an MCP server tool, or all tools on the server when `toolName` is null.</summary>
+/// <remarks>The <c>mcp</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionMetadataIsProcessingRequest
+public partial class PermissionDecisionApproveForLocationApprovalMcp : PermissionDecisionApproveForLocationApproval
 {
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "mcp";
+
+    /// <summary>MCP server name.</summary>
+    [JsonPropertyName("serverName")]
+    public required string ServerName { get; set; }
+
+    /// <summary>MCP tool name, or null to cover every tool on the server.</summary>
+    [JsonPropertyName("toolName")]
+    public string? ToolName { get; set; }
 }
 
-/// <summary>Current activity flags for the session.</summary>
+/// <summary>Location-scoped approval details for MCP sampling requests from a server.</summary>
+/// <remarks>The <c>mcp-sampling</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionActivity
+public partial class PermissionDecisionApproveForLocationApprovalMcpSampling : PermissionDecisionApproveForLocationApproval
 {
-    /// <summary>Whether an in-flight operation can currently be aborted.</summary>
-    [JsonPropertyName("abortable")]
-    public bool Abortable { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "mcp-sampling";
 
-    /// <summary>Whether the session currently has active work, including running turns or tasks.</summary>
-    [JsonPropertyName("hasActiveWork")]
-    public bool HasActiveWork { get; set; }
+    /// <summary>MCP server name.</summary>
+    [JsonPropertyName("serverName")]
+    public required string ServerName { get; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Location-scoped approval details for writes to long-term memory.</summary>
+/// <remarks>The <c>memory</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionMetadataActivityRequest
+public partial class PermissionDecisionApproveForLocationApprovalMemory : PermissionDecisionApproveForLocationApproval
 {
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "memory";
 }
 
-/// <summary>Token-usage breakdown for the session's current context window.</summary>
-public sealed class MetadataContextInfoResultContextInfo
+/// <summary>Location-scoped approval details for a custom tool, keyed by tool name.</summary>
+/// <remarks>The <c>custom-tool</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionApproveForLocationApprovalCustomTool : PermissionDecisionApproveForLocationApproval
 {
-    /// <summary>Output reserve plus tokens after the buffer-exhaustion blocking threshold (default 95%).</summary>
-    [JsonPropertyName("bufferTokens")]
-    public long BufferTokens { get; set; }
-
-    /// <summary>Token count at which background compaction starts (configurable percentage of promptTokenLimit).</summary>
-    [JsonPropertyName("compactionThreshold")]
-    public long CompactionThreshold { get; set; }
-
-    /// <summary>Tokens consumed by user/assistant/tool messages.</summary>
-    [JsonPropertyName("conversationTokens")]
-    public long ConversationTokens { get; set; }
-
-    /// <summary>Prompt token limit plus the model's full output token limit.</summary>
-    [JsonPropertyName("limit")]
-    public long Limit { get; set; }
-
-    /// <summary>Tokens consumed by MCP tool definitions (subset of toolDefinitionsTokens, excludes deferred tools).</summary>
-    [JsonPropertyName("mcpToolsTokens")]
-    public long McpToolsTokens { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "custom-tool";
 
-    /// <summary>The model used for token counting.</summary>
-    [JsonPropertyName("modelName")]
-    public string ModelName { get; set; } = string.Empty;
+    /// <summary>Custom tool name.</summary>
+    [JsonPropertyName("toolName")]
+    public required string ToolName { get; set; }
+}
 
-    /// <summary>Maximum prompt tokens allowed by the model (or DEFAULT_TOKEN_LIMIT if unspecified).</summary>
-    [JsonPropertyName("promptTokenLimit")]
-    public long PromptTokenLimit { get; set; }
+/// <summary>Location-scoped approval details for extension-management operations, optionally narrowed by operation.</summary>
+/// <remarks>The <c>extension-management</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionApproveForLocationApprovalExtensionManagement : PermissionDecisionApproveForLocationApproval
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "extension-management";
 
-    /// <summary>Tokens consumed by the system prompt.</summary>
-    [JsonPropertyName("systemTokens")]
-    public long SystemTokens { get; set; }
+    /// <summary>Optional operation identifier; when omitted, the approval covers all extension management operations.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("operation")]
+    public string? Operation { get; set; }
+}
 
-    /// <summary>Tokens consumed by tool definitions sent to the model (excludes deferred tools).</summary>
-    [JsonPropertyName("toolDefinitionsTokens")]
-    public long ToolDefinitionsTokens { get; set; }
+/// <summary>Location-scoped factory approval, optionally narrowed by approval key.</summary>
+/// <remarks>The <c>factory</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionApproveForLocationApprovalFactory : PermissionDecisionApproveForLocationApproval
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "factory";
 
-    /// <summary>Sum of system, conversation and tool-definition tokens.</summary>
-    [JsonPropertyName("totalTokens")]
-    public long TotalTokens { get; set; }
+    /// <summary>Optional factory operation name or canonical approval key; when omitted, the approval covers all factory operations.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("approvalKey")]
+    public string? ApprovalKey { get; set; }
 }
 
-/// <summary>Token breakdown for the session's current context window, or null if uninitialized.</summary>
+/// <summary>Location-scoped approval details for an extension's permission-gated capability access, keyed by extension name.</summary>
+/// <remarks>The <c>extension-permission-access</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class MetadataContextInfoResult
+public partial class PermissionDecisionApproveForLocationApprovalExtensionPermissionAccess : PermissionDecisionApproveForLocationApproval
 {
-    /// <summary>Token breakdown for the current context window, or null if the session has not yet been initialized (no system prompt or tool metadata cached).</summary>
-    [JsonPropertyName("contextInfo")]
-    public MetadataContextInfoResultContextInfo? ContextInfo { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "extension-permission-access";
+
+    /// <summary>Extension name.</summary>
+    [JsonPropertyName("extensionName")]
+    public required string ExtensionName { get; set; }
 }
 
-/// <summary>Model identifier and token limits used to compute the context-info breakdown.</summary>
+/// <summary>Location-scoped approval details for an extension's access to sensitive environment variables, keyed by extension name and the exact set of variable names.</summary>
+/// <remarks>The <c>extension-env-access</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class MetadataContextInfoRequest
+public partial class PermissionDecisionApproveForLocationApprovalExtensionEnvAccess : PermissionDecisionApproveForLocationApproval
 {
-    /// <summary>Maximum output tokens allowed by the target model. Pass 0 if unknown.</summary>
-    [JsonPropertyName("outputTokenLimit")]
-    public long OutputTokenLimit { get; set; }
-
-    /// <summary>Maximum prompt tokens allowed by the target model. Pass 0 to use the runtime default.</summary>
-    [JsonPropertyName("promptTokenLimit")]
-    public long PromptTokenLimit { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "extension-env-access";
 
-    /// <summary>Model identifier used for tokenization. Omit to use the session default. Used both for token counting and to compute display values.</summary>
-    [JsonPropertyName("selectedModel")]
-    public string? SelectedModel { get; set; }
+    /// <summary>Names of the sensitive environment variables this approval covers. Values are never persisted.</summary>
+    [JsonPropertyName("environmentVariables")]
+    public required IList<string> EnvironmentVariables { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Extension name.</summary>
+    [JsonPropertyName("extensionName")]
+    public required string ExtensionName { get; set; }
 }
 
-/// <summary>The six normalized `/context` header buckets, computed from the same tokenization as `entries` so the two never disagree. Convenience rollups: `freeSpace` and `buffer` describe window capacity rather than occupied context, so the values do not sum to `totalTokens`.</summary>
-public sealed class MetadataContextAttributionResultContextAttributionCategories
+/// <summary>Permission-decision request variant to approve and persist a permission for a project location, with approval details and location key.</summary>
+/// <remarks>The <c>approve-for-location</c> variant of <see cref="PermissionDecision"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionApproveForLocation : PermissionDecision
 {
-    /// <summary>Output reserve plus post-blocking-threshold buffer.</summary>
-    [JsonPropertyName("buffer")]
-    public long Buffer { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "approve-for-location";
 
-    /// <summary>Custom-instructions tokens (0 when none are configured).</summary>
-    [JsonPropertyName("customInstructions")]
-    public long CustomInstructions { get; set; }
+    /// <summary>Approval to persist for this location.</summary>
+    [JsonPropertyName("approval")]
+    public required PermissionDecisionApproveForLocationApproval Approval { get; set; }
 
-    /// <summary>Remaining unused window capacity (clamped at 0).</summary>
-    [JsonPropertyName("freeSpace")]
-    public long FreeSpace { get; set; }
+    /// <summary>Location key (git root or cwd) to persist the approval to.</summary>
+    [JsonPropertyName("locationKey")]
+    public required string LocationKey { get; set; }
+}
 
-    /// <summary>MCP tool-definition tokens.</summary>
-    [JsonPropertyName("mcpTools")]
-    public long McpTools { get; set; }
+/// <summary>Permission-decision request variant to permanently approve a URL domain across sessions.</summary>
+/// <remarks>The <c>approve-permanently</c> variant of <see cref="PermissionDecision"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionApprovePermanently : PermissionDecision
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "approve-permanently";
 
-    /// <summary>Conversation (user/assistant/tool) message tokens.</summary>
-    [JsonPropertyName("messages")]
-    public long Messages { get; set; }
+    /// <summary>URL domain to approve permanently.</summary>
+    [JsonPropertyName("domain")]
+    public required string Domain { get; set; }
+}
 
-    /// <summary>System prompt tokens, excluding custom instructions.</summary>
-    [JsonPropertyName("systemPrompt")]
-    public long SystemPrompt { get; set; }
+/// <summary>Permission-decision request variant to reject a pending permission request, with optional feedback.</summary>
+/// <remarks>The <c>reject</c> variant of <see cref="PermissionDecision"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionReject : PermissionDecision
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "reject";
 
-    /// <summary>Non-MCP tool-definition tokens.</summary>
-    [JsonPropertyName("systemTools")]
-    public long SystemTools { get; set; }
+    /// <summary>Optional feedback explaining the rejection.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("feedback")]
+    public string? Feedback { get; set; }
 }
 
-/// <summary>Successful compaction history for the session.</summary>
-public sealed class MetadataContextAttributionResultContextAttributionCompactions
+/// <summary>Permission-decision variant indicating no user was available to confirm the request.</summary>
+/// <remarks>The <c>user-not-available</c> variant of <see cref="PermissionDecision"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionUserNotAvailable : PermissionDecision
 {
-    /// <summary>Number of successful compactions in this session.</summary>
-    [JsonPropertyName("count")]
-    public long Count { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "user-not-available";
 }
 
-/// <summary>RPC data type for MetadataContextAttributionResultContextAttributionEntry operations.</summary>
-public sealed class MetadataContextAttributionResultContextAttributionEntry
+/// <summary>Permission-decision variant indicating the request was approved.</summary>
+/// <remarks>The <c>approved</c> variant of <see cref="PermissionDecision"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionApproved : PermissionDecision
 {
-    /// <summary>Supplementary per-entry metadata (e.g. `messageCount`, `role`, `evictable`, `pluginSource`). Values are stringified; parse as needed and ignore unrecognized keys.</summary>
-    [JsonPropertyName("attributes")]
-    public IDictionary<string, string>? Attributes { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "approved";
+}
 
-    /// <summary>Identifier for this entry, formed by joining its `kind` and source name (e.g. `tool:bash`, `skill:tmux`, `toolDefinition:bash`); unique within the snapshot. Use it to match the same entry across snapshots, to correlate with other APIs (skill/agent/MCP registries), and as the `parentId` target for nesting. Distinct from the human-facing `label`.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
+/// <summary>Permission-decision variant indicating approval was remembered for the session, with approval details.</summary>
+/// <remarks>The <c>approved-for-session</c> variant of <see cref="PermissionDecision"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionApprovedForSession : PermissionDecision
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "approved-for-session";
 
-    /// <summary>Source category for this entry. Not a closed set — tolerate unknown values. Known values today: `skill`, `subagent`, `mcpServer`, `tool`, `system`, `toolDefinition`, `plugin`.</summary>
-    [JsonPropertyName("kind")]
-    public string Kind { get; set; } = string.Empty;
+    /// <summary>The approval to add as a session-scoped rule.</summary>
+    [JsonPropertyName("approval")]
+    public required UserToolSessionApproval Approval { get; set; }
+}
 
-    /// <summary>Human-readable display label, e.g. `bash` or `skill: tmux`. Presentation-only; may be localized/reformatted without notice — do not key off it.</summary>
-    [JsonPropertyName("label")]
-    public string Label { get; set; } = string.Empty;
+/// <summary>Permission-decision variant indicating approval was persisted for a project location, with approval details and location key.</summary>
+/// <remarks>The <c>approved-for-location</c> variant of <see cref="PermissionDecision"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionApprovedForLocation : PermissionDecision
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "approved-for-location";
 
-    /// <summary>Optional `id` of the parent entry: e.g. a `plugin` entry parenting its `skill`/`mcpServer` entries, or the `system` entry parenting `toolDefinition` entries. Omitted for top-level entries.</summary>
-    [JsonPropertyName("parentId")]
-    public string? ParentId { get; set; }
+    /// <summary>The approval to persist for this location.</summary>
+    [JsonPropertyName("approval")]
+    public required UserToolSessionApproval Approval { get; set; }
 
-    /// <summary>Token count currently in context attributable to this entry.</summary>
-    [JsonPropertyName("tokens")]
-    public long Tokens { get; set; }
+    /// <summary>The location key (git root or cwd) to persist the approval to.</summary>
+    [JsonPropertyName("locationKey")]
+    public required string LocationKey { get; set; }
 }
 
-/// <summary>Per-source token attribution snapshot for the current context window. The heaviest individual messages are available separately via `metadata.getContextHeaviestMessages`.</summary>
-public sealed class MetadataContextAttributionResultContextAttribution
+/// <summary>Permission-decision variant indicating the request was cancelled before use, with an optional reason.</summary>
+/// <remarks>The <c>cancelled</c> variant of <see cref="PermissionDecision"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionCancelled : PermissionDecision
 {
-    /// <summary>Output reserve plus the tokens past the buffer-exhaustion blocking threshold. Mirrors `SessionContextInfo.bufferTokens`.</summary>
-    [JsonPropertyName("bufferTokens")]
-    public long BufferTokens { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "cancelled";
 
-    /// <summary>The six normalized `/context` header buckets, computed from the same tokenization as `entries` so the two never disagree. Convenience rollups: `freeSpace` and `buffer` describe window capacity rather than occupied context, so the values do not sum to `totalTokens`.</summary>
-    [JsonPropertyName("categories")]
-    public MetadataContextAttributionResultContextAttributionCategories Categories { get => field ??= new(); set; }
+    /// <summary>Optional explanation of why the request was cancelled.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("reason")]
+    public string? Reason { get; set; }
+}
 
-    /// <summary>Successful compaction history for the session.</summary>
-    [JsonPropertyName("compactions")]
-    public MetadataContextAttributionResultContextAttributionCompactions Compactions { get => field ??= new(); set; }
+/// <summary>Permission-decision variant indicating explicit denial by permission rules, with the matching rules.</summary>
+/// <remarks>The <c>denied-by-rules</c> variant of <see cref="PermissionDecision"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionDeniedByRules : PermissionDecision
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "denied-by-rules";
 
-    /// <summary>Token count at which background compaction starts. Mirrors `SessionContextInfo.compactionThreshold`.</summary>
-    [JsonPropertyName("compactionThreshold")]
-    public long CompactionThreshold { get; set; }
+    /// <summary>Rules that denied the request.</summary>
+    [JsonPropertyName("rules")]
+    public required IList<PermissionRule> Rules { get; set; }
+}
 
-    /// <summary>Flat list of per-source attribution entries. Group by `kind` and render unrecognized kinds generically. Nesting and rollups are expressed via `parentId`.</summary>
-    [JsonPropertyName("entries")]
-    public IList<MetadataContextAttributionResultContextAttributionEntry> Entries { get => field ??= []; set; }
+/// <summary>Permission-decision variant indicating no approval rule matched and user confirmation was unavailable.</summary>
+/// <remarks>The <c>denied-no-approval-rule-and-could-not-request-from-user</c> variant of <see cref="PermissionDecision"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionDeniedNoApprovalRuleAndCouldNotRequestFromUser : PermissionDecision
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "denied-no-approval-rule-and-could-not-request-from-user";
+}
 
-    /// <summary>Prompt limit plus the model's output reserve: the full context window `categories.freeSpace` and `categories.buffer` are measured against. Mirrors `SessionContextInfo.limit`.</summary>
-    [JsonPropertyName("limit")]
-    public long Limit { get; set; }
+/// <summary>Permission-decision variant indicating the user denied an interactive prompt, with optional feedback and force-reject flag.</summary>
+/// <remarks>The <c>denied-interactively-by-user</c> variant of <see cref="PermissionDecision"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionDeniedInteractivelyByUser : PermissionDecision
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "denied-interactively-by-user";
 
-    /// <summary>The concrete model id the entire breakdown was tokenized against (feeds the per-model token multiplier). Under `Auto` (Free/Student) this is the resolved model, not the literal `auto` sentinel, so totals are not undercounted. A single-model approximation of a potentially multi-model Auto session.</summary>
-    [JsonPropertyName("modelId")]
-    public string ModelId { get; set; } = string.Empty;
+    /// <summary>Optional feedback from the user explaining the denial.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("feedback")]
+    public string? Feedback { get; set; }
 
-    /// <summary>How `modelId` was chosen. Not a closed set — tolerate unknown values. Known values today: `autoResolved` (the model Auto resolved to), `selected` (the user's explicitly selected model), `default` (a fallback before any model is known).</summary>
-    [JsonPropertyName("modelSource")]
-    public string ModelSource { get; set; } = string.Empty;
+    /// <summary>Whether to force-reject the current agent turn.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("forceReject")]
+    public bool? ForceReject { get; set; }
+}
 
-    /// <summary>Maximum prompt tokens the resolved model accepts — the denominator for a `##k/###k` context-usage display. Mirrors `SessionContextInfo.promptTokenLimit`.</summary>
-    [JsonPropertyName("promptTokenLimit")]
-    public long PromptTokenLimit { get; set; }
+/// <summary>Permission-decision variant indicating denial by content-exclusion policy, with path and message.</summary>
+/// <remarks>The <c>denied-by-content-exclusion-policy</c> variant of <see cref="PermissionDecision"/>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+public partial class PermissionDecisionDeniedByContentExclusionPolicy : PermissionDecision
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "denied-by-content-exclusion-policy";
 
-    /// <summary>Total token count of the current context window the entries are measured against (system message + conversation messages + tool definitions — the same total reported by /context). Divide an entry's `tokens` by this to derive its share.</summary>
-    [JsonPropertyName("totalTokens")]
-    public long TotalTokens { get; set; }
+    /// <summary>Human-readable explanation of why the path was excluded.</summary>
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
+
+    /// <summary>File path that triggered the exclusion.</summary>
+    [JsonPropertyName("path")]
+    public required string Path { get; set; }
 }
 
-/// <summary>Per-source attribution breakdown for the session's current context window, or null if uninitialized.</summary>
+/// <summary>Permission-decision variant indicating denial by a permission request hook, with optional message and interrupt flag.</summary>
+/// <remarks>The <c>denied-by-permission-request-hook</c> variant of <see cref="PermissionDecision"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class MetadataContextAttributionResult
+public partial class PermissionDecisionDeniedByPermissionRequestHook : PermissionDecision
 {
-    /// <summary>Per-source context-window attribution, or null if the session has not yet been initialized (no system prompt or tool metadata cached).</summary>
-    [JsonPropertyName("contextAttribution")]
-    public MetadataContextAttributionResultContextAttribution? ContextAttribution { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "denied-by-permission-request-hook";
+
+    /// <summary>Whether to interrupt the current agent turn.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("interrupt")]
+    public bool? Interrupt { get; set; }
+
+    /// <summary>Optional message from the hook explaining the denial.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("message")]
+    public string? Message { get; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Pending permission request ID and the decision to apply (approve/reject and scope).</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionMetadataGetContextAttributionRequest
+internal sealed class PermissionDecisionRequest
 {
+    /// <summary>Optional informational context describing how and where this response was made. Omit it to preserve legacy behavior without attributing an origin.</summary>
+    [JsonPropertyName("decisionContext")]
+    public PermissionDecisionContext? DecisionContext { get; set; }
+
+    /// <summary>Request ID of the pending permission request.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
+
+    /// <summary>The client's response to the pending permission prompt.</summary>
+    [JsonPropertyName("result")]
+    public PermissionDecision Result { get => field ??= new(); set; }
+
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>A single large message currently in context.</summary>
+/// <summary>Pending permission prompt reconstructed from event history, with request ID and user-facing prompt details.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ContextHeaviestMessage
+public sealed class PendingPermissionRequest
 {
-    /// <summary>Stable identifier for this message within the snapshot.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
-
-    /// <summary>Human-readable source label, e.g. `tool: bash` or `skill: tmux`. Presentation-only.</summary>
-    [JsonPropertyName("label")]
-    public string Label { get; set; } = string.Empty;
-
-    /// <summary>Role of the chat message (`user`, `assistant`, or `tool`).</summary>
-    [JsonPropertyName("role")]
-    public string Role { get; set; } = string.Empty;
+    /// <summary>The user-facing permission prompt details (commands, write, read, mcp, url, memory, custom-tool, path, hook).</summary>
+    [JsonPropertyName("request")]
+    public PermissionPromptRequest Request { get; set; } = null!;
 
-    /// <summary>Token count currently in context for this individual message.</summary>
-    [JsonPropertyName("tokens")]
-    public long Tokens { get; set; }
+    /// <summary>Unique identifier for the pending permission request.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
 }
 
-/// <summary>The heaviest individual messages in the session's context window, most-expensive first.</summary>
+/// <summary>List of pending permission requests reconstructed from event history.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class MetadataContextHeaviestMessagesResult
+public sealed class PendingPermissionRequestList
 {
-    /// <summary>Heaviest messages, most-expensive first.</summary>
-    [JsonPropertyName("messages")]
-    public IList<ContextHeaviestMessage> Messages { get => field ??= []; set; }
-
-    /// <summary>Total token count of the current context window, so callers can compute each message's share without a second call.</summary>
-    [JsonPropertyName("totalTokens")]
-    public long TotalTokens { get; set; }
+    /// <summary>Pending permission prompts reconstructed from the session's event history. Equivalent to the set of `permission.requested` events that have not yet been followed by a matching `permission.completed` event. Used by clients (e.g. the CLI) to hydrate UI for prompts that were emitted before the client attached to the session.</summary>
+    [JsonPropertyName("items")]
+    public IList<PendingPermissionRequest> Items { get => field ??= []; set; }
 }
 
-/// <summary>Parameters for the heaviest-messages query.</summary>
+/// <summary>No parameters; returns currently-pending permission requests for the session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class MetadataContextHeaviestMessagesRequest
+internal sealed class PermissionsPendingRequestsRequest
 {
-    /// <summary>Maximum number of messages to return, most-expensive first. Omit for the server default.</summary>
-    [JsonPropertyName("limit")]
-    public long? Limit { get; set; }
-
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Notify the session that its working directory context has changed. Emits a `session.context_changed` event so consumers (telemetry, OTel tracker, ACP, the timeline UI) can react. Use this when the host has detected a cwd/branch/repo change outside the session's normal lifecycle (e.g., after a shell command in interactive mode). For a local session, a report whose `cwd` diverges from the session's current working directory is ignored (the call still succeeds but records nothing and emits no event); move a local session's working directory via `metadata.setWorkingDirectory` instead.</summary>
+/// <summary>Indicates whether the operation succeeded.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class MetadataRecordContextChangeResult
+public sealed class PermissionsSetApproveAllResult
 {
+    /// <summary>Whether the operation succeeded.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-/// <summary>Updated working directory and git context. Emitted as the new payload of `session.context_changed`.</summary>
+/// <summary>Allow-all toggle for tool permission requests, with an optional telemetry source.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionWorkingDirectoryContext
+internal sealed class PermissionsSetApproveAllRequest
 {
-    /// <summary>Merge-base commit SHA (fork point from the remote default branch).</summary>
-    [JsonPropertyName("baseCommit")]
-    public string? BaseCommit { get; set; }
-
-    /// <summary>Current git branch name.</summary>
-    [JsonPropertyName("branch")]
-    public string? Branch { get; set; }
-
-    /// <summary>Current working directory path.</summary>
-    [JsonPropertyName("cwd")]
-    public string Cwd { get; set; } = string.Empty;
-
-    /// <summary>Root directory of the git repository, resolved via git rev-parse.</summary>
-    [JsonPropertyName("gitRoot")]
-    public string? GitRoot { get; set; }
+    /// <summary>Whether to auto-approve all tool permission requests.</summary>
+    [JsonPropertyName("enabled")]
+    public bool Enabled { get; set; }
 
-    /// <summary>Head commit of the current git branch.</summary>
-    [JsonPropertyName("headCommit")]
-    public string? HeadCommit { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 
-    /// <summary>Hosting platform type of the repository.</summary>
-    [JsonPropertyName("hostType")]
-    public SessionWorkingDirectoryContextHostType? HostType { get; set; }
+    /// <summary>Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers.</summary>
+    [JsonPropertyName("source")]
+    public PermissionsSetApproveAllSource? Source { get; set; }
+}
 
-    /// <summary>Repository identifier derived from the git remote URL ("owner/name" for GitHub, "org/project/repo" for Azure DevOps).</summary>
-    [JsonPropertyName("repository")]
-    public string? Repository { get; set; }
+/// <summary>Indicates whether the requested permission mode was applied and reports the authoritative post-mutation mode.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class PermissionsSetModeResult
+{
+    /// <summary>Authoritative permission mode after the mutation.</summary>
+    [JsonPropertyName("mode")]
+    public PermissionMode Mode { get; set; }
 
-    /// <summary>Raw host string from the git remote URL (e.g. "github.com", "dev.azure.com").</summary>
-    [JsonPropertyName("repositoryHost")]
-    public string? RepositoryHost { get; set; }
+    /// <summary>Whether the operation succeeded.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-/// <summary>Updated working-directory/git context to record on the session.</summary>
+/// <summary>Permission mode to apply for the session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class MetadataRecordContextChangeRequest
+internal sealed class PermissionsSetModeRequest
 {
-    /// <summary>Updated working directory and git context. Emitted as the new payload of `session.context_changed`.</summary>
-    [JsonPropertyName("context")]
-    public SessionWorkingDirectoryContext Context { get => field ??= new(); set; }
+    /// <summary>Optional judge model id for assisted mode. When omitted, the session resolves the provider default: `gpt-5.5` for CAPI sessions and the active session model for BYOK sessions.</summary>
+    [JsonPropertyName("assistedApprovalModel")]
+    public string? AssistedApprovalModel { get; set; }
+
+    /// <summary>Permission mode to apply.</summary>
+    [JsonPropertyName("mode")]
+    public PermissionMode Mode { get; set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Optional source for permission-mode telemetry. Defaults to `rpc` when omitted for SDK callers.</summary>
+    [JsonPropertyName("source")]
+    public PermissionModeSource? Source { get; set; }
 }
 
-/// <summary>Update the session's working directory. Used by the host when the user explicitly changes cwd (e.g., the `/cd` slash command). The host is responsible for any related side-effects (file index, etc.); it does NOT change the process working directory (a session's cwd is per-session, not process-global). For local sessions the runtime validates the target first (an absolute path that exists on disk) and re-bases the permission primary directory; a rejected validation fails the call before anything is mutated, persisted, or emitted. Location-scoped permission rules are then re-keyed to the new directory (best-effort). Remote sessions only record the path.</summary>
+/// <summary>Current permission mode.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class MetadataSetWorkingDirectoryResult
+public sealed class PermissionsGetModeResult
 {
-    /// <summary>Working directory after the update.</summary>
-    [JsonPropertyName("workingDirectory")]
-    public string WorkingDirectory { get; set; } = string.Empty;
+    /// <summary>Current permission mode.</summary>
+    [JsonPropertyName("mode")]
+    public PermissionMode Mode { get; set; }
 }
 
-/// <summary>Absolute path to set as the session's new working directory. For local sessions the path must be absolute and exist on disk: it is validated before any session state changes, and a failing validation rejects the call with nothing mutated, persisted, or emitted. Remote sessions record the path as-is.</summary>
+/// <summary>No parameters.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class MetadataSetWorkingDirectoryRequest
+internal sealed class PermissionsGetModeRequest
 {
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
-
-    /// <summary>Absolute path to set as the session's working directory. The runtime updates the session's recorded cwd so subsequent operations (shell tools, file lookups, telemetry) anchor to it.</summary>
-    [JsonPropertyName("workingDirectory")]
-    public string WorkingDirectory { get; set; } = string.Empty;
 }
 
-/// <summary>Re-tokenize the session's existing messages against `modelId` and return the token totals. Useful for hosts that want an initial estimate of context usage on session resume, before the next agent turn fires `session.context_info_changed` events. Returns zeros for an empty session.</summary>
+/// <summary>Indicates whether the operation succeeded.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class MetadataRecomputeContextTokensResult
+public sealed class PermissionsModifyRulesResult
 {
-    /// <summary>Tokens contributed by user/assistant/tool messages (excludes system/developer prompts).</summary>
-    [JsonPropertyName("messagesTokenCount")]
-    public long MessagesTokenCount { get; set; }
-
-    /// <summary>Tokens contributed by system/developer prompt snapshots.</summary>
-    [JsonPropertyName("systemTokenCount")]
-    public long SystemTokenCount { get; set; }
-
-    /// <summary>Sum of tokens across chat-context and system-context messages currently held by the session.</summary>
-    [JsonPropertyName("totalTokens")]
-    public long TotalTokens { get; set; }
+    /// <summary>Whether the operation succeeded.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-/// <summary>Model identifier to use when re-tokenizing the session's existing messages.</summary>
+/// <summary>Scope and add/remove instructions for modifying session- or location-scoped permission rules.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class MetadataRecomputeContextTokensRequest
+internal sealed class PermissionsModifyRulesParams
 {
-    /// <summary>Model identifier used for tokenization. The runtime token-counts both chat-context and system-context messages against this model.</summary>
-    [JsonPropertyName("modelId")]
-    public string ModelId { get; set; } = string.Empty;
+    /// <summary>Rules to add to the scope. Applied before `remove`/`removeAll`.</summary>
+    [JsonPropertyName("add")]
+    public IList<PermissionRule>? Add { get; set; }
+
+    /// <summary>Specific rules to remove from the scope. Ignored when `removeAll` is true.</summary>
+    [JsonPropertyName("remove")]
+    public IList<PermissionRule>? Remove { get; set; }
+
+    /// <summary>When true, removes every rule currently in the scope (after any `add` is applied). Useful for clearing the location scope wholesale.</summary>
+    [JsonPropertyName("removeAll")]
+    public bool? RemoveAll { get; set; }
+
+    /// <summary>Whether the change applies to ephemeral session-scoped rules (cleared at session end) or to location-scoped rules persisted via the location-permissions config file.</summary>
+    [JsonPropertyName("scope")]
+    public PermissionsModifyRulesScope Scope { get; set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Availability of built-in job tools surfaced to boundary consumers.</summary>
+/// <summary>Indicates whether the operation succeeded.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionSettingsBuiltInToolAvailabilitySnapshot
+public sealed class PermissionsSetRequiredResult
 {
-    /// <summary>Whether the create-pull-request tool is available.</summary>
-    [JsonPropertyName("createPullRequest")]
-    public bool? CreatePullRequest { get; set; }
-
-    /// <summary>Whether the report-progress tool is available.</summary>
-    [JsonPropertyName("reportProgress")]
-    public bool? ReportProgress { get; set; }
+    /// <summary>Whether the operation succeeded.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-/// <summary>Redacted job settings for a session. The job nonce is excluded.</summary>
+/// <summary>Toggles whether permission prompts should be bridged into session events for this client.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionSettingsJobSnapshot
+internal sealed class PermissionsSetRequiredRequest
 {
-    /// <summary>Availability of job-specific built-in tools.</summary>
-    [JsonPropertyName("builtInToolAvailability")]
-    public SessionSettingsBuiltInToolAvailabilitySnapshot? BuiltInToolAvailability { get; set; }
-
-    /// <summary>GitHub Actions event type for the job.</summary>
-    [JsonPropertyName("eventType")]
-    public string? EventType { get; set; }
+    /// <summary>Whether the client wants `permission.requested` events bridged from the session-owned permission service. CLI clients that render prompt UI set this to `true` for as long as their listener is mounted; headless callers leave it unset (the default is `false`).</summary>
+    [JsonPropertyName("required")]
+    public bool Required { get; set; }
 
-    /// <summary>Whether this is the workflow's trigger job.</summary>
-    [JsonPropertyName("isTriggerJob")]
-    public bool? IsTriggerJob { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Redacted model routing settings for a session.</summary>
+/// <summary>Indicates whether the operation succeeded.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionSettingsModelSnapshot
+public sealed class PermissionsResetSessionApprovalsResult
 {
-    /// <summary>Agent service callback URL for job and progress updates.</summary>
-    [JsonPropertyName("callbackUrl")]
-    public string? CallbackUrl { get; set; }
-
-    /// <summary>Default reasoning effort for the selected model.</summary>
-    [JsonPropertyName("defaultReasoningEffort")]
-    public string? DefaultReasoningEffort { get; set; }
-
-    /// <summary>Agent job identifier for the session.</summary>
-    [JsonPropertyName("instanceId")]
-    public string? InstanceId { get; set; }
-
-    /// <summary>Selected model identifier.</summary>
-    [JsonPropertyName("model")]
-    public string? Model { get; set; }
+    /// <summary>Whether the operation succeeded.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-/// <summary>Online-evaluation settings safe to expose across the SDK boundary.</summary>
+/// <summary>Clears session-scoped tool permission approvals, and optionally the location-scoped ones.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionSettingsOnlineEvaluationSnapshot
+internal sealed class PermissionsResetSessionApprovalsRequest
 {
-    /// <summary>Whether online evaluation is disabled.</summary>
-    [JsonPropertyName("disableOnlineEvaluation")]
-    public bool? DisableOnlineEvaluation { get; set; }
+    /// <summary>Whether location-scoped approvals are cleared too. Defaults to `true`.</summary>
+    [JsonPropertyName("includeLocation")]
+    public bool? IncludeLocation { get; set; }
 
-    /// <summary>Whether online-evaluation output-file generation is enabled.</summary>
-    [JsonPropertyName("enableOnlineEvaluationOutputFile")]
-    public bool? EnableOnlineEvaluationOutputFile { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Redacted repository and GitHub host settings for a session.</summary>
+/// <summary>Indicates whether the operation succeeded.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionSettingsRepoSnapshot
+public sealed class PermissionsNotifyPromptShownResult
 {
-    /// <summary>Checked-out repository branch.</summary>
-    [JsonPropertyName("branch")]
-    public string? Branch { get; set; }
-
-    /// <summary>Checked-out commit SHA.</summary>
-    [JsonPropertyName("commit")]
-    public string? Commit { get; set; }
-
-    /// <summary>GitHub server host name.</summary>
-    [JsonPropertyName("host")]
-    public string? Host { get; set; }
-
-    /// <summary>Protocol used to access the GitHub host.</summary>
-    [JsonPropertyName("hostProtocol")]
-    public string? HostProtocol { get; set; }
-
-    /// <summary>GitHub repository database ID.</summary>
-    [JsonPropertyName("id")]
-    public double? Id { get; set; }
-
-    /// <summary>Repository name.</summary>
-    [JsonPropertyName("name")]
-    public string? Name { get; set; }
-
-    /// <summary>GitHub repository owner database ID.</summary>
-    [JsonPropertyName("ownerId")]
-    public double? OwnerId { get; set; }
-
-    /// <summary>Repository owner login.</summary>
-    [JsonPropertyName("ownerName")]
-    public string? OwnerName { get; set; }
-
-    /// <summary>Number of commits in the pull request.</summary>
-    [JsonPropertyName("prCommitCount")]
-    public double? PrCommitCount { get; set; }
-
-    /// <summary>Whether the repository is writable.</summary>
-    [JsonPropertyName("readWrite")]
-    public bool? ReadWrite { get; set; }
-
-    /// <summary>GitHub secret-scanning service URL.</summary>
-    [JsonPropertyName("secretScanningUrl")]
-    public string? SecretScanningUrl { get; set; }
-
-    /// <summary>GitHub server base URL.</summary>
-    [JsonPropertyName("serverUrl")]
-    public string? ServerUrl { get; set; }
+    /// <summary>Whether the operation succeeded.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-/// <summary>Redacted validation and memory-tool settings for a session.</summary>
+/// <summary>Notification payload describing the permission prompt that the client just rendered.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionSettingsValidationSnapshot
+internal sealed class PermissionPromptShownNotification
 {
-    /// <summary>Whether advisory validation is enabled.</summary>
-    [JsonPropertyName("advisoryEnabled")]
-    public bool? AdvisoryEnabled { get; set; }
-
-    /// <summary>Whether CodeQL validation is enabled.</summary>
-    [JsonPropertyName("codeqlEnabled")]
-    public bool? CodeqlEnabled { get; set; }
-
-    /// <summary>Whether code-review validation is enabled.</summary>
-    [JsonPropertyName("codeReviewEnabled")]
-    public bool? CodeReviewEnabled { get; set; }
-
-    /// <summary>Model used for code-review validation.</summary>
-    [JsonPropertyName("codeReviewModel")]
-    public string? CodeReviewModel { get; set; }
-
-    /// <summary>Dependabot validation timeout budget in seconds.</summary>
-    [JsonPropertyName("dependabotTimeout")]
-    public double? DependabotTimeout { get; set; }
-
-    /// <summary>Whether the memory-store tool is enabled.</summary>
-    [JsonPropertyName("memoryStoreEnabled")]
-    public bool? MemoryStoreEnabled { get; set; }
-
-    /// <summary>Whether the memory-vote tool is enabled.</summary>
-    [JsonPropertyName("memoryVoteEnabled")]
-    public bool? MemoryVoteEnabled { get; set; }
-
-    /// <summary>Whether secret-scanning validation is enabled.</summary>
-    [JsonPropertyName("secretScanningEnabled")]
-    public bool? SecretScanningEnabled { get; set; }
+    /// <summary>Human-readable description of the prompt the user is being asked to approve. Used by the runtime to fire the registered `permission_prompt` notification hook (e.g. terminal bell, desktop notification).</summary>
+    [JsonPropertyName("message")]
+    public string Message { get; set; } = string.Empty;
 
-    /// <summary>General validation timeout budget in seconds.</summary>
-    [JsonPropertyName("timeout")]
-    public double? Timeout { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Redacted, serializable view of session runtime settings for SDK boundary consumers. Secrets and raw feature flags are intentionally excluded.</summary>
+/// <summary>Snapshot of the session's allow-listed directories and primary working directory.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionSettingsSnapshot
+public sealed class PermissionPathsList
 {
-    /// <summary>Name of the SDK client that created the session.</summary>
-    [JsonPropertyName("clientName")]
-    public string? ClientName { get; set; }
-
-    /// <summary>Redacted job settings.</summary>
-    [JsonPropertyName("job")]
-    public SessionSettingsJobSnapshot Job { get => field ??= new(); set; }
-
-    /// <summary>Redacted model routing settings.</summary>
-    [JsonPropertyName("model")]
-    public SessionSettingsModelSnapshot Model { get => field ??= new(); set; }
-
-    /// <summary>Online-evaluation settings safe for SDK consumers.</summary>
-    [JsonPropertyName("onlineEvaluation")]
-    public SessionSettingsOnlineEvaluationSnapshot OnlineEvaluation { get => field ??= new(); set; }
-
-    /// <summary>Redacted repository and host settings.</summary>
-    [JsonPropertyName("repo")]
-    public SessionSettingsRepoSnapshot Repo { get => field ??= new(); set; }
-
-    /// <summary>Session start time as Unix epoch milliseconds.</summary>
-    [JsonPropertyName("startTimeMs")]
-    public double? StartTimeMs { get; set; }
-
-    /// <summary>Session timeout in milliseconds.</summary>
-    [JsonPropertyName("timeoutMs")]
-    public double? TimeoutMs { get; set; }
-
-    /// <summary>Redacted validation and memory-tool settings.</summary>
-    [JsonPropertyName("validation")]
-    public SessionSettingsValidationSnapshot Validation { get => field ??= new(); set; }
+    /// <summary>All directories currently allowed for tool access on this session.</summary>
+    [JsonPropertyName("directories")]
+    public IList<string> Directories { get => field ??= []; set; }
 
-    /// <summary>Agent runtime version selector copied from the session settings, such as `latest` or a runtime release identifier.</summary>
-    [JsonPropertyName("version")]
-    public string? Version { get; set; }
+    /// <summary>The primary working directory for this session.</summary>
+    [JsonPropertyName("primary")]
+    public string Primary { get; set; } = string.Empty;
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>No parameters; returns the session's allow-listed directories.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionSettingsSnapshotRequest
+internal sealed class PermissionsPathsListRequest
 {
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Result of evaluating a Rust-owned settings predicate.</summary>
+/// <summary>Indicates whether the operation succeeded.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionSettingsEvaluatePredicateResult
+public sealed class PermissionsPathsAddResult
 {
-    /// <summary>Whether the named settings predicate evaluated to enabled.</summary>
-    [JsonPropertyName("enabled")]
-    public bool Enabled { get; set; }
+    /// <summary>Whether the operation succeeded.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-/// <summary>Named Rust-owned settings predicate to evaluate for this session.</summary>
+/// <summary>Directory path to add to the session's allowed directories.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionSettingsEvaluatePredicateRequest
+internal sealed class PermissionPathsAddParams
 {
-    /// <summary>Predicate name. The runtime owns the raw feature-flag names and composition logic.</summary>
-    [JsonPropertyName("name")]
-    public SessionSettingsPredicateName Name { get; set; }
+    /// <summary>Directory to add to the allow-list. The runtime resolves and validates the path before adding.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
-
-    /// <summary>Tool name for tool-scoped predicates such as trivial-change handling.</summary>
-    [JsonPropertyName("toolName")]
-    public string? ToolName { get; set; }
 }
 
-/// <summary>Content-exclusion decision for one requested path.</summary>
+/// <summary>Indicates whether the operation succeeded.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ContentExclusionPathCheck
+public sealed class PermissionsPathsUpdatePrimaryResult
 {
-    /// <summary>Whether the session's complete content-exclusion policy excludes the path.</summary>
-    [JsonPropertyName("excluded")]
-    public bool Excluded { get; set; }
+    /// <summary>Whether the operation succeeded.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
+}
 
-    /// <summary>The path supplied by the caller.</summary>
+/// <summary>Directory path to set as the session's new primary working directory.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class PermissionPathsUpdatePrimaryParams
+{
+    /// <summary>Directory to set as the new primary working directory for the session's permission policy.</summary>
     [JsonPropertyName("path")]
     public string Path { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Batch content-exclusion result. Callers must fail closed when policy evaluation is unavailable.</summary>
+/// <summary>Indicates whether the supplied path is within the session's allowed directories.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ContentExclusionCheckPathsResult
+public sealed class PermissionPathsAllowedCheckResult
 {
-    /// <summary>Whether the session's policy service was available for the complete batch. When false, checks is empty and callers must treat every requested path as excluded.</summary>
-    [JsonPropertyName("available")]
-    public bool Available { get; set; }
-
-    /// <summary>Per-path decisions in request order. Empty when available is false.</summary>
-    [JsonPropertyName("checks")]
-    public IList<ContentExclusionPathCheck> Checks { get => field ??= []; set; }
+    /// <summary>Whether the path is within the session's allowed directories.</summary>
+    [JsonPropertyName("allowed")]
+    public bool Allowed { get; set; }
 }
 
-/// <summary>Local file system absolute paths within the session working directory to check against its content-exclusion policy.</summary>
+/// <summary>Path to evaluate against the session's allowed directories.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class ContentExclusionCheckPathsRequest
+internal sealed class PermissionPathsAllowedCheckParams
 {
-    /// <summary>Local file system absolute paths within the session working directory to check. Results are returned in the same order, including duplicates.</summary>
-    [JsonPropertyName("paths")]
-    public IList<string> Paths { get => field ??= []; set; }
+    /// <summary>Path to check against the session's allowed directories.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Identifier of the spawned process, used to correlate streamed output and exit notifications.</summary>
+/// <summary>Indicates whether the supplied path is within the session's workspace directory.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ShellExecResult
+public sealed class PermissionPathsWorkspaceCheckResult
 {
-    /// <summary>Unique identifier for tracking streamed output.</summary>
-    [JsonPropertyName("processId")]
-    public string ProcessId { get; set; } = string.Empty;
+    /// <summary>Whether the path is within the session workspace directory.</summary>
+    [JsonPropertyName("allowed")]
+    public bool Allowed { get; set; }
 }
 
-/// <summary>Shell command to run, with optional working directory and timeout in milliseconds.</summary>
+/// <summary>Path to evaluate against the session's workspace (primary) directory.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class ShellExecRequest
+internal sealed class PermissionPathsWorkspaceCheckParams
 {
-    /// <summary>Shell command to execute.</summary>
-    [JsonPropertyName("command")]
-    public string Command { get; set; } = string.Empty;
-
-    /// <summary>Working directory (defaults to session working directory).</summary>
-    [JsonPropertyName("cwd")]
-    public string? Cwd { get; set; }
+    /// <summary>Path to check against the session workspace directory.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
-
-    /// <summary>Timeout in milliseconds (default: 30000).</summary>
-    [JsonConverter(typeof(MillisecondsTimeSpanConverter))]
-    [JsonPropertyName("timeout")]
-    public TimeSpan? Timeout { get; set; }
 }
 
-/// <summary>Indicates whether the signal was delivered; false if the process was unknown or already exited.</summary>
+/// <summary>Resolved location-permissions key and type.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ShellKillResult
+public sealed class PermissionLocationResolveResult
 {
-    /// <summary>Whether the signal was sent successfully.</summary>
-    [JsonPropertyName("killed")]
-    public bool Killed { get; set; }
+    /// <summary>Location key used in the location-permissions store.</summary>
+    [JsonPropertyName("locationKey")]
+    public string LocationKey { get; set; } = string.Empty;
+
+    /// <summary>Whether the location is a git repo or directory.</summary>
+    [JsonPropertyName("locationType")]
+    public PermissionLocationType LocationType { get; set; }
 }
 
-/// <summary>Identifier of a process previously returned by "shell.exec" and the signal to send.</summary>
+/// <summary>Working directory to resolve into a location-permissions key.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class ShellKillRequest
+internal sealed class PermissionLocationResolveParams
 {
-    /// <summary>Process identifier returned by shell.exec.</summary>
-    [JsonPropertyName("processId")]
-    public string ProcessId { get; set; } = string.Empty;
-
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 
-    /// <summary>Signal to send (default: SIGTERM).</summary>
-    [JsonPropertyName("signal")]
-    public ShellKillSignal? Signal { get; set; }
+    /// <summary>Working directory whose permission location should be resolved.</summary>
+    [JsonPropertyName("workingDirectory")]
+    public string WorkingDirectory { get; set; } = string.Empty;
 }
 
-/// <summary>Result of a user-requested shell command.</summary>
+/// <summary>Summary of persisted location permissions applied to the session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class UserRequestedShellCommandResult
+public sealed class PermissionLocationApplyResult
 {
-    /// <summary>Error output when the execution failed.</summary>
-    [JsonPropertyName("error")]
-    public string? Error { get; set; }
+    /// <summary>Number of persisted allowed directories added to the live path manager.</summary>
+    [JsonPropertyName("appliedDirectoryCount")]
+    public long AppliedDirectoryCount { get; set; }
 
-    /// <summary>Process exit code, when available.</summary>
-    [JsonPropertyName("exitCode")]
-    public long? ExitCode { get; set; }
+    /// <summary>Number of location-scoped rules added to the live permission service.</summary>
+    [JsonPropertyName("appliedRuleCount")]
+    public long AppliedRuleCount { get; set; }
 
-    /// <summary>Captured command output.</summary>
-    [JsonPropertyName("output")]
-    public string Output { get; set; } = string.Empty;
+    /// <summary>Location-scoped rules applied to the live permission service.</summary>
+    [JsonPropertyName("appliedRules")]
+    public IList<PermissionRule> AppliedRules { get => field ??= []; set; }
 
-    /// <summary>Whether the command completed successfully.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
+    /// <summary>Whether a different location was applied since the previous apply call.</summary>
+    [JsonPropertyName("changed")]
+    public bool Changed { get; set; }
 
-    /// <summary>Tool call id emitted for the shell execution.</summary>
-    [JsonPropertyName("toolCallId")]
-    public string ToolCallId { get; set; } = string.Empty;
+    /// <summary>Location key used in the location-permissions store.</summary>
+    [JsonPropertyName("locationKey")]
+    public string LocationKey { get; set; } = string.Empty;
+
+    /// <summary>Whether the location is a git repo or directory.</summary>
+    [JsonPropertyName("locationType")]
+    public PermissionLocationType LocationType { get; set; }
 }
 
-/// <summary>User-requested shell command and cancellation handle.</summary>
+/// <summary>Working directory to load persisted location permissions for.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class ShellExecuteUserRequestedRequest
+internal sealed class PermissionLocationApplyParams
 {
-    /// <summary>Shell command to execute.</summary>
-    [JsonPropertyName("command")]
-    public string Command { get; set; } = string.Empty;
-
-    /// <summary>Caller-provided cancellation handle for this execution.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
-
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Working directory whose persisted location permissions should be applied.</summary>
+    [JsonPropertyName("workingDirectory")]
+    public string WorkingDirectory { get; set; } = string.Empty;
 }
 
-/// <summary>Cancellation result for a user-requested shell command.</summary>
+/// <summary>Indicates whether the operation succeeded.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class CancelUserRequestedShellCommandResult
+public sealed class PermissionsLocationsAddToolApprovalResult
 {
-    /// <summary>Whether an in-flight execution was found and signalled to cancel.</summary>
-    [JsonPropertyName("cancelled")]
-    public bool Cancelled { get; set; }
+    /// <summary>Whether the operation succeeded.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-/// <summary>User-requested shell execution cancellation handle.</summary>
+/// <summary>Tool approval to persist and apply.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class ShellCancelUserRequestedRequest
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "kind",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsCommands), "commands")]
+[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsRead), "read")]
+[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsWrite), "write")]
+[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsMcp), "mcp")]
+[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsMcpSampling), "mcp-sampling")]
+[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsMemory), "memory")]
+[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsCustomTool), "custom-tool")]
+[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsExtensionManagement), "extension-management")]
+[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsFactory), "factory")]
+[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsExtensionPermissionAccess), "extension-permission-access")]
+[JsonDerivedType(typeof(PermissionsLocationsAddToolApprovalDetailsExtensionEnvAccess), "extension-env-access")]
+public partial class PermissionsLocationsAddToolApprovalDetails
 {
-    /// <summary>Request ID previously passed to executeUserRequested.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
-
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("kind")]
+    public virtual string Kind { get; set; } = string.Empty;
 }
 
-/// <summary>Post-compaction context window usage breakdown.</summary>
+
+/// <summary>Location-persisted tool approval details for specific command identifiers.</summary>
+/// <remarks>The <c>commands</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class HistoryCompactContextWindow
+public partial class PermissionsLocationsAddToolApprovalDetailsCommands : PermissionsLocationsAddToolApprovalDetails
 {
-    /// <summary>Token count from non-system messages (user, assistant, tool).</summary>
-    [JsonPropertyName("conversationTokens")]
-    public long? ConversationTokens { get; set; }
-
-    /// <summary>Current total tokens in the context window (system + conversation + tool definitions).</summary>
-    [JsonPropertyName("currentTokens")]
-    public long CurrentTokens { get; set; }
-
-    /// <summary>Current number of messages in the conversation.</summary>
-    [JsonPropertyName("messagesLength")]
-    public long MessagesLength { get; set; }
-
-    /// <summary>Token count from system message(s).</summary>
-    [JsonPropertyName("systemTokens")]
-    public long? SystemTokens { get; set; }
-
-    /// <summary>Maximum token count for the model's context window.</summary>
-    [JsonPropertyName("tokenLimit")]
-    public long TokenLimit { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "commands";
 
-    /// <summary>Token count from tool definitions.</summary>
-    [JsonPropertyName("toolDefinitionsTokens")]
-    public long? ToolDefinitionsTokens { get; set; }
+    /// <summary>Command identifiers covered by this approval.</summary>
+    [JsonPropertyName("commandIdentifiers")]
+    public required IList<string> CommandIdentifiers { get; set; }
 }
 
-/// <summary>Compaction outcome with the number of tokens and messages removed, summary text, and the resulting context window breakdown.</summary>
+/// <summary>Location-persisted tool approval details for read-only filesystem operations.</summary>
+/// <remarks>The <c>read</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class HistoryCompactResult
+public partial class PermissionsLocationsAddToolApprovalDetailsRead : PermissionsLocationsAddToolApprovalDetails
 {
-    /// <summary>Post-compaction context window usage breakdown.</summary>
-    [JsonPropertyName("contextWindow")]
-    public HistoryCompactContextWindow? ContextWindow { get; set; }
-
-    /// <summary>Number of messages removed during compaction.</summary>
-    [JsonPropertyName("messagesRemoved")]
-    public long MessagesRemoved { get; set; }
-
-    /// <summary>Whether compaction completed successfully.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
-
-    /// <summary>Summary text produced by compaction. Omitted when compaction did not produce a summary (e.g. failure path).</summary>
-    [JsonPropertyName("summaryContent")]
-    public string? SummaryContent { get; set; }
-
-    /// <summary>Number of tokens freed by compaction.</summary>
-    [JsonPropertyName("tokensRemoved")]
-    public long TokensRemoved { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "read";
 }
 
-/// <summary>RPC data type for SessionHistoryCompact operations.</summary>
+/// <summary>Location-persisted tool approval details for filesystem write operations.</summary>
+/// <remarks>The <c>write</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionHistoryCompactRequest
+public partial class PermissionsLocationsAddToolApprovalDetailsWrite : PermissionsLocationsAddToolApprovalDetails
 {
-    /// <summary>Optional user-provided instructions to focus the compaction summary.</summary>
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MaxLength(4000)]
-    [JsonPropertyName("customInstructions")]
-    public string? CustomInstructions { get; set; }
-
-    /// <summary>Context window token limit this compaction is targeting, recorded as the `tokenLimit` on the persisted `session.compaction_start` / `session.compaction_complete` events. Set it when the compaction targets a window other than the compacting model's own, e.g. switching to a model with a smaller context window: the compaction still runs on the current model, so the limit that motivated it would otherwise be lost. When absent, the events record the compacting model's own resolved limit. Attribution metadata only - it does not change how much the compaction removes.</summary>
-    [JsonPropertyName("tokenLimit")]
-    public long? TokenLimit { get; set; }
-
-    /// <summary>What initiated this compaction request, recorded as the `trigger` on the persisted `session.compaction_start` / `session.compaction_complete` events. When absent, the compaction is persisted without trigger attribution (initiator unknown).</summary>
-    [JsonPropertyName("trigger")]
-    public SessionHistoryCompactRequestTrigger? Trigger { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "write";
 }
 
-/// <summary>RPC data type for SessionHistoryCompactRequestWithSession operations.</summary>
+/// <summary>Location-persisted tool approval details for an MCP server tool, or all tools when `toolName` is null.</summary>
+/// <remarks>The <c>mcp</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionHistoryCompactRequestWithSession
+public partial class PermissionsLocationsAddToolApprovalDetailsMcp : PermissionsLocationsAddToolApprovalDetails
 {
-    /// <summary>Optional user-provided instructions to focus the compaction summary.</summary>
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MaxLength(4000)]
-    [JsonPropertyName("customInstructions")]
-    public string? CustomInstructions { get; set; }
-
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "mcp";
 
-    /// <summary>Context window token limit this compaction is targeting, recorded as the `tokenLimit` on the persisted `session.compaction_start` / `session.compaction_complete` events. Set it when the compaction targets a window other than the compacting model's own, e.g. switching to a model with a smaller context window: the compaction still runs on the current model, so the limit that motivated it would otherwise be lost. When absent, the events record the compacting model's own resolved limit. Attribution metadata only - it does not change how much the compaction removes.</summary>
-    [JsonPropertyName("tokenLimit")]
-    public long? TokenLimit { get; set; }
+    /// <summary>MCP server name.</summary>
+    [JsonPropertyName("serverName")]
+    public required string ServerName { get; set; }
 
-    /// <summary>What initiated this compaction request, recorded as the `trigger` on the persisted `session.compaction_start` / `session.compaction_complete` events. When absent, the compaction is persisted without trigger attribution (initiator unknown).</summary>
-    [JsonPropertyName("trigger")]
-    public SessionHistoryCompactRequestTrigger? Trigger { get; set; }
+    /// <summary>MCP tool name, or null to cover every tool on the server.</summary>
+    [JsonPropertyName("toolName")]
+    public string? ToolName { get; set; }
 }
 
-/// <summary>Number of events that were removed by the truncation.</summary>
+/// <summary>Location-persisted tool approval details for MCP sampling requests from a server.</summary>
+/// <remarks>The <c>mcp-sampling</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class HistoryTruncateResult
+public partial class PermissionsLocationsAddToolApprovalDetailsMcpSampling : PermissionsLocationsAddToolApprovalDetails
 {
-    /// <summary>Failure detail when checkpointCleanupFailed is true.</summary>
-    [JsonPropertyName("checkpointCleanupError")]
-    public string? CheckpointCleanupError { get; set; }
-
-    /// <summary>True when conversation truncation succeeded but post-truncation workspace checkpoint cleanup failed. History is already truncated; callers may still prune snapshots but should report a checkpoint-cleanup rather than a truncation failure.</summary>
-    [JsonPropertyName("checkpointCleanupFailed")]
-    public bool? CheckpointCleanupFailed { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "mcp-sampling";
 
-    /// <summary>Number of events that were removed.</summary>
-    [JsonPropertyName("eventsRemoved")]
-    public long EventsRemoved { get; set; }
+    /// <summary>MCP server name.</summary>
+    [JsonPropertyName("serverName")]
+    public required string ServerName { get; set; }
 }
 
-/// <summary>Identifier of the event to truncate to; this event and all later events are removed.</summary>
+/// <summary>Location-persisted tool approval details for writes to long-term memory.</summary>
+/// <remarks>The <c>memory</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class HistoryTruncateRequest
+public partial class PermissionsLocationsAddToolApprovalDetailsMemory : PermissionsLocationsAddToolApprovalDetails
 {
-    /// <summary>Event ID to truncate to. This event and all events after it are removed from the session.</summary>
-    [JsonPropertyName("eventId")]
-    public string EventId { get; set; } = string.Empty;
-
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "memory";
 }
 
-/// <summary>A root user turn that the session can rewind to.</summary>
+/// <summary>Location-persisted tool approval details for a custom tool, keyed by tool name.</summary>
+/// <remarks>The <c>custom-tool</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class HistoryRewindPoint
+public partial class PermissionsLocationsAddToolApprovalDetailsCustomTool : PermissionsLocationsAddToolApprovalDetails
 {
-    /// <summary>Whether at least one file in this turn or a later turn can be restored.</summary>
-    [JsonPropertyName("canRestoreFiles")]
-    public bool CanRestoreFiles { get; set; }
-
-    /// <summary>ID of the user.message event that begins the discarded suffix.</summary>
-    [JsonPropertyName("eventId")]
-    public string EventId { get; set; } = string.Empty;
-
-    /// <summary>Number of unique files in this turn and all later turns that have captured changes.</summary>
-    [JsonPropertyName("fileCount")]
-    public long FileCount { get; set; }
-
-    /// <summary>Whether this turn was an automatically injected autopilot continuation.</summary>
-    [JsonPropertyName("isAutopilotContinuation")]
-    public bool IsAutopilotContinuation { get; set; }
-
-    /// <summary>Lines added by this turn's captured file changes.</summary>
-    [JsonPropertyName("linesAdded")]
-    public long LinesAdded { get; set; }
-
-    /// <summary>Lines removed by this turn's captured file changes.</summary>
-    [JsonPropertyName("linesRemoved")]
-    public long LinesRemoved { get; set; }
-
-    /// <summary>ISO timestamp of the user turn.</summary>
-    [JsonPropertyName("timestamp")]
-    public string Timestamp { get; set; } = string.Empty;
-
-    /// <summary>Whether this turn itself captured any file changes.</summary>
-    [JsonPropertyName("turnChangedFiles")]
-    public bool TurnChangedFiles { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "custom-tool";
 
-    /// <summary>User-visible message text for the turn.</summary>
-    [JsonPropertyName("userMessage")]
-    public string UserMessage { get; set; } = string.Empty;
+    /// <summary>Custom tool name.</summary>
+    [JsonPropertyName("toolName")]
+    public required string ToolName { get; set; }
 }
 
-/// <summary>Rewind points and file-change-tracking availability for the session.</summary>
+/// <summary>Location-persisted tool approval details for extension-management operations, optionally narrowed by operation.</summary>
+/// <remarks>The <c>extension-management</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class HistoryListRewindPointsResult
+public partial class PermissionsLocationsAddToolApprovalDetailsExtensionManagement : PermissionsLocationsAddToolApprovalDetails
 {
-    /// <summary>Whether this session captured file changes from its first turn.</summary>
-    [JsonPropertyName("fileChangeTrackingEnabled")]
-    public bool FileChangeTrackingEnabled { get; set; }
-
-    /// <summary>Root user turns in chronological order. Empty when `unavailableReason` is set.</summary>
-    [JsonPropertyName("points")]
-    public IList<HistoryRewindPoint> Points { get => field ??= []; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "extension-management";
 
-    /// <summary>Why the listed points could not be produced, when applicable; the points list is empty whenever it is set. `unsupported-remote-session` is permanent for the session and comes with `fileChangeTrackingEnabled: false`. `session-busy` is transient and only ever reported by a session that *is* tracking (`fileChangeTrackingEnabled: true`), because the file-change captures cannot be read while work that may still mutate them is in flight; the same request succeeds once the session settles, so a client that wants points should retry rather than treat it as a failure. It is never `file-change-tracking-disabled`: an untracked local session still lists conversation-only points and reports that through `fileChangeTrackingEnabled: false`.</summary>
-    [JsonPropertyName("unavailableReason")]
-    public HistoryRewindUnavailableReason? UnavailableReason { get; set; }
+    /// <summary>Optional operation identifier; when omitted, the approval covers all extension management operations.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("operation")]
+    public string? Operation { get; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Location-persisted factory approval, optionally narrowed by approval key.</summary>
+/// <remarks>The <c>factory</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionHistoryListRewindPointsRequest
+public partial class PermissionsLocationsAddToolApprovalDetailsFactory : PermissionsLocationsAddToolApprovalDetails
 {
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "factory";
+
+    /// <summary>Optional factory operation name or canonical approval key; when omitted, the approval covers all factory operations.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("approvalKey")]
+    public string? ApprovalKey { get; set; }
 }
 
-/// <summary>A file that a conversation-and-files rewind would restore.</summary>
+/// <summary>Location-persisted tool approval details for an extension's permission-gated capability access, keyed by extension name.</summary>
+/// <remarks>The <c>extension-permission-access</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class HistoryRewindFilePreview
+public partial class PermissionsLocationsAddToolApprovalDetailsExtensionPermissionAccess : PermissionsLocationsAddToolApprovalDetails
 {
-    /// <summary>Aggregate change made across the discarded turns.</summary>
-    [JsonPropertyName("changeType")]
-    public HistoryRewindChangeType ChangeType { get; set; }
-
-    /// <summary>Lines added across the discarded turns.</summary>
-    [JsonPropertyName("linesAdded")]
-    public long LinesAdded { get; set; }
-
-    /// <summary>Lines removed across the discarded turns.</summary>
-    [JsonPropertyName("linesRemoved")]
-    public long LinesRemoved { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "extension-permission-access";
 
-    /// <summary>Absolute path of the captured file.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+    /// <summary>Extension name.</summary>
+    [JsonPropertyName("extensionName")]
+    public required string ExtensionName { get; set; }
 }
 
-/// <summary>Files and aggregate changes for a prospective rewind.</summary>
+/// <summary>Location-persisted tool approval details for an extension's access to sensitive environment variables, keyed by extension name and the exact set of variable names.</summary>
+/// <remarks>The <c>extension-env-access</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed class HistoryPreviewRewindResult
+public partial class PermissionsLocationsAddToolApprovalDetailsExtensionEnvAccess : PermissionsLocationsAddToolApprovalDetails
 {
-    /// <summary>Whether file restore is available for this session. This is authoritative: switch on it and read `reason` only when it is false.</summary>
-    [JsonPropertyName("available")]
-    public bool Available { get; set; }
-
-    /// <summary>Number of unique files in the preview.</summary>
-    [JsonPropertyName("fileCount")]
-    public long FileCount { get; set; }
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "extension-env-access";
 
-    /// <summary>Files ordered by path.</summary>
-    [JsonPropertyName("files")]
-    public IList<HistoryRewindFilePreview> Files { get => field ??= []; set; }
+    /// <summary>Names of the sensitive environment variables this approval covers. Values are never persisted.</summary>
+    [JsonPropertyName("environmentVariables")]
+    public required IList<string> EnvironmentVariables { get; set; }
 
-    /// <summary>Why file restore is unavailable, when applicable. Populated only when `available` is false and never set when `available` is true.</summary>
-    [JsonPropertyName("reason")]
-    public HistoryRewindUnavailableReason? Reason { get; set; }
+    /// <summary>Extension name.</summary>
+    [JsonPropertyName("extensionName")]
+    public required string ExtensionName { get; set; }
 }
 
-/// <summary>Event boundary to preview for conversation-and-files rewind.</summary>
+/// <summary>Location-scoped tool approval to persist.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class HistoryPreviewRewindRequest
+internal sealed class PermissionLocationAddToolApprovalParams
 {
-    /// <summary>ID of the user.message event that begins the discarded suffix.</summary>
-    [JsonPropertyName("eventId")]
-    public string EventId { get; set; } = string.Empty;
+    /// <summary>Tool approval to persist and apply.</summary>
+    [JsonPropertyName("approval")]
+    public PermissionsLocationsAddToolApprovalDetails Approval { get => field ??= new(); set; }
+
+    /// <summary>Location key (git root or cwd) to persist the approval to.</summary>
+    [JsonPropertyName("locationKey")]
+    public string LocationKey { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>A captured file that rewind intentionally left unchanged.</summary>
+/// <summary>Folder trust check result.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class HistorySkippedFileRestore
+public sealed class FolderTrustCheckResult
 {
-    /// <summary>Absolute path of the skipped file.</summary>
+    /// <summary>Whether the folder is trusted.</summary>
+    [JsonPropertyName("trusted")]
+    public bool Trusted { get; set; }
+}
+
+/// <summary>Folder path to check for trust.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class FolderTrustCheckParams
+{
+    /// <summary>Folder path to check.</summary>
     [JsonPropertyName("path")]
     public string Path { get; set; } = string.Empty;
 
-    /// <summary>Reason the file was not restored.</summary>
-    [JsonPropertyName("reason")]
-    public HistoryFileRestoreSkipReason Reason { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Structured outcome of a rewind request.</summary>
+/// <summary>Indicates whether the operation succeeded.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class HistoryRewindResult
+public sealed class PermissionsFolderTrustAddTrustedResult
 {
-    /// <summary>Failure detail. Set only for the failure and partial-failure outcomes (`files-rolled-back`, `rollback-incomplete`, `truncation-failed`, `checkpoint-cleanup-failed`, `snapshot-prune-failed`); omitted for `success` and for the unavailable outcomes (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`).</summary>
-    [JsonPropertyName("error")]
-    public string? Error { get; set; }
-
-    /// <summary>Number of persisted events removed by conversation truncation. Present only when truncation succeeded (outcomes `success`, `checkpoint-cleanup-failed`, and `snapshot-prune-failed`); omitted for every unavailable outcome (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`) and for `truncation-failed`, `files-rolled-back`, and `rollback-incomplete`.</summary>
-    [JsonPropertyName("eventsRemoved")]
-    public long? EventsRemoved { get; set; }
-
-    /// <summary>Overall rewind outcome. This discriminates the result: it governs which of the remaining fields are populated, so consumers must switch on it before reading `eventsRemoved`, `restoredFiles`, `skippedFiles`, or `error`. See each field for the outcomes that populate it.</summary>
-    [JsonPropertyName("outcome")]
-    public HistoryRewindOutcome Outcome { get; set; }
-
-    /// <summary>Absolute paths restored to their captured preimages. Always empty for conversation-only rewinds and for the unavailable outcomes (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`); only conversation-and-files outcomes that reached the file-restore stage populate it.</summary>
-    [JsonPropertyName("restoredFiles")]
-    public IList<string> RestoredFiles { get => field ??= []; set; }
-
-    /// <summary>Captured files intentionally left unchanged. Always empty for conversation-only rewinds and for the unavailable outcomes (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`); only conversation-and-files outcomes that reached the file-restore stage populate it.</summary>
-    [JsonPropertyName("skippedFiles")]
-    public IList<HistorySkippedFileRestore> SkippedFiles { get => field ??= []; set; }
+    /// <summary>Whether the operation succeeded.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-/// <summary>Boundary and mode for rewinding session history.</summary>
+/// <summary>Folder path to add to trusted folders.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class HistoryRewindRequest
+internal sealed class FolderTrustAddParams
 {
-    /// <summary>ID of the user.message event that begins the discarded suffix.</summary>
-    [JsonPropertyName("eventId")]
-    public string EventId { get; set; } = string.Empty;
-
-    /// <summary>Whether to rewind only conversation history or also restore captured files.</summary>
-    [JsonPropertyName("mode")]
-    public HistoryRewindMode Mode { get; set; }
+    /// <summary>Folder path to mark as trusted.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether an in-progress background compaction was cancelled.</summary>
+/// <summary>Indicates whether the operation succeeded.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class HistoryCancelBackgroundCompactionResult
+public sealed class PermissionsUrlsSetUnrestrictedModeResult
 {
-    /// <summary>Whether an in-progress background compaction was cancelled. False when no compaction was running, when the session is remote, or when the underlying processor was unavailable.</summary>
-    [JsonPropertyName("cancelled")]
-    public bool Cancelled { get; set; }
+    /// <summary>Whether the operation succeeded.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Whether the URL-permission policy should run in unrestricted mode.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionHistoryCancelBackgroundCompactionRequest
+internal sealed class PermissionUrlsSetUnrestrictedModeParams
 {
+    /// <summary>Whether to allow access to all URLs without prompting. Toggles the runtime's URL-permission policy in place.</summary>
+    [JsonPropertyName("enabled")]
+    public bool Enabled { get; set; }
+
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether an in-progress manual compaction was aborted.</summary>
+/// <summary>The repository the remote session targets.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class HistoryAbortManualCompactionResult
+public sealed class MetadataSnapshotRemoteMetadataRepository
 {
-    /// <summary>Whether an in-progress manual compaction was aborted. False when no manual compaction was running, when its abort controller was already aborted, or when the session is remote.</summary>
-    [JsonPropertyName("aborted")]
-    public bool Aborted { get; set; }
+    /// <summary>The branch the remote session is operating on.</summary>
+    [JsonPropertyName("branch")]
+    public string Branch { get; set; } = string.Empty;
+
+    /// <summary>The GitHub repository name (without owner).</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
+
+    /// <summary>The GitHub owner (user or organization) of the target repository.</summary>
+    [JsonPropertyName("owner")]
+    public string Owner { get; set; } = string.Empty;
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Remote-session-specific metadata. Populated only when `isRemote` is true. Fields are immutable for the lifetime of the session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionHistoryAbortManualCompactionRequest
+public sealed class MetadataSnapshotRemoteMetadata
 {
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>The pull request number the remote session is associated with, if any.</summary>
+    [JsonPropertyName("pullRequestNumber")]
+    public long? PullRequestNumber { get; set; }
+
+    /// <summary>The repository the remote session targets.</summary>
+    [JsonPropertyName("repository")]
+    public MetadataSnapshotRemoteMetadataRepository Repository { get => field ??= new(); set; }
+
+    /// <summary>The original resource identifier (task ID or PR node ID), preserved across event-replay reconstructions. Falls back to `sessionId` when absent.</summary>
+    [JsonPropertyName("resourceId")]
+    public string? ResourceId { get; set; }
+
+    /// <summary>Whether the remote task originated from Copilot Coding Agent (cca) or a CLI `--remote` invocation.</summary>
+    [JsonPropertyName("taskType")]
+    public MetadataSnapshotRemoteMetadataTaskType? TaskType { get; set; }
 }
 
-/// <summary>Markdown summary of the conversation context (empty when not available).</summary>
+/// <summary>Public-facing projection of workspace metadata for SDK / TUI consumers.</summary>
+public sealed class SessionMetadataSnapshotWorkspace
+{
+    /// <summary>Branch checked out at session start, if any.</summary>
+    [JsonPropertyName("branch")]
+    public string? Branch { get; set; }
+
+    /// <summary>ISO 8601 timestamp when the workspace was created.</summary>
+    [JsonPropertyName("created_at")]
+    public DateTimeOffset? CreatedAt { get; set; }
+
+    /// <summary>Current working directory at session start.</summary>
+    [JsonPropertyName("cwd")]
+    public string? Cwd { get; set; }
+
+    /// <summary>Resolved git root for cwd, if any.</summary>
+    [JsonPropertyName("git_root")]
+    public string? GitRoot { get; set; }
+
+    /// <summary>Repository host type, if known.</summary>
+    [JsonPropertyName("host_type")]
+    public WorkspaceSummaryHostType? HostType { get; set; }
+
+    /// <summary>Workspace identifier (1:1 with sessionId).</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
+
+    /// <summary>Display name for the session, if set.</summary>
+    [JsonPropertyName("name")]
+    public string? Name { get; set; }
+
+    /// <summary>Repository identifier in 'owner/repo' or 'org/project/repo' format, if any.</summary>
+    [JsonPropertyName("repository")]
+    public string? Repository { get; set; }
+
+    /// <summary>ISO 8601 timestamp when the workspace was last updated.</summary>
+    [JsonPropertyName("updated_at")]
+    public DateTimeOffset? UpdatedAt { get; set; }
+
+    /// <summary>Whether the display name was explicitly set by the user.</summary>
+    [JsonPropertyName("user_named")]
+    public bool? UserNamed { get; set; }
+}
+
+/// <summary>Point-in-time snapshot of slow-changing session identifier and state fields.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class HistorySummarizeForHandoffResult
+public sealed class SessionMetadataSnapshot
 {
-    /// <summary>Markdown summary of the conversation context produced by an LLM. Empty string when there are no messages or when the session does not support local summarization.</summary>
+    /// <summary>True when the session was detected to be in use by another process at construction time. Local consumers may surface a confirmation prompt before fully attaching. Always false for new sessions.</summary>
+    [JsonPropertyName("alreadyInUse")]
+    public bool AlreadyInUse { get; set; }
+
+    /// <summary>Runtime client name associated with the session (telemetry identifier).</summary>
+    [JsonPropertyName("clientName")]
+    public string? ClientName { get; set; }
+
+    /// <summary>The current agent mode for this session (e.g., 'interactive', 'plan', 'autopilot').</summary>
+    [JsonPropertyName("currentMode")]
+    public MetadataSnapshotCurrentMode CurrentMode { get; set; }
+
+    /// <summary>User-provided name supplied at session construction (via `--name`), if any. Immutable after construction.</summary>
+    [JsonPropertyName("initialName")]
+    public string? InitialName { get; set; }
+
+    /// <summary>Whether this is a remote session (i.e., one whose runtime executes elsewhere and is steered through this process).</summary>
+    [JsonPropertyName("isRemote")]
+    public bool IsRemote { get; set; }
+
+    /// <summary>ISO 8601 timestamp of when the session's persisted state was last modified on disk. For new sessions, equals startTime. For resumed sessions, reflects the previous modification time at construction.</summary>
+    [JsonPropertyName("modifiedTime")]
+    public DateTimeOffset ModifiedTime { get; set; }
+
+    /// <summary>Remote-session-specific metadata. Populated only when `isRemote` is true. Fields are immutable for the lifetime of the session.</summary>
+    [JsonPropertyName("remoteMetadata")]
+    public MetadataSnapshotRemoteMetadata? RemoteMetadata { get; set; }
+
+    /// <summary>Currently selected model identifier, if any.</summary>
+    [JsonPropertyName("selectedModel")]
+    public string? SelectedModel { get; set; }
+
+    /// <summary>The unique identifier of the session.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Current session limits, or null when no limits are active.</summary>
+    [JsonPropertyName("sessionLimits")]
+    public SessionLimitsConfig? SessionLimits { get; set; }
+
+    /// <summary>ISO 8601 timestamp of when the session started.</summary>
+    [JsonPropertyName("startTime")]
+    public DateTimeOffset StartTime { get; set; }
+
+    /// <summary>Short human-readable summary of the session, if known. Omitted when no summary has been generated.</summary>
     [JsonPropertyName("summary")]
-    public string Summary { get; set; } = string.Empty;
+    public string? Summary { get; set; }
+
+    /// <summary>Absolute path to the session's current working directory.</summary>
+    [JsonPropertyName("workingDirectory")]
+    public string WorkingDirectory { get; set; } = string.Empty;
+
+    /// <summary>Public-facing workspace metadata for this session, or null if the session has no associated workspace. Excludes runtime-internal fields (GitHub IDs, summary count, internal flags).</summary>
+    [JsonPropertyName("workspace")]
+    public SessionMetadataSnapshotWorkspace? Workspace { get; set; }
+
+    /// <summary>Absolute path to the session's workspace directory on disk, or null if the session has no associated workspace.</summary>
+    [JsonPropertyName("workspacePath")]
+    public string? WorkspacePath { get; set; }
 }
 
 /// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionHistorySummarizeForHandoffRequest
+internal sealed class SessionMetadataSnapshotRequest
 {
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>What a successful clear removed. A clear that could not be applied rejects instead of reporting a count.</summary>
+/// <summary>Indicates whether the local session is currently processing a turn or background continuation.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class HistoryClearContextResult
+public sealed class MetadataIsProcessingResult
 {
-    /// <summary>Number of non-system, non-developer messages that were removed from the conversation. Zero only when the window already held no conversation.</summary>
-    [JsonPropertyName("messagesCleared")]
-    public long MessagesCleared { get; set; }
+    /// <summary>Whether the session is currently processing user/agent messages. False for non-local sessions (which don't run a local agentic loop). Reflects an in-flight turn or background continuation.</summary>
+    [JsonPropertyName("processing")]
+    public bool Processing { get; set; }
 }
 
-/// <summary>Parameters for clearing the conversation and seeding the window that replaces it.</summary>
+/// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class HistoryClearContextRequest
+internal sealed class SessionMetadataIsProcessingRequest
 {
-    /// <summary>First user message of the fresh context window. Required: a cleared window holding only system and developer messages is not a conversation a model can answer, so every clear seeds the window it creates. Delivered by the enclosing turn driver once the agentic loop exits, which is why the call must be made from inside a tool handler.</summary>
-    [JsonPropertyName("prompt")]
-    public string Prompt { get; set; } = string.Empty;
-
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>User-facing pending queue entry, with kind and display text for a queued message, slash command, or model change.</summary>
+/// <summary>Current activity flags for the session.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class QueuePendingItems
+public sealed class SessionActivity
 {
-    /// <summary>Agent mode stored on this queued entry, as stamped when it was enqueued. Items without an explicit mode report interactive. This is not necessarily the mode that will constrain the turn: a plan or autopilot session applies its own write gate, continuation loop and permission posture to every drained item regardless of the mode stored here.</summary>
-    [JsonPropertyName("agentMode")]
-    public SendAgentMode AgentMode { get; set; }
-
-    /// <summary>Human-readable text to display for this queue entry in the UI.</summary>
-    [JsonPropertyName("displayText")]
-    public string DisplayText { get; set; } = string.Empty;
-
-    /// <summary>Stable opaque id for the canonical queued item. Batch rows share one id.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
-
-    /// <summary>Whether this item is a queued user message or a queued slash command / model change.</summary>
-    [JsonPropertyName("kind")]
-    public QueuePendingItemsKind Kind { get; set; }
-}
-
-/// <summary>Snapshot of the session's pending queued items and immediate-steering messages.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class QueuePendingItemsResult
-{
-    /// <summary>Pending queued items in submission order. Includes user messages, queued slash commands, and queued model changes; omits internal system items.</summary>
-    [JsonPropertyName("items")]
-    public IList<QueuePendingItems> Items { get => field ??= []; set; }
+    /// <summary>Whether an in-flight operation can currently be aborted.</summary>
+    [JsonPropertyName("abortable")]
+    public bool Abortable { get; set; }
 
-    /// <summary>Display text for messages currently in the immediate steering queue (interjections sent during a running turn).</summary>
-    [JsonPropertyName("steeringMessages")]
-    public IList<string> SteeringMessages { get => field ??= []; set; }
+    /// <summary>Whether the session currently has active work, including running turns or tasks.</summary>
+    [JsonPropertyName("hasActiveWork")]
+    public bool HasActiveWork { get; set; }
 }
 
 /// <summary>Identifies the target session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionQueuePendingItemsRequest
+internal sealed class SessionMetadataActivityRequest
 {
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Internal snapshot of native queue state for local session orchestration.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class QueueSnapshotResult
+/// <summary>Token-usage breakdown for the session's current context window.</summary>
+public sealed class MetadataContextInfoResultContextInfo
 {
-    /// <summary>Insertion orders for queued items, aligned with `items`.</summary>
-    [JsonPropertyName("itemOrders")]
-    public IList<long>? ItemOrders { get; set; }
+    /// <summary>Output reserve plus tokens after the buffer-exhaustion blocking threshold (default 95%).</summary>
+    [JsonPropertyName("bufferTokens")]
+    public long BufferTokens { get; set; }
 
-    /// <summary>User-facing pending items in FIFO order.</summary>
-    [JsonPropertyName("items")]
-    public IList<QueuePendingItems> Items { get => field ??= []; set; }
+    /// <summary>Token count at which background compaction starts (configurable percentage of promptTokenLimit).</summary>
+    [JsonPropertyName("compactionThreshold")]
+    public long CompactionThreshold { get; set; }
 
-    /// <summary>Insertion orders for immediate steering messages, aligned with `steeringMessages`.</summary>
-    [JsonPropertyName("steeringMessageOrders")]
-    public IList<long>? SteeringMessageOrders { get; set; }
+    /// <summary>Tokens consumed by user/assistant/tool messages.</summary>
+    [JsonPropertyName("conversationTokens")]
+    public long ConversationTokens { get; set; }
 
-    /// <summary>Immediate steering messages waiting for an active turn.</summary>
-    [JsonPropertyName("steeringMessages")]
-    public IList<string> SteeringMessages { get => field ??= []; set; }
-}
+    /// <summary>Prompt token limit plus the model's full output token limit.</summary>
+    [JsonPropertyName("limit")]
+    public long Limit { get; set; }
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionQueueSnapshotRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Tokens consumed by MCP tool definitions (subset of toolDefinitionsTokens, excludes deferred tools).</summary>
+    [JsonPropertyName("mcpToolsTokens")]
+    public long McpToolsTokens { get; set; }
 
-/// <summary>Result of moving a queued item.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class QueueMoveItemResult
-{
-    /// <summary>True when the item changed position; false when it was already at the requested position.</summary>
-    [JsonPropertyName("changed")]
-    public bool Changed { get; set; }
-}
+    /// <summary>The model used for token counting.</summary>
+    [JsonPropertyName("modelName")]
+    public string ModelName { get; set; } = string.Empty;
 
-/// <summary>Parameters for moving a queued item by stable id.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class QueueMoveItemRequest
-{
-    /// <summary>Stable opaque queued-item id.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
+    /// <summary>Maximum prompt tokens allowed by the model (or DEFAULT_TOKEN_LIMIT if unspecified).</summary>
+    [JsonPropertyName("promptTokenLimit")]
+    public long PromptTokenLimit { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Tokens consumed by the system prompt.</summary>
+    [JsonPropertyName("systemTokens")]
+    public long SystemTokens { get; set; }
 
-    /// <summary>Zero-based target position in the public visible queue. Values outside the queue clamp to an end.</summary>
-    [JsonPropertyName("toPosition")]
-    public long ToPosition { get; set; }
+    /// <summary>Tokens consumed by tool definitions sent to the model (excludes deferred tools).</summary>
+    [JsonPropertyName("toolDefinitionsTokens")]
+    public long ToolDefinitionsTokens { get; set; }
+
+    /// <summary>Sum of system, conversation and tool-definition tokens.</summary>
+    [JsonPropertyName("totalTokens")]
+    public long TotalTokens { get; set; }
 }
 
-/// <summary>Result of inserting a queued message.</summary>
+/// <summary>Token breakdown for the session's current context window, or null if uninitialized.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class QueueInsertAtResult
+public sealed class MetadataContextInfoResult
 {
-    /// <summary>Fresh stable opaque id assigned to the inserted item.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
+    /// <summary>Token breakdown for the current context window, or null if the session has not yet been initialized (no system prompt or tool metadata cached).</summary>
+    [JsonPropertyName("contextInfo")]
+    public MetadataContextInfoResultContextInfo? ContextInfo { get; set; }
 }
 
-/// <summary>Serializable message fields accepted by queue.insertAt.</summary>
+/// <summary>Model identifier and token limits used to compute the context-info breakdown.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class QueueInsertMessage
+internal sealed class MetadataContextInfoRequest
 {
-    /// <summary>Optional explicit agent mode. When omitted, the session's current mode is assigned.</summary>
-    [JsonPropertyName("agentMode")]
-    public SendAgentMode? AgentMode { get; set; }
-
-    /// <summary>Optional attachments for the message.</summary>
-    [JsonPropertyName("attachments")]
-    public IList<Attachment>? Attachments { get; set; }
+    /// <summary>Maximum output tokens allowed by the target model. Pass 0 if unknown.</summary>
+    [JsonPropertyName("outputTokenLimit")]
+    public long OutputTokenLimit { get; set; }
 
-    /// <summary>Whether the message is billable.</summary>
-    [JsonPropertyName("billable")]
-    public bool? Billable { get; set; }
+    /// <summary>Maximum prompt tokens allowed by the target model. Pass 0 to use the runtime default.</summary>
+    [JsonPropertyName("promptTokenLimit")]
+    public long PromptTokenLimit { get; set; }
 
-    /// <summary>Accepted for internal SendOptions compatibility but ignored; delivery is derived from current session activity.</summary>
-    [JsonPropertyName("delivery")]
-    public string? Delivery { get; set; }
+    /// <summary>Model identifier used for tokenization. Omit to use the session default. Used both for token counting and to compute display values.</summary>
+    [JsonPropertyName("selectedModel")]
+    public string? SelectedModel { get; set; }
 
-    /// <summary>Optional user-facing display text.</summary>
-    [JsonPropertyName("displayPrompt")]
-    public string? DisplayPrompt { get; set; }
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
 
-    /// <summary>Accepted for SendOptions compatibility but ignored; inserted items always use queued delivery semantics.</summary>
-    [JsonPropertyName("mode")]
-    public SendMode? Mode { get; set; }
+/// <summary>The six normalized `/context` header buckets, computed from the same tokenization as `entries` so the two never disagree. Convenience rollups: `freeSpace` and `buffer` describe window capacity rather than occupied context, so the values do not sum to `totalTokens`.</summary>
+public sealed class MetadataContextAttributionResultContextAttributionCategories
+{
+    /// <summary>Output reserve plus post-blocking-threshold buffer.</summary>
+    [JsonPropertyName("buffer")]
+    public long Buffer { get; set; }
 
-    /// <summary>Accepted for SendOptions compatibility but ignored; the requested public position controls placement.</summary>
-    [JsonPropertyName("prepend")]
-    public bool? Prepend { get; set; }
+    /// <summary>Custom-instructions tokens (0 when none are configured).</summary>
+    [JsonPropertyName("customInstructions")]
+    public long CustomInstructions { get; set; }
 
-    /// <summary>The user message text.</summary>
-    [JsonPropertyName("prompt")]
-    public string Prompt { get; set; } = string.Empty;
+    /// <summary>Remaining unused window capacity (clamped at 0).</summary>
+    [JsonPropertyName("freeSpace")]
+    public long FreeSpace { get; set; }
 
-    /// <summary>Per-turn request headers.</summary>
-    [JsonPropertyName("requestHeaders")]
-    public IDictionary<string, string>? RequestHeaders { get; set; }
+    /// <summary>MCP tool-definition tokens.</summary>
+    [JsonPropertyName("mcpTools")]
+    public long McpTools { get; set; }
 
-    /// <summary>Required tool name for the turn, when any.</summary>
-    [JsonPropertyName("requiredTool")]
-    public string? RequiredTool { get; set; }
+    /// <summary>Conversation (user/assistant/tool) message tokens.</summary>
+    [JsonPropertyName("messages")]
+    public long Messages { get; set; }
 
-    /// <summary>Optional provenance source. `system` is rejected: it would hide the inserted row from `pendingItems` and make it unaddressable while still executing, so inserted items must stay visible.</summary>
-    [JsonPropertyName("source")]
-    public string? Source { get; set; }
+    /// <summary>System prompt tokens, excluding custom instructions.</summary>
+    [JsonPropertyName("systemPrompt")]
+    public long SystemPrompt { get; set; }
 
-    /// <summary>Accepted for SendOptions compatibility but ignored; insertion scheduling is controlled by the queue drain state.</summary>
-    [JsonPropertyName("wait")]
-    public bool? Wait { get; set; }
+    /// <summary>Non-MCP tool-definition tokens.</summary>
+    [JsonPropertyName("systemTools")]
+    public long SystemTools { get; set; }
 }
 
-/// <summary>Parameters for inserting a queued message at a public visible position.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class QueueInsertAtRequest
+/// <summary>Successful compaction history for the session.</summary>
+public sealed class MetadataContextAttributionResultContextAttributionCompactions
 {
-    /// <summary>Queued message contents and delivery metadata.</summary>
-    [JsonPropertyName("message")]
-    public QueueInsertMessage Message { get => field ??= new(); set; }
-
-    /// <summary>Zero-based position in the public visible queue. Values outside the queue clamp to an end.</summary>
-    [JsonPropertyName("position")]
-    public long Position { get; set; }
-
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Number of successful compactions in this session.</summary>
+    [JsonPropertyName("count")]
+    public long Count { get; set; }
 }
 
-/// <summary>Result of removing a queued item.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class QueueRemoveAtResult
+/// <summary>RPC data type for MetadataContextAttributionResultContextAttributionEntry operations.</summary>
+public sealed class MetadataContextAttributionResultContextAttributionEntry
 {
-    /// <summary>True when the addressed item was removed.</summary>
-    [JsonPropertyName("removed")]
-    public bool Removed { get; set; }
-}
+    /// <summary>Supplementary per-entry metadata (e.g. `messageCount`, `role`, `evictable`, `pluginSource`). Values are stringified; parse as needed and ignore unrecognized keys.</summary>
+    [JsonPropertyName("attributes")]
+    public IDictionary<string, string>? Attributes { get; set; }
 
-/// <summary>Parameters for removing a queued item by stable id.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class QueueRemoveAtRequest
-{
-    /// <summary>Stable opaque ID of the queued item to remove.</summary>
+    /// <summary>Identifier for this entry, formed by joining its `kind` and source name (e.g. `tool:bash`, `skill:tmux`, `toolDefinition:bash`); unique within the snapshot. Use it to match the same entry across snapshots, to correlate with other APIs (skill/agent/MCP registries), and as the `parentId` target for nesting. Distinct from the human-facing `label`.</summary>
     [JsonPropertyName("id")]
     public string Id { get; set; } = string.Empty;
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Source category for this entry. Not a closed set — tolerate unknown values. Known values today: `skill`, `subagent`, `mcpServer`, `tool`, `system`, `toolDefinition`, `plugin`.</summary>
+    [JsonPropertyName("kind")]
+    public string Kind { get; set; } = string.Empty;
+
+    /// <summary>Human-readable display label, e.g. `bash` or `skill: tmux`. Presentation-only; may be localized/reformatted without notice — do not key off it.</summary>
+    [JsonPropertyName("label")]
+    public string Label { get; set; } = string.Empty;
+
+    /// <summary>Optional `id` of the parent entry: e.g. a `plugin` entry parenting its `skill`/`mcpServer` entries, or the `system` entry parenting `toolDefinition` entries. Omitted for top-level entries.</summary>
+    [JsonPropertyName("parentId")]
+    public string? ParentId { get; set; }
+
+    /// <summary>Token count currently in context attributable to this entry.</summary>
+    [JsonPropertyName("tokens")]
+    public long Tokens { get; set; }
 }
 
-/// <summary>Result of editing a queued message.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class QueueUpdateTextResult
+/// <summary>Per-source token attribution snapshot for the current context window. The heaviest individual messages are available separately via `metadata.getContextHeaviestMessages`.</summary>
+public sealed class MetadataContextAttributionResultContextAttribution
 {
-    /// <summary>True when the stored text changed.</summary>
-    [JsonPropertyName("updated")]
-    public bool Updated { get; set; }
+    /// <summary>Output reserve plus the tokens past the buffer-exhaustion blocking threshold. Mirrors `SessionContextInfo.bufferTokens`.</summary>
+    [JsonPropertyName("bufferTokens")]
+    public long BufferTokens { get; set; }
+
+    /// <summary>The six normalized `/context` header buckets, computed from the same tokenization as `entries` so the two never disagree. Convenience rollups: `freeSpace` and `buffer` describe window capacity rather than occupied context, so the values do not sum to `totalTokens`.</summary>
+    [JsonPropertyName("categories")]
+    public MetadataContextAttributionResultContextAttributionCategories Categories { get => field ??= new(); set; }
+
+    /// <summary>Successful compaction history for the session.</summary>
+    [JsonPropertyName("compactions")]
+    public MetadataContextAttributionResultContextAttributionCompactions Compactions { get => field ??= new(); set; }
+
+    /// <summary>Token count at which background compaction starts. Mirrors `SessionContextInfo.compactionThreshold`.</summary>
+    [JsonPropertyName("compactionThreshold")]
+    public long CompactionThreshold { get; set; }
+
+    /// <summary>Flat list of per-source attribution entries. Group by `kind` and render unrecognized kinds generically. Nesting and rollups are expressed via `parentId`.</summary>
+    [JsonPropertyName("entries")]
+    public IList<MetadataContextAttributionResultContextAttributionEntry> Entries { get => field ??= []; set; }
+
+    /// <summary>Prompt limit plus the model's output reserve: the full context window `categories.freeSpace` and `categories.buffer` are measured against. Mirrors `SessionContextInfo.limit`.</summary>
+    [JsonPropertyName("limit")]
+    public long Limit { get; set; }
+
+    /// <summary>The concrete model id the entire breakdown was tokenized against (feeds the per-model token multiplier). Under `Auto` (Free/Student) this is the resolved model, not the literal `auto` sentinel, so totals are not undercounted. A single-model approximation of a potentially multi-model Auto session.</summary>
+    [JsonPropertyName("modelId")]
+    public string ModelId { get; set; } = string.Empty;
+
+    /// <summary>How `modelId` was chosen. Not a closed set — tolerate unknown values. Known values today: `autoResolved` (the model Auto resolved to), `selected` (the user's explicitly selected model), `default` (a fallback before any model is known).</summary>
+    [JsonPropertyName("modelSource")]
+    public string ModelSource { get; set; } = string.Empty;
+
+    /// <summary>Maximum prompt tokens the resolved model accepts — the denominator for a `##k/###k` context-usage display. Mirrors `SessionContextInfo.promptTokenLimit`.</summary>
+    [JsonPropertyName("promptTokenLimit")]
+    public long PromptTokenLimit { get; set; }
+
+    /// <summary>Total token count of the current context window the entries are measured against (system message + conversation messages + tool definitions — the same total reported by /context). Divide an entry's `tokens` by this to derive its share.</summary>
+    [JsonPropertyName("totalTokens")]
+    public long TotalTokens { get; set; }
 }
 
-/// <summary>Parameters for editing a single queued message.</summary>
+/// <summary>Per-source attribution breakdown for the session's current context window, or null if uninitialized.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class QueueUpdateTextRequest
+public sealed class MetadataContextAttributionResult
 {
-    /// <summary>Optional replacement prompt displayed to the user.</summary>
-    [JsonPropertyName("displayPrompt")]
-    public string? DisplayPrompt { get; set; }
-
-    /// <summary>Stable opaque ID of the queued item to edit.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
-
-    /// <summary>Replacement prompt sent to the model.</summary>
-    [JsonPropertyName("prompt")]
-    public string Prompt { get; set; } = string.Empty;
+    /// <summary>Per-source context-window attribution, or null if the session has not yet been initialized (no system prompt or tool metadata cached).</summary>
+    [JsonPropertyName("contextAttribution")]
+    public MetadataContextAttributionResultContextAttribution? ContextAttribution { get; set; }
+}
 
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionMetadataGetContextAttributionRequest
+{
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Result of duplicating a queued item.</summary>
+/// <summary>A single large message currently in context.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class QueueDuplicateAtResult
+public sealed class ContextHeaviestMessage
 {
-    /// <summary>Fresh stable opaque id assigned to the duplicate.</summary>
+    /// <summary>Stable identifier for this message within the snapshot.</summary>
     [JsonPropertyName("id")]
     public string Id { get; set; } = string.Empty;
+
+    /// <summary>Human-readable source label, e.g. `tool: bash` or `skill: tmux`. Presentation-only.</summary>
+    [JsonPropertyName("label")]
+    public string Label { get; set; } = string.Empty;
+
+    /// <summary>Role of the chat message (`user`, `assistant`, or `tool`).</summary>
+    [JsonPropertyName("role")]
+    public string Role { get; set; } = string.Empty;
+
+    /// <summary>Token count currently in context for this individual message.</summary>
+    [JsonPropertyName("tokens")]
+    public long Tokens { get; set; }
 }
 
-/// <summary>Parameters for duplicating a queued item.</summary>
+/// <summary>The heaviest individual messages in the session's context window, most-expensive first.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class QueueDuplicateAtRequest
+public sealed class MetadataContextHeaviestMessagesResult
 {
-    /// <summary>Stable opaque ID of the queued item to duplicate.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
+    /// <summary>Heaviest messages, most-expensive first.</summary>
+    [JsonPropertyName("messages")]
+    public IList<ContextHeaviestMessage> Messages { get => field ??= []; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Total token count of the current context window, so callers can compute each message's share without a second call.</summary>
+    [JsonPropertyName("totalTokens")]
+    public long TotalTokens { get; set; }
 }
 
-/// <summary>Parameters for acquiring or releasing the queued-lane drain pause. Acquisition is exclusive and non-idempotent: `paused: true` against an already-paused session fails with `queue_already_paused`. The pause is never released automatically — it is not tied to the caller's lifetime, so a client that exits without sending `paused: false` leaves the lane frozen. Release is unowned: `paused: false` clears the pause for any caller, including one that never acquired it.</summary>
+/// <summary>Parameters for the heaviest-messages query.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class QueueSetDrainPausedRequest
+internal sealed class MetadataContextHeaviestMessagesRequest
 {
-    /// <summary>Whether queued-lane draining should be paused.</summary>
-    [JsonPropertyName("paused")]
-    public bool Paused { get; set; }
+    /// <summary>Maximum number of messages to return, most-expensive first. Omit for the server default.</summary>
+    [JsonPropertyName("limit")]
+    public long? Limit { get; set; }
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Result of trying to steer a queued message into a live turn.</summary>
+/// <summary>Notify the session that its working directory context has changed. Emits a `session.context_changed` event so consumers (telemetry, OTel tracker, ACP, the timeline UI) can react. Use this when the host has detected a cwd/branch/repo change outside the session's normal lifecycle (e.g., after a shell command in interactive mode). For a local session, a report whose `cwd` diverges from the session's current working directory is ignored (the call still succeeds but records nothing and emits no event); move a local session's working directory via `metadata.setWorkingDirectory` instead.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class QueueSendNowResult
+public sealed class MetadataRecordContextChangeResult
 {
-    /// <summary>True when the item was accepted into the steering lane; false when no main turn was live.</summary>
-    [JsonPropertyName("steered")]
-    public bool Steered { get; set; }
 }
 
-/// <summary>Parameters for steering a queued message into a live turn.</summary>
+/// <summary>Updated working directory and git context. Emitted as the new payload of `session.context_changed`.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class QueueSendNowRequest
+public sealed class SessionWorkingDirectoryContext
 {
-    /// <summary>Stable opaque ID of the queued item to steer into the live turn.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
+    /// <summary>Merge-base commit SHA (fork point from the remote default branch).</summary>
+    [JsonPropertyName("baseCommit")]
+    public string? BaseCommit { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Current git branch name.</summary>
+    [JsonPropertyName("branch")]
+    public string? Branch { get; set; }
 
-/// <summary>Whether the native queue has pending work.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class QueueHasPendingResult
-{
-    /// <summary>True when queued or immediate native work is pending.</summary>
-    [JsonPropertyName("hasPending")]
-    public bool HasPending { get; set; }
+    /// <summary>Current working directory path.</summary>
+    [JsonPropertyName("cwd")]
+    public string Cwd { get; set; } = string.Empty;
+
+    /// <summary>Root directory of the git repository, resolved via git rev-parse.</summary>
+    [JsonPropertyName("gitRoot")]
+    public string? GitRoot { get; set; }
+
+    /// <summary>Head commit of the current git branch.</summary>
+    [JsonPropertyName("headCommit")]
+    public string? HeadCommit { get; set; }
+
+    /// <summary>Hosting platform type of the repository.</summary>
+    [JsonPropertyName("hostType")]
+    public SessionWorkingDirectoryContextHostType? HostType { get; set; }
+
+    /// <summary>Repository identifier derived from the git remote URL ("owner/name" for GitHub, "org/project/repo" for Azure DevOps).</summary>
+    [JsonPropertyName("repository")]
+    public string? Repository { get; set; }
+
+    /// <summary>Raw host string from the git remote URL (e.g. "github.com", "dev.azure.com").</summary>
+    [JsonPropertyName("repositoryHost")]
+    public string? RepositoryHost { get; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Updated working-directory/git context to record on the session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionQueueHasPendingRequest
+internal sealed class MetadataRecordContextChangeRequest
 {
+    /// <summary>Updated working directory and git context. Emitted as the new payload of `session.context_changed`.</summary>
+    [JsonPropertyName("context")]
+    public SessionWorkingDirectoryContext Context { get => field ??= new(); set; }
+
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Whether a deferred-idle drain should run.</summary>
+/// <summary>Update the session's working directory. Used by the host when the user explicitly changes cwd (e.g., the `/cd` slash command). The host is responsible for any related side-effects (file index, etc.); it does NOT change the process working directory (a session's cwd is per-session, not process-global). For local sessions the runtime validates the target first (an absolute path that exists on disk) and re-bases the permission primary directory; a rejected validation fails the call before anything is mutated, persisted, or emitted. Location-scoped permission rules are then re-keyed to the new directory (best-effort). Remote sessions only record the path.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class QueueBeginDeferredIdleDrainResult
+public sealed class MetadataSetWorkingDirectoryResult
 {
-    /// <summary>True when the host should run finishDeferredIdleDrain asynchronously.</summary>
-    [JsonPropertyName("shouldDrain")]
-    public bool ShouldDrain { get; set; }
+    /// <summary>Working directory after the update.</summary>
+    [JsonPropertyName("workingDirectory")]
+    public string WorkingDirectory { get; set; } = string.Empty;
 }
 
-/// <summary>Inputs for starting a deferred-idle drain.</summary>
+/// <summary>Absolute path to set as the session's new working directory. For local sessions the path must be absolute and exist on disk: it is validated before any session state changes, and a failing validation rejects the call with nothing mutated, persisted, or emitted. Remote sessions record the path as-is.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class QueueBeginDeferredIdleDrainRequest
+internal sealed class MetadataSetWorkingDirectoryRequest
 {
-    /// <summary>Whether the host still has active background work.</summary>
-    [JsonPropertyName("activeBackgroundWork")]
-    public bool ActiveBackgroundWork { get; set; }
-
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
-}
-
-/// <summary>Action selected by the native deferred-idle drain.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class QueueFinishDeferredIdleDrainResult
-{
-    /// <summary>Whether the deferred idle was caused by an aborted foreground turn.</summary>
-    [JsonPropertyName("aborted")]
-    public bool Aborted { get; set; }
 
-    /// <summary>One of none, processQueue, or emitSessionIdle.</summary>
-    [JsonPropertyName("action")]
-    public string Action { get; set; } = string.Empty;
+    /// <summary>Absolute path to set as the session's working directory. The runtime updates the session's recorded cwd so subsequent operations (shell tools, file lookups, telemetry) anchor to it.</summary>
+    [JsonPropertyName("workingDirectory")]
+    public string WorkingDirectory { get; set; } = string.Empty;
 }
 
-/// <summary>Inputs for completing a deferred-idle drain.</summary>
+/// <summary>Re-tokenize the session's existing messages against `modelId` and return the token totals. Useful for hosts that want an initial estimate of context usage on session resume, before the next agent turn fires `session.context_info_changed` events. Returns zeros for an empty session.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class QueueFinishDeferredIdleDrainRequest
+public sealed class MetadataRecomputeContextTokensResult
 {
-    /// <summary>Whether the host still has active background work.</summary>
-    [JsonPropertyName("activeBackgroundWork")]
-    public bool ActiveBackgroundWork { get; set; }
+    /// <summary>Tokens contributed by user/assistant/tool messages (excludes system/developer prompts).</summary>
+    [JsonPropertyName("messagesTokenCount")]
+    public long MessagesTokenCount { get; set; }
 
-    /// <summary>Whether native queued work remains.</summary>
-    [JsonPropertyName("hasPending")]
-    public bool HasPending { get; set; }
+    /// <summary>Tokens contributed by system/developer prompt snapshots.</summary>
+    [JsonPropertyName("systemTokenCount")]
+    public long SystemTokenCount { get; set; }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Sum of tokens across chat-context and system-context messages currently held by the session.</summary>
+    [JsonPropertyName("totalTokens")]
+    public long TotalTokens { get; set; }
 }
 
-/// <summary>Inputs for marking session.idle deferred in native state.</summary>
+/// <summary>Model identifier to use when re-tokenizing the session's existing messages.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class QueueDeferSessionIdleRequest
+internal sealed class MetadataRecomputeContextTokensRequest
 {
-    /// <summary>Whether the deferred idle was caused by an aborted foreground turn.</summary>
-    [JsonPropertyName("aborted")]
-    public bool Aborted { get; set; }
+    /// <summary>Model identifier used for tokenization. The runtime token-counts both chat-context and system-context messages against this model.</summary>
+    [JsonPropertyName("modelId")]
+    public string ModelId { get; set; } = string.Empty;
 
     /// <summary>Target session identifier.</summary>
     [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Indicates whether a user-facing pending item was removed.</summary>
+/// <summary>Availability of built-in job tools surfaced to boundary consumers.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class QueueRemoveMostRecentResult
+public sealed class SessionSettingsBuiltInToolAvailabilitySnapshot
 {
-    /// <summary>True if a user-facing pending item was removed (LIFO across both queues); false when no removable items remained.</summary>
-    [JsonPropertyName("removed")]
-    public bool Removed { get; set; }
+    /// <summary>Whether the create-pull-request tool is available.</summary>
+    [JsonPropertyName("createPullRequest")]
+    public bool? CreatePullRequest { get; set; }
+
+    /// <summary>Whether the report-progress tool is available.</summary>
+    [JsonPropertyName("reportProgress")]
+    public bool? ReportProgress { get; set; }
 }
 
-/// <summary>Identifies the target session.</summary>
+/// <summary>Redacted job settings for a session. The job nonce is excluded.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class SessionQueueRemoveMostRecentRequest
+public sealed class SessionSettingsJobSnapshot
 {
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
+    /// <summary>Availability of job-specific built-in tools.</summary>
+    [JsonPropertyName("builtInToolAvailability")]
+    public SessionSettingsBuiltInToolAvailabilitySnapshot? BuiltInToolAvailability { get; set; }
+
+    /// <summary>GitHub Actions event type for the job.</summary>
+    [JsonPropertyName("eventType")]
+    public string? EventType { get; set; }
+
+    /// <summary>Whether this is the workflow's trigger job.</summary>
+    [JsonPropertyName("isTriggerJob")]
+    public bool? IsTriggerJob { get; set; }
+}
+
+/// <summary>Redacted model routing settings for a session.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionSettingsModelSnapshot
+{
+    /// <summary>Agent service callback URL for job and progress updates.</summary>
+    [JsonPropertyName("callbackUrl")]
+    public string? CallbackUrl { get; set; }
+
+    /// <summary>Default reasoning effort for the selected model.</summary>
+    [JsonPropertyName("defaultReasoningEffort")]
+    public string? DefaultReasoningEffort { get; set; }
+
+    /// <summary>Agent job identifier for the session.</summary>
+    [JsonPropertyName("instanceId")]
+    public string? InstanceId { get; set; }
+
+    /// <summary>Selected model identifier.</summary>
+    [JsonPropertyName("model")]
+    public string? Model { get; set; }
+}
+
+/// <summary>Online-evaluation settings safe to expose across the SDK boundary.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionSettingsOnlineEvaluationSnapshot
+{
+    /// <summary>Whether online evaluation is disabled.</summary>
+    [JsonPropertyName("disableOnlineEvaluation")]
+    public bool? DisableOnlineEvaluation { get; set; }
+
+    /// <summary>Whether online-evaluation output-file generation is enabled.</summary>
+    [JsonPropertyName("enableOnlineEvaluationOutputFile")]
+    public bool? EnableOnlineEvaluationOutputFile { get; set; }
+}
+
+/// <summary>Redacted repository and GitHub host settings for a session.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionSettingsRepoSnapshot
+{
+    /// <summary>Checked-out repository branch.</summary>
+    [JsonPropertyName("branch")]
+    public string? Branch { get; set; }
+
+    /// <summary>Checked-out commit SHA.</summary>
+    [JsonPropertyName("commit")]
+    public string? Commit { get; set; }
+
+    /// <summary>GitHub server host name.</summary>
+    [JsonPropertyName("host")]
+    public string? Host { get; set; }
+
+    /// <summary>Protocol used to access the GitHub host.</summary>
+    [JsonPropertyName("hostProtocol")]
+    public string? HostProtocol { get; set; }
+
+    /// <summary>GitHub repository database ID.</summary>
+    [JsonPropertyName("id")]
+    public double? Id { get; set; }
+
+    /// <summary>Repository name.</summary>
+    [JsonPropertyName("name")]
+    public string? Name { get; set; }
+
+    /// <summary>GitHub repository owner database ID.</summary>
+    [JsonPropertyName("ownerId")]
+    public double? OwnerId { get; set; }
+
+    /// <summary>Repository owner login.</summary>
+    [JsonPropertyName("ownerName")]
+    public string? OwnerName { get; set; }
+
+    /// <summary>Number of commits in the pull request.</summary>
+    [JsonPropertyName("prCommitCount")]
+    public double? PrCommitCount { get; set; }
+
+    /// <summary>Whether the repository is writable.</summary>
+    [JsonPropertyName("readWrite")]
+    public bool? ReadWrite { get; set; }
+
+    /// <summary>GitHub secret-scanning service URL.</summary>
+    [JsonPropertyName("secretScanningUrl")]
+    public string? SecretScanningUrl { get; set; }
+
+    /// <summary>GitHub server base URL.</summary>
+    [JsonPropertyName("serverUrl")]
+    public string? ServerUrl { get; set; }
+}
+
+/// <summary>Redacted validation and memory-tool settings for a session.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionSettingsValidationSnapshot
+{
+    /// <summary>Whether advisory validation is enabled.</summary>
+    [JsonPropertyName("advisoryEnabled")]
+    public bool? AdvisoryEnabled { get; set; }
+
+    /// <summary>Whether CodeQL validation is enabled.</summary>
+    [JsonPropertyName("codeqlEnabled")]
+    public bool? CodeqlEnabled { get; set; }
+
+    /// <summary>Whether code-review validation is enabled.</summary>
+    [JsonPropertyName("codeReviewEnabled")]
+    public bool? CodeReviewEnabled { get; set; }
+
+    /// <summary>Model used for code-review validation.</summary>
+    [JsonPropertyName("codeReviewModel")]
+    public string? CodeReviewModel { get; set; }
+
+    /// <summary>Dependabot validation timeout budget in seconds.</summary>
+    [JsonPropertyName("dependabotTimeout")]
+    public double? DependabotTimeout { get; set; }
+
+    /// <summary>Whether the memory-store tool is enabled.</summary>
+    [JsonPropertyName("memoryStoreEnabled")]
+    public bool? MemoryStoreEnabled { get; set; }
+
+    /// <summary>Whether the memory-vote tool is enabled.</summary>
+    [JsonPropertyName("memoryVoteEnabled")]
+    public bool? MemoryVoteEnabled { get; set; }
+
+    /// <summary>Whether secret-scanning validation is enabled.</summary>
+    [JsonPropertyName("secretScanningEnabled")]
+    public bool? SecretScanningEnabled { get; set; }
+
+    /// <summary>General validation timeout budget in seconds.</summary>
+    [JsonPropertyName("timeout")]
+    public double? Timeout { get; set; }
+}
+
+/// <summary>Redacted, serializable view of session runtime settings for SDK boundary consumers. Secrets and raw feature flags are intentionally excluded.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionSettingsSnapshot
+{
+    /// <summary>Name of the SDK client that created the session.</summary>
+    [JsonPropertyName("clientName")]
+    public string? ClientName { get; set; }
+
+    /// <summary>Redacted job settings.</summary>
+    [JsonPropertyName("job")]
+    public SessionSettingsJobSnapshot Job { get => field ??= new(); set; }
+
+    /// <summary>Redacted model routing settings.</summary>
+    [JsonPropertyName("model")]
+    public SessionSettingsModelSnapshot Model { get => field ??= new(); set; }
+
+    /// <summary>Online-evaluation settings safe for SDK consumers.</summary>
+    [JsonPropertyName("onlineEvaluation")]
+    public SessionSettingsOnlineEvaluationSnapshot OnlineEvaluation { get => field ??= new(); set; }
+
+    /// <summary>Redacted repository and host settings.</summary>
+    [JsonPropertyName("repo")]
+    public SessionSettingsRepoSnapshot Repo { get => field ??= new(); set; }
+
+    /// <summary>Session start time as Unix epoch milliseconds.</summary>
+    [JsonPropertyName("startTimeMs")]
+    public double? StartTimeMs { get; set; }
+
+    /// <summary>Session timeout in milliseconds.</summary>
+    [JsonPropertyName("timeoutMs")]
+    public double? TimeoutMs { get; set; }
+
+    /// <summary>Redacted validation and memory-tool settings.</summary>
+    [JsonPropertyName("validation")]
+    public SessionSettingsValidationSnapshot Validation { get => field ??= new(); set; }
+
+    /// <summary>Agent runtime version selector copied from the session settings, such as `latest` or a runtime release identifier.</summary>
+    [JsonPropertyName("version")]
+    public string? Version { get; set; }
+}
+
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionSettingsSnapshotRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Result of evaluating a Rust-owned settings predicate.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionSettingsEvaluatePredicateResult
+{
+    /// <summary>Whether the named settings predicate evaluated to enabled.</summary>
+    [JsonPropertyName("enabled")]
+    public bool Enabled { get; set; }
+}
+
+/// <summary>Named Rust-owned settings predicate to evaluate for this session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionSettingsEvaluatePredicateRequest
+{
+    /// <summary>Predicate name. The runtime owns the raw feature-flag names and composition logic.</summary>
+    [JsonPropertyName("name")]
+    public SessionSettingsPredicateName Name { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Tool name for tool-scoped predicates such as trivial-change handling.</summary>
+    [JsonPropertyName("toolName")]
+    public string? ToolName { get; set; }
+}
+
+/// <summary>Content-exclusion decision for one requested path.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class ContentExclusionPathCheck
+{
+    /// <summary>Whether the session's complete content-exclusion policy excludes the path.</summary>
+    [JsonPropertyName("excluded")]
+    public bool Excluded { get; set; }
+
+    /// <summary>The path supplied by the caller.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
+}
+
+/// <summary>Batch content-exclusion result. Callers must fail closed when policy evaluation is unavailable.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class ContentExclusionCheckPathsResult
+{
+    /// <summary>Whether the session's policy service was available for the complete batch. When false, checks is empty and callers must treat every requested path as excluded.</summary>
+    [JsonPropertyName("available")]
+    public bool Available { get; set; }
+
+    /// <summary>Per-path decisions in request order. Empty when available is false.</summary>
+    [JsonPropertyName("checks")]
+    public IList<ContentExclusionPathCheck> Checks { get => field ??= []; set; }
+}
+
+/// <summary>Local file system absolute paths within the session working directory to check against its content-exclusion policy.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class ContentExclusionCheckPathsRequest
+{
+    /// <summary>Local file system absolute paths within the session working directory to check. Results are returned in the same order, including duplicates.</summary>
+    [JsonPropertyName("paths")]
+    public IList<string> Paths { get => field ??= []; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionQueueClearRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+/// <summary>Identifier of the spawned process, used to correlate streamed output and exit notifications.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class ShellExecResult
+{
+    /// <summary>Unique identifier for tracking streamed output.</summary>
+    [JsonPropertyName("processId")]
+    public string ProcessId { get; set; } = string.Empty;
+}
+
+/// <summary>Shell command to run, with optional working directory and timeout in milliseconds.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class ShellExecRequest
+{
+    /// <summary>Shell command to execute.</summary>
+    [JsonPropertyName("command")]
+    public string Command { get; set; } = string.Empty;
+
+    /// <summary>Working directory (defaults to session working directory).</summary>
+    [JsonPropertyName("cwd")]
+    public string? Cwd { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Timeout in milliseconds (default: 30000).</summary>
+    [JsonConverter(typeof(MillisecondsTimeSpanConverter))]
+    [JsonPropertyName("timeout")]
+    public TimeSpan? Timeout { get; set; }
+}
+
+/// <summary>Indicates whether the signal was delivered; false if the process was unknown or already exited.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class ShellKillResult
+{
+    /// <summary>Whether the signal was sent successfully.</summary>
+    [JsonPropertyName("killed")]
+    public bool Killed { get; set; }
+}
+
+/// <summary>Identifier of a process previously returned by "shell.exec" and the signal to send.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class ShellKillRequest
+{
+    /// <summary>Process identifier returned by shell.exec.</summary>
+    [JsonPropertyName("processId")]
+    public string ProcessId { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Signal to send (default: SIGTERM).</summary>
+    [JsonPropertyName("signal")]
+    public ShellKillSignal? Signal { get; set; }
+}
+
+/// <summary>Result of a user-requested shell command.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class UserRequestedShellCommandResult
+{
+    /// <summary>Error output when the execution failed.</summary>
+    [JsonPropertyName("error")]
+    public string? Error { get; set; }
+
+    /// <summary>Process exit code, when available.</summary>
+    [JsonPropertyName("exitCode")]
+    public long? ExitCode { get; set; }
+
+    /// <summary>Captured command output.</summary>
+    [JsonPropertyName("output")]
+    public string Output { get; set; } = string.Empty;
+
+    /// <summary>Whether the command completed successfully.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
+
+    /// <summary>Tool call id emitted for the shell execution.</summary>
+    [JsonPropertyName("toolCallId")]
+    public string ToolCallId { get; set; } = string.Empty;
+}
+
+/// <summary>User-requested shell command and cancellation handle.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class ShellExecuteUserRequestedRequest
+{
+    /// <summary>Shell command to execute.</summary>
+    [JsonPropertyName("command")]
+    public string Command { get; set; } = string.Empty;
+
+    /// <summary>Caller-provided cancellation handle for this execution.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Cancellation result for a user-requested shell command.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class CancelUserRequestedShellCommandResult
+{
+    /// <summary>Whether an in-flight execution was found and signalled to cancel.</summary>
+    [JsonPropertyName("cancelled")]
+    public bool Cancelled { get; set; }
+}
+
+/// <summary>User-requested shell execution cancellation handle.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class ShellCancelUserRequestedRequest
+{
+    /// <summary>Request ID previously passed to executeUserRequested.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Post-compaction context window usage breakdown.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class HistoryCompactContextWindow
+{
+    /// <summary>Token count from non-system messages (user, assistant, tool).</summary>
+    [JsonPropertyName("conversationTokens")]
+    public long? ConversationTokens { get; set; }
+
+    /// <summary>Current total tokens in the context window (system + conversation + tool definitions).</summary>
+    [JsonPropertyName("currentTokens")]
+    public long CurrentTokens { get; set; }
+
+    /// <summary>Current number of messages in the conversation.</summary>
+    [JsonPropertyName("messagesLength")]
+    public long MessagesLength { get; set; }
+
+    /// <summary>Token count from system message(s).</summary>
+    [JsonPropertyName("systemTokens")]
+    public long? SystemTokens { get; set; }
+
+    /// <summary>Maximum token count for the model's context window.</summary>
+    [JsonPropertyName("tokenLimit")]
+    public long TokenLimit { get; set; }
+
+    /// <summary>Token count from tool definitions.</summary>
+    [JsonPropertyName("toolDefinitionsTokens")]
+    public long? ToolDefinitionsTokens { get; set; }
+}
+
+/// <summary>Compaction outcome with the number of tokens and messages removed, summary text, and the resulting context window breakdown.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class HistoryCompactResult
+{
+    /// <summary>Post-compaction context window usage breakdown.</summary>
+    [JsonPropertyName("contextWindow")]
+    public HistoryCompactContextWindow? ContextWindow { get; set; }
+
+    /// <summary>Number of messages removed during compaction.</summary>
+    [JsonPropertyName("messagesRemoved")]
+    public long MessagesRemoved { get; set; }
+
+    /// <summary>Whether compaction completed successfully.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
+
+    /// <summary>Summary text produced by compaction. Omitted when compaction did not produce a summary (e.g. failure path).</summary>
+    [JsonPropertyName("summaryContent")]
+    public string? SummaryContent { get; set; }
+
+    /// <summary>Number of tokens freed by compaction.</summary>
+    [JsonPropertyName("tokensRemoved")]
+    public long TokensRemoved { get; set; }
+}
+
+/// <summary>RPC data type for SessionHistoryCompact operations.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionHistoryCompactRequest
+{
+    /// <summary>Optional user-provided instructions to focus the compaction summary.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(4000)]
+    [JsonPropertyName("customInstructions")]
+    public string? CustomInstructions { get; set; }
+
+    /// <summary>Context window token limit this compaction is targeting, recorded as the `tokenLimit` on the persisted `session.compaction_start` / `session.compaction_complete` events. Set it when the compaction targets a window other than the compacting model's own, e.g. switching to a model with a smaller context window: the compaction still runs on the current model, so the limit that motivated it would otherwise be lost. When absent, the events record the compacting model's own resolved limit. Attribution metadata only - it does not change how much the compaction removes.</summary>
+    [JsonPropertyName("tokenLimit")]
+    public long? TokenLimit { get; set; }
+
+    /// <summary>What initiated this compaction request, recorded as the `trigger` on the persisted `session.compaction_start` / `session.compaction_complete` events. When absent, the compaction is persisted without trigger attribution (initiator unknown).</summary>
+    [JsonPropertyName("trigger")]
+    public SessionHistoryCompactRequestTrigger? Trigger { get; set; }
+}
+
+/// <summary>RPC data type for SessionHistoryCompactRequestWithSession operations.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionHistoryCompactRequestWithSession
+{
+    /// <summary>Optional user-provided instructions to focus the compaction summary.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MaxLength(4000)]
+    [JsonPropertyName("customInstructions")]
+    public string? CustomInstructions { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Context window token limit this compaction is targeting, recorded as the `tokenLimit` on the persisted `session.compaction_start` / `session.compaction_complete` events. Set it when the compaction targets a window other than the compacting model's own, e.g. switching to a model with a smaller context window: the compaction still runs on the current model, so the limit that motivated it would otherwise be lost. When absent, the events record the compacting model's own resolved limit. Attribution metadata only - it does not change how much the compaction removes.</summary>
+    [JsonPropertyName("tokenLimit")]
+    public long? TokenLimit { get; set; }
+
+    /// <summary>What initiated this compaction request, recorded as the `trigger` on the persisted `session.compaction_start` / `session.compaction_complete` events. When absent, the compaction is persisted without trigger attribution (initiator unknown).</summary>
+    [JsonPropertyName("trigger")]
+    public SessionHistoryCompactRequestTrigger? Trigger { get; set; }
+}
+
+/// <summary>Number of events that were removed by the truncation.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class HistoryTruncateResult
+{
+    /// <summary>Failure detail when checkpointCleanupFailed is true.</summary>
+    [JsonPropertyName("checkpointCleanupError")]
+    public string? CheckpointCleanupError { get; set; }
+
+    /// <summary>True when conversation truncation succeeded but post-truncation workspace checkpoint cleanup failed. History is already truncated; callers may still prune snapshots but should report a checkpoint-cleanup rather than a truncation failure.</summary>
+    [JsonPropertyName("checkpointCleanupFailed")]
+    public bool? CheckpointCleanupFailed { get; set; }
+
+    /// <summary>Number of events that were removed.</summary>
+    [JsonPropertyName("eventsRemoved")]
+    public long EventsRemoved { get; set; }
+}
+
+/// <summary>Identifier of the event to truncate to; this event and all later events are removed.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class HistoryTruncateRequest
+{
+    /// <summary>Event ID to truncate to. This event and all events after it are removed from the session.</summary>
+    [JsonPropertyName("eventId")]
+    public string EventId { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>A root user turn that the session can rewind to.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class HistoryRewindPoint
+{
+    /// <summary>Whether at least one file in this turn or a later turn can be restored.</summary>
+    [JsonPropertyName("canRestoreFiles")]
+    public bool CanRestoreFiles { get; set; }
+
+    /// <summary>ID of the user.message event that begins the discarded suffix.</summary>
+    [JsonPropertyName("eventId")]
+    public string EventId { get; set; } = string.Empty;
+
+    /// <summary>Number of unique files in this turn and all later turns that have captured changes.</summary>
+    [JsonPropertyName("fileCount")]
+    public long FileCount { get; set; }
+
+    /// <summary>Whether this turn was an automatically injected autopilot continuation.</summary>
+    [JsonPropertyName("isAutopilotContinuation")]
+    public bool IsAutopilotContinuation { get; set; }
+
+    /// <summary>Lines added by this turn's captured file changes.</summary>
+    [JsonPropertyName("linesAdded")]
+    public long LinesAdded { get; set; }
+
+    /// <summary>Lines removed by this turn's captured file changes.</summary>
+    [JsonPropertyName("linesRemoved")]
+    public long LinesRemoved { get; set; }
+
+    /// <summary>ISO timestamp of the user turn.</summary>
+    [JsonPropertyName("timestamp")]
+    public string Timestamp { get; set; } = string.Empty;
+
+    /// <summary>Whether this turn itself captured any file changes.</summary>
+    [JsonPropertyName("turnChangedFiles")]
+    public bool TurnChangedFiles { get; set; }
+
+    /// <summary>User-visible message text for the turn.</summary>
+    [JsonPropertyName("userMessage")]
+    public string UserMessage { get; set; } = string.Empty;
+}
+
+/// <summary>Rewind points and file-change-tracking availability for the session.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class HistoryListRewindPointsResult
+{
+    /// <summary>Whether this session captured file changes from its first turn.</summary>
+    [JsonPropertyName("fileChangeTrackingEnabled")]
+    public bool FileChangeTrackingEnabled { get; set; }
+
+    /// <summary>Root user turns in chronological order. Empty when `unavailableReason` is set.</summary>
+    [JsonPropertyName("points")]
+    public IList<HistoryRewindPoint> Points { get => field ??= []; set; }
+
+    /// <summary>Why the listed points could not be produced, when applicable; the points list is empty whenever it is set. `unsupported-remote-session` is permanent for the session and comes with `fileChangeTrackingEnabled: false`. `session-busy` is transient and only ever reported by a session that *is* tracking (`fileChangeTrackingEnabled: true`), because the file-change captures cannot be read while work that may still mutate them is in flight; the same request succeeds once the session settles, so a client that wants points should retry rather than treat it as a failure. It is never `file-change-tracking-disabled`: an untracked local session still lists conversation-only points and reports that through `fileChangeTrackingEnabled: false`.</summary>
+    [JsonPropertyName("unavailableReason")]
+    public HistoryRewindUnavailableReason? UnavailableReason { get; set; }
+}
+
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionHistoryListRewindPointsRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>A file that a conversation-and-files rewind would restore.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class HistoryRewindFilePreview
+{
+    /// <summary>Aggregate change made across the discarded turns.</summary>
+    [JsonPropertyName("changeType")]
+    public HistoryRewindChangeType ChangeType { get; set; }
+
+    /// <summary>Lines added across the discarded turns.</summary>
+    [JsonPropertyName("linesAdded")]
+    public long LinesAdded { get; set; }
+
+    /// <summary>Lines removed across the discarded turns.</summary>
+    [JsonPropertyName("linesRemoved")]
+    public long LinesRemoved { get; set; }
+
+    /// <summary>Absolute path of the captured file.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
+}
+
+/// <summary>Files and aggregate changes for a prospective rewind.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class HistoryPreviewRewindResult
+{
+    /// <summary>Whether file restore is available for this session. This is authoritative: switch on it and read `reason` only when it is false.</summary>
+    [JsonPropertyName("available")]
+    public bool Available { get; set; }
+
+    /// <summary>Number of unique files in the preview.</summary>
+    [JsonPropertyName("fileCount")]
+    public long FileCount { get; set; }
+
+    /// <summary>Files ordered by path.</summary>
+    [JsonPropertyName("files")]
+    public IList<HistoryRewindFilePreview> Files { get => field ??= []; set; }
+
+    /// <summary>Why file restore is unavailable, when applicable. Populated only when `available` is false and never set when `available` is true.</summary>
+    [JsonPropertyName("reason")]
+    public HistoryRewindUnavailableReason? Reason { get; set; }
+}
+
+/// <summary>Event boundary to preview for conversation-and-files rewind.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class HistoryPreviewRewindRequest
+{
+    /// <summary>ID of the user.message event that begins the discarded suffix.</summary>
+    [JsonPropertyName("eventId")]
+    public string EventId { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>A captured file that rewind intentionally left unchanged.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class HistorySkippedFileRestore
+{
+    /// <summary>Absolute path of the skipped file.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
+
+    /// <summary>Reason the file was not restored.</summary>
+    [JsonPropertyName("reason")]
+    public HistoryFileRestoreSkipReason Reason { get; set; }
+}
+
+/// <summary>Structured outcome of a rewind request.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class HistoryRewindResult
+{
+    /// <summary>Failure detail. Set only for the failure and partial-failure outcomes (`files-rolled-back`, `rollback-incomplete`, `truncation-failed`, `checkpoint-cleanup-failed`, `snapshot-prune-failed`); omitted for `success` and for the unavailable outcomes (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`).</summary>
+    [JsonPropertyName("error")]
+    public string? Error { get; set; }
+
+    /// <summary>Number of persisted events removed by conversation truncation. Present only when truncation succeeded (outcomes `success`, `checkpoint-cleanup-failed`, and `snapshot-prune-failed`); omitted for every unavailable outcome (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`) and for `truncation-failed`, `files-rolled-back`, and `rollback-incomplete`.</summary>
+    [JsonPropertyName("eventsRemoved")]
+    public long? EventsRemoved { get; set; }
+
+    /// <summary>Overall rewind outcome. This discriminates the result: it governs which of the remaining fields are populated, so consumers must switch on it before reading `eventsRemoved`, `restoredFiles`, `skippedFiles`, or `error`. See each field for the outcomes that populate it.</summary>
+    [JsonPropertyName("outcome")]
+    public HistoryRewindOutcome Outcome { get; set; }
+
+    /// <summary>Absolute paths restored to their captured preimages. Always empty for conversation-only rewinds and for the unavailable outcomes (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`); only conversation-and-files outcomes that reached the file-restore stage populate it.</summary>
+    [JsonPropertyName("restoredFiles")]
+    public IList<string> RestoredFiles { get => field ??= []; set; }
+
+    /// <summary>Captured files intentionally left unchanged. Always empty for conversation-only rewinds and for the unavailable outcomes (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`); only conversation-and-files outcomes that reached the file-restore stage populate it.</summary>
+    [JsonPropertyName("skippedFiles")]
+    public IList<HistorySkippedFileRestore> SkippedFiles { get => field ??= []; set; }
+}
+
+/// <summary>Boundary and mode for rewinding session history.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class HistoryRewindRequest
+{
+    /// <summary>ID of the user.message event that begins the discarded suffix.</summary>
+    [JsonPropertyName("eventId")]
+    public string EventId { get; set; } = string.Empty;
+
+    /// <summary>Whether to rewind only conversation history or also restore captured files.</summary>
+    [JsonPropertyName("mode")]
+    public HistoryRewindMode Mode { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Indicates whether an in-progress background compaction was cancelled.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class HistoryCancelBackgroundCompactionResult
+{
+    /// <summary>Whether an in-progress background compaction was cancelled. False when no compaction was running, when the session is remote, or when the underlying processor was unavailable.</summary>
+    [JsonPropertyName("cancelled")]
+    public bool Cancelled { get; set; }
+}
+
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionHistoryCancelBackgroundCompactionRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Indicates whether an in-progress manual compaction was aborted.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class HistoryAbortManualCompactionResult
+{
+    /// <summary>Whether an in-progress manual compaction was aborted. False when no manual compaction was running, when its abort controller was already aborted, or when the session is remote.</summary>
+    [JsonPropertyName("aborted")]
+    public bool Aborted { get; set; }
+}
+
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionHistoryAbortManualCompactionRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Markdown summary of the conversation context (empty when not available).</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class HistorySummarizeForHandoffResult
+{
+    /// <summary>Markdown summary of the conversation context produced by an LLM. Empty string when there are no messages or when the session does not support local summarization.</summary>
+    [JsonPropertyName("summary")]
+    public string Summary { get; set; } = string.Empty;
+}
+
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionHistorySummarizeForHandoffRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>What a successful clear removed. A clear that could not be applied rejects instead of reporting a count.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class HistoryClearContextResult
+{
+    /// <summary>Number of non-system, non-developer messages that were removed from the conversation. Zero only when the window already held no conversation.</summary>
+    [JsonPropertyName("messagesCleared")]
+    public long MessagesCleared { get; set; }
+}
+
+/// <summary>Parameters for clearing the conversation and seeding the window that replaces it.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class HistoryClearContextRequest
+{
+    /// <summary>First user message of the fresh context window. Required: a cleared window holding only system and developer messages is not a conversation a model can answer, so every clear seeds the window it creates. Delivered by the enclosing turn driver once the agentic loop exits, which is why the call must be made from inside a tool handler.</summary>
+    [JsonPropertyName("prompt")]
+    public string Prompt { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>User-facing pending queue entry, with kind and display text for a queued message, slash command, or model change.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class QueuePendingItems
+{
+    /// <summary>Agent mode stored on this queued entry, as stamped when it was enqueued. Items without an explicit mode report interactive. This is not necessarily the mode that will constrain the turn: a plan or autopilot session applies its own write gate, continuation loop and permission posture to every drained item regardless of the mode stored here.</summary>
+    [JsonPropertyName("agentMode")]
+    public SendAgentMode AgentMode { get; set; }
+
+    /// <summary>Human-readable text to display for this queue entry in the UI.</summary>
+    [JsonPropertyName("displayText")]
+    public string DisplayText { get; set; } = string.Empty;
+
+    /// <summary>Stable opaque id for the canonical queued item. Batch rows share one id.</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
+
+    /// <summary>Whether this item is a queued user message or a queued slash command / model change.</summary>
+    [JsonPropertyName("kind")]
+    public QueuePendingItemsKind Kind { get; set; }
+}
+
+/// <summary>Snapshot of the session's pending queued items and immediate-steering messages.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class QueuePendingItemsResult
+{
+    /// <summary>Pending queued items in submission order. Includes user messages, queued slash commands, and queued model changes; omits internal system items.</summary>
+    [JsonPropertyName("items")]
+    public IList<QueuePendingItems> Items { get => field ??= []; set; }
+
+    /// <summary>Display text for messages currently in the immediate steering queue (interjections sent during a running turn).</summary>
+    [JsonPropertyName("steeringMessages")]
+    public IList<string> SteeringMessages { get => field ??= []; set; }
+}
+
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionQueuePendingItemsRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Internal snapshot of native queue state for local session orchestration.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class QueueSnapshotResult
+{
+    /// <summary>Insertion orders for queued items, aligned with `items`.</summary>
+    [JsonPropertyName("itemOrders")]
+    public IList<long>? ItemOrders { get; set; }
+
+    /// <summary>User-facing pending items in FIFO order.</summary>
+    [JsonPropertyName("items")]
+    public IList<QueuePendingItems> Items { get => field ??= []; set; }
+
+    /// <summary>Insertion orders for immediate steering messages, aligned with `steeringMessages`.</summary>
+    [JsonPropertyName("steeringMessageOrders")]
+    public IList<long>? SteeringMessageOrders { get; set; }
+
+    /// <summary>Immediate steering messages waiting for an active turn.</summary>
+    [JsonPropertyName("steeringMessages")]
+    public IList<string> SteeringMessages { get => field ??= []; set; }
+}
+
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionQueueSnapshotRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Result of moving a queued item.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class QueueMoveItemResult
+{
+    /// <summary>True when the item changed position; false when it was already at the requested position.</summary>
+    [JsonPropertyName("changed")]
+    public bool Changed { get; set; }
+}
+
+/// <summary>Parameters for moving a queued item by stable id.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class QueueMoveItemRequest
+{
+    /// <summary>Stable opaque queued-item id.</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Zero-based target position in the public visible queue. Values outside the queue clamp to an end.</summary>
+    [JsonPropertyName("toPosition")]
+    public long ToPosition { get; set; }
+}
+
+/// <summary>Result of inserting a queued message.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class QueueInsertAtResult
+{
+    /// <summary>Fresh stable opaque id assigned to the inserted item.</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
+}
+
+/// <summary>Serializable message fields accepted by queue.insertAt.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class QueueInsertMessage
+{
+    /// <summary>Optional explicit agent mode. When omitted, the session's current mode is assigned.</summary>
+    [JsonPropertyName("agentMode")]
+    public SendAgentMode? AgentMode { get; set; }
+
+    /// <summary>Optional attachments for the message.</summary>
+    [JsonPropertyName("attachments")]
+    public IList<Attachment>? Attachments { get; set; }
+
+    /// <summary>Whether the message is billable.</summary>
+    [JsonPropertyName("billable")]
+    public bool? Billable { get; set; }
+
+    /// <summary>Accepted for internal SendOptions compatibility but ignored; delivery is derived from current session activity.</summary>
+    [JsonPropertyName("delivery")]
+    public string? Delivery { get; set; }
+
+    /// <summary>Optional user-facing display text.</summary>
+    [JsonPropertyName("displayPrompt")]
+    public string? DisplayPrompt { get; set; }
+
+    /// <summary>Accepted for SendOptions compatibility but ignored; inserted items always use queued delivery semantics.</summary>
+    [JsonPropertyName("mode")]
+    public SendMode? Mode { get; set; }
+
+    /// <summary>Accepted for SendOptions compatibility but ignored; the requested public position controls placement.</summary>
+    [JsonPropertyName("prepend")]
+    public bool? Prepend { get; set; }
+
+    /// <summary>The user message text.</summary>
+    [JsonPropertyName("prompt")]
+    public string Prompt { get; set; } = string.Empty;
+
+    /// <summary>Per-turn request headers.</summary>
+    [JsonPropertyName("requestHeaders")]
+    public IDictionary<string, string>? RequestHeaders { get; set; }
+
+    /// <summary>Required tool name for the turn, when any.</summary>
+    [JsonPropertyName("requiredTool")]
+    public string? RequiredTool { get; set; }
+
+    /// <summary>Optional provenance source. `system` is rejected: it would hide the inserted row from `pendingItems` and make it unaddressable while still executing, so inserted items must stay visible.</summary>
+    [JsonPropertyName("source")]
+    public string? Source { get; set; }
+
+    /// <summary>Accepted for SendOptions compatibility but ignored; insertion scheduling is controlled by the queue drain state.</summary>
+    [JsonPropertyName("wait")]
+    public bool? Wait { get; set; }
+}
+
+/// <summary>Parameters for inserting a queued message at a public visible position.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class QueueInsertAtRequest
+{
+    /// <summary>Queued message contents and delivery metadata.</summary>
+    [JsonPropertyName("message")]
+    public QueueInsertMessage Message { get => field ??= new(); set; }
+
+    /// <summary>Zero-based position in the public visible queue. Values outside the queue clamp to an end.</summary>
+    [JsonPropertyName("position")]
+    public long Position { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Result of removing a queued item.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class QueueRemoveAtResult
+{
+    /// <summary>True when the addressed item was removed.</summary>
+    [JsonPropertyName("removed")]
+    public bool Removed { get; set; }
+}
+
+/// <summary>Parameters for removing a queued item by stable id.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class QueueRemoveAtRequest
+{
+    /// <summary>Stable opaque ID of the queued item to remove.</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Result of editing a queued message.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class QueueUpdateTextResult
+{
+    /// <summary>True when the stored text changed.</summary>
+    [JsonPropertyName("updated")]
+    public bool Updated { get; set; }
+}
+
+/// <summary>Parameters for editing a single queued message.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class QueueUpdateTextRequest
+{
+    /// <summary>Optional replacement prompt displayed to the user.</summary>
+    [JsonPropertyName("displayPrompt")]
+    public string? DisplayPrompt { get; set; }
+
+    /// <summary>Stable opaque ID of the queued item to edit.</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
+
+    /// <summary>Replacement prompt sent to the model.</summary>
+    [JsonPropertyName("prompt")]
+    public string Prompt { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Result of duplicating a queued item.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class QueueDuplicateAtResult
+{
+    /// <summary>Fresh stable opaque id assigned to the duplicate.</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
+}
+
+/// <summary>Parameters for duplicating a queued item.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class QueueDuplicateAtRequest
+{
+    /// <summary>Stable opaque ID of the queued item to duplicate.</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Parameters for acquiring or releasing the queued-lane drain pause. Acquisition is exclusive and non-idempotent: `paused: true` against an already-paused session fails with `queue_already_paused`. The pause is never released automatically — it is not tied to the caller's lifetime, so a client that exits without sending `paused: false` leaves the lane frozen. Release is unowned: `paused: false` clears the pause for any caller, including one that never acquired it.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class QueueSetDrainPausedRequest
+{
+    /// <summary>Whether queued-lane draining should be paused.</summary>
+    [JsonPropertyName("paused")]
+    public bool Paused { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Result of trying to steer a queued message into a live turn.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class QueueSendNowResult
+{
+    /// <summary>True when the item was accepted into the steering lane; false when no main turn was live.</summary>
+    [JsonPropertyName("steered")]
+    public bool Steered { get; set; }
+}
+
+/// <summary>Parameters for steering a queued message into a live turn.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class QueueSendNowRequest
+{
+    /// <summary>Stable opaque ID of the queued item to steer into the live turn.</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Whether the native queue has pending work.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class QueueHasPendingResult
+{
+    /// <summary>True when queued or immediate native work is pending.</summary>
+    [JsonPropertyName("hasPending")]
+    public bool HasPending { get; set; }
+}
+
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionQueueHasPendingRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Whether a deferred-idle drain should run.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class QueueBeginDeferredIdleDrainResult
+{
+    /// <summary>True when the host should run finishDeferredIdleDrain asynchronously.</summary>
+    [JsonPropertyName("shouldDrain")]
+    public bool ShouldDrain { get; set; }
+}
+
+/// <summary>Inputs for starting a deferred-idle drain.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class QueueBeginDeferredIdleDrainRequest
+{
+    /// <summary>Whether the host still has active background work.</summary>
+    [JsonPropertyName("activeBackgroundWork")]
+    public bool ActiveBackgroundWork { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Action selected by the native deferred-idle drain.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class QueueFinishDeferredIdleDrainResult
+{
+    /// <summary>Whether the deferred idle was caused by an aborted foreground turn.</summary>
+    [JsonPropertyName("aborted")]
+    public bool Aborted { get; set; }
+
+    /// <summary>One of none, processQueue, or emitSessionIdle.</summary>
+    [JsonPropertyName("action")]
+    public string Action { get; set; } = string.Empty;
+}
+
+/// <summary>Inputs for completing a deferred-idle drain.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class QueueFinishDeferredIdleDrainRequest
+{
+    /// <summary>Whether the host still has active background work.</summary>
+    [JsonPropertyName("activeBackgroundWork")]
+    public bool ActiveBackgroundWork { get; set; }
+
+    /// <summary>Whether native queued work remains.</summary>
+    [JsonPropertyName("hasPending")]
+    public bool HasPending { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Inputs for marking session.idle deferred in native state.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class QueueDeferSessionIdleRequest
+{
+    /// <summary>Whether the deferred idle was caused by an aborted foreground turn.</summary>
+    [JsonPropertyName("aborted")]
+    public bool Aborted { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Indicates whether a user-facing pending item was removed.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class QueueRemoveMostRecentResult
+{
+    /// <summary>True if a user-facing pending item was removed (LIFO across both queues); false when no removable items remained.</summary>
+    [JsonPropertyName("removed")]
+    public bool Removed { get; set; }
+}
+
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionQueueRemoveMostRecentRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionQueueClearRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Internal filter for consuming queued system notifications.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class QueueConsumeSystemNotificationsRequest
+{
+    /// <summary>Opaque runtime-owned filter object.</summary>
+    [JsonPropertyName("filter")]
+    public JsonElement Filter { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Result of enqueueing the resume-pending wake item.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class QueueEnqueueResumePendingResult
+{
+    /// <summary>True when a wake item was newly queued.</summary>
+    [JsonPropertyName("queued")]
+    public bool Queued { get; set; }
+}
+
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionQueueEnqueueResumePendingRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionQueueProcessRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Batch of session events returned by a read, with cursor and continuation metadata.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class EventsReadResult
+{
+    /// <summary>Opaque cursor for the next read. Pass back unchanged in the next read.cursor to continue from where this read left off. Always present, even when no events were returned. For a backward read this cursor pages toward OLDER events; keep passing `direction: backward` with it (the cursor is also self-describing, so backward paging continues correctly).</summary>
+    [JsonPropertyName("cursor")]
+    public string Cursor { get; set; } = string.Empty;
+
+    /// <summary>Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history. For a forward read the fallback starts from the beginning of the remaining history; for a backward read it falls back to the tail (the newest window). Because the fallback page is a fresh boundary snapshot rather than a continuation of the requested cursor, it may overlap events the consumer has already rendered — a backward fallback to the tail in particular can repeat the newest window. On 'expired', consumers should reset or rebase their local pagination state (or deduplicate by event id) before continuing from the returned cursor rather than blindly appending/prepending the fallback page.</summary>
+    [JsonPropertyName("cursorStatus")]
+    public EventsCursorStatus CursorStatus { get; set; }
+
+    /// <summary>Session events for this batch, merged into a single stream in creation order: durable (persisted) events and ephemeral events interleave exactly as they were emitted. Set `includeEphemeral: false` to receive only durable events. Ephemeral events are never replayable once pruned from the in-memory ring, so a consumer that needs them should keep reading with a non-zero `waitMs`. For a backward (tail-first) read, the returned window contains persisted events only, still in chronological (oldest-to-newest) append order.</summary>
+    [JsonPropertyName("events")]
+    public IList<SessionEvent> Events { get => field ??= []; set; }
+
+    /// <summary>True when more events are available in the read's direction. For a forward read, true means the batch returned `max` events and more are available immediately. For a backward read, true means older persisted events remain before the returned window.</summary>
+    [JsonPropertyName("hasMore")]
+    public bool HasMore { get; set; }
+}
+
+/// <summary>Cursor, batch size, and optional long-poll/filter parameters for reading session events.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class EventLogReadRequest
+{
+    /// <summary>Optional non-empty list of subagent identifiers. When provided, only events owned by one of these agents are returned; ownership recognizes the event envelope's agentId plus legacy data.agentId and data.parentToolCallId markers. This filter takes precedence over agentScope.</summary>
+    [JsonPropertyName("agentIds")]
+    public IList<string>? AgentIds { get; set; }
+
+    /// <summary>Agent-scope filter: 'primary' returns only main-agent events plus events whose type starts with 'subagent.' (matching the typed-subscription default behavior); 'all' returns events from all agents (matching wildcard-subscription behavior). Default is 'all' to preserve wildcard semantics for catch-up callers.</summary>
+    [JsonPropertyName("agentScope")]
+    public EventsAgentScope? AgentScope { get; set; }
+
+    /// <summary>Opaque cursor returned by a previous read. Omit on the first call to start from the beginning of the session's persisted history.</summary>
+    [JsonPropertyName("cursor")]
+    public string? Cursor { get; set; }
+
+    /// <summary>Direction to page through the session's persisted event history. 'forward' (default) pages from the cursor toward newer events (or from the start of history when no cursor is given). 'backward' enables tail-first reads: with no cursor it returns the NEWEST `max` events, and the returned cursor pages toward OLDER events on subsequent backward reads. Events within a returned batch are always in chronological (oldest-to-newest) order, even for a backward read. Backward reads cover PERSISTED history only; ephemeral events are never returned by a backward read. `direction` selects the INITIAL read only: the returned cursor is self-describing, so a continuation read pages in the cursor's own direction regardless of the `direction` passed alongside it — a forward cursor always pages forward and a backward cursor always pages backward. Pass the direction that matches the cursor to avoid confusion.</summary>
+    [JsonPropertyName("direction")]
+    public EventsReadDirection? Direction { get; set; }
+
+    /// <summary>When false, skip ephemeral events entirely and return only durable (persisted) events. History-backfill callers that discard ephemerals anyway should set this so the read is bounded by the durable log length instead of racing the ephemeral ring on a busy session. Defaults to true (ephemerals are interleaved with durable events in creation order). Ignored by backward reads, which always cover persisted history only.</summary>
+    [JsonPropertyName("includeEphemeral")]
+    public bool? IncludeEphemeral { get; set; }
+
+    /// <summary>Maximum number of events to return in this batch (1–1000, default 200).</summary>
+    [JsonPropertyName("max")]
+    public long? Max { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Either '*' to receive all event types, or a non-empty list of event types to receive.</summary>
+    [JsonPropertyName("types")]
+    public JsonElement? Types { get; set; }
+
+    /// <summary>Milliseconds to wait for new events when the cursor is at the tail of history. 0 (default) returns immediately even if no events are available. Capped at 30000ms. Ephemeral events that arrive during the wait are delivered in this batch but are NOT replayable on a subsequent read (use a non-zero waitMs in your next call to capture future ephemerals as they happen). This applies to forward reads only: a backward read always returns immediately and ignores `waitMs`, because backward paging covers persisted history only while new events append at the tail (the opposite end from a backward page), so no blocking or ephemeral delivery can occur.</summary>
+    [JsonConverter(typeof(MillisecondsTimeSpanConverter))]
+    [JsonPropertyName("waitMs")]
+    public TimeSpan? Wait { get; set; }
+}
+
+/// <summary>Snapshot of the current tail cursor without returning any events. Use this when a consumer wants to subscribe to live events going forward without first paginating through the entire persisted history (which would happen if `read` were called without a cursor on a long-lived session).</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class EventLogTailResult
+{
+    /// <summary>Opaque cursor pointing at the current tail of the session's persisted-events history. Pass back to `read` to receive only events that arrive AFTER this snapshot. When the session has no events, this returns the same sentinel as an unset cursor (i.e. equivalent to omitting the cursor on a first read).</summary>
+    [JsonPropertyName("cursor")]
+    public string Cursor { get; set; } = string.Empty;
+}
+
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionEventLogTailRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Opaque handle representing an event-type interest registration.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class RegisterEventInterestResult
+{
+    /// <summary>Opaque handle for this registration. Pass to releaseInterest to release. Each call to registerInterest produces a fresh handle, even when the same eventType is registered multiple times.</summary>
+    [JsonPropertyName("handle")]
+    public string Handle { get; set; } = string.Empty;
+}
+
+/// <summary>Event type to register consumer interest for, used by runtime gating logic.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class RegisterEventInterestParams
+{
+    /// <summary>The event type the consumer wants the runtime to treat as 'observed' for behavior-switching gating. Some runtime code paths inspect whether any consumer is interested in a specific event type and choose a different implementation accordingly (e.g. `mcp.oauth_required`: when interest is registered the runtime delegates interactive OAuth token acquisition to the consumer via `mcp.oauth_required` events; when no interest is registered the runtime still attempts non-interactive reconnect from cached or refreshable tokens, and only marks the server `needs-auth` if usable credentials are unavailable — it does not open a browser or start interactive OAuth without a consumer). SDK clients that long-poll events do NOT automatically appear as listeners to these gating checks — they must explicitly call `registerInterest` for each event type they want the runtime to count as having a consumer. Multiple registrations for the same event type from the same or different consumers are tracked independently and must each be released. See: `mcp.oauth_required`, `sampling.requested`, `auto_mode_switch.requested`, `session_limits_exhausted.requested`, `user_input.requested`, `elicitation.requested`, `command.queued`, `exit_plan_mode.requested`.</summary>
+    [JsonPropertyName("eventType")]
+    public string EventType { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Indicates whether the operation succeeded.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class EventLogReleaseInterestResult
+{
+    /// <summary>Whether the operation succeeded.</summary>
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
+}
+
+/// <summary>Opaque handle previously returned by `registerInterest` to release.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class ReleaseEventInterestParams
+{
+    /// <summary>Handle returned by a previous `registerInterest` call. Idempotent: releasing an unknown or already-released handle is a no-op (returns success). When the last outstanding handle for an event type is released, the runtime reverts to its 'no consumer' code path for that event type.</summary>
+    [JsonPropertyName("handle")]
+    public string Handle { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Request count and cost metrics for this model.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class UsageMetricsModelMetricRequests
+{
+    /// <summary>User-initiated premium request cost (with multiplier applied).</summary>
+    [JsonPropertyName("cost")]
+    public double Cost { get; set; }
+
+    /// <summary>Number of API requests made with this model.</summary>
+    [JsonPropertyName("count")]
+    public long Count { get; set; }
+}
+
+/// <summary>Per-model token-detail entry containing the accumulated token count for one token type.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class UsageMetricsModelMetricTokenDetail
+{
+    /// <summary>Accumulated token count for this token type.</summary>
+    [JsonPropertyName("tokenCount")]
+    public long TokenCount { get; set; }
+}
+
+/// <summary>Token usage metrics for this model.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class UsageMetricsModelMetricUsage
+{
+    /// <summary>Total tokens read from prompt cache.</summary>
+    [JsonPropertyName("cacheReadTokens")]
+    public long CacheReadTokens { get; set; }
+
+    /// <summary>Total tokens written to prompt cache.</summary>
+    [JsonPropertyName("cacheWriteTokens")]
+    public long CacheWriteTokens { get; set; }
+
+    /// <summary>Total input tokens consumed.</summary>
+    [JsonPropertyName("inputTokens")]
+    public long InputTokens { get; set; }
+
+    /// <summary>Total output tokens produced.</summary>
+    [JsonPropertyName("outputTokens")]
+    public long OutputTokens { get; set; }
+
+    /// <summary>Total output tokens used for reasoning.</summary>
+    [JsonPropertyName("reasoningTokens")]
+    public long? ReasoningTokens { get; set; }
+}
+
+/// <summary>Per-model usage metrics, including request counts/costs, token usage, nano-AI units, and per-token-type details.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class UsageMetricsModelMetric
+{
+    /// <summary>Latest known prompt-cache expiration for this model. A timestamp in the past indicates that the observed cache has expired.</summary>
+    [JsonPropertyName("cacheExpiresAt")]
+    public DateTimeOffset? CacheExpiresAt { get; set; }
+
+    /// <summary>Request count and cost metrics for this model.</summary>
+    [JsonPropertyName("requests")]
+    public UsageMetricsModelMetricRequests Requests { get => field ??= new(); set; }
+
+    /// <summary>Token count details per type.</summary>
+    [JsonPropertyName("tokenDetails")]
+    public IDictionary<string, UsageMetricsModelMetricTokenDetail>? TokenDetails { get; set; }
+
+    /// <summary>Accumulated nano-AI units cost for this model.</summary>
+    [JsonPropertyName("totalNanoAiu")]
+    public double? TotalNanoAiu { get; set; }
+
+    /// <summary>Token usage metrics for this model.</summary>
+    [JsonPropertyName("usage")]
+    public UsageMetricsModelMetricUsage Usage { get => field ??= new(); set; }
+}
+
+/// <summary>Usage attributed to one agent instance, including its identity, API duration, AI units, and per-model breakdown.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class UsageMetricsAgentMetric
+{
+    /// <summary>Human-readable label for this subagent invocation, copied from the originating `subagent.started` event. For task-tool subagents this is the invocation's task description rather than the agent's configured display name, so group by `agentName` for stable per-agent labels.</summary>
+    [JsonPropertyName("agentDisplayName")]
+    public string? AgentDisplayName { get; set; }
+
+    /// <summary>Configured agent name, when this is a subagent.</summary>
+    [JsonPropertyName("agentName")]
+    public string? AgentName { get; set; }
+
+    /// <summary>Per-model usage for this agent, keyed by model identifier.</summary>
+    [JsonPropertyName("modelMetrics")]
+    public IDictionary<string, UsageMetricsModelMetric> ModelMetrics { get => field ??= new Dictionary<string, UsageMetricsModelMetric>(); set; }
+
+    /// <summary>Time spent in model API calls by this agent, in milliseconds.</summary>
+    [JsonConverter(typeof(MillisecondsTimeSpanConverter))]
+    [JsonPropertyName("totalApiDurationMs")]
+    public TimeSpan TotalApiDuration { get; set; }
+
+    /// <summary>Accumulated nano-AI units cost for this agent.</summary>
+    [JsonPropertyName("totalNanoAiu")]
+    public double TotalNanoAiu { get; set; }
+}
+
+/// <summary>Aggregated code change metrics.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class UsageMetricsCodeChanges
+{
+    /// <summary>Distinct file paths modified during the session.</summary>
+    [JsonPropertyName("filesModified")]
+    public IList<string> FilesModified { get => field ??= []; set; }
+
+    /// <summary>Number of distinct files modified.</summary>
+    [JsonPropertyName("filesModifiedCount")]
+    public long FilesModifiedCount { get; set; }
+
+    /// <summary>Total lines of code added.</summary>
+    [JsonPropertyName("linesAdded")]
+    public long LinesAdded { get; set; }
+
+    /// <summary>Total lines of code removed.</summary>
+    [JsonPropertyName("linesRemoved")]
+    public long LinesRemoved { get; set; }
+}
+
+/// <summary>Session-wide token-detail entry containing the accumulated token count for one token type.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class UsageMetricsTokenDetail
+{
+    /// <summary>Accumulated token count for this token type.</summary>
+    [JsonPropertyName("tokenCount")]
+    public long TokenCount { get; set; }
+}
+
+/// <summary>Accumulated session usage metrics, including premium request cost, token counts, model breakdown, and code-change totals.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class UsageGetMetricsResult
+{
+    /// <summary>Per-agent usage metrics, keyed by agent instance identifier. The main conversation uses the stable key `main`.</summary>
+    [JsonPropertyName("agentMetrics")]
+    public IDictionary<string, UsageMetricsAgentMetric>? AgentMetrics { get; set; }
+
+    /// <summary>Aggregated code change metrics.</summary>
+    [JsonPropertyName("codeChanges")]
+    public UsageMetricsCodeChanges CodeChanges { get => field ??= new(); set; }
+
+    /// <summary>Currently active model identifier.</summary>
+    [JsonPropertyName("currentModel")]
+    public string? CurrentModel { get; set; }
+
+    /// <summary>Input tokens from the most recent main-agent API call.</summary>
+    [JsonPropertyName("lastCallInputTokens")]
+    public long LastCallInputTokens { get; set; }
+
+    /// <summary>Output tokens from the most recent main-agent API call.</summary>
+    [JsonPropertyName("lastCallOutputTokens")]
+    public long LastCallOutputTokens { get; set; }
+
+    /// <summary>Per-model token and request metrics, keyed by model identifier.</summary>
+    [JsonPropertyName("modelMetrics")]
+    public IDictionary<string, UsageMetricsModelMetric> ModelMetrics { get => field ??= new Dictionary<string, UsageMetricsModelMetric>(); set; }
+
+    /// <summary>ISO 8601 timestamp when the session started.</summary>
+    [JsonPropertyName("sessionStartTime")]
+    public DateTimeOffset SessionStartTime { get; set; }
+
+    /// <summary>Session-wide per-token-type accumulated token counts.</summary>
+    [JsonPropertyName("tokenDetails")]
+    public IDictionary<string, UsageMetricsTokenDetail>? TokenDetails { get; set; }
+
+    /// <summary>Total time spent in model API calls (milliseconds).</summary>
+    [JsonConverter(typeof(MillisecondsTimeSpanConverter))]
+    [JsonPropertyName("totalApiDurationMs")]
+    public TimeSpan TotalApiDuration { get; set; }
+
+    /// <summary>Session-wide accumulated nano-AI units cost.</summary>
+    [JsonPropertyName("totalNanoAiu")]
+    public double? TotalNanoAiu { get; set; }
+
+    /// <summary>Total user-initiated premium request cost across all models (may be fractional due to multipliers).</summary>
+    [JsonPropertyName("totalPremiumRequestCost")]
+    public double TotalPremiumRequestCost { get; set; }
+
+    /// <summary>Raw count of user-initiated API requests.</summary>
+    [JsonPropertyName("totalUserRequests")]
+    public long TotalUserRequests { get; set; }
+}
+
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionUsageGetMetricsRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Prediction result. Available results include prediction details; unavailable results include an explicit reason.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
+[Experimental(Diagnostics.Experimental)]
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "kind",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(SessionLimitPredictionResultAvailable), "available")]
+[JsonDerivedType(typeof(SessionLimitPredictionResultUnavailable), "unavailable")]
+public partial class SessionLimitPredictionResult
+{
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("kind")]
+    public virtual string Kind { get; set; } = string.Empty;
+}
+
+
+/// <summary>Baseline data provenance for a prediction.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionLimitPredictionBaselineData
+{
+    /// <summary>End of the baseline data slice.</summary>
+    [JsonPropertyName("windowEnd")]
+    public string WindowEnd { get; set; } = string.Empty;
+
+    /// <summary>Start of the baseline data slice.</summary>
+    [JsonPropertyName("windowStart")]
+    public string WindowStart { get; set; } = string.Empty;
+}
+
+/// <summary>Semantic usage tier and its AI-credit cap.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionLimitPredictionTierOption
+{
+    /// <summary>AI-credit cap for this tier.</summary>
+    [JsonPropertyName("cap")]
+    public double Cap { get; set; }
+
+    /// <summary>Semantic usage tier.</summary>
+    [JsonPropertyName("tier")]
+    public SessionLimitPredictionTier Tier { get; set; }
+}
+
+/// <summary>Explainable AI-credit session-limit prediction.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionLimitPredictionDetails
+{
+    /// <summary>Baseline data provenance.</summary>
+    [JsonPropertyName("baselineData")]
+    public SessionLimitPredictionBaselineData BaselineData { get => field ??= new(); set; }
+
+    /// <summary>Client population used for the prediction.</summary>
+    [JsonPropertyName("clientType")]
+    public SessionLimitPredictionClientType ClientType { get; set; }
+
+    /// <summary>Resolved model family when known.</summary>
+    [JsonPropertyName("family")]
+    public string? Family { get; set; }
+
+    /// <summary>Model identifier used for lookup.</summary>
+    [JsonPropertyName("modelId")]
+    public string ModelId { get; set; } = string.Empty;
+
+    /// <summary>Recommended maximum AI credits for this session.</summary>
+    [JsonPropertyName("recommendedCap")]
+    public double RecommendedCap { get; set; }
+
+    /// <summary>Tier chosen as the recommended cap.</summary>
+    [JsonPropertyName("recommendedTier")]
+    public SessionLimitPredictionTier RecommendedTier { get; set; }
+
+    /// <summary>Baseline fallback level used to create the prediction.</summary>
+    [JsonPropertyName("source")]
+    public SessionLimitPredictionSource Source { get; set; }
+
+    /// <summary>Key matched at the source level, such as a model id, family id, or `global`.</summary>
+    [JsonPropertyName("sourceKey")]
+    public string SourceKey { get; set; } = string.Empty;
+
+    /// <summary>Ordered usage tiers and their AI-credit caps.</summary>
+    [JsonPropertyName("tiers")]
+    public IList<SessionLimitPredictionTierOption> Tiers { get => field ??= []; set; }
+}
+
+/// <summary>The <c>available</c> variant of <see cref="SessionLimitPredictionResult"/>.</summary>
+[Experimental(Diagnostics.Experimental)]
+public partial class SessionLimitPredictionResultAvailable : SessionLimitPredictionResult
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "available";
+
+    /// <summary>Predicted session limit details.</summary>
+    [JsonPropertyName("prediction")]
+    public required SessionLimitPredictionDetails Prediction { get; set; }
+}
+
+/// <summary>The <c>unavailable</c> variant of <see cref="SessionLimitPredictionResult"/>.</summary>
+[Experimental(Diagnostics.Experimental)]
+public partial class SessionLimitPredictionResultUnavailable : SessionLimitPredictionResult
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Kind => "unavailable";
+
+    /// <summary>Reason no prediction is available.</summary>
+    [JsonPropertyName("reason")]
+    public required SessionLimitPredictionUnavailableReason Reason { get; set; }
+}
+
+/// <summary>RPC data type for SessionLimitPredictionPredict operations.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionLimitPredictionPredictRequest
+{
+    /// <summary>Client type to size for. Defaults to `cli-interactive`.</summary>
+    [JsonPropertyName("clientType")]
+    public SessionLimitPredictionClientType? ClientType { get; set; }
+
+    /// <summary>Optional model identifier override. If omitted, the session's current model is used.</summary>
+    [JsonPropertyName("modelId")]
+    public string? ModelId { get; set; }
+}
+
+/// <summary>RPC data type for SessionLimitPredictionPredictRequestWithSession operations.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionLimitPredictionPredictRequestWithSession
+{
+    /// <summary>Client type to size for. Defaults to `cli-interactive`.</summary>
+    [JsonPropertyName("clientType")]
+    public SessionLimitPredictionClientType? ClientType { get; set; }
+
+    /// <summary>Optional model identifier override. If omitted, the session's current model is used.</summary>
+    [JsonPropertyName("modelId")]
+    public string? ModelId { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>GitHub URL for the session and a flag indicating whether remote steering is enabled.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class RemoteEnableResult
+{
+    /// <summary>Whether remote steering is enabled.</summary>
+    [JsonPropertyName("remoteSteerable")]
+    public bool RemoteSteerable { get; set; }
+
+    /// <summary>GitHub frontend URL for this session.</summary>
+    [Url]
+    [StringSyntax(StringSyntaxAttribute.Uri)]
+    [JsonPropertyName("url")]
+    public string? Url { get; set; }
+}
+
+/// <summary>Optional remote session mode ("off", "export", or "on"); defaults to enabling both export and remote steering.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class RemoteEnableRequest
+{
+    /// <summary>Per-session remote mode. "off" disables remote, "export" exports session events to GitHub without enabling remote steering, "on" enables both export and remote steering.</summary>
+    [JsonPropertyName("mode")]
+    public RemoteSessionMode? Mode { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionRemoteDisableRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Persist a steerability change as a `session.remote_steerable_changed` event. Used by the host (CLI / SDK consumer) when it has just finished enabling or disabling steering on a remote exporter that the runtime does not directly own.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class RemoteNotifySteerableChangedResult
+{
+}
+
+/// <summary>New remote-steerability state to persist as a `session.remote_steerable_changed` event.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class RemoteNotifySteerableChangedRequest
+{
+    /// <summary>Whether the session now supports remote steering via GitHub. The runtime persists this as a `session.remote_steerable_changed` event so resume/replay sees the up-to-date capability.</summary>
+    [JsonPropertyName("remoteSteerable")]
+    public bool RemoteSteerable { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Current sharing status and shareable GitHub URL for a session.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class VisibilityGetResult
+{
+    /// <summary>Shareable GitHub URL for the session. Present when the session is synced and the URL can be resolved.</summary>
+    [Url]
+    [StringSyntax(StringSyntaxAttribute.Uri)]
+    [JsonPropertyName("shareUrl")]
+    public string? ShareUrl { get; set; }
+
+    /// <summary>Current sharing status. Absent when the session is not synced or the status could not be retrieved (e.g. the user is not authenticated).</summary>
+    [JsonPropertyName("status")]
+    public SessionVisibilityStatus? Status { get; set; }
+
+    /// <summary>Whether the session has been synced to Mission Control (i.e. has a GitHub task). When false, the session cannot be shared and `status`/`shareUrl` are absent.</summary>
+    [JsonPropertyName("synced")]
+    public bool Synced { get; set; }
+}
+
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionVisibilityGetRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Effective sharing status and shareable GitHub URL after updating session visibility.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class VisibilitySetResult
+{
+    /// <summary>Shareable GitHub URL for the session. Present when the session is synced and the URL can be resolved.</summary>
+    [Url]
+    [StringSyntax(StringSyntaxAttribute.Uri)]
+    [JsonPropertyName("shareUrl")]
+    public string? ShareUrl { get; set; }
+
+    /// <summary>Effective sharing status after the update. May differ from the requested status for task types that are already visible to repository readers by default. Absent when the update could not be applied (e.g. the session is not synced or the user is not authenticated).</summary>
+    [JsonPropertyName("status")]
+    public SessionVisibilityStatus? Status { get; set; }
+
+    /// <summary>Whether the session has been synced to Mission Control (i.e. has a GitHub task). When false, the visibility change could not be applied and `status`/`shareUrl` are absent.</summary>
+    [JsonPropertyName("synced")]
+    public bool Synced { get; set; }
+}
+
+/// <summary>Desired sharing status for the session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class VisibilitySetRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Sharing status to apply. "repo" makes the session visible to repository readers; "unshared" restricts it to the creator and collaborators.</summary>
+    [JsonPropertyName("status")]
+    public SessionVisibilityStatus Status { get; set; }
+}
+
+/// <summary>Scheduled prompt entry with ID, timing (`intervalMs`, `cron`, or `at`), prompt text, recurrence, and next run time.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class ScheduleEntry
+{
+    /// <summary>Absolute fire time (epoch milliseconds) for a one-shot calendar schedule.</summary>
+    [JsonPropertyName("at")]
+    public long? At { get; set; }
+
+    /// <summary>5-field cron expression for a recurring calendar schedule, evaluated in `tz`.</summary>
+    [JsonPropertyName("cron")]
+    public string? Cron { get; set; }
+
+    /// <summary>Display-only label for the prompt as shown in the UI (e.g. `/skill-name` for a skill-invocation schedule). The actual enqueued prompt is `prompt`.</summary>
+    [JsonPropertyName("displayPrompt")]
+    public string? DisplayPrompt { get; set; }
+
+    /// <summary>Sequential id assigned by the runtime within the session. Stable across resumes (rebuilt from the event log).</summary>
+    [JsonPropertyName("id")]
+    public long Id { get; set; }
+
+    /// <summary>Interval between scheduled ticks, in milliseconds (relative-interval schedules).</summary>
+    [JsonConverter(typeof(MillisecondsTimeSpanConverter))]
+    [JsonPropertyName("intervalMs")]
+    public TimeSpan? Interval { get; set; }
+
+    /// <summary>ISO 8601 timestamp when the next tick is scheduled to fire.</summary>
+    [JsonPropertyName("nextRunAt")]
+    public DateTimeOffset NextRunAt { get; set; }
+
+    /// <summary>Prompt text that gets enqueued on every tick.</summary>
+    [JsonPropertyName("prompt")]
+    public string Prompt { get; set; } = string.Empty;
+
+    /// <summary>Whether the schedule re-arms after each tick (`/every`) or fires once (`/after`).</summary>
+    [JsonPropertyName("recurring")]
+    public bool Recurring { get; set; }
+
+    /// <summary>True for a self-paced (`dynamic`) schedule: no fixed cadence; the model arms each next run via the `manage_schedule` `wakeup` action. `nextRunAt` is model-controlled.</summary>
+    [JsonPropertyName("selfPaced")]
+    public bool? SelfPaced { get; set; }
+
+    /// <summary>IANA timezone the `cron` expression is evaluated in.</summary>
+    [JsonPropertyName("tz")]
+    public string? Tz { get; set; }
+}
+
+/// <summary>Snapshot of the currently active recurring prompts for this session.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class ScheduleList
+{
+    /// <summary>Active scheduled prompts, ordered by id.</summary>
+    [JsonPropertyName("entries")]
+    public IList<ScheduleEntry> Entries { get => field ??= []; set; }
+}
+
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionScheduleListRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionScheduleHydrateRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Whether the session currently has an active self-paced schedule.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class ScheduleHasSelfPacedResult
+{
+    /// <summary>True when at least one active schedule is self-paced.</summary>
+    [JsonPropertyName("hasSelfPaced")]
+    public bool HasSelfPaced { get; set; }
+}
+
+/// <summary>Identifies the target session.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class SessionScheduleHasSelfPacedRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Result of registering or re-arming a scheduled prompt.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class ScheduleAddResult
+{
+    /// <summary>The registered or updated schedule entry.</summary>
+    [JsonPropertyName("entry")]
+    public ScheduleEntry? Entry { get; set; }
+
+    /// <summary>User-facing validation error, when registration failed.</summary>
+    [JsonPropertyName("error")]
+    public string? Error { get; set; }
+}
+
+/// <summary>Register a relative-interval scheduled prompt.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class ScheduleAddRequest
+{
+    /// <summary>Optional display-only prompt label.</summary>
+    [JsonPropertyName("displayPrompt")]
+    public string? DisplayPrompt { get; set; }
+
+    /// <summary>Human-readable interval such as `30s`, `5m`, or `2h`.</summary>
+    [JsonPropertyName("interval")]
+    public string Interval { get; set; } = string.Empty;
+
+    /// <summary>Prompt text to enqueue when the schedule fires.</summary>
+    [JsonPropertyName("prompt")]
+    public string Prompt { get; set; } = string.Empty;
+
+    /// <summary>Whether the schedule should re-arm after each tick. Defaults to true.</summary>
+    [JsonPropertyName("recurring")]
+    public bool? Recurring { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Register a cron scheduled prompt.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class ScheduleAddCronRequest
+{
+    /// <summary>5-field cron expression.</summary>
+    [JsonPropertyName("cron")]
+    public string Cron { get; set; } = string.Empty;
+
+    /// <summary>Optional display-only prompt label.</summary>
+    [JsonPropertyName("displayPrompt")]
+    public string? DisplayPrompt { get; set; }
+
+    /// <summary>Prompt text to enqueue when the schedule fires.</summary>
+    [JsonPropertyName("prompt")]
+    public string Prompt { get; set; } = string.Empty;
+
+    /// <summary>Whether the schedule should re-arm after each tick. Defaults to true.</summary>
+    [JsonPropertyName("recurring")]
+    public bool? Recurring { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>IANA timezone for evaluating the cron expression.</summary>
+    [JsonPropertyName("tz")]
+    public string? Tz { get; set; }
+}
+
+/// <summary>Register an absolute-time scheduled prompt.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class ScheduleAddAtRequest
+{
+    /// <summary>Epoch milliseconds when the prompt should fire.</summary>
+    [JsonPropertyName("at")]
+    public long At { get; set; }
+
+    /// <summary>Optional display-only prompt label.</summary>
+    [JsonPropertyName("displayPrompt")]
+    public string? DisplayPrompt { get; set; }
+
+    /// <summary>Prompt text to enqueue when the schedule fires.</summary>
+    [JsonPropertyName("prompt")]
+    public string Prompt { get; set; } = string.Empty;
+
+    /// <summary>Whether the schedule should re-arm after each tick. Defaults to false.</summary>
+    [JsonPropertyName("recurring")]
+    public bool? Recurring { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Register a self-paced scheduled prompt.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class ScheduleAddSelfPacedRequest
+{
+    /// <summary>Optional display-only prompt label.</summary>
+    [JsonPropertyName("displayPrompt")]
+    public string? DisplayPrompt { get; set; }
+
+    /// <summary>Prompt text to enqueue when the schedule fires.</summary>
+    [JsonPropertyName("prompt")]
+    public string Prompt { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Re-arm a self-paced scheduled prompt.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class ScheduleRearmSelfPacedRequest
+{
+    /// <summary>Epoch milliseconds when the prompt should next fire.</summary>
+    [JsonPropertyName("at")]
+    public long At { get; set; }
+
+    /// <summary>Id of the self-paced scheduled prompt.</summary>
+    [JsonPropertyName("id")]
+    public long Id { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Remove a scheduled prompt by id. The result entry is omitted if the id was unknown.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class ScheduleStopResult
+{
+    /// <summary>The removed entry, or omitted if no entry matched.</summary>
+    [JsonPropertyName("entry")]
+    public ScheduleEntry? Entry { get; set; }
+}
+
+/// <summary>Identifier of the scheduled prompt to remove.</summary>
+[Experimental(Diagnostics.Experimental)]
+internal sealed class ScheduleStopRequest
+{
+    /// <summary>Id of the scheduled prompt to remove.</summary>
+    [JsonPropertyName("id")]
+    public long Id { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>A bearer token supplied by the SDK client for a BYOK provider. The runtime sets it as `Authorization: Bearer &lt;token&gt;` on the outbound request and does no caching; the SDK consumer owns token caching and refresh.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class ProviderTokenAcquireResult
+{
+    /// <summary>The bearer token value (without the `Bearer ` prefix).</summary>
+    [JsonPropertyName("token")]
+    public string Token { get; set; } = string.Empty;
+}
+
+/// <summary>Asks the SDK client to acquire a bearer token for a BYOK provider whose config set `hasBearerTokenProvider: true`. Issued by the runtime before each outbound model request; the runtime does no caching, so this is sent once per request.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class ProviderTokenAcquireRequest
+{
+    /// <summary>Name of the BYOK provider needing a token. For the legacy whole-session provider this is the implicit provider name; for named providers it is the configured provider name.</summary>
+    [JsonPropertyName("providerName")]
+    public string ProviderName { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Result returned by an extension factory closure.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class FactoryExecuteResult
+{
+    /// <summary>Factory result value.</summary>
+    [JsonPropertyName("result")]
+    public JsonElement? Result { get; set; }
+}
+
+/// <summary>Parameters sent to the owning extension to execute a factory closure.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class FactoryExecuteRequest
+{
+    /// <summary>Factory input value.</summary>
+    [JsonPropertyName("args")]
+    public JsonElement Args { get; set; }
+
+    /// <summary>Opaque token identifying this factory execution attempt.</summary>
+    [JsonPropertyName("executionToken")]
+    public string ExecutionToken { get; set; } = string.Empty;
+
+    /// <summary>Registered factory name.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
+
+    /// <summary>Factory run identifier.</summary>
+    [JsonPropertyName("runId")]
+    public string RunId { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Parameters for cooperatively aborting a factory body.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class FactoryAbortRequest
+{
+    /// <summary>Factory run identifier.</summary>
+    [JsonPropertyName("runId")]
+    public string RunId { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Describes a filesystem error.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsError
+{
+    /// <summary>Error classification.</summary>
+    [JsonPropertyName("code")]
+    public SessionFsErrorCode Code { get; set; }
+
+    /// <summary>Free-form detail about the error, for logging/diagnostics.</summary>
+    [JsonPropertyName("message")]
+    public string? Message { get; set; }
+}
+
+/// <summary>File content as a UTF-8 string, or a filesystem error if the read failed.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsReadFileResult
+{
+    /// <summary>File content as UTF-8 string.</summary>
+    [JsonPropertyName("content")]
+    public string Content { get; set; } = string.Empty;
+
+    /// <summary>Describes a filesystem error.</summary>
+    [JsonPropertyName("error")]
+    public SessionFsError? Error { get; set; }
+}
+
+/// <summary>Path of the file to read from the client-provided session filesystem.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsReadFileRequest
+{
+    /// <summary>Path using SessionFs conventions.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>File path, content to write, and optional mode for the client-provided session filesystem.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsWriteFileRequest
+{
+    /// <summary>Content to write.</summary>
+    [JsonPropertyName("content")]
+    public string Content { get; set; } = string.Empty;
+
+    /// <summary>Optional POSIX-style mode for newly created files.</summary>
+    [JsonPropertyName("mode")]
+    public long? Mode { get; set; }
+
+    /// <summary>Path using SessionFs conventions.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>File path, content to append, and optional mode for the client-provided session filesystem.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsAppendFileRequest
+{
+    /// <summary>Content to append.</summary>
+    [JsonPropertyName("content")]
+    public string Content { get; set; } = string.Empty;
+
+    /// <summary>Optional POSIX-style mode for newly created files.</summary>
+    [JsonPropertyName("mode")]
+    public long? Mode { get; set; }
+
+    /// <summary>Path using SessionFs conventions.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Indicates whether the requested path exists in the client-provided session filesystem.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsExistsResult
+{
+    /// <summary>Whether the path exists.</summary>
+    [JsonPropertyName("exists")]
+    public bool Exists { get; set; }
+}
+
+/// <summary>Path to test for existence in the client-provided session filesystem.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsExistsRequest
+{
+    /// <summary>Path using SessionFs conventions.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Filesystem metadata for the requested path, or a filesystem error if the stat failed.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsStatResult
+{
+    /// <summary>ISO 8601 timestamp of creation.</summary>
+    [JsonPropertyName("birthtime")]
+    public DateTimeOffset Birthtime { get; set; }
+
+    /// <summary>Describes a filesystem error.</summary>
+    [JsonPropertyName("error")]
+    public SessionFsError? Error { get; set; }
+
+    /// <summary>Whether the path is a directory.</summary>
+    [JsonPropertyName("isDirectory")]
+    public bool IsDirectory { get; set; }
+
+    /// <summary>Whether the path is a file.</summary>
+    [JsonPropertyName("isFile")]
+    public bool IsFile { get; set; }
+
+    /// <summary>ISO 8601 timestamp of last modification.</summary>
+    [JsonPropertyName("mtime")]
+    public DateTimeOffset Mtime { get; set; }
+
+    /// <summary>File size in bytes.</summary>
+    [JsonPropertyName("size")]
+    public long Size { get; set; }
+}
+
+/// <summary>Path whose metadata should be returned from the client-provided session filesystem.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsStatRequest
+{
+    /// <summary>Path using SessionFs conventions.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Directory path to create in the client-provided session filesystem, with options for recursive creation and POSIX mode.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsMkdirRequest
+{
+    /// <summary>Optional POSIX-style mode for newly created directories.</summary>
+    [JsonPropertyName("mode")]
+    public long? Mode { get; set; }
+
+    /// <summary>Path using SessionFs conventions.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
+
+    /// <summary>Create parent directories as needed.</summary>
+    [JsonPropertyName("recursive")]
+    public bool? Recursive { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Names of entries in the requested directory, or a filesystem error if the read failed.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsReaddirResult
+{
+    /// <summary>Entry names in the directory.</summary>
+    [JsonPropertyName("entries")]
+    public IList<string> Entries { get => field ??= []; set; }
+
+    /// <summary>Describes a filesystem error.</summary>
+    [JsonPropertyName("error")]
+    public SessionFsError? Error { get; set; }
+}
+
+/// <summary>Directory path whose entries should be listed from the client-provided session filesystem.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsReaddirRequest
+{
+    /// <summary>Path using SessionFs conventions.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Directory entry returned by session filesystem `readdirWithTypes`, with name and entry type.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsReaddirWithTypesEntry
+{
+    /// <summary>Entry name.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
+
+    /// <summary>Entry type.</summary>
+    [JsonPropertyName("type")]
+    public SessionFsReaddirWithTypesEntryType Type { get; set; }
+}
+
+/// <summary>Entries in the requested directory paired with file/directory type information, or a filesystem error if the read failed.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsReaddirWithTypesResult
+{
+    /// <summary>Directory entries with type information.</summary>
+    [JsonPropertyName("entries")]
+    public IList<SessionFsReaddirWithTypesEntry> Entries { get => field ??= []; set; }
+
+    /// <summary>Describes a filesystem error.</summary>
+    [JsonPropertyName("error")]
+    public SessionFsError? Error { get; set; }
+}
+
+/// <summary>Directory path whose entries (with type information) should be listed from the client-provided session filesystem.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsReaddirWithTypesRequest
+{
+    /// <summary>Path using SessionFs conventions.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Path to remove from the client-provided session filesystem, with options for recursive removal and force.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsRmRequest
+{
+    /// <summary>Ignore errors if the path does not exist.</summary>
+    [JsonPropertyName("force")]
+    public bool? Force { get; set; }
+
+    /// <summary>Path using SessionFs conventions.</summary>
+    [JsonPropertyName("path")]
+    public string Path { get; set; } = string.Empty;
+
+    /// <summary>Remove directories and their contents recursively.</summary>
+    [JsonPropertyName("recursive")]
+    public bool? Recursive { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Source and destination paths for renaming or moving an entry in the client-provided session filesystem.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsRenameRequest
+{
+    /// <summary>Destination path using SessionFs conventions.</summary>
+    [JsonPropertyName("dest")]
+    public string Dest { get; set; } = string.Empty;
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Source path using SessionFs conventions.</summary>
+    [JsonPropertyName("src")]
+    public string Src { get; set; } = string.Empty;
+}
+
+/// <summary>Query results including rows, columns, and rows affected, or a filesystem error if execution failed.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsSqliteQueryResult
+{
+    /// <summary>Column names from the result set.</summary>
+    [JsonPropertyName("columns")]
+    public IList<string> Columns { get => field ??= []; set; }
+
+    /// <summary>Describes a filesystem error.</summary>
+    [JsonPropertyName("error")]
+    public SessionFsError? Error { get; set; }
+
+    /// <summary>SQLite last_insert_rowid() value for INSERT.</summary>
+    [JsonPropertyName("lastInsertRowid")]
+    public long? LastInsertRowid { get; set; }
+
+    /// <summary>For SELECT: array of row objects. For others: empty array.</summary>
+    [JsonPropertyName("rows")]
+    public IList<IDictionary<string, JsonElement>> Rows { get => field ??= []; set; }
+
+    /// <summary>Number of rows affected (for INSERT/UPDATE/DELETE).</summary>
+    [JsonPropertyName("rowsAffected")]
+    public long RowsAffected { get; set; }
+}
+
+/// <summary>SQL query, query type, and optional bind parameters for executing a SQLite query against the per-session database. The provider applies its SQLite busy timeout for every call.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsSqliteQueryRequest
+{
+    /// <summary>Optional named bind parameters.</summary>
+    [JsonPropertyName("params")]
+    public IDictionary<string, JsonElement>? Params { get; set; }
+
+    /// <summary>SQL query to execute.</summary>
+    [JsonPropertyName("query")]
+    public string Query { get; set; } = string.Empty;
+
+    /// <summary>How to execute the query: 'exec' for DDL/multi-statement (no results), 'query' for SELECT (returns rows), 'run' for INSERT/UPDATE/DELETE (returns rowsAffected).</summary>
+    [JsonPropertyName("queryType")]
+    public SessionFsSqliteQueryType QueryType { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Classified SQLite transaction failure. busyOrLocked guarantees rollback; postCommitAmbiguous must never be retried.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsSqliteTransactionError
+{
+    /// <summary>Machine-readable classification of the transaction failure.</summary>
+    [JsonPropertyName("errorClass")]
+    public SessionFsSqliteTransactionErrorClass ErrorClass { get; set; }
+
+    /// <summary>Human-readable transaction failure message.</summary>
+    [JsonPropertyName("message")]
+    public string Message { get; set; } = string.Empty;
+}
+
+/// <summary>Per-statement results, or a classified transaction error.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsSqliteTransactionResult
+{
+    /// <summary>Classified transaction failure, when execution did not succeed.</summary>
+    [JsonPropertyName("error")]
+    public SessionFsSqliteTransactionError? Error { get; set; }
+
+    /// <summary>Per-statement query results in input order.</summary>
+    [JsonPropertyName("results")]
+    public IList<SessionFsSqliteQueryResult> Results { get => field ??= []; set; }
+}
+
+/// <summary>One statement in an atomic SQLite transaction.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsSqliteTransactionStatement
+{
+    /// <summary>Optional named bind parameters.</summary>
+    [JsonPropertyName("params")]
+    public IDictionary<string, JsonElement>? Params { get; set; }
+
+    /// <summary>SQL statement to execute.</summary>
+    [JsonPropertyName("query")]
+    public string Query { get; set; } = string.Empty;
+
+    /// <summary>How to execute the statement.</summary>
+    [JsonPropertyName("queryType")]
+    public SessionFsSqliteQueryType QueryType { get; set; }
+}
+
+/// <summary>Statements to execute atomically. Providers apply busy handling for every call.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsSqliteTransactionRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Ordered SQL statements to execute in one transaction.</summary>
+    [JsonPropertyName("statements")]
+    public IList<SessionFsSqliteTransactionStatement> Statements { get => field ??= []; set; }
+}
+
+/// <summary>Indicates whether the per-session SQLite database already exists.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class SessionFsSqliteExistsResult
+{
+    /// <summary>Whether the session database already exists.</summary>
+    [JsonPropertyName("exists")]
+    public bool Exists { get; set; }
+}
+
+/// <summary>Identifies the target session.</summary>
+public sealed class SessionFsSqliteExistsRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Canvas open result returned by the provider.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class CanvasProviderOpenResult
+{
+    /// <summary>Provider-supplied status text.</summary>
+    [JsonPropertyName("status")]
+    public string? Status { get; set; }
+
+    /// <summary>Provider-supplied title.</summary>
+    [JsonPropertyName("title")]
+    public string? Title { get; set; }
+
+    /// <summary>URL for web-rendered canvases.</summary>
+    [JsonPropertyName("url")]
+    public string? Url { get; set; }
+}
+
+/// <summary>Host capabilities.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class CanvasHostContextCapabilities
+{
+    /// <summary>Whether canvas rendering is supported.</summary>
+    [JsonPropertyName("canvases")]
+    public bool? Canvases { get; set; }
+}
+
+/// <summary>Host context supplied by the runtime.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class CanvasHostContext
+{
+    /// <summary>Host capabilities.</summary>
+    [JsonPropertyName("capabilities")]
+    public CanvasHostContextCapabilities? Capabilities { get; set; }
+}
+
+/// <summary>Session context supplied by the runtime.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class CanvasSessionContext
+{
+    /// <summary>Active session working directory, when known.</summary>
+    [JsonPropertyName("workingDirectory")]
+    public string? WorkingDirectory { get; set; }
+}
+
+/// <summary>Canvas open parameters sent to the provider.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class CanvasProviderOpenRequest
+{
+    /// <summary>Provider-local canvas identifier.</summary>
+    [JsonPropertyName("canvasId")]
+    public string CanvasId { get; set; } = string.Empty;
+
+    /// <summary>Owning provider identifier.</summary>
+    [JsonPropertyName("extensionId")]
+    public string ExtensionId { get; set; } = string.Empty;
+
+    /// <summary>Host context supplied by the runtime.</summary>
+    [JsonPropertyName("host")]
+    public CanvasHostContext? Host { get; set; }
+
+    /// <summary>Canvas open input.</summary>
+    [JsonPropertyName("input")]
+    public JsonElement? Input { get; set; }
+
+    /// <summary>Stable caller-supplied canvas instance identifier.</summary>
+    [JsonPropertyName("instanceId")]
+    public string InstanceId { get; set; } = string.Empty;
+
+    /// <summary>Session context supplied by the runtime.</summary>
+    [JsonPropertyName("session")]
+    public CanvasSessionContext? Session { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Canvas close parameters sent to the provider.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class CanvasProviderCloseRequest
+{
+    /// <summary>Provider-local canvas identifier.</summary>
+    [JsonPropertyName("canvasId")]
+    public string CanvasId { get; set; } = string.Empty;
+
+    /// <summary>Owning provider identifier.</summary>
+    [JsonPropertyName("extensionId")]
+    public string ExtensionId { get; set; } = string.Empty;
+
+    /// <summary>Host context supplied by the runtime.</summary>
+    [JsonPropertyName("host")]
+    public CanvasHostContext? Host { get; set; }
+
+    /// <summary>Canvas instance identifier.</summary>
+    [JsonPropertyName("instanceId")]
+    public string InstanceId { get; set; } = string.Empty;
+
+    /// <summary>Session context supplied by the runtime.</summary>
+    [JsonPropertyName("session")]
+    public CanvasSessionContext? Session { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Canvas action invocation parameters sent to the provider.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class CanvasProviderInvokeActionRequest
+{
+    /// <summary>Action name to invoke.</summary>
+    [JsonPropertyName("actionName")]
+    public string ActionName { get; set; } = string.Empty;
+
+    /// <summary>Provider-local canvas identifier.</summary>
+    [JsonPropertyName("canvasId")]
+    public string CanvasId { get; set; } = string.Empty;
+
+    /// <summary>Owning provider identifier.</summary>
+    [JsonPropertyName("extensionId")]
+    public string ExtensionId { get; set; } = string.Empty;
+
+    /// <summary>Host context supplied by the runtime.</summary>
+    [JsonPropertyName("host")]
+    public CanvasHostContext? Host { get; set; }
+
+    /// <summary>Action input.</summary>
+    [JsonPropertyName("input")]
+    public JsonElement? Input { get; set; }
+
+    /// <summary>Canvas instance identifier.</summary>
+    [JsonPropertyName("instanceId")]
+    public string InstanceId { get; set; } = string.Empty;
+
+    /// <summary>Session context supplied by the runtime.</summary>
+    [JsonPropertyName("session")]
+    public CanvasSessionContext? Session { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Opaque integrator-owned process launch profile for one extension entrypoint.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class ExtensionLaunchProfile
+{
+    /// <summary>Opaque integrator-defined arguments passed to the executable. The runtime does not append the extension entrypoint.</summary>
+    [JsonPropertyName("args")]
+    public IList<string> Args { get => field ??= []; set; }
+
+    /// <summary>Opaque integrator-defined environment variables. Runtime-owned COPILOT_SDK_PATH, SESSION_ID, and COPILOT_EXTENSION_PARENT_PID values take precedence.</summary>
+    [JsonPropertyName("env")]
+    public IDictionary<string, string> Env { get => field ??= new Dictionary<string, string>(); set; }
+
+    /// <summary>Executable used to launch the extension entrypoint.</summary>
+    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
+    [MinLength(1)]
+    [JsonPropertyName("executable")]
+    public string Executable { get; set; } = string.Empty;
+}
+
+/// <summary>The launch profile for a supported entrypoint. Omit launch when the provider does not support the entrypoint.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class ExtensionLaunchProviderResolveResult
+{
+    /// <summary>Opaque launch profile, omitted when this provider does not support the entrypoint.</summary>
+    [JsonPropertyName("launch")]
+    public ExtensionLaunchProfile? Launch { get; set; }
+}
+
+/// <summary>A discovered extension entrypoint that the registered integrator may classify and resolve to an opaque launch profile.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class ExtensionLaunchProviderResolveRequest
+{
+    /// <summary>Source-qualified extension identifier.</summary>
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
+
+    /// <summary>Absolute path to the discovered extension entrypoint.</summary>
+    [JsonPropertyName("modulePath")]
+    public string ModulePath { get; set; } = string.Empty;
+
+    /// <summary>Human-readable extension name.</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
+
+    /// <summary>Discovery source for the extension entrypoint.</summary>
+    [JsonPropertyName("source")]
+    public ExtensionSource Source { get; set; }
+}
+
+/// <summary>Acknowledgement. Returning successfully simply means the SDK accepted the start frame; it does not imply the request will succeed.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class LlmInferenceHttpRequestStartResult
+{
+}
+
+/// <summary>The head of an outbound model-layer HTTP request.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class LlmInferenceHttpRequestStartRequest
+{
+    /// <summary>Stable identity of the agent trajectory that issued this request. Present when the request originates from an agent turn; absent for requests outside any agent context. This is the same identity used by lifecycle and bridged session events and remains constant across turns and retries.</summary>
+    [JsonPropertyName("agentId")]
+    public string? AgentId { get; set; }
+
+    /// <summary>Identity of the agent invocation (one agentic loop) that issued this request. It remains fixed across physical retries within the invocation and is distinct from the stable trajectory `agentId`. A caller-supplied invocation id always takes precedence (this covers auxiliary calls that have no model call id). Otherwise, first-party CAPI requests fall back to the runtime's agent task id — the same value the runtime emits as the `X-Agent-Task-Id` header — while custom-provider requests fall back to the model call id.</summary>
+    [JsonPropertyName("agentInvocationId")]
+    public string? AgentInvocationId { get; set; }
+
+    /// <summary>HTTP request headers, preserving multiple values per name.</summary>
+    [JsonPropertyName("headers")]
+    public IDictionary<string, IList<string>> Headers { get => field ??= new Dictionary<string, IList<string>>(); set; }
+
+    /// <summary>Coarse classification of the interaction that produced this request. Open string for forward-compatibility; known values include `conversation-agent`, `conversation-subagent`, `conversation-sampling`, `conversation-background`, `conversation-compaction`, and `conversation-user`. Absent when the runtime did not classify the request. Comes from the runtime's per-request agent context independently of transport; on the CAPI transport the runtime derives the upstream `X-Interaction-Type` header from this same context.</summary>
+    [JsonPropertyName("interactionType")]
+    public string? InteractionType { get; set; }
+
+    /// <summary>HTTP method, e.g. GET, POST.</summary>
+    [JsonPropertyName("method")]
+    public string Method { get; set; } = string.Empty;
+
+    /// <summary>Stable identity of the immediate parent trajectory. Present for child trajectories such as subagents and conversation-sampling requests; absent for root-agent and non-agent requests.</summary>
+    [JsonPropertyName("parentAgentId")]
+    public string? ParentAgentId { get; set; }
+
+    /// <summary>Opaque runtime-minted id, unique per in-flight request. The SDK uses this to correlate httpRequestChunk frames and to address its httpResponseStart / httpResponseChunk replies back to the runtime.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
+
+    /// <summary>Id of the runtime session that triggered this request, when one is in scope. Absent for requests issued outside any session (e.g. startup model-catalog or capability resolution). This is a payload field — not a dispatch key — because the client-global API is registered process-wide rather than per session.</summary>
+    [JsonPropertyName("sessionId")]
+    public string? SessionId { get; set; }
+
+    /// <summary>Transport the runtime would otherwise use for this request. `http` (the default when absent) covers plain HTTP and SSE responses; `websocket` indicates a full-duplex message channel where each body chunk maps to one WebSocket message and the `binary` flag distinguishes text from binary frames. The SDK consumer uses this to decide whether to service the request with an HTTP client or a WebSocket client. It is the one piece of request metadata the consumer cannot reliably infer from the URL or headers alone.</summary>
+    [JsonPropertyName("transport")]
+    public LlmInferenceHttpRequestStartTransport? Transport { get; set; }
+
+    /// <summary>Absolute request URL.</summary>
+    [JsonPropertyName("url")]
+    public string Url { get; set; } = string.Empty;
+}
+
+/// <summary>Acknowledgement. The SDK is free to ignore the ack and treat chunk delivery as fire-and-forget.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class LlmInferenceHttpRequestChunkResult
+{
+}
+
+/// <summary>A request body chunk or cancellation signal.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class LlmInferenceHttpRequestChunkRequest
+{
+    /// <summary>Identity of the agent invocation (one agentic loop) this body chunk belongs to, matching the `agentInvocationId` semantics on httpRequestStart. Carried per chunk so a persistent transport can attribute successive turns correctly: when a WebSocket connection is reused across turns, the httpRequestStart identity reflects only the turn that opened the connection, so each later turn stamps its own invocation id here. Absent when the runtime has no invocation context for the request, or on the plain-HTTP transport where every request has its own httpRequestStart.</summary>
+    [JsonPropertyName("agentInvocationId")]
+    public string? AgentInvocationId { get; set; }
+
+    /// <summary>When true, `data` is base64-encoded bytes. When absent or false, `data` is UTF-8 text.</summary>
+    [JsonPropertyName("binary")]
+    public bool? Binary { get; set; }
+
+    /// <summary>When true, the runtime is cancelling the in-flight request (e.g. upstream consumer aborted). `data` is ignored. Implies end-of-request.</summary>
+    [JsonPropertyName("cancel")]
+    public bool? Cancel { get; set; }
+
+    /// <summary>Optional human-readable reason for the cancellation, propagated for logging.</summary>
+    [JsonPropertyName("cancelReason")]
+    public string? CancelReason { get; set; }
+
+    /// <summary>Body byte range. UTF-8 text when `binary` is absent or false; base64-encoded bytes when `binary` is true. May be empty.</summary>
+    [JsonPropertyName("data")]
+    public string Data { get; set; } = string.Empty;
+
+    /// <summary>When true, this is the final body chunk for the request. The SDK may rely on having received an end-marked chunk before treating the request body as complete.</summary>
+    [JsonPropertyName("end")]
+    public bool? End { get; set; }
+
+    /// <summary>Matches the requestId from the originating httpRequestStart frame.</summary>
+    [JsonPropertyName("requestId")]
+    public string RequestId { get; set; } = string.Empty;
+}
+
+/// <summary>Client environment metadata describing the process that produced a telemetry event.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class GitHubTelemetryClientInfo
+{
+    /// <summary>Copilot CLI version string.</summary>
+    [JsonPropertyName("cli_version")]
+    public string CliVersion { get; set; } = string.Empty;
+
+    /// <summary>Name of the client application.</summary>
+    [JsonPropertyName("client_name")]
+    public string? ClientName { get; set; }
+
+    /// <summary>Type of client.</summary>
+    [JsonPropertyName("client_type")]
+    public string? ClientType { get; set; }
+
+    /// <summary>Copilot subscription plan, when known.</summary>
+    [JsonPropertyName("copilot_plan")]
+    public string? CopilotPlan { get; set; }
+
+    /// <summary>Stable machine identifier for the device.</summary>
+    [JsonPropertyName("dev_device_id")]
+    public string? DevDeviceId { get; set; }
+
+    /// <summary>Whether the user is a GitHub/Microsoft staff member.</summary>
+    [JsonPropertyName("is_staff")]
+    public bool? IsStaff { get; set; }
+
+    /// <summary>Node.js runtime version string.</summary>
+    [JsonPropertyName("node_version")]
+    public string NodeVersion { get; set; } = string.Empty;
+
+    /// <summary>Operating system architecture (e.g. arm64, x64).</summary>
+    [JsonPropertyName("os_arch")]
+    public string OsArch { get; set; } = string.Empty;
+
+    /// <summary>Operating system platform (e.g. darwin, linux, win32).</summary>
+    [JsonPropertyName("os_platform")]
+    public string OsPlatform { get; set; } = string.Empty;
+
+    /// <summary>Operating system version string.</summary>
+    [JsonPropertyName("os_version")]
+    public string OsVersion { get; set; } = string.Empty;
+}
+
+/// <summary>A single telemetry event in the runtime's native GitHub-shaped telemetry format, forwarded verbatim to opted-in hosts. The `restricted` flag on the enclosing GitHubTelemetryNotification distinguishes standard from restricted events; the payload shape is identical for both.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class GitHubTelemetryEvent
+{
+    /// <summary>Client environment metadata.</summary>
+    [JsonPropertyName("client")]
+    public GitHubTelemetryClientInfo? Client { get; set; }
+
+    /// <summary>Copilot tracking ID for user-level attribution.</summary>
+    [JsonPropertyName("copilot_tracking_id")]
+    public string? CopilotTrackingId { get; set; }
+
+    /// <summary>Timestamp when the event was created (ISO 8601 format).</summary>
+    [JsonPropertyName("created_at")]
+    public string? CreatedAt { get; set; }
+
+    /// <summary>Experiment assignment context.</summary>
+    [JsonPropertyName("exp_assignment_context")]
+    public string? ExpAssignmentContext { get; set; }
+
+    /// <summary>Feature flags enabled for this session, as a map from flag to value.</summary>
+    [JsonPropertyName("features")]
+    public IDictionary<string, string>? Features { get; set; }
+
+    /// <summary>Event type/kind (e.g. get_completion_with_tools_turn, tool_call_executed).</summary>
+    [JsonPropertyName("kind")]
+    public string Kind { get; set; } = string.Empty;
+
+    /// <summary>Numeric metrics as a map from key to value.</summary>
+    [JsonPropertyName("metrics")]
+    public IDictionary<string, double> Metrics { get => field ??= new Dictionary<string, double>(); set; }
+
+    /// <summary>Reference to the model call that produced this event.</summary>
+    [JsonPropertyName("model_call_id")]
+    public string? ModelCallId { get; set; }
+
+    /// <summary>String-valued properties as a map from key to value.</summary>
+    [JsonPropertyName("properties")]
+    public IDictionary<string, string> Properties { get => field ??= new Dictionary<string, string>(); set; }
+
+    /// <summary>Session identifier the event belongs to.</summary>
+    [JsonPropertyName("session_id")]
+    public string? SessionId { get; set; }
+}
+
+/// <summary>Payload for a `gitHubTelemetry.event` notification: a single GitHub telemetry event the runtime forwards to a host connection that opted into telemetry forwarding during the `server.connect` handshake.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class GitHubTelemetryNotification
+{
+    /// <summary>The telemetry event, in the runtime's native GitHub-shaped telemetry format.</summary>
+    [JsonPropertyName("event")]
+    public GitHubTelemetryEvent Event { get => field ??= new(); set; }
+
+    /// <summary>Whether this is a restricted telemetry event (cli.restricted_telemetry). Hosts must route restricted events to first-party Microsoft stores only.</summary>
+    [JsonPropertyName("restricted")]
+    public bool Restricted { get; set; }
+
+    /// <summary>Session the telemetry event belongs to, when it is session-scoped. Omitted for sessionless events (for example, `server.sendTelemetry` calls with no session id), which are still forwarded to opted-in connections.</summary>
+    [JsonPropertyName("sessionId")]
+    public string? SessionId { get; set; }
+}
+
+/// <summary>Resolved Anthropic adaptive-thinking capability for a model.</summary>
+[Experimental(Diagnostics.Experimental)]
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct AdaptiveThinkingSupport : IEquatable<AdaptiveThinkingSupport>
+{
+    private readonly string? _value;
+
+    /// <summary>Initializes a new instance of the <see cref="AdaptiveThinkingSupport"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="AdaptiveThinkingSupport"/>.</param>
+    [JsonConstructor]
+    public AdaptiveThinkingSupport(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="AdaptiveThinkingSupport"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>The model does not accept thinking.type='adaptive'.</summary>
+    public static AdaptiveThinkingSupport Unsupported { get; } = new("unsupported");
+
+    /// <summary>The model accepts adaptive thinking but also accepts thinking.type='enabled'.</summary>
+    public static AdaptiveThinkingSupport Optional { get; } = new("optional");
+
+    /// <summary>The model only accepts adaptive thinking and rejects thinking.type='enabled' with HTTP 400 (e.g. opus-4.7/4.8).</summary>
+    public static AdaptiveThinkingSupport Required { get; } = new("required");
+
+    /// <summary>Returns a value indicating whether two <see cref="AdaptiveThinkingSupport"/> instances are equivalent.</summary>
+    public static bool operator ==(AdaptiveThinkingSupport left, AdaptiveThinkingSupport right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="AdaptiveThinkingSupport"/> instances are not equivalent.</summary>
+    public static bool operator !=(AdaptiveThinkingSupport left, AdaptiveThinkingSupport right) => !(left == right);
+
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is AdaptiveThinkingSupport other && Equals(other);
+
+    /// <inheritdoc />
+    public bool Equals(AdaptiveThinkingSupport other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
+
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{AdaptiveThinkingSupport}"/> for serializing <see cref="AdaptiveThinkingSupport"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<AdaptiveThinkingSupport>
+    {
+        /// <inheritdoc />
+        public override AdaptiveThinkingSupport Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, AdaptiveThinkingSupport value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(AdaptiveThinkingSupport));
+        }
+    }
+}
+
+
+/// <summary>Model capability category for grouping in the model picker.</summary>
+[Experimental(Diagnostics.Experimental)]
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct ModelPickerCategory : IEquatable<ModelPickerCategory>
+{
+    private readonly string? _value;
+
+    /// <summary>Initializes a new instance of the <see cref="ModelPickerCategory"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="ModelPickerCategory"/>.</param>
+    [JsonConstructor]
+    public ModelPickerCategory(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="ModelPickerCategory"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>Lightweight model category optimized for faster, lower-cost interactions.</summary>
+    public static ModelPickerCategory Lightweight { get; } = new("lightweight");
+
+    /// <summary>Versatile model category suitable for a broad range of tasks.</summary>
+    public static ModelPickerCategory Versatile { get; } = new("versatile");
+
+    /// <summary>Powerful model category optimized for complex tasks.</summary>
+    public static ModelPickerCategory Powerful { get; } = new("powerful");
+
+    /// <summary>Returns a value indicating whether two <see cref="ModelPickerCategory"/> instances are equivalent.</summary>
+    public static bool operator ==(ModelPickerCategory left, ModelPickerCategory right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="ModelPickerCategory"/> instances are not equivalent.</summary>
+    public static bool operator !=(ModelPickerCategory left, ModelPickerCategory right) => !(left == right);
+
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is ModelPickerCategory other && Equals(other);
+
+    /// <inheritdoc />
+    public bool Equals(ModelPickerCategory other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
+
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{ModelPickerCategory}"/> for serializing <see cref="ModelPickerCategory"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<ModelPickerCategory>
+    {
+        /// <inheritdoc />
+        public override ModelPickerCategory Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, ModelPickerCategory value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(ModelPickerCategory));
+        }
+    }
+}
+
+
+/// <summary>Relative cost tier for token-based billing users.</summary>
+[Experimental(Diagnostics.Experimental)]
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct ModelPickerPriceCategory : IEquatable<ModelPickerPriceCategory>
+{
+    private readonly string? _value;
+
+    /// <summary>Initializes a new instance of the <see cref="ModelPickerPriceCategory"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="ModelPickerPriceCategory"/>.</param>
+    [JsonConstructor]
+    public ModelPickerPriceCategory(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="ModelPickerPriceCategory"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>Lowest relative token cost tier.</summary>
+    public static ModelPickerPriceCategory Low { get; } = new("low");
+
+    /// <summary>Medium relative token cost tier.</summary>
+    public static ModelPickerPriceCategory Medium { get; } = new("medium");
+
+    /// <summary>High relative token cost tier.</summary>
+    public static ModelPickerPriceCategory High { get; } = new("high");
+
+    /// <summary>Highest relative token cost tier.</summary>
+    public static ModelPickerPriceCategory VeryHigh { get; } = new("very_high");
+
+    /// <summary>Returns a value indicating whether two <see cref="ModelPickerPriceCategory"/> instances are equivalent.</summary>
+    public static bool operator ==(ModelPickerPriceCategory left, ModelPickerPriceCategory right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="ModelPickerPriceCategory"/> instances are not equivalent.</summary>
+    public static bool operator !=(ModelPickerPriceCategory left, ModelPickerPriceCategory right) => !(left == right);
+
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is ModelPickerPriceCategory other && Equals(other);
+
+    /// <inheritdoc />
+    public bool Equals(ModelPickerPriceCategory other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
-/// <summary>Internal filter for consuming queued system notifications.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class QueueConsumeSystemNotificationsRequest
-{
-    /// <summary>Opaque runtime-owned filter object.</summary>
-    [JsonPropertyName("filter")]
-    public JsonElement Filter { get; set; }
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <inheritdoc />
+    public override string ToString() => Value;
 
-/// <summary>Result of enqueueing the resume-pending wake item.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class QueueEnqueueResumePendingResult
-{
-    /// <summary>True when a wake item was newly queued.</summary>
-    [JsonPropertyName("queued")]
-    public bool Queued { get; set; }
-}
+    /// <summary>Provides a <see cref="JsonConverter{ModelPickerPriceCategory}"/> for serializing <see cref="ModelPickerPriceCategory"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<ModelPickerPriceCategory>
+    {
+        /// <inheritdoc />
+        public override ModelPickerPriceCategory Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionQueueEnqueueResumePendingRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, ModelPickerPriceCategory value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(ModelPickerPriceCategory));
+        }
+    }
 }
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionQueueProcessRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
 
-/// <summary>Batch of session events returned by a read, with cursor and continuation metadata.</summary>
+/// <summary>Current policy state for this model.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class EventsReadResult
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct ModelPolicyState : IEquatable<ModelPolicyState>
 {
-    /// <summary>Opaque cursor for the next read. Pass back unchanged in the next read.cursor to continue from where this read left off. Always present, even when no events were returned. For a backward read this cursor pages toward OLDER events; keep passing `direction: backward` with it (the cursor is also self-describing, so backward paging continues correctly).</summary>
-    [JsonPropertyName("cursor")]
-    public string Cursor { get; set; } = string.Empty;
+    private readonly string? _value;
 
-    /// <summary>Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history. For a forward read the fallback starts from the beginning of the remaining history; for a backward read it falls back to the tail (the newest window). Because the fallback page is a fresh boundary snapshot rather than a continuation of the requested cursor, it may overlap events the consumer has already rendered — a backward fallback to the tail in particular can repeat the newest window. On 'expired', consumers should reset or rebase their local pagination state (or deduplicate by event id) before continuing from the returned cursor rather than blindly appending/prepending the fallback page.</summary>
-    [JsonPropertyName("cursorStatus")]
-    public EventsCursorStatus CursorStatus { get; set; }
+    /// <summary>Initializes a new instance of the <see cref="ModelPolicyState"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="ModelPolicyState"/>.</param>
+    [JsonConstructor]
+    public ModelPolicyState(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
 
-    /// <summary>Session events for this batch, merged into a single stream in creation order: durable (persisted) events and ephemeral events interleave exactly as they were emitted. Set `includeEphemeral: false` to receive only durable events. Ephemeral events are never replayable once pruned from the in-memory ring, so a consumer that needs them should keep reading with a non-zero `waitMs`. For a backward (tail-first) read, the returned window contains persisted events only, still in chronological (oldest-to-newest) append order.</summary>
-    [JsonPropertyName("events")]
-    public IList<SessionEvent> Events { get => field ??= []; set; }
+    /// <summary>Gets the value associated with this <see cref="ModelPolicyState"/>.</summary>
+    public string Value => _value ?? string.Empty;
 
-    /// <summary>True when more events are available in the read's direction. For a forward read, true means the batch returned `max` events and more are available immediately. For a backward read, true means older persisted events remain before the returned window.</summary>
-    [JsonPropertyName("hasMore")]
-    public bool HasMore { get; set; }
-}
+    /// <summary>The model is enabled by policy.</summary>
+    public static ModelPolicyState Enabled { get; } = new("enabled");
 
-/// <summary>Cursor, batch size, and optional long-poll/filter parameters for reading session events.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class EventLogReadRequest
-{
-    /// <summary>Optional non-empty list of subagent identifiers. When provided, only events owned by one of these agents are returned; ownership recognizes the event envelope's agentId plus legacy data.agentId and data.parentToolCallId markers. This filter takes precedence over agentScope.</summary>
-    [JsonPropertyName("agentIds")]
-    public IList<string>? AgentIds { get; set; }
+    /// <summary>The model is disabled by policy.</summary>
+    public static ModelPolicyState Disabled { get; } = new("disabled");
 
-    /// <summary>Agent-scope filter: 'primary' returns only main-agent events plus events whose type starts with 'subagent.' (matching the typed-subscription default behavior); 'all' returns events from all agents (matching wildcard-subscription behavior). Default is 'all' to preserve wildcard semantics for catch-up callers.</summary>
-    [JsonPropertyName("agentScope")]
-    public EventsAgentScope? AgentScope { get; set; }
+    /// <summary>No explicit policy is configured for the model.</summary>
+    public static ModelPolicyState Unconfigured { get; } = new("unconfigured");
 
-    /// <summary>Opaque cursor returned by a previous read. Omit on the first call to start from the beginning of the session's persisted history.</summary>
-    [JsonPropertyName("cursor")]
-    public string? Cursor { get; set; }
+    /// <summary>Returns a value indicating whether two <see cref="ModelPolicyState"/> instances are equivalent.</summary>
+    public static bool operator ==(ModelPolicyState left, ModelPolicyState right) => left.Equals(right);
 
-    /// <summary>Direction to page through the session's persisted event history. 'forward' (default) pages from the cursor toward newer events (or from the start of history when no cursor is given). 'backward' enables tail-first reads: with no cursor it returns the NEWEST `max` events, and the returned cursor pages toward OLDER events on subsequent backward reads. Events within a returned batch are always in chronological (oldest-to-newest) order, even for a backward read. Backward reads cover PERSISTED history only; ephemeral events are never returned by a backward read. `direction` selects the INITIAL read only: the returned cursor is self-describing, so a continuation read pages in the cursor's own direction regardless of the `direction` passed alongside it — a forward cursor always pages forward and a backward cursor always pages backward. Pass the direction that matches the cursor to avoid confusion.</summary>
-    [JsonPropertyName("direction")]
-    public EventsReadDirection? Direction { get; set; }
+    /// <summary>Returns a value indicating whether two <see cref="ModelPolicyState"/> instances are not equivalent.</summary>
+    public static bool operator !=(ModelPolicyState left, ModelPolicyState right) => !(left == right);
 
-    /// <summary>When false, skip ephemeral events entirely and return only durable (persisted) events. History-backfill callers that discard ephemerals anyway should set this so the read is bounded by the durable log length instead of racing the ephemeral ring on a busy session. Defaults to true (ephemerals are interleaved with durable events in creation order). Ignored by backward reads, which always cover persisted history only.</summary>
-    [JsonPropertyName("includeEphemeral")]
-    public bool? IncludeEphemeral { get; set; }
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is ModelPolicyState other && Equals(other);
 
-    /// <summary>Maximum number of events to return in this batch (1–1000, default 200).</summary>
-    [JsonPropertyName("max")]
-    public long? Max { get; set; }
+    /// <inheritdoc />
+    public bool Equals(ModelPolicyState other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
 
-    /// <summary>Either '*' to receive all event types, or a non-empty list of event types to receive.</summary>
-    [JsonPropertyName("types")]
-    public JsonElement? Types { get; set; }
+    /// <inheritdoc />
+    public override string ToString() => Value;
 
-    /// <summary>Milliseconds to wait for new events when the cursor is at the tail of history. 0 (default) returns immediately even if no events are available. Capped at 30000ms. Ephemeral events that arrive during the wait are delivered in this batch but are NOT replayable on a subsequent read (use a non-zero waitMs in your next call to capture future ephemerals as they happen). This applies to forward reads only: a backward read always returns immediately and ignores `waitMs`, because backward paging covers persisted history only while new events append at the tail (the opposite end from a backward page), so no blocking or ephemeral delivery can occur.</summary>
-    [JsonConverter(typeof(MillisecondsTimeSpanConverter))]
-    [JsonPropertyName("waitMs")]
-    public TimeSpan? Wait { get; set; }
-}
+    /// <summary>Provides a <see cref="JsonConverter{ModelPolicyState}"/> for serializing <see cref="ModelPolicyState"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<ModelPolicyState>
+    {
+        /// <inheritdoc />
+        public override ModelPolicyState Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
 
-/// <summary>Snapshot of the current tail cursor without returning any events. Use this when a consumer wants to subscribe to live events going forward without first paginating through the entire persisted history (which would happen if `read` were called without a cursor on a long-lived session).</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class EventLogTailResult
-{
-    /// <summary>Opaque cursor pointing at the current tail of the session's persisted-events history. Pass back to `read` to receive only events that arrive AFTER this snapshot. When the session has no events, this returns the same sentinel as an unset cursor (i.e. equivalent to omitting the cursor on a first read).</summary>
-    [JsonPropertyName("cursor")]
-    public string Cursor { get; set; } = string.Empty;
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, ModelPolicyState value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(ModelPolicyState));
+        }
+    }
 }
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionEventLogTailRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
 
-/// <summary>Opaque handle representing an event-type interest registration.</summary>
+/// <summary>Server transport type: stdio, http, sse (deprecated), or memory.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class RegisterEventInterestResult
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct DiscoveredMcpServerType : IEquatable<DiscoveredMcpServerType>
 {
-    /// <summary>Opaque handle for this registration. Pass to releaseInterest to release. Each call to registerInterest produces a fresh handle, even when the same eventType is registered multiple times.</summary>
-    [JsonPropertyName("handle")]
-    public string Handle { get; set; } = string.Empty;
-}
+    private readonly string? _value;
 
-/// <summary>Event type to register consumer interest for, used by runtime gating logic.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class RegisterEventInterestParams
-{
-    /// <summary>The event type the consumer wants the runtime to treat as 'observed' for behavior-switching gating. Some runtime code paths inspect whether any consumer is interested in a specific event type and choose a different implementation accordingly (e.g. `mcp.oauth_required`: when interest is registered the runtime delegates interactive OAuth token acquisition to the consumer via `mcp.oauth_required` events; when no interest is registered the runtime still attempts non-interactive reconnect from cached or refreshable tokens, and only marks the server `needs-auth` if usable credentials are unavailable — it does not open a browser or start interactive OAuth without a consumer). SDK clients that long-poll events do NOT automatically appear as listeners to these gating checks — they must explicitly call `registerInterest` for each event type they want the runtime to count as having a consumer. Multiple registrations for the same event type from the same or different consumers are tracked independently and must each be released. See: `mcp.oauth_required`, `sampling.requested`, `auto_mode_switch.requested`, `session_limits_exhausted.requested`, `user_input.requested`, `elicitation.requested`, `command.queued`, `exit_plan_mode.requested`.</summary>
-    [JsonPropertyName("eventType")]
-    public string EventType { get; set; } = string.Empty;
+    /// <summary>Initializes a new instance of the <see cref="DiscoveredMcpServerType"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="DiscoveredMcpServerType"/>.</param>
+    [JsonConstructor]
+    public DiscoveredMcpServerType(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Gets the value associated with this <see cref="DiscoveredMcpServerType"/>.</summary>
+    public string Value => _value ?? string.Empty;
 
-/// <summary>Indicates whether the operation succeeded.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class EventLogReleaseInterestResult
-{
-    /// <summary>Whether the operation succeeded.</summary>
-    [JsonPropertyName("success")]
-    public bool Success { get; set; }
-}
+    /// <summary>Server communicates over stdio with a local child process.</summary>
+    public static DiscoveredMcpServerType Stdio { get; } = new("stdio");
 
-/// <summary>Opaque handle previously returned by `registerInterest` to release.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class ReleaseEventInterestParams
-{
-    /// <summary>Handle returned by a previous `registerInterest` call. Idempotent: releasing an unknown or already-released handle is a no-op (returns success). When the last outstanding handle for an event type is released, the runtime reverts to its 'no consumer' code path for that event type.</summary>
-    [JsonPropertyName("handle")]
-    public string Handle { get; set; } = string.Empty;
+    /// <summary>Server communicates over streamable HTTP.</summary>
+    public static DiscoveredMcpServerType Http { get; } = new("http");
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Server communicates over Server-Sent Events (deprecated).</summary>
+    public static DiscoveredMcpServerType Sse { get; } = new("sse");
 
-/// <summary>Request count and cost metrics for this model.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class UsageMetricsModelMetricRequests
-{
-    /// <summary>User-initiated premium request cost (with multiplier applied).</summary>
-    [JsonPropertyName("cost")]
-    public double Cost { get; set; }
+    /// <summary>Server is backed by an in-memory runtime implementation.</summary>
+    public static DiscoveredMcpServerType Memory { get; } = new("memory");
 
-    /// <summary>Number of API requests made with this model.</summary>
-    [JsonPropertyName("count")]
-    public long Count { get; set; }
-}
+    /// <summary>Returns a value indicating whether two <see cref="DiscoveredMcpServerType"/> instances are equivalent.</summary>
+    public static bool operator ==(DiscoveredMcpServerType left, DiscoveredMcpServerType right) => left.Equals(right);
 
-/// <summary>Per-model token-detail entry containing the accumulated token count for one token type.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class UsageMetricsModelMetricTokenDetail
-{
-    /// <summary>Accumulated token count for this token type.</summary>
-    [JsonPropertyName("tokenCount")]
-    public long TokenCount { get; set; }
-}
+    /// <summary>Returns a value indicating whether two <see cref="DiscoveredMcpServerType"/> instances are not equivalent.</summary>
+    public static bool operator !=(DiscoveredMcpServerType left, DiscoveredMcpServerType right) => !(left == right);
 
-/// <summary>Token usage metrics for this model.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class UsageMetricsModelMetricUsage
-{
-    /// <summary>Total tokens read from prompt cache.</summary>
-    [JsonPropertyName("cacheReadTokens")]
-    public long CacheReadTokens { get; set; }
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is DiscoveredMcpServerType other && Equals(other);
 
-    /// <summary>Total tokens written to prompt cache.</summary>
-    [JsonPropertyName("cacheWriteTokens")]
-    public long CacheWriteTokens { get; set; }
+    /// <inheritdoc />
+    public bool Equals(DiscoveredMcpServerType other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
-    /// <summary>Total input tokens consumed.</summary>
-    [JsonPropertyName("inputTokens")]
-    public long InputTokens { get; set; }
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
 
-    /// <summary>Total output tokens produced.</summary>
-    [JsonPropertyName("outputTokens")]
-    public long OutputTokens { get; set; }
+    /// <inheritdoc />
+    public override string ToString() => Value;
 
-    /// <summary>Total output tokens used for reasoning.</summary>
-    [JsonPropertyName("reasoningTokens")]
-    public long? ReasoningTokens { get; set; }
+    /// <summary>Provides a <see cref="JsonConverter{DiscoveredMcpServerType}"/> for serializing <see cref="DiscoveredMcpServerType"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<DiscoveredMcpServerType>
+    {
+        /// <inheritdoc />
+        public override DiscoveredMcpServerType Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, DiscoveredMcpServerType value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(DiscoveredMcpServerType));
+        }
+    }
 }
 
-/// <summary>Per-model usage metrics, including request counts/costs, token usage, nano-AI units, and per-token-type details.</summary>
+
+/// <summary>A wire feature a caller can require of the catalog surface, negotiated per request. A grant means the runtime understands the feature's contract, not that the deployment has enabled the operation; typed unavailable results report availability separately.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class UsageMetricsModelMetric
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct CatalogCapability : IEquatable<CatalogCapability>
 {
-    /// <summary>Latest known prompt-cache expiration for this model. A timestamp in the past indicates that the observed cache has expired.</summary>
-    [JsonPropertyName("cacheExpiresAt")]
-    public DateTimeOffset? CacheExpiresAt { get; set; }
+    private readonly string? _value;
 
-    /// <summary>Request count and cost metrics for this model.</summary>
-    [JsonPropertyName("requests")]
-    public UsageMetricsModelMetricRequests Requests { get => field ??= new(); set; }
+    /// <summary>Initializes a new instance of the <see cref="CatalogCapability"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CatalogCapability"/>.</param>
+    [JsonConstructor]
+    public CatalogCapability(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
 
-    /// <summary>Token count details per type.</summary>
-    [JsonPropertyName("tokenDetails")]
-    public IDictionary<string, UsageMetricsModelMetricTokenDetail>? TokenDetails { get; set; }
+    /// <summary>Gets the value associated with this <see cref="CatalogCapability"/>.</summary>
+    public string Value => _value ?? string.Empty;
 
-    /// <summary>Accumulated nano-AI units cost for this model.</summary>
-    [JsonPropertyName("totalNanoAiu")]
-    public double? TotalNanoAiu { get; set; }
+    /// <summary>Understands the current `application/mcp-server-card+json` media type.</summary>
+    public static CatalogCapability McpServerCard { get; } = new("mcp-server-card");
 
-    /// <summary>Token usage metrics for this model.</summary>
-    [JsonPropertyName("usage")]
-    public UsageMetricsModelMetricUsage Usage { get => field ??= new(); set; }
-}
+    /// <summary>Understands the legacy `application/mcp-server+json` media type.</summary>
+    public static CatalogCapability LegacyMcpServerCard { get; } = new("legacy-mcp-server-card");
 
-/// <summary>Usage attributed to one agent instance, including its identity, API duration, AI units, and per-model breakdown.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class UsageMetricsAgentMetric
-{
-    /// <summary>Human-readable label for this subagent invocation, copied from the originating `subagent.started` event. For task-tool subagents this is the invocation's task description rather than the agent's configured display name, so group by `agentName` for stable per-agent labels.</summary>
-    [JsonPropertyName("agentDisplayName")]
-    public string? AgentDisplayName { get; set; }
+    /// <summary>Understands `application/ai-skill` candidates as discovery-only and typed non-installable.</summary>
+    public static CatalogCapability AiSkillDiscovery { get; } = new("ai-skill-discovery");
 
-    /// <summary>Configured agent name, when this is a subagent.</summary>
-    [JsonPropertyName("agentName")]
-    public string? AgentName { get; set; }
+    /// <summary>Understands side-effect-free MCP install-plan requests, results, and plan handles; `planning-unavailable` separately reports that planning is not enabled.</summary>
+    public static CatalogCapability McpInstallPlanning { get; } = new("mcp-install-planning");
 
-    /// <summary>Per-model usage for this agent, keyed by model identifier.</summary>
-    [JsonPropertyName("modelMetrics")]
-    public IDictionary<string, UsageMetricsModelMetric> ModelMetrics { get => field ??= new Dictionary<string, UsageMetricsModelMetric>(); set; }
+    /// <summary>Understands plans that enumerate every eligible transport rather than a single preferred one.</summary>
+    public static CatalogCapability MultipleTransportChoice { get; } = new("multiple-transport-choice");
 
-    /// <summary>Time spent in model API calls by this agent, in milliseconds.</summary>
-    [JsonConverter(typeof(MillisecondsTimeSpanConverter))]
-    [JsonPropertyName("totalApiDurationMs")]
-    public TimeSpan TotalApiDuration { get; set; }
+    /// <summary>Returns a value indicating whether two <see cref="CatalogCapability"/> instances are equivalent.</summary>
+    public static bool operator ==(CatalogCapability left, CatalogCapability right) => left.Equals(right);
 
-    /// <summary>Accumulated nano-AI units cost for this agent.</summary>
-    [JsonPropertyName("totalNanoAiu")]
-    public double TotalNanoAiu { get; set; }
-}
+    /// <summary>Returns a value indicating whether two <see cref="CatalogCapability"/> instances are not equivalent.</summary>
+    public static bool operator !=(CatalogCapability left, CatalogCapability right) => !(left == right);
 
-/// <summary>Aggregated code change metrics.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class UsageMetricsCodeChanges
-{
-    /// <summary>Distinct file paths modified during the session.</summary>
-    [JsonPropertyName("filesModified")]
-    public IList<string> FilesModified { get => field ??= []; set; }
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is CatalogCapability other && Equals(other);
 
-    /// <summary>Number of distinct files modified.</summary>
-    [JsonPropertyName("filesModifiedCount")]
-    public long FilesModifiedCount { get; set; }
+    /// <inheritdoc />
+    public bool Equals(CatalogCapability other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
-    /// <summary>Total lines of code added.</summary>
-    [JsonPropertyName("linesAdded")]
-    public long LinesAdded { get; set; }
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
 
-    /// <summary>Total lines of code removed.</summary>
-    [JsonPropertyName("linesRemoved")]
-    public long LinesRemoved { get; set; }
-}
+    /// <inheritdoc />
+    public override string ToString() => Value;
 
-/// <summary>Session-wide token-detail entry containing the accumulated token count for one token type.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class UsageMetricsTokenDetail
-{
-    /// <summary>Accumulated token count for this token type.</summary>
-    [JsonPropertyName("tokenCount")]
-    public long TokenCount { get; set; }
+    /// <summary>Provides a <see cref="JsonConverter{CatalogCapability}"/> for serializing <see cref="CatalogCapability"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<CatalogCapability>
+    {
+        /// <inheritdoc />
+        public override CatalogCapability Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, CatalogCapability value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CatalogCapability));
+        }
+    }
 }
 
-/// <summary>Accumulated session usage metrics, including premium request cost, token counts, model breakdown, and code-change totals.</summary>
+
+/// <summary>Whether a planned configuration change would create or modify an entry.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class UsageGetMetricsResult
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct McpPlanConfigurationOperation : IEquatable<McpPlanConfigurationOperation>
 {
-    /// <summary>Per-agent usage metrics, keyed by agent instance identifier. The main conversation uses the stable key `main`.</summary>
-    [JsonPropertyName("agentMetrics")]
-    public IDictionary<string, UsageMetricsAgentMetric>? AgentMetrics { get; set; }
+    private readonly string? _value;
 
-    /// <summary>Aggregated code change metrics.</summary>
-    [JsonPropertyName("codeChanges")]
-    public UsageMetricsCodeChanges CodeChanges { get => field ??= new(); set; }
+    /// <summary>Initializes a new instance of the <see cref="McpPlanConfigurationOperation"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="McpPlanConfigurationOperation"/>.</param>
+    [JsonConstructor]
+    public McpPlanConfigurationOperation(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
 
-    /// <summary>Currently active model identifier.</summary>
-    [JsonPropertyName("currentModel")]
-    public string? CurrentModel { get; set; }
+    /// <summary>Gets the value associated with this <see cref="McpPlanConfigurationOperation"/>.</summary>
+    public string Value => _value ?? string.Empty;
 
-    /// <summary>Input tokens from the most recent main-agent API call.</summary>
-    [JsonPropertyName("lastCallInputTokens")]
-    public long LastCallInputTokens { get; set; }
+    /// <summary>Creates a configuration entry that does not exist yet.</summary>
+    public static McpPlanConfigurationOperation Add { get; } = new("add");
 
-    /// <summary>Output tokens from the most recent main-agent API call.</summary>
-    [JsonPropertyName("lastCallOutputTokens")]
-    public long LastCallOutputTokens { get; set; }
+    /// <summary>Modifies a configuration entry that already exists.</summary>
+    public static McpPlanConfigurationOperation Update { get; } = new("update");
 
-    /// <summary>Per-model token and request metrics, keyed by model identifier.</summary>
-    [JsonPropertyName("modelMetrics")]
-    public IDictionary<string, UsageMetricsModelMetric> ModelMetrics { get => field ??= new Dictionary<string, UsageMetricsModelMetric>(); set; }
+    /// <summary>Returns a value indicating whether two <see cref="McpPlanConfigurationOperation"/> instances are equivalent.</summary>
+    public static bool operator ==(McpPlanConfigurationOperation left, McpPlanConfigurationOperation right) => left.Equals(right);
 
-    /// <summary>ISO 8601 timestamp when the session started.</summary>
-    [JsonPropertyName("sessionStartTime")]
-    public DateTimeOffset SessionStartTime { get; set; }
+    /// <summary>Returns a value indicating whether two <see cref="McpPlanConfigurationOperation"/> instances are not equivalent.</summary>
+    public static bool operator !=(McpPlanConfigurationOperation left, McpPlanConfigurationOperation right) => !(left == right);
 
-    /// <summary>Session-wide per-token-type accumulated token counts.</summary>
-    [JsonPropertyName("tokenDetails")]
-    public IDictionary<string, UsageMetricsTokenDetail>? TokenDetails { get; set; }
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is McpPlanConfigurationOperation other && Equals(other);
 
-    /// <summary>Total time spent in model API calls (milliseconds).</summary>
-    [JsonConverter(typeof(MillisecondsTimeSpanConverter))]
-    [JsonPropertyName("totalApiDurationMs")]
-    public TimeSpan TotalApiDuration { get; set; }
+    /// <inheritdoc />
+    public bool Equals(McpPlanConfigurationOperation other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
-    /// <summary>Session-wide accumulated nano-AI units cost.</summary>
-    [JsonPropertyName("totalNanoAiu")]
-    public double? TotalNanoAiu { get; set; }
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
 
-    /// <summary>Total user-initiated premium request cost across all models (may be fractional due to multipliers).</summary>
-    [JsonPropertyName("totalPremiumRequestCost")]
-    public double TotalPremiumRequestCost { get; set; }
+    /// <inheritdoc />
+    public override string ToString() => Value;
 
-    /// <summary>Raw count of user-initiated API requests.</summary>
-    [JsonPropertyName("totalUserRequests")]
-    public long TotalUserRequests { get; set; }
-}
+    /// <summary>Provides a <see cref="JsonConverter{McpPlanConfigurationOperation}"/> for serializing <see cref="McpPlanConfigurationOperation"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<McpPlanConfigurationOperation>
+    {
+        /// <inheritdoc />
+        public override McpPlanConfigurationOperation Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionUsageGetMetricsRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, McpPlanConfigurationOperation value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(McpPlanConfigurationOperation));
+        }
+    }
 }
 
-/// <summary>Prediction result. Available results include prediction details; unavailable results include an explicit reason.</summary>
-/// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
+
+/// <summary>Configuration scope an MCP install plan targets.</summary>
 [Experimental(Diagnostics.Experimental)]
-[JsonPolymorphic(
-    TypeDiscriminatorPropertyName = "kind",
-    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
-[JsonDerivedType(typeof(SessionLimitPredictionResultAvailable), "available")]
-[JsonDerivedType(typeof(SessionLimitPredictionResultUnavailable), "unavailable")]
-public partial class SessionLimitPredictionResult
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct McpPlanScope : IEquatable<McpPlanScope>
 {
-    /// <summary>The type discriminator.</summary>
-    [JsonPropertyName("kind")]
-    public virtual string Kind { get; set; } = string.Empty;
-}
+    private readonly string? _value;
+
+    /// <summary>Initializes a new instance of the <see cref="McpPlanScope"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="McpPlanScope"/>.</param>
+    [JsonConstructor]
+    public McpPlanScope(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
 
+    /// <summary>Gets the value associated with this <see cref="McpPlanScope"/>.</summary>
+    public string Value => _value ?? string.Empty;
 
-/// <summary>Baseline data provenance for a prediction.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionLimitPredictionBaselineData
-{
-    /// <summary>End of the baseline data slice.</summary>
-    [JsonPropertyName("windowEnd")]
-    public string WindowEnd { get; set; } = string.Empty;
+    /// <summary>The user's own MCP configuration.</summary>
+    public static McpPlanScope User { get; } = new("user");
+
+    /// <summary>Returns a value indicating whether two <see cref="McpPlanScope"/> instances are equivalent.</summary>
+    public static bool operator ==(McpPlanScope left, McpPlanScope right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="McpPlanScope"/> instances are not equivalent.</summary>
+    public static bool operator !=(McpPlanScope left, McpPlanScope right) => !(left == right);
+
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is McpPlanScope other && Equals(other);
+
+    /// <inheritdoc />
+    public bool Equals(McpPlanScope other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
+
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{McpPlanScope}"/> for serializing <see cref="McpPlanScope"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<McpPlanScope>
+    {
+        /// <inheritdoc />
+        public override McpPlanScope Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
 
-    /// <summary>Start of the baseline data slice.</summary>
-    [JsonPropertyName("windowStart")]
-    public string WindowStart { get; set; } = string.Empty;
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, McpPlanScope value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(McpPlanScope));
+        }
+    }
 }
 
-/// <summary>Semantic usage tier and its AI-credit cap.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionLimitPredictionTierOption
-{
-    /// <summary>AI-credit cap for this tier.</summary>
-    [JsonPropertyName("cap")]
-    public double Cap { get; set; }
-
-    /// <summary>Semantic usage tier.</summary>
-    [JsonPropertyName("tier")]
-    public SessionLimitPredictionTier Tier { get; set; }
-}
 
-/// <summary>Explainable AI-credit session-limit prediction.</summary>
+/// <summary>What policy decided for a planned server.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionLimitPredictionDetails
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct McpPlanPolicyDecision : IEquatable<McpPlanPolicyDecision>
 {
-    /// <summary>Baseline data provenance.</summary>
-    [JsonPropertyName("baselineData")]
-    public SessionLimitPredictionBaselineData BaselineData { get => field ??= new(); set; }
-
-    /// <summary>Client population used for the prediction.</summary>
-    [JsonPropertyName("clientType")]
-    public SessionLimitPredictionClientType ClientType { get; set; }
+    private readonly string? _value;
 
-    /// <summary>Resolved model family when known.</summary>
-    [JsonPropertyName("family")]
-    public string? Family { get; set; }
+    /// <summary>Initializes a new instance of the <see cref="McpPlanPolicyDecision"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="McpPlanPolicyDecision"/>.</param>
+    [JsonConstructor]
+    public McpPlanPolicyDecision(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
 
-    /// <summary>Model identifier used for lookup.</summary>
-    [JsonPropertyName("modelId")]
-    public string ModelId { get; set; } = string.Empty;
+    /// <summary>Gets the value associated with this <see cref="McpPlanPolicyDecision"/>.</summary>
+    public string Value => _value ?? string.Empty;
 
-    /// <summary>Recommended maximum AI credits for this session.</summary>
-    [JsonPropertyName("recommendedCap")]
-    public double RecommendedCap { get; set; }
+    /// <summary>Policy permits the server.</summary>
+    public static McpPlanPolicyDecision Allowed { get; } = new("allowed");
 
-    /// <summary>Tier chosen as the recommended cap.</summary>
-    [JsonPropertyName("recommendedTier")]
-    public SessionLimitPredictionTier RecommendedTier { get; set; }
+    /// <summary>Policy forbids the server, so the plan cannot be applied.</summary>
+    public static McpPlanPolicyDecision Blocked { get; } = new("blocked");
 
-    /// <summary>Baseline fallback level used to create the prediction.</summary>
-    [JsonPropertyName("source")]
-    public SessionLimitPredictionSource Source { get; set; }
+    /// <summary>Policy permits the server only after an explicit approval.</summary>
+    public static McpPlanPolicyDecision RequiresApproval { get; } = new("requires-approval");
 
-    /// <summary>Key matched at the source level, such as a model id, family id, or `global`.</summary>
-    [JsonPropertyName("sourceKey")]
-    public string SourceKey { get; set; } = string.Empty;
+    /// <summary>Returns a value indicating whether two <see cref="McpPlanPolicyDecision"/> instances are equivalent.</summary>
+    public static bool operator ==(McpPlanPolicyDecision left, McpPlanPolicyDecision right) => left.Equals(right);
 
-    /// <summary>Ordered usage tiers and their AI-credit caps.</summary>
-    [JsonPropertyName("tiers")]
-    public IList<SessionLimitPredictionTierOption> Tiers { get => field ??= []; set; }
-}
+    /// <summary>Returns a value indicating whether two <see cref="McpPlanPolicyDecision"/> instances are not equivalent.</summary>
+    public static bool operator !=(McpPlanPolicyDecision left, McpPlanPolicyDecision right) => !(left == right);
 
-/// <summary>The <c>available</c> variant of <see cref="SessionLimitPredictionResult"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
-public partial class SessionLimitPredictionResultAvailable : SessionLimitPredictionResult
-{
     /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "available";
+    public override bool Equals(object? obj) => obj is McpPlanPolicyDecision other && Equals(other);
 
-    /// <summary>Predicted session limit details.</summary>
-    [JsonPropertyName("prediction")]
-    public required SessionLimitPredictionDetails Prediction { get; set; }
-}
+    /// <inheritdoc />
+    public bool Equals(McpPlanPolicyDecision other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
-/// <summary>The <c>unavailable</c> variant of <see cref="SessionLimitPredictionResult"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
-public partial class SessionLimitPredictionResultUnavailable : SessionLimitPredictionResult
-{
     /// <inheritdoc />
-    [JsonIgnore]
-    public override string Kind => "unavailable";
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
 
-    /// <summary>Reason no prediction is available.</summary>
-    [JsonPropertyName("reason")]
-    public required SessionLimitPredictionUnavailableReason Reason { get; set; }
-}
+    /// <inheritdoc />
+    public override string ToString() => Value;
 
-/// <summary>RPC data type for SessionLimitPredictionPredict operations.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionLimitPredictionPredictRequest
-{
-    /// <summary>Client type to size for. Defaults to `cli-interactive`.</summary>
-    [JsonPropertyName("clientType")]
-    public SessionLimitPredictionClientType? ClientType { get; set; }
+    /// <summary>Provides a <see cref="JsonConverter{McpPlanPolicyDecision}"/> for serializing <see cref="McpPlanPolicyDecision"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<McpPlanPolicyDecision>
+    {
+        /// <inheritdoc />
+        public override McpPlanPolicyDecision Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
 
-    /// <summary>Optional model identifier override. If omitted, the session's current model is used.</summary>
-    [JsonPropertyName("modelId")]
-    public string? ModelId { get; set; }
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, McpPlanPolicyDecision value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(McpPlanPolicyDecision));
+        }
+    }
 }
 
-/// <summary>RPC data type for SessionLimitPredictionPredictRequestWithSession operations.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionLimitPredictionPredictRequestWithSession
-{
-    /// <summary>Client type to size for. Defaults to `cli-interactive`.</summary>
-    [JsonPropertyName("clientType")]
-    public SessionLimitPredictionClientType? ClientType { get; set; }
-
-    /// <summary>Optional model identifier override. If omitted, the session's current model is used.</summary>
-    [JsonPropertyName("modelId")]
-    public string? ModelId { get; set; }
-
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
 
-/// <summary>GitHub URL for the session and a flag indicating whether remote steering is enabled.</summary>
+/// <summary>Which authority produced a policy decision.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class RemoteEnableResult
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct McpPlanPolicySource : IEquatable<McpPlanPolicySource>
 {
-    /// <summary>Whether remote steering is enabled.</summary>
-    [JsonPropertyName("remoteSteerable")]
-    public bool RemoteSteerable { get; set; }
+    private readonly string? _value;
 
-    /// <summary>GitHub frontend URL for this session.</summary>
-    [Url]
-    [StringSyntax(StringSyntaxAttribute.Uri)]
-    [JsonPropertyName("url")]
-    public string? Url { get; set; }
-}
+    /// <summary>Initializes a new instance of the <see cref="McpPlanPolicySource"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="McpPlanPolicySource"/>.</param>
+    [JsonConstructor]
+    public McpPlanPolicySource(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
 
-/// <summary>Optional remote session mode ("off", "export", or "on"); defaults to enabling both export and remote steering.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class RemoteEnableRequest
-{
-    /// <summary>Per-session remote mode. "off" disables remote, "export" exports session events to GitHub without enabling remote steering, "on" enables both export and remote steering.</summary>
-    [JsonPropertyName("mode")]
-    public RemoteSessionMode? Mode { get; set; }
+    /// <summary>Gets the value associated with this <see cref="McpPlanPolicySource"/>.</summary>
+    public string Value => _value ?? string.Empty;
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>No policy applied, so the server is permitted by default.</summary>
+    public static McpPlanPolicySource None { get; } = new("none");
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionRemoteDisableRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>An enterprise allowlist evaluated the server.</summary>
+    public static McpPlanPolicySource EnterpriseAllowlist { get; } = new("enterprise-allowlist");
 
-/// <summary>Persist a steerability change as a `session.remote_steerable_changed` event. Used by the host (CLI / SDK consumer) when it has just finished enabling or disabling steering on a remote exporter that the runtime does not directly own.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class RemoteNotifySteerableChangedResult
-{
-}
+    /// <summary>The registry the card came from evaluated the server.</summary>
+    public static McpPlanPolicySource RegistryPolicy { get; } = new("registry-policy");
 
-/// <summary>New remote-steerability state to persist as a `session.remote_steerable_changed` event.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class RemoteNotifySteerableChangedRequest
-{
-    /// <summary>Whether the session now supports remote steering via GitHub. The runtime persists this as a `session.remote_steerable_changed` event so resume/replay sees the up-to-date capability.</summary>
-    [JsonPropertyName("remoteSteerable")]
-    public bool RemoteSteerable { get; set; }
+    /// <summary>Local trust settings evaluated the server.</summary>
+    public static McpPlanPolicySource LocalTrust { get; } = new("local-trust");
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Returns a value indicating whether two <see cref="McpPlanPolicySource"/> instances are equivalent.</summary>
+    public static bool operator ==(McpPlanPolicySource left, McpPlanPolicySource right) => left.Equals(right);
 
-/// <summary>Current sharing status and shareable GitHub URL for a session.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class VisibilityGetResult
-{
-    /// <summary>Shareable GitHub URL for the session. Present when the session is synced and the URL can be resolved.</summary>
-    [Url]
-    [StringSyntax(StringSyntaxAttribute.Uri)]
-    [JsonPropertyName("shareUrl")]
-    public string? ShareUrl { get; set; }
+    /// <summary>Returns a value indicating whether two <see cref="McpPlanPolicySource"/> instances are not equivalent.</summary>
+    public static bool operator !=(McpPlanPolicySource left, McpPlanPolicySource right) => !(left == right);
 
-    /// <summary>Current sharing status. Absent when the session is not synced or the status could not be retrieved (e.g. the user is not authenticated).</summary>
-    [JsonPropertyName("status")]
-    public SessionVisibilityStatus? Status { get; set; }
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is McpPlanPolicySource other && Equals(other);
 
-    /// <summary>Whether the session has been synced to Mission Control (i.e. has a GitHub task). When false, the session cannot be shared and `status`/`shareUrl` are absent.</summary>
-    [JsonPropertyName("synced")]
-    public bool Synced { get; set; }
-}
+    /// <inheritdoc />
+    public bool Equals(McpPlanPolicySource other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionVisibilityGetRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
 
-/// <summary>Effective sharing status and shareable GitHub URL after updating session visibility.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class VisibilitySetResult
-{
-    /// <summary>Shareable GitHub URL for the session. Present when the session is synced and the URL can be resolved.</summary>
-    [Url]
-    [StringSyntax(StringSyntaxAttribute.Uri)]
-    [JsonPropertyName("shareUrl")]
-    public string? ShareUrl { get; set; }
+    /// <inheritdoc />
+    public override string ToString() => Value;
 
-    /// <summary>Effective sharing status after the update. May differ from the requested status for task types that are already visible to repository readers by default. Absent when the update could not be applied (e.g. the session is not synced or the user is not authenticated).</summary>
-    [JsonPropertyName("status")]
-    public SessionVisibilityStatus? Status { get; set; }
+    /// <summary>Provides a <see cref="JsonConverter{McpPlanPolicySource}"/> for serializing <see cref="McpPlanPolicySource"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<McpPlanPolicySource>
+    {
+        /// <inheritdoc />
+        public override McpPlanPolicySource Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
 
-    /// <summary>Whether the session has been synced to Mission Control (i.e. has a GitHub task). When false, the visibility change could not be applied and `status`/`shareUrl` are absent.</summary>
-    [JsonPropertyName("synced")]
-    public bool Synced { get; set; }
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, McpPlanPolicySource value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(McpPlanPolicySource));
+        }
+    }
 }
 
-/// <summary>Desired sharing status for the session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class VisibilitySetRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-
-    /// <summary>Sharing status to apply. "repo" makes the session visible to repository readers; "unshared" restricts it to the creator and collaborators.</summary>
-    [JsonPropertyName("status")]
-    public SessionVisibilityStatus Status { get; set; }
-}
 
-/// <summary>Scheduled prompt entry with ID, timing (`intervalMs`, `cron`, or `at`), prompt text, recurrence, and next run time.</summary>
+/// <summary>Canonical digest algorithm for a validated MCP card.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ScheduleEntry
-{
-    /// <summary>Absolute fire time (epoch milliseconds) for a one-shot calendar schedule.</summary>
-    [JsonPropertyName("at")]
-    public long? At { get; set; }
-
-    /// <summary>5-field cron expression for a recurring calendar schedule, evaluated in `tz`.</summary>
-    [JsonPropertyName("cron")]
-    public string? Cron { get; set; }
-
-    /// <summary>Display-only label for the prompt as shown in the UI (e.g. `/skill-name` for a skill-invocation schedule). The actual enqueued prompt is `prompt`.</summary>
-    [JsonPropertyName("displayPrompt")]
-    public string? DisplayPrompt { get; set; }
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct CardDigestAlgorithm : IEquatable<CardDigestAlgorithm>
+{
+    private readonly string? _value;
 
-    /// <summary>Sequential id assigned by the runtime within the session. Stable across resumes (rebuilt from the event log).</summary>
-    [JsonPropertyName("id")]
-    public long Id { get; set; }
+    /// <summary>Initializes a new instance of the <see cref="CardDigestAlgorithm"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CardDigestAlgorithm"/>.</param>
+    [JsonConstructor]
+    public CardDigestAlgorithm(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
 
-    /// <summary>Interval between scheduled ticks, in milliseconds (relative-interval schedules).</summary>
-    [JsonConverter(typeof(MillisecondsTimeSpanConverter))]
-    [JsonPropertyName("intervalMs")]
-    public TimeSpan? Interval { get; set; }
+    /// <summary>Gets the value associated with this <see cref="CardDigestAlgorithm"/>.</summary>
+    public string Value => _value ?? string.Empty;
 
-    /// <summary>ISO 8601 timestamp when the next tick is scheduled to fire.</summary>
-    [JsonPropertyName("nextRunAt")]
-    public DateTimeOffset NextRunAt { get; set; }
+    /// <summary>SHA-256 over RFC 8785 canonical JSON encoded as UTF-8.</summary>
+    public static CardDigestAlgorithm Sha256Rfc8785 { get; } = new("sha256-rfc8785");
 
-    /// <summary>Prompt text that gets enqueued on every tick.</summary>
-    [JsonPropertyName("prompt")]
-    public string Prompt { get; set; } = string.Empty;
+    /// <summary>Returns a value indicating whether two <see cref="CardDigestAlgorithm"/> instances are equivalent.</summary>
+    public static bool operator ==(CardDigestAlgorithm left, CardDigestAlgorithm right) => left.Equals(right);
 
-    /// <summary>Whether the schedule re-arms after each tick (`/every`) or fires once (`/after`).</summary>
-    [JsonPropertyName("recurring")]
-    public bool Recurring { get; set; }
+    /// <summary>Returns a value indicating whether two <see cref="CardDigestAlgorithm"/> instances are not equivalent.</summary>
+    public static bool operator !=(CardDigestAlgorithm left, CardDigestAlgorithm right) => !(left == right);
 
-    /// <summary>True for a self-paced (`dynamic`) schedule: no fixed cadence; the model arms each next run via the `manage_schedule` `wakeup` action. `nextRunAt` is model-controlled.</summary>
-    [JsonPropertyName("selfPaced")]
-    public bool? SelfPaced { get; set; }
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is CardDigestAlgorithm other && Equals(other);
 
-    /// <summary>IANA timezone the `cron` expression is evaluated in.</summary>
-    [JsonPropertyName("tz")]
-    public string? Tz { get; set; }
-}
+    /// <inheritdoc />
+    public bool Equals(CardDigestAlgorithm other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
-/// <summary>Snapshot of the currently active recurring prompts for this session.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class ScheduleList
-{
-    /// <summary>Active scheduled prompts, ordered by id.</summary>
-    [JsonPropertyName("entries")]
-    public IList<ScheduleEntry> Entries { get => field ??= []; set; }
-}
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionScheduleListRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <inheritdoc />
+    public override string ToString() => Value;
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionScheduleHydrateRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Provides a <see cref="JsonConverter{CardDigestAlgorithm}"/> for serializing <see cref="CardDigestAlgorithm"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<CardDigestAlgorithm>
+    {
+        /// <inheritdoc />
+        public override CardDigestAlgorithm Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
 
-/// <summary>Whether the session currently has an active self-paced schedule.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class ScheduleHasSelfPacedResult
-{
-    /// <summary>True when at least one active schedule is self-paced.</summary>
-    [JsonPropertyName("hasSelfPaced")]
-    public bool HasSelfPaced { get; set; }
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, CardDigestAlgorithm value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CardDigestAlgorithm));
+        }
+    }
 }
 
-/// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class SessionScheduleHasSelfPacedRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
 
-/// <summary>Result of registering or re-arming a scheduled prompt.</summary>
+/// <summary>JSON MCP card media type accepted for install planning.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class ScheduleAddResult
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct McpServerCardMediaType : IEquatable<McpServerCardMediaType>
 {
-    /// <summary>The registered or updated schedule entry.</summary>
-    [JsonPropertyName("entry")]
-    public ScheduleEntry? Entry { get; set; }
+    private readonly string? _value;
 
-    /// <summary>User-facing validation error, when registration failed.</summary>
-    [JsonPropertyName("error")]
-    public string? Error { get; set; }
-}
+    /// <summary>Initializes a new instance of the <see cref="McpServerCardMediaType"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="McpServerCardMediaType"/>.</param>
+    [JsonConstructor]
+    public McpServerCardMediaType(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
 
-/// <summary>Register a relative-interval scheduled prompt.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class ScheduleAddRequest
-{
-    /// <summary>Optional display-only prompt label.</summary>
-    [JsonPropertyName("displayPrompt")]
-    public string? DisplayPrompt { get; set; }
+    /// <summary>Gets the value associated with this <see cref="McpServerCardMediaType"/>.</summary>
+    public string Value => _value ?? string.Empty;
 
-    /// <summary>Human-readable interval such as `30s`, `5m`, or `2h`.</summary>
-    [JsonPropertyName("interval")]
-    public string Interval { get; set; } = string.Empty;
+    /// <summary>The current MCP server card media type.</summary>
+    public static McpServerCardMediaType ApplicationMcpServerCardJson { get; } = new("application/mcp-server-card+json");
 
-    /// <summary>Prompt text to enqueue when the schedule fires.</summary>
-    [JsonPropertyName("prompt")]
-    public string Prompt { get; set; } = string.Empty;
+    /// <summary>The legacy MCP server card media type, accepted for compatibility.</summary>
+    public static McpServerCardMediaType ApplicationMcpServerJson { get; } = new("application/mcp-server+json");
 
-    /// <summary>Whether the schedule should re-arm after each tick. Defaults to true.</summary>
-    [JsonPropertyName("recurring")]
-    public bool? Recurring { get; set; }
+    /// <summary>Returns a value indicating whether two <see cref="McpServerCardMediaType"/> instances are equivalent.</summary>
+    public static bool operator ==(McpServerCardMediaType left, McpServerCardMediaType right) => left.Equals(right);
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Returns a value indicating whether two <see cref="McpServerCardMediaType"/> instances are not equivalent.</summary>
+    public static bool operator !=(McpServerCardMediaType left, McpServerCardMediaType right) => !(left == right);
 
-/// <summary>Register a cron scheduled prompt.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class ScheduleAddCronRequest
-{
-    /// <summary>5-field cron expression.</summary>
-    [JsonPropertyName("cron")]
-    public string Cron { get; set; } = string.Empty;
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is McpServerCardMediaType other && Equals(other);
 
-    /// <summary>Optional display-only prompt label.</summary>
-    [JsonPropertyName("displayPrompt")]
-    public string? DisplayPrompt { get; set; }
+    /// <inheritdoc />
+    public bool Equals(McpServerCardMediaType other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
-    /// <summary>Prompt text to enqueue when the schedule fires.</summary>
-    [JsonPropertyName("prompt")]
-    public string Prompt { get; set; } = string.Empty;
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
 
-    /// <summary>Whether the schedule should re-arm after each tick. Defaults to true.</summary>
-    [JsonPropertyName("recurring")]
-    public bool? Recurring { get; set; }
+    /// <inheritdoc />
+    public override string ToString() => Value;
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Provides a <see cref="JsonConverter{McpServerCardMediaType}"/> for serializing <see cref="McpServerCardMediaType"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<McpServerCardMediaType>
+    {
+        /// <inheritdoc />
+        public override McpServerCardMediaType Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
 
-    /// <summary>IANA timezone for evaluating the cron expression.</summary>
-    [JsonPropertyName("tz")]
-    public string? Tz { get; set; }
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, McpServerCardMediaType value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(McpServerCardMediaType));
+        }
+    }
 }
 
-/// <summary>Register an absolute-time scheduled prompt.</summary>
+
+/// <summary>Where a required value is applied when the planned server is launched.</summary>
 [Experimental(Diagnostics.Experimental)]
-internal sealed class ScheduleAddAtRequest
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct McpPlanValueCategory : IEquatable<McpPlanValueCategory>
 {
-    /// <summary>Epoch milliseconds when the prompt should fire.</summary>
-    [JsonPropertyName("at")]
-    public long At { get; set; }
+    private readonly string? _value;
 
-    /// <summary>Optional display-only prompt label.</summary>
-    [JsonPropertyName("displayPrompt")]
-    public string? DisplayPrompt { get; set; }
+    /// <summary>Initializes a new instance of the <see cref="McpPlanValueCategory"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="McpPlanValueCategory"/>.</param>
+    [JsonConstructor]
+    public McpPlanValueCategory(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
 
-    /// <summary>Prompt text to enqueue when the schedule fires.</summary>
-    [JsonPropertyName("prompt")]
-    public string Prompt { get; set; } = string.Empty;
+    /// <summary>Gets the value associated with this <see cref="McpPlanValueCategory"/>.</summary>
+    public string Value => _value ?? string.Empty;
 
-    /// <summary>Whether the schedule should re-arm after each tick. Defaults to false.</summary>
-    [JsonPropertyName("recurring")]
-    public bool? Recurring { get; set; }
+    /// <summary>Set as an environment variable on the launched process.</summary>
+    public static McpPlanValueCategory EnvironmentVariable { get; } = new("environment-variable");
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Passed to the runtime that launches the package.</summary>
+    public static McpPlanValueCategory RuntimeArgument { get; } = new("runtime-argument");
 
-/// <summary>Register a self-paced scheduled prompt.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class ScheduleAddSelfPacedRequest
-{
-    /// <summary>Optional display-only prompt label.</summary>
-    [JsonPropertyName("displayPrompt")]
-    public string? DisplayPrompt { get; set; }
+    /// <summary>Passed to the packaged server itself.</summary>
+    public static McpPlanValueCategory PackageArgument { get; } = new("package-argument");
 
-    /// <summary>Prompt text to enqueue when the schedule fires.</summary>
-    [JsonPropertyName("prompt")]
-    public string Prompt { get; set; } = string.Empty;
+    /// <summary>Sent as a request header to a remote endpoint.</summary>
+    public static McpPlanValueCategory Header { get; } = new("header");
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Substituted into the remote endpoint URL.</summary>
+    public static McpPlanValueCategory UrlVariable { get; } = new("url-variable");
 
-/// <summary>Re-arm a self-paced scheduled prompt.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class ScheduleRearmSelfPacedRequest
-{
-    /// <summary>Epoch milliseconds when the prompt should next fire.</summary>
-    [JsonPropertyName("at")]
-    public long At { get; set; }
+    /// <summary>Returns a value indicating whether two <see cref="McpPlanValueCategory"/> instances are equivalent.</summary>
+    public static bool operator ==(McpPlanValueCategory left, McpPlanValueCategory right) => left.Equals(right);
 
-    /// <summary>Id of the self-paced scheduled prompt.</summary>
-    [JsonPropertyName("id")]
-    public long Id { get; set; }
+    /// <summary>Returns a value indicating whether two <see cref="McpPlanValueCategory"/> instances are not equivalent.</summary>
+    public static bool operator !=(McpPlanValueCategory left, McpPlanValueCategory right) => !(left == right);
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is McpPlanValueCategory other && Equals(other);
 
-/// <summary>Remove a scheduled prompt by id. The result entry is omitted if the id was unknown.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class ScheduleStopResult
-{
-    /// <summary>The removed entry, or omitted if no entry matched.</summary>
-    [JsonPropertyName("entry")]
-    public ScheduleEntry? Entry { get; set; }
-}
+    /// <inheritdoc />
+    public bool Equals(McpPlanValueCategory other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
-/// <summary>Identifier of the scheduled prompt to remove.</summary>
-[Experimental(Diagnostics.Experimental)]
-internal sealed class ScheduleStopRequest
-{
-    /// <summary>Id of the scheduled prompt to remove.</summary>
-    [JsonPropertyName("id")]
-    public long Id { get; set; }
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <inheritdoc />
+    public override string ToString() => Value;
 
-/// <summary>A bearer token supplied by the SDK client for a BYOK provider. The runtime sets it as `Authorization: Bearer &lt;token&gt;` on the outbound request and does no caching; the SDK consumer owns token caching and refresh.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class ProviderTokenAcquireResult
-{
-    /// <summary>The bearer token value (without the `Bearer ` prefix).</summary>
-    [JsonPropertyName("token")]
-    public string Token { get; set; } = string.Empty;
+    /// <summary>Provides a <see cref="JsonConverter{McpPlanValueCategory}"/> for serializing <see cref="McpPlanValueCategory"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<McpPlanValueCategory>
+    {
+        /// <inheritdoc />
+        public override McpPlanValueCategory Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, McpPlanValueCategory value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(McpPlanValueCategory));
+        }
+    }
 }
 
-/// <summary>Asks the SDK client to acquire a bearer token for a BYOK provider whose config set `hasBearerTokenProvider: true`. Issued by the runtime before each outbound model request; the runtime does no caching, so this is sent once per request.</summary>
+
+/// <summary>Scalar type a required value must conform to.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ProviderTokenAcquireRequest
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct McpPlanScalarValueType : IEquatable<McpPlanScalarValueType>
 {
-    /// <summary>Name of the BYOK provider needing a token. For the legacy whole-session provider this is the implicit provider name; for named providers it is the configured provider name.</summary>
-    [JsonPropertyName("providerName")]
-    public string ProviderName { get; set; } = string.Empty;
+    private readonly string? _value;
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Initializes a new instance of the <see cref="McpPlanScalarValueType"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="McpPlanScalarValueType"/>.</param>
+    [JsonConstructor]
+    public McpPlanScalarValueType(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
 
-/// <summary>Result returned by an extension factory closure.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class FactoryExecuteResult
-{
-    /// <summary>Factory result value.</summary>
-    [JsonPropertyName("result")]
-    public JsonElement? Result { get; set; }
-}
+    /// <summary>Gets the value associated with this <see cref="McpPlanScalarValueType"/>.</summary>
+    public string Value => _value ?? string.Empty;
 
-/// <summary>Parameters sent to the owning extension to execute a factory closure.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class FactoryExecuteRequest
-{
-    /// <summary>Factory input value.</summary>
-    [JsonPropertyName("args")]
-    public JsonElement Args { get; set; }
+    /// <summary>Free text.</summary>
+    public static McpPlanScalarValueType String { get; } = new("string");
 
-    /// <summary>Opaque token identifying this factory execution attempt.</summary>
-    [JsonPropertyName("executionToken")]
-    public string ExecutionToken { get; set; } = string.Empty;
+    /// <summary>A number.</summary>
+    public static McpPlanScalarValueType Number { get; } = new("number");
 
-    /// <summary>Registered factory name.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>A boolean.</summary>
+    public static McpPlanScalarValueType Boolean { get; } = new("boolean");
 
-    /// <summary>Factory run identifier.</summary>
-    [JsonPropertyName("runId")]
-    public string RunId { get; set; } = string.Empty;
+    /// <summary>A filesystem path.</summary>
+    public static McpPlanScalarValueType Path { get; } = new("path");
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Returns a value indicating whether two <see cref="McpPlanScalarValueType"/> instances are equivalent.</summary>
+    public static bool operator ==(McpPlanScalarValueType left, McpPlanScalarValueType right) => left.Equals(right);
 
-/// <summary>Parameters for cooperatively aborting a factory body.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class FactoryAbortRequest
-{
-    /// <summary>Factory run identifier.</summary>
-    [JsonPropertyName("runId")]
-    public string RunId { get; set; } = string.Empty;
+    /// <summary>Returns a value indicating whether two <see cref="McpPlanScalarValueType"/> instances are not equivalent.</summary>
+    public static bool operator !=(McpPlanScalarValueType left, McpPlanScalarValueType right) => !(left == right);
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is McpPlanScalarValueType other && Equals(other);
 
-/// <summary>Describes a filesystem error.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsError
-{
-    /// <summary>Error classification.</summary>
-    [JsonPropertyName("code")]
-    public SessionFsErrorCode Code { get; set; }
+    /// <inheritdoc />
+    public bool Equals(McpPlanScalarValueType other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
-    /// <summary>Free-form detail about the error, for logging/diagnostics.</summary>
-    [JsonPropertyName("message")]
-    public string? Message { get; set; }
-}
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
 
-/// <summary>File content as a UTF-8 string, or a filesystem error if the read failed.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsReadFileResult
-{
-    /// <summary>File content as UTF-8 string.</summary>
-    [JsonPropertyName("content")]
-    public string Content { get; set; } = string.Empty;
+    /// <inheritdoc />
+    public override string ToString() => Value;
 
-    /// <summary>Describes a filesystem error.</summary>
-    [JsonPropertyName("error")]
-    public SessionFsError? Error { get; set; }
+    /// <summary>Provides a <see cref="JsonConverter{McpPlanScalarValueType}"/> for serializing <see cref="McpPlanScalarValueType"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<McpPlanScalarValueType>
+    {
+        /// <inheritdoc />
+        public override McpPlanScalarValueType Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, McpPlanScalarValueType value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(McpPlanScalarValueType));
+        }
+    }
 }
 
-/// <summary>Path of the file to read from the client-provided session filesystem.</summary>
+
+/// <summary>Discriminator for an enumerated required value.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsReadFileRequest
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct McpPlanEnumValueType : IEquatable<McpPlanEnumValueType>
 {
-    /// <summary>Path using SessionFs conventions.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+    private readonly string? _value;
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Initializes a new instance of the <see cref="McpPlanEnumValueType"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="McpPlanEnumValueType"/>.</param>
+    [JsonConstructor]
+    public McpPlanEnumValueType(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
 
-/// <summary>File path, content to write, and optional mode for the client-provided session filesystem.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsWriteFileRequest
-{
-    /// <summary>Content to write.</summary>
-    [JsonPropertyName("content")]
-    public string Content { get; set; } = string.Empty;
+    /// <summary>Gets the value associated with this <see cref="McpPlanEnumValueType"/>.</summary>
+    public string Value => _value ?? string.Empty;
 
-    /// <summary>Optional POSIX-style mode for newly created files.</summary>
-    [JsonPropertyName("mode")]
-    public long? Mode { get; set; }
+    /// <summary>One of a fixed, non-empty set of permitted values.</summary>
+    public static McpPlanEnumValueType Enum { get; } = new("enum");
 
-    /// <summary>Path using SessionFs conventions.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+    /// <summary>Returns a value indicating whether two <see cref="McpPlanEnumValueType"/> instances are equivalent.</summary>
+    public static bool operator ==(McpPlanEnumValueType left, McpPlanEnumValueType right) => left.Equals(right);
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Returns a value indicating whether two <see cref="McpPlanEnumValueType"/> instances are not equivalent.</summary>
+    public static bool operator !=(McpPlanEnumValueType left, McpPlanEnumValueType right) => !(left == right);
 
-/// <summary>File path, content to append, and optional mode for the client-provided session filesystem.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsAppendFileRequest
-{
-    /// <summary>Content to append.</summary>
-    [JsonPropertyName("content")]
-    public string Content { get; set; } = string.Empty;
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is McpPlanEnumValueType other && Equals(other);
 
-    /// <summary>Optional POSIX-style mode for newly created files.</summary>
-    [JsonPropertyName("mode")]
-    public long? Mode { get; set; }
+    /// <inheritdoc />
+    public bool Equals(McpPlanEnumValueType other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
-    /// <summary>Path using SessionFs conventions.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <inheritdoc />
+    public override string ToString() => Value;
 
-/// <summary>Indicates whether the requested path exists in the client-provided session filesystem.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsExistsResult
-{
-    /// <summary>Whether the path exists.</summary>
-    [JsonPropertyName("exists")]
-    public bool Exists { get; set; }
+    /// <summary>Provides a <see cref="JsonConverter{McpPlanEnumValueType}"/> for serializing <see cref="McpPlanEnumValueType"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<McpPlanEnumValueType>
+    {
+        /// <inheritdoc />
+        public override McpPlanEnumValueType Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, McpPlanEnumValueType value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(McpPlanEnumValueType));
+        }
+    }
 }
 
-/// <summary>Path to test for existence in the client-provided session filesystem.</summary>
+
+/// <summary>Transport exposed by a locally launched package.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsExistsRequest
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct McpPlanPackageTransport : IEquatable<McpPlanPackageTransport>
 {
-    /// <summary>Path using SessionFs conventions.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+    private readonly string? _value;
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Initializes a new instance of the <see cref="McpPlanPackageTransport"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="McpPlanPackageTransport"/>.</param>
+    [JsonConstructor]
+    public McpPlanPackageTransport(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
 
-/// <summary>Filesystem metadata for the requested path, or a filesystem error if the stat failed.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsStatResult
-{
-    /// <summary>ISO 8601 timestamp of creation.</summary>
-    [JsonPropertyName("birthtime")]
-    public DateTimeOffset Birthtime { get; set; }
+    /// <summary>Gets the value associated with this <see cref="McpPlanPackageTransport"/>.</summary>
+    public string Value => _value ?? string.Empty;
 
-    /// <summary>Describes a filesystem error.</summary>
-    [JsonPropertyName("error")]
-    public SessionFsError? Error { get; set; }
+    /// <summary>A locally launched process spoken to over standard input and output.</summary>
+    public static McpPlanPackageTransport Stdio { get; } = new("stdio");
 
-    /// <summary>Whether the path is a directory.</summary>
-    [JsonPropertyName("isDirectory")]
-    public bool IsDirectory { get; set; }
+    /// <summary>Returns a value indicating whether two <see cref="McpPlanPackageTransport"/> instances are equivalent.</summary>
+    public static bool operator ==(McpPlanPackageTransport left, McpPlanPackageTransport right) => left.Equals(right);
 
-    /// <summary>Whether the path is a file.</summary>
-    [JsonPropertyName("isFile")]
-    public bool IsFile { get; set; }
+    /// <summary>Returns a value indicating whether two <see cref="McpPlanPackageTransport"/> instances are not equivalent.</summary>
+    public static bool operator !=(McpPlanPackageTransport left, McpPlanPackageTransport right) => !(left == right);
 
-    /// <summary>ISO 8601 timestamp of last modification.</summary>
-    [JsonPropertyName("mtime")]
-    public DateTimeOffset Mtime { get; set; }
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is McpPlanPackageTransport other && Equals(other);
 
-    /// <summary>File size in bytes.</summary>
-    [JsonPropertyName("size")]
-    public long Size { get; set; }
+    /// <inheritdoc />
+    public bool Equals(McpPlanPackageTransport other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
+
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{McpPlanPackageTransport}"/> for serializing <see cref="McpPlanPackageTransport"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<McpPlanPackageTransport>
+    {
+        /// <inheritdoc />
+        public override McpPlanPackageTransport Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, McpPlanPackageTransport value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(McpPlanPackageTransport));
+        }
+    }
 }
 
-/// <summary>Path whose metadata should be returned from the client-provided session filesystem.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsStatRequest
-{
-    /// <summary>Path using SessionFs conventions.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+/// <summary>Transport exposed by a remote endpoint.</summary>
+[Experimental(Diagnostics.Experimental)]
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct McpPlanRemoteTransport : IEquatable<McpPlanRemoteTransport>
+{
+    private readonly string? _value;
+
+    /// <summary>Initializes a new instance of the <see cref="McpPlanRemoteTransport"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="McpPlanRemoteTransport"/>.</param>
+    [JsonConstructor]
+    public McpPlanRemoteTransport(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="McpPlanRemoteTransport"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>An HTTP endpoint.</summary>
+    public static McpPlanRemoteTransport Http { get; } = new("http");
+
+    /// <summary>A streamable HTTP endpoint.</summary>
+    public static McpPlanRemoteTransport StreamableHttp { get; } = new("streamable-http");
+
+    /// <summary>A server-sent events endpoint.</summary>
+    public static McpPlanRemoteTransport Sse { get; } = new("sse");
 
-/// <summary>Directory path to create in the client-provided session filesystem, with options for recursive creation and POSIX mode.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsMkdirRequest
-{
-    /// <summary>Optional POSIX-style mode for newly created directories.</summary>
-    [JsonPropertyName("mode")]
-    public long? Mode { get; set; }
+    /// <summary>Returns a value indicating whether two <see cref="McpPlanRemoteTransport"/> instances are equivalent.</summary>
+    public static bool operator ==(McpPlanRemoteTransport left, McpPlanRemoteTransport right) => left.Equals(right);
 
-    /// <summary>Path using SessionFs conventions.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+    /// <summary>Returns a value indicating whether two <see cref="McpPlanRemoteTransport"/> instances are not equivalent.</summary>
+    public static bool operator !=(McpPlanRemoteTransport left, McpPlanRemoteTransport right) => !(left == right);
 
-    /// <summary>Create parent directories as needed.</summary>
-    [JsonPropertyName("recursive")]
-    public bool? Recursive { get; set; }
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is McpPlanRemoteTransport other && Equals(other);
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <inheritdoc />
+    public bool Equals(McpPlanRemoteTransport other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
-/// <summary>Names of entries in the requested directory, or a filesystem error if the read failed.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsReaddirResult
-{
-    /// <summary>Entry names in the directory.</summary>
-    [JsonPropertyName("entries")]
-    public IList<string> Entries { get => field ??= []; set; }
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
 
-    /// <summary>Describes a filesystem error.</summary>
-    [JsonPropertyName("error")]
-    public SessionFsError? Error { get; set; }
-}
+    /// <inheritdoc />
+    public override string ToString() => Value;
 
-/// <summary>Directory path whose entries should be listed from the client-provided session filesystem.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsReaddirRequest
-{
-    /// <summary>Path using SessionFs conventions.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+    /// <summary>Provides a <see cref="JsonConverter{McpPlanRemoteTransport}"/> for serializing <see cref="McpPlanRemoteTransport"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<McpPlanRemoteTransport>
+    {
+        /// <inheritdoc />
+        public override McpPlanRemoteTransport Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, McpPlanRemoteTransport value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(McpPlanRemoteTransport));
+        }
+    }
 }
 
-/// <summary>Directory entry returned by session filesystem `readdirWithTypes`, with name and entry type.</summary>
+
+/// <summary>Why capability and protocol-version negotiation refused a caller.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsReaddirWithTypesEntry
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct CatalogNegotiationRefusedReason : IEquatable<CatalogNegotiationRefusedReason>
 {
-    /// <summary>Entry name.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    private readonly string? _value;
 
-    /// <summary>Entry type.</summary>
-    [JsonPropertyName("type")]
-    public SessionFsReaddirWithTypesEntryType Type { get; set; }
-}
+    /// <summary>Initializes a new instance of the <see cref="CatalogNegotiationRefusedReason"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CatalogNegotiationRefusedReason"/>.</param>
+    [JsonConstructor]
+    public CatalogNegotiationRefusedReason(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
 
-/// <summary>Entries in the requested directory paired with file/directory type information, or a filesystem error if the read failed.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsReaddirWithTypesResult
-{
-    /// <summary>Directory entries with type information.</summary>
-    [JsonPropertyName("entries")]
-    public IList<SessionFsReaddirWithTypesEntry> Entries { get => field ??= []; set; }
+    /// <summary>Gets the value associated with this <see cref="CatalogNegotiationRefusedReason"/>.</summary>
+    public string Value => _value ?? string.Empty;
 
-    /// <summary>Describes a filesystem error.</summary>
-    [JsonPropertyName("error")]
-    public SessionFsError? Error { get; set; }
-}
+    /// <summary>The caller's protocol version is below the lowest this runtime serves.</summary>
+    public static CatalogNegotiationRefusedReason UnsupportedProtocolVersion { get; } = new("unsupported-protocol-version");
 
-/// <summary>Directory path whose entries (with type information) should be listed from the client-provided session filesystem.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsReaddirWithTypesRequest
-{
-    /// <summary>Path using SessionFs conventions.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+    /// <summary>The caller requires at least one capability this runtime cannot honour.</summary>
+    public static CatalogNegotiationRefusedReason UnsupportedCapability { get; } = new("unsupported-capability");
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Returns a value indicating whether two <see cref="CatalogNegotiationRefusedReason"/> instances are equivalent.</summary>
+    public static bool operator ==(CatalogNegotiationRefusedReason left, CatalogNegotiationRefusedReason right) => left.Equals(right);
 
-/// <summary>Path to remove from the client-provided session filesystem, with options for recursive removal and force.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsRmRequest
-{
-    /// <summary>Ignore errors if the path does not exist.</summary>
-    [JsonPropertyName("force")]
-    public bool? Force { get; set; }
+    /// <summary>Returns a value indicating whether two <see cref="CatalogNegotiationRefusedReason"/> instances are not equivalent.</summary>
+    public static bool operator !=(CatalogNegotiationRefusedReason left, CatalogNegotiationRefusedReason right) => !(left == right);
 
-    /// <summary>Path using SessionFs conventions.</summary>
-    [JsonPropertyName("path")]
-    public string Path { get; set; } = string.Empty;
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is CatalogNegotiationRefusedReason other && Equals(other);
 
-    /// <summary>Remove directories and their contents recursively.</summary>
-    [JsonPropertyName("recursive")]
-    public bool? Recursive { get; set; }
+    /// <inheritdoc />
+    public bool Equals(CatalogNegotiationRefusedReason other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
 
-/// <summary>Source and destination paths for renaming or moving an entry in the client-provided session filesystem.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsRenameRequest
-{
-    /// <summary>Destination path using SessionFs conventions.</summary>
-    [JsonPropertyName("dest")]
-    public string Dest { get; set; } = string.Empty;
+    /// <inheritdoc />
+    public override string ToString() => Value;
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Provides a <see cref="JsonConverter{CatalogNegotiationRefusedReason}"/> for serializing <see cref="CatalogNegotiationRefusedReason"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<CatalogNegotiationRefusedReason>
+    {
+        /// <inheritdoc />
+        public override CatalogNegotiationRefusedReason Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
 
-    /// <summary>Source path using SessionFs conventions.</summary>
-    [JsonPropertyName("src")]
-    public string Src { get; set; } = string.Empty;
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, CatalogNegotiationRefusedReason value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CatalogNegotiationRefusedReason));
+        }
+    }
 }
 
-/// <summary>Query results including rows, columns, and rows affected, or a filesystem error if execution failed.</summary>
+
+/// <summary>Which kind of opaque handle was presented.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsSqliteQueryResult
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct CatalogHandleType : IEquatable<CatalogHandleType>
 {
-    /// <summary>Column names from the result set.</summary>
-    [JsonPropertyName("columns")]
-    public IList<string> Columns { get => field ??= []; set; }
+    private readonly string? _value;
 
-    /// <summary>Describes a filesystem error.</summary>
-    [JsonPropertyName("error")]
-    public SessionFsError? Error { get; set; }
+    /// <summary>Initializes a new instance of the <see cref="CatalogHandleType"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CatalogHandleType"/>.</param>
+    [JsonConstructor]
+    public CatalogHandleType(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
 
-    /// <summary>SQLite last_insert_rowid() value for INSERT.</summary>
-    [JsonPropertyName("lastInsertRowid")]
-    public long? LastInsertRowid { get; set; }
+    /// <summary>Gets the value associated with this <see cref="CatalogHandleType"/>.</summary>
+    public string Value => _value ?? string.Empty;
 
-    /// <summary>For SELECT: array of row objects. For others: empty array.</summary>
-    [JsonPropertyName("rows")]
-    public IList<IDictionary<string, JsonElement>> Rows { get => field ??= []; set; }
+    /// <summary>A search candidate handle.</summary>
+    public static CatalogHandleType Candidate { get; } = new("candidate");
 
-    /// <summary>Number of rows affected (for INSERT/UPDATE/DELETE).</summary>
-    [JsonPropertyName("rowsAffected")]
-    public long RowsAffected { get; set; }
-}
+    /// <summary>An install plan handle.</summary>
+    public static CatalogHandleType Plan { get; } = new("plan");
 
-/// <summary>SQL query, query type, and optional bind parameters for executing a SQLite query against the per-session database. The provider applies its SQLite busy timeout for every call.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsSqliteQueryRequest
-{
-    /// <summary>Optional named bind parameters.</summary>
-    [JsonPropertyName("params")]
-    public IDictionary<string, JsonElement>? Params { get; set; }
+    /// <summary>Returns a value indicating whether two <see cref="CatalogHandleType"/> instances are equivalent.</summary>
+    public static bool operator ==(CatalogHandleType left, CatalogHandleType right) => left.Equals(right);
 
-    /// <summary>SQL query to execute.</summary>
-    [JsonPropertyName("query")]
-    public string Query { get; set; } = string.Empty;
+    /// <summary>Returns a value indicating whether two <see cref="CatalogHandleType"/> instances are not equivalent.</summary>
+    public static bool operator !=(CatalogHandleType left, CatalogHandleType right) => !(left == right);
 
-    /// <summary>How to execute the query: 'exec' for DDL/multi-statement (no results), 'query' for SELECT (returns rows), 'run' for INSERT/UPDATE/DELETE (returns rowsAffected).</summary>
-    [JsonPropertyName("queryType")]
-    public SessionFsSqliteQueryType QueryType { get; set; }
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is CatalogHandleType other && Equals(other);
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <inheritdoc />
+    public bool Equals(CatalogHandleType other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
-/// <summary>Classified SQLite transaction failure. busyOrLocked guarantees rollback; postCommitAmbiguous must never be retried.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsSqliteTransactionError
-{
-    /// <summary>Machine-readable classification of the transaction failure.</summary>
-    [JsonPropertyName("errorClass")]
-    public SessionFsSqliteTransactionErrorClass ErrorClass { get; set; }
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
 
-    /// <summary>Human-readable transaction failure message.</summary>
-    [JsonPropertyName("message")]
-    public string Message { get; set; } = string.Empty;
-}
+    /// <inheritdoc />
+    public override string ToString() => Value;
 
-/// <summary>Per-statement results, or a classified transaction error.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsSqliteTransactionResult
-{
-    /// <summary>Classified transaction failure, when execution did not succeed.</summary>
-    [JsonPropertyName("error")]
-    public SessionFsSqliteTransactionError? Error { get; set; }
+    /// <summary>Provides a <see cref="JsonConverter{CatalogHandleType}"/> for serializing <see cref="CatalogHandleType"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<CatalogHandleType>
+    {
+        /// <inheritdoc />
+        public override CatalogHandleType Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
 
-    /// <summary>Per-statement query results in input order.</summary>
-    [JsonPropertyName("results")]
-    public IList<SessionFsSqliteQueryResult> Results { get => field ??= []; set; }
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, CatalogHandleType value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CatalogHandleType));
+        }
+    }
 }
 
-/// <summary>One statement in an atomic SQLite transaction.</summary>
+
+/// <summary>Why a presented handle was rejected.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsSqliteTransactionStatement
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct CatalogHandleRejectionReason : IEquatable<CatalogHandleRejectionReason>
 {
-    /// <summary>Optional named bind parameters.</summary>
-    [JsonPropertyName("params")]
-    public IDictionary<string, JsonElement>? Params { get; set; }
+    private readonly string? _value;
 
-    /// <summary>SQL statement to execute.</summary>
-    [JsonPropertyName("query")]
-    public string Query { get; set; } = string.Empty;
+    /// <summary>Initializes a new instance of the <see cref="CatalogHandleRejectionReason"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CatalogHandleRejectionReason"/>.</param>
+    [JsonConstructor]
+    public CatalogHandleRejectionReason(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="CatalogHandleRejectionReason"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>The handle is unparseable, unknown, or was issued for a different operation.</summary>
+    public static CatalogHandleRejectionReason Invalid { get; } = new("invalid");
+
+    /// <summary>The handle's time to live has elapsed.</summary>
+    public static CatalogHandleRejectionReason Stale { get; } = new("stale");
+
+    /// <summary>The handle has already been used, and handles are single-use.</summary>
+    public static CatalogHandleRejectionReason Replayed { get; } = new("replayed");
 
-    /// <summary>How to execute the statement.</summary>
-    [JsonPropertyName("queryType")]
-    public SessionFsSqliteQueryType QueryType { get; set; }
-}
+    /// <summary>The handle was issued by a different runtime instance.</summary>
+    public static CatalogHandleRejectionReason Foreign { get; } = new("foreign");
 
-/// <summary>Statements to execute atomically. Providers apply busy handling for every call.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsSqliteTransactionRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <summary>Returns a value indicating whether two <see cref="CatalogHandleRejectionReason"/> instances are equivalent.</summary>
+    public static bool operator ==(CatalogHandleRejectionReason left, CatalogHandleRejectionReason right) => left.Equals(right);
 
-    /// <summary>Ordered SQL statements to execute in one transaction.</summary>
-    [JsonPropertyName("statements")]
-    public IList<SessionFsSqliteTransactionStatement> Statements { get => field ??= []; set; }
-}
+    /// <summary>Returns a value indicating whether two <see cref="CatalogHandleRejectionReason"/> instances are not equivalent.</summary>
+    public static bool operator !=(CatalogHandleRejectionReason left, CatalogHandleRejectionReason right) => !(left == right);
 
-/// <summary>Indicates whether the per-session SQLite database already exists.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SessionFsSqliteExistsResult
-{
-    /// <summary>Whether the session database already exists.</summary>
-    [JsonPropertyName("exists")]
-    public bool Exists { get; set; }
-}
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is CatalogHandleRejectionReason other && Equals(other);
 
-/// <summary>Identifies the target session.</summary>
-public sealed class SessionFsSqliteExistsRequest
-{
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <inheritdoc />
+    public bool Equals(CatalogHandleRejectionReason other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
-/// <summary>Canvas open result returned by the provider.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class CanvasProviderOpenResult
-{
-    /// <summary>Provider-supplied status text.</summary>
-    [JsonPropertyName("status")]
-    public string? Status { get; set; }
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
 
-    /// <summary>Provider-supplied title.</summary>
-    [JsonPropertyName("title")]
-    public string? Title { get; set; }
+    /// <inheritdoc />
+    public override string ToString() => Value;
 
-    /// <summary>URL for web-rendered canvases.</summary>
-    [JsonPropertyName("url")]
-    public string? Url { get; set; }
-}
+    /// <summary>Provides a <see cref="JsonConverter{CatalogHandleRejectionReason}"/> for serializing <see cref="CatalogHandleRejectionReason"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<CatalogHandleRejectionReason>
+    {
+        /// <inheritdoc />
+        public override CatalogHandleRejectionReason Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
 
-/// <summary>Host capabilities.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class CanvasHostContextCapabilities
-{
-    /// <summary>Whether canvas rendering is supported.</summary>
-    [JsonPropertyName("canvases")]
-    public bool? Canvases { get; set; }
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, CatalogHandleRejectionReason value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CatalogHandleRejectionReason));
+        }
+    }
 }
 
-/// <summary>Host context supplied by the runtime.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class CanvasHostContext
-{
-    /// <summary>Host capabilities.</summary>
-    [JsonPropertyName("capabilities")]
-    public CanvasHostContextCapabilities? Capabilities { get; set; }
-}
 
-/// <summary>Session context supplied by the runtime.</summary>
+/// <summary>Which request field was rejected before any work was done.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class CanvasSessionContext
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct CatalogInvalidRequestField : IEquatable<CatalogInvalidRequestField>
 {
-    /// <summary>Active session working directory, when known.</summary>
-    [JsonPropertyName("workingDirectory")]
-    public string? WorkingDirectory { get; set; }
-}
+    private readonly string? _value;
 
-/// <summary>Canvas open parameters sent to the provider.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class CanvasProviderOpenRequest
-{
-    /// <summary>Provider-local canvas identifier.</summary>
-    [JsonPropertyName("canvasId")]
-    public string CanvasId { get; set; } = string.Empty;
+    /// <summary>Initializes a new instance of the <see cref="CatalogInvalidRequestField"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CatalogInvalidRequestField"/>.</param>
+    [JsonConstructor]
+    public CatalogInvalidRequestField(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
 
-    /// <summary>Owning provider identifier.</summary>
-    [JsonPropertyName("extensionId")]
-    public string ExtensionId { get; set; } = string.Empty;
+    /// <summary>Gets the value associated with this <see cref="CatalogInvalidRequestField"/>.</summary>
+    public string Value => _value ?? string.Empty;
 
-    /// <summary>Host context supplied by the runtime.</summary>
-    [JsonPropertyName("host")]
-    public CanvasHostContext? Host { get; set; }
+    /// <summary>The search query was empty or longer than permitted.</summary>
+    public static CatalogInvalidRequestField Query { get; } = new("query");
 
-    /// <summary>Canvas open input.</summary>
-    [JsonPropertyName("input")]
-    public JsonElement? Input { get; set; }
+    /// <summary>The requested result count fell outside its permitted range.</summary>
+    public static CatalogInvalidRequestField Limit { get; } = new("limit");
 
-    /// <summary>Stable caller-supplied canvas instance identifier.</summary>
-    [JsonPropertyName("instanceId")]
-    public string InstanceId { get; set; } = string.Empty;
+    /// <summary>The requested candidate kinds were empty or contained a duplicate.</summary>
+    public static CatalogInvalidRequestField Kinds { get; } = new("kinds");
 
-    /// <summary>Session context supplied by the runtime.</summary>
-    [JsonPropertyName("session")]
-    public CanvasSessionContext? Session { get; set; }
+    /// <summary>The negotiation block was missing or malformed.</summary>
+    public static CatalogInvalidRequestField Contract { get; } = new("contract");
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>The plan source was missing or malformed.</summary>
+    public static CatalogInvalidRequestField Source { get; } = new("source");
 
-/// <summary>Canvas close parameters sent to the provider.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class CanvasProviderCloseRequest
-{
-    /// <summary>Provider-local canvas identifier.</summary>
-    [JsonPropertyName("canvasId")]
-    public string CanvasId { get; set; } = string.Empty;
+    /// <summary>The supplied card was missing its media type, URL, or data.</summary>
+    public static CatalogInvalidRequestField Card { get; } = new("card");
 
-    /// <summary>Owning provider identifier.</summary>
-    [JsonPropertyName("extensionId")]
-    public string ExtensionId { get; set; } = string.Empty;
+    /// <summary>The requested configuration scope is not one this runtime writes.</summary>
+    public static CatalogInvalidRequestField Scope { get; } = new("scope");
 
-    /// <summary>Host context supplied by the runtime.</summary>
-    [JsonPropertyName("host")]
-    public CanvasHostContext? Host { get; set; }
+    /// <summary>Returns a value indicating whether two <see cref="CatalogInvalidRequestField"/> instances are equivalent.</summary>
+    public static bool operator ==(CatalogInvalidRequestField left, CatalogInvalidRequestField right) => left.Equals(right);
 
-    /// <summary>Canvas instance identifier.</summary>
-    [JsonPropertyName("instanceId")]
-    public string InstanceId { get; set; } = string.Empty;
+    /// <summary>Returns a value indicating whether two <see cref="CatalogInvalidRequestField"/> instances are not equivalent.</summary>
+    public static bool operator !=(CatalogInvalidRequestField left, CatalogInvalidRequestField right) => !(left == right);
 
-    /// <summary>Session context supplied by the runtime.</summary>
-    [JsonPropertyName("session")]
-    public CanvasSessionContext? Session { get; set; }
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is CatalogInvalidRequestField other && Equals(other);
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
+    /// <inheritdoc />
+    public bool Equals(CatalogInvalidRequestField other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
+
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{CatalogInvalidRequestField}"/> for serializing <see cref="CatalogInvalidRequestField"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<CatalogInvalidRequestField>
+    {
+        /// <inheritdoc />
+        public override CatalogInvalidRequestField Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, CatalogInvalidRequestField value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CatalogInvalidRequestField));
+        }
+    }
 }
 
-/// <summary>Canvas action invocation parameters sent to the provider.</summary>
+
+/// <summary>Why the catalog authority did not accept the caller's identity.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class CanvasProviderInvokeActionRequest
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct CatalogAuthenticationRequiredReason : IEquatable<CatalogAuthenticationRequiredReason>
 {
-    /// <summary>Action name to invoke.</summary>
-    [JsonPropertyName("actionName")]
-    public string ActionName { get; set; } = string.Empty;
+    private readonly string? _value;
 
-    /// <summary>Provider-local canvas identifier.</summary>
-    [JsonPropertyName("canvasId")]
-    public string CanvasId { get; set; } = string.Empty;
+    /// <summary>Initializes a new instance of the <see cref="CatalogAuthenticationRequiredReason"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CatalogAuthenticationRequiredReason"/>.</param>
+    [JsonConstructor]
+    public CatalogAuthenticationRequiredReason(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
 
-    /// <summary>Owning provider identifier.</summary>
-    [JsonPropertyName("extensionId")]
-    public string ExtensionId { get; set; } = string.Empty;
+    /// <summary>Gets the value associated with this <see cref="CatalogAuthenticationRequiredReason"/>.</summary>
+    public string Value => _value ?? string.Empty;
 
-    /// <summary>Host context supplied by the runtime.</summary>
-    [JsonPropertyName("host")]
-    public CanvasHostContext? Host { get; set; }
+    /// <summary>No credential was presented, so there is nothing to refresh and the caller must sign in.</summary>
+    public static CatalogAuthenticationRequiredReason NoCredential { get; } = new("no-credential");
 
-    /// <summary>Action input.</summary>
-    [JsonPropertyName("input")]
-    public JsonElement? Input { get; set; }
+    /// <summary>A credential was presented and its lifetime has elapsed. A silent refresh is worth attempting before prompting anyone.</summary>
+    public static CatalogAuthenticationRequiredReason CredentialExpired { get; } = new("credential-expired");
 
-    /// <summary>Canvas instance identifier.</summary>
-    [JsonPropertyName("instanceId")]
-    public string InstanceId { get; set; } = string.Empty;
+    /// <summary>A credential was presented and the authority refused it, for example because it was revoked, malformed, or issued for another audience. Refreshing the same rejected credential is not useful; the caller must sign in again.</summary>
+    public static CatalogAuthenticationRequiredReason CredentialRejected { get; } = new("credential-rejected");
 
-    /// <summary>Session context supplied by the runtime.</summary>
-    [JsonPropertyName("session")]
-    public CanvasSessionContext? Session { get; set; }
+    /// <summary>Returns a value indicating whether two <see cref="CatalogAuthenticationRequiredReason"/> instances are equivalent.</summary>
+    public static bool operator ==(CatalogAuthenticationRequiredReason left, CatalogAuthenticationRequiredReason right) => left.Equals(right);
 
-    /// <summary>Target session identifier.</summary>
-    [JsonPropertyName("sessionId")]
-    public string SessionId { get; set; } = string.Empty;
-}
+    /// <summary>Returns a value indicating whether two <see cref="CatalogAuthenticationRequiredReason"/> instances are not equivalent.</summary>
+    public static bool operator !=(CatalogAuthenticationRequiredReason left, CatalogAuthenticationRequiredReason right) => !(left == right);
 
-/// <summary>Opaque integrator-owned process launch profile for one extension entrypoint.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class ExtensionLaunchProfile
-{
-    /// <summary>Opaque integrator-defined arguments passed to the executable. The runtime does not append the extension entrypoint.</summary>
-    [JsonPropertyName("args")]
-    public IList<string> Args { get => field ??= []; set; }
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is CatalogAuthenticationRequiredReason other && Equals(other);
 
-    /// <summary>Opaque integrator-defined environment variables. Runtime-owned COPILOT_SDK_PATH, SESSION_ID, and COPILOT_EXTENSION_PARENT_PID values take precedence.</summary>
-    [JsonPropertyName("env")]
-    public IDictionary<string, string> Env { get => field ??= new Dictionary<string, string>(); set; }
+    /// <inheritdoc />
+    public bool Equals(CatalogAuthenticationRequiredReason other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
-    /// <summary>Executable used to launch the extension entrypoint.</summary>
-    [UnconditionalSuppressMessage("Trimming", "IL2026", Justification = "Safe for generated string properties: JSON Schema minLength/maxLength map to string length validation, not reflection over trimmed Count members")]
-    [MinLength(1)]
-    [JsonPropertyName("executable")]
-    public string Executable { get; set; } = string.Empty;
-}
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
 
-/// <summary>The launch profile for a supported entrypoint. Omit launch when the provider does not support the entrypoint.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class ExtensionLaunchProviderResolveResult
-{
-    /// <summary>Opaque launch profile, omitted when this provider does not support the entrypoint.</summary>
-    [JsonPropertyName("launch")]
-    public ExtensionLaunchProfile? Launch { get; set; }
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{CatalogAuthenticationRequiredReason}"/> for serializing <see cref="CatalogAuthenticationRequiredReason"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<CatalogAuthenticationRequiredReason>
+    {
+        /// <inheritdoc />
+        public override CatalogAuthenticationRequiredReason Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, CatalogAuthenticationRequiredReason value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CatalogAuthenticationRequiredReason));
+        }
+    }
 }
 
-/// <summary>A discovered extension entrypoint that the registered integrator may classify and resolve to an opaque launch profile.</summary>
+
+/// <summary>Categorised network failure, low cardinality so it can be aggregated without carrying a URL.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class ExtensionLaunchProviderResolveRequest
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct CatalogNetworkFailureReason : IEquatable<CatalogNetworkFailureReason>
 {
-    /// <summary>Source-qualified extension identifier.</summary>
-    [JsonPropertyName("id")]
-    public string Id { get; set; } = string.Empty;
+    private readonly string? _value;
 
-    /// <summary>Absolute path to the discovered extension entrypoint.</summary>
-    [JsonPropertyName("modulePath")]
-    public string ModulePath { get; set; } = string.Empty;
+    /// <summary>Initializes a new instance of the <see cref="CatalogNetworkFailureReason"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CatalogNetworkFailureReason"/>.</param>
+    [JsonConstructor]
+    public CatalogNetworkFailureReason(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="CatalogNetworkFailureReason"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>No network is available, so nothing was attempted.</summary>
+    public static CatalogNetworkFailureReason Offline { get; } = new("offline");
 
-    /// <summary>Human-readable extension name.</summary>
-    [JsonPropertyName("name")]
-    public string Name { get; set; } = string.Empty;
+    /// <summary>The authority's name could not be resolved.</summary>
+    public static CatalogNetworkFailureReason Dns { get; } = new("dns");
 
-    /// <summary>Discovery source for the extension entrypoint.</summary>
-    [JsonPropertyName("source")]
-    public ExtensionSource Source { get; set; }
-}
+    /// <summary>The request exceeded its time budget.</summary>
+    public static CatalogNetworkFailureReason Timeout { get; } = new("timeout");
 
-/// <summary>Acknowledgement. Returning successfully simply means the SDK accepted the start frame; it does not imply the request will succeed.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class LlmInferenceHttpRequestStartResult
-{
-}
+    /// <summary>The TLS handshake or certificate validation failed.</summary>
+    public static CatalogNetworkFailureReason Tls { get; } = new("tls");
 
-/// <summary>The head of an outbound model-layer HTTP request.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class LlmInferenceHttpRequestStartRequest
-{
-    /// <summary>Stable identity of the agent trajectory that issued this request. Present when the request originates from an agent turn; absent for requests outside any agent context. This is the same identity used by lifecycle and bridged session events and remains constant across turns and retries.</summary>
-    [JsonPropertyName("agentId")]
-    public string? AgentId { get; set; }
+    /// <summary>The connection was refused or reset.</summary>
+    public static CatalogNetworkFailureReason ConnectionRefused { get; } = new("connection-refused");
 
-    /// <summary>Identity of the agent invocation (one agentic loop) that issued this request. It remains fixed across physical retries within the invocation and is distinct from the stable trajectory `agentId`. A caller-supplied invocation id always takes precedence (this covers auxiliary calls that have no model call id). Otherwise, first-party CAPI requests fall back to the runtime's agent task id — the same value the runtime emits as the `X-Agent-Task-Id` header — while custom-provider requests fall back to the model call id.</summary>
-    [JsonPropertyName("agentInvocationId")]
-    public string? AgentInvocationId { get; set; }
+    /// <summary>The authority returned a status the runtime treats as a failure.</summary>
+    public static CatalogNetworkFailureReason HttpStatus { get; } = new("http-status");
 
-    /// <summary>HTTP request headers, preserving multiple values per name.</summary>
-    [JsonPropertyName("headers")]
-    public IDictionary<string, IList<string>> Headers { get => field ??= new Dictionary<string, IList<string>>(); set; }
+    /// <summary>The response exceeded the permitted size.</summary>
+    public static CatalogNetworkFailureReason ResponseTooLarge { get; } = new("response-too-large");
 
-    /// <summary>Coarse classification of the interaction that produced this request. Open string for forward-compatibility; known values include `conversation-agent`, `conversation-subagent`, `conversation-sampling`, `conversation-background`, `conversation-compaction`, and `conversation-user`. Absent when the runtime did not classify the request. Comes from the runtime's per-request agent context independently of transport; on the CAPI transport the runtime derives the upstream `X-Interaction-Type` header from this same context.</summary>
-    [JsonPropertyName("interactionType")]
-    public string? InteractionType { get; set; }
+    /// <summary>A redirect was refused by the runtime's redirect policy.</summary>
+    public static CatalogNetworkFailureReason RedirectRejected { get; } = new("redirect-rejected");
 
-    /// <summary>HTTP method, e.g. GET, POST.</summary>
-    [JsonPropertyName("method")]
-    public string Method { get; set; } = string.Empty;
+    /// <summary>Returns a value indicating whether two <see cref="CatalogNetworkFailureReason"/> instances are equivalent.</summary>
+    public static bool operator ==(CatalogNetworkFailureReason left, CatalogNetworkFailureReason right) => left.Equals(right);
 
-    /// <summary>Stable identity of the immediate parent trajectory. Present for child trajectories such as subagents and conversation-sampling requests; absent for root-agent and non-agent requests.</summary>
-    [JsonPropertyName("parentAgentId")]
-    public string? ParentAgentId { get; set; }
+    /// <summary>Returns a value indicating whether two <see cref="CatalogNetworkFailureReason"/> instances are not equivalent.</summary>
+    public static bool operator !=(CatalogNetworkFailureReason left, CatalogNetworkFailureReason right) => !(left == right);
 
-    /// <summary>Opaque runtime-minted id, unique per in-flight request. The SDK uses this to correlate httpRequestChunk frames and to address its httpResponseStart / httpResponseChunk replies back to the runtime.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is CatalogNetworkFailureReason other && Equals(other);
 
-    /// <summary>Id of the runtime session that triggered this request, when one is in scope. Absent for requests issued outside any session (e.g. startup model-catalog or capability resolution). This is a payload field — not a dispatch key — because the client-global API is registered process-wide rather than per session.</summary>
-    [JsonPropertyName("sessionId")]
-    public string? SessionId { get; set; }
+    /// <inheritdoc />
+    public bool Equals(CatalogNetworkFailureReason other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
-    /// <summary>Transport the runtime would otherwise use for this request. `http` (the default when absent) covers plain HTTP and SSE responses; `websocket` indicates a full-duplex message channel where each body chunk maps to one WebSocket message and the `binary` flag distinguishes text from binary frames. The SDK consumer uses this to decide whether to service the request with an HTTP client or a WebSocket client. It is the one piece of request metadata the consumer cannot reliably infer from the URL or headers alone.</summary>
-    [JsonPropertyName("transport")]
-    public LlmInferenceHttpRequestStartTransport? Transport { get; set; }
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
 
-    /// <summary>Absolute request URL.</summary>
-    [JsonPropertyName("url")]
-    public string Url { get; set; } = string.Empty;
-}
+    /// <inheritdoc />
+    public override string ToString() => Value;
 
-/// <summary>Acknowledgement. The SDK is free to ignore the ack and treat chunk delivery as fire-and-forget.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class LlmInferenceHttpRequestChunkResult
-{
+    /// <summary>Provides a <see cref="JsonConverter{CatalogNetworkFailureReason}"/> for serializing <see cref="CatalogNetworkFailureReason"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<CatalogNetworkFailureReason>
+    {
+        /// <inheritdoc />
+        public override CatalogNetworkFailureReason Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, CatalogNetworkFailureReason value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CatalogNetworkFailureReason));
+        }
+    }
 }
 
-/// <summary>A request body chunk or cancellation signal.</summary>
+
+/// <summary>Which hardened-fetch control refused a retrieval.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class LlmInferenceHttpRequestChunkRequest
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct CatalogUnsafeRetrievalReason : IEquatable<CatalogUnsafeRetrievalReason>
 {
-    /// <summary>Identity of the agent invocation (one agentic loop) this body chunk belongs to, matching the `agentInvocationId` semantics on httpRequestStart. Carried per chunk so a persistent transport can attribute successive turns correctly: when a WebSocket connection is reused across turns, the httpRequestStart identity reflects only the turn that opened the connection, so each later turn stamps its own invocation id here. Absent when the runtime has no invocation context for the request, or on the plain-HTTP transport where every request has its own httpRequestStart.</summary>
-    [JsonPropertyName("agentInvocationId")]
-    public string? AgentInvocationId { get; set; }
+    private readonly string? _value;
 
-    /// <summary>When true, `data` is base64-encoded bytes. When absent or false, `data` is UTF-8 text.</summary>
-    [JsonPropertyName("binary")]
-    public bool? Binary { get; set; }
+    /// <summary>Initializes a new instance of the <see cref="CatalogUnsafeRetrievalReason"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CatalogUnsafeRetrievalReason"/>.</param>
+    [JsonConstructor]
+    public CatalogUnsafeRetrievalReason(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
 
-    /// <summary>When true, the runtime is cancelling the in-flight request (e.g. upstream consumer aborted). `data` is ignored. Implies end-of-request.</summary>
-    [JsonPropertyName("cancel")]
-    public bool? Cancel { get; set; }
+    /// <summary>Gets the value associated with this <see cref="CatalogUnsafeRetrievalReason"/>.</summary>
+    public string Value => _value ?? string.Empty;
 
-    /// <summary>Optional human-readable reason for the cancellation, propagated for logging.</summary>
-    [JsonPropertyName("cancelReason")]
-    public string? CancelReason { get; set; }
+    /// <summary>The URL used a scheme the runtime refuses to fetch.</summary>
+    public static CatalogUnsafeRetrievalReason BlockedScheme { get; } = new("blocked-scheme");
 
-    /// <summary>Body byte range. UTF-8 text when `binary` is absent or false; base64-encoded bytes when `binary` is true. May be empty.</summary>
-    [JsonPropertyName("data")]
-    public string Data { get; set; } = string.Empty;
+    /// <summary>The URL embedded credentials.</summary>
+    public static CatalogUnsafeRetrievalReason CredentialsInUrl { get; } = new("credentials-in-url");
 
-    /// <summary>When true, this is the final body chunk for the request. The SDK may rely on having received an end-marked chunk before treating the request body as complete.</summary>
-    [JsonPropertyName("end")]
-    public bool? End { get; set; }
+    /// <summary>The URL resolved to a loopback, private, link-local, or cloud metadata address.</summary>
+    public static CatalogUnsafeRetrievalReason BlockedAddress { get; } = new("blocked-address");
 
-    /// <summary>Matches the requestId from the originating httpRequestStart frame.</summary>
-    [JsonPropertyName("requestId")]
-    public string RequestId { get; set; } = string.Empty;
-}
+    /// <summary>A redirect target resolved to a blocked address.</summary>
+    public static CatalogUnsafeRetrievalReason RedirectToBlockedAddress { get; } = new("redirect-to-blocked-address");
 
-/// <summary>Client environment metadata describing the process that produced a telemetry event.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class GitHubTelemetryClientInfo
-{
-    /// <summary>Copilot CLI version string.</summary>
-    [JsonPropertyName("cli_version")]
-    public string CliVersion { get; set; } = string.Empty;
+    /// <summary>The configured proxy policy refused the request.</summary>
+    public static CatalogUnsafeRetrievalReason ProxyRejected { get; } = new("proxy-rejected");
 
-    /// <summary>Name of the client application.</summary>
-    [JsonPropertyName("client_name")]
-    public string? ClientName { get; set; }
+    /// <summary>The authority is not permitted for card retrieval.</summary>
+    public static CatalogUnsafeRetrievalReason HostNotPermitted { get; } = new("host-not-permitted");
 
-    /// <summary>Type of client.</summary>
-    [JsonPropertyName("client_type")]
-    public string? ClientType { get; set; }
+    /// <summary>Returns a value indicating whether two <see cref="CatalogUnsafeRetrievalReason"/> instances are equivalent.</summary>
+    public static bool operator ==(CatalogUnsafeRetrievalReason left, CatalogUnsafeRetrievalReason right) => left.Equals(right);
 
-    /// <summary>Copilot subscription plan, when known.</summary>
-    [JsonPropertyName("copilot_plan")]
-    public string? CopilotPlan { get; set; }
+    /// <summary>Returns a value indicating whether two <see cref="CatalogUnsafeRetrievalReason"/> instances are not equivalent.</summary>
+    public static bool operator !=(CatalogUnsafeRetrievalReason left, CatalogUnsafeRetrievalReason right) => !(left == right);
 
-    /// <summary>Stable machine identifier for the device.</summary>
-    [JsonPropertyName("dev_device_id")]
-    public string? DevDeviceId { get; set; }
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is CatalogUnsafeRetrievalReason other && Equals(other);
 
-    /// <summary>Whether the user is a GitHub/Microsoft staff member.</summary>
-    [JsonPropertyName("is_staff")]
-    public bool? IsStaff { get; set; }
+    /// <inheritdoc />
+    public bool Equals(CatalogUnsafeRetrievalReason other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
-    /// <summary>Node.js runtime version string.</summary>
-    [JsonPropertyName("node_version")]
-    public string NodeVersion { get; set; } = string.Empty;
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
 
-    /// <summary>Operating system architecture (e.g. arm64, x64).</summary>
-    [JsonPropertyName("os_arch")]
-    public string OsArch { get; set; } = string.Empty;
+    /// <inheritdoc />
+    public override string ToString() => Value;
 
-    /// <summary>Operating system platform (e.g. darwin, linux, win32).</summary>
-    [JsonPropertyName("os_platform")]
-    public string OsPlatform { get; set; } = string.Empty;
+    /// <summary>Provides a <see cref="JsonConverter{CatalogUnsafeRetrievalReason}"/> for serializing <see cref="CatalogUnsafeRetrievalReason"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<CatalogUnsafeRetrievalReason>
+    {
+        /// <inheritdoc />
+        public override CatalogUnsafeRetrievalReason Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
 
-    /// <summary>Operating system version string.</summary>
-    [JsonPropertyName("os_version")]
-    public string OsVersion { get; set; } = string.Empty;
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, CatalogUnsafeRetrievalReason value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CatalogUnsafeRetrievalReason));
+        }
+    }
 }
 
-/// <summary>A single telemetry event in the runtime's native GitHub-shaped telemetry format, forwarded verbatim to opted-in hosts. The `restricted` flag on the enclosing GitHubTelemetryNotification distinguishes standard from restricted events; the payload shape is identical for both.</summary>
+
+/// <summary>Media type a catalog card is interpreted as.</summary>
 [Experimental(Diagnostics.Experimental)]
-public sealed class GitHubTelemetryEvent
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct CatalogMediaType : IEquatable<CatalogMediaType>
 {
-    /// <summary>Client environment metadata.</summary>
-    [JsonPropertyName("client")]
-    public GitHubTelemetryClientInfo? Client { get; set; }
+    private readonly string? _value;
 
-    /// <summary>Copilot tracking ID for user-level attribution.</summary>
-    [JsonPropertyName("copilot_tracking_id")]
-    public string? CopilotTrackingId { get; set; }
+    /// <summary>Initializes a new instance of the <see cref="CatalogMediaType"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CatalogMediaType"/>.</param>
+    [JsonConstructor]
+    public CatalogMediaType(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
 
-    /// <summary>Timestamp when the event was created (ISO 8601 format).</summary>
-    [JsonPropertyName("created_at")]
-    public string? CreatedAt { get; set; }
+    /// <summary>Gets the value associated with this <see cref="CatalogMediaType"/>.</summary>
+    public string Value => _value ?? string.Empty;
 
-    /// <summary>Experiment assignment context.</summary>
-    [JsonPropertyName("exp_assignment_context")]
-    public string? ExpAssignmentContext { get; set; }
+    /// <summary>The current MCP server card media type.</summary>
+    public static CatalogMediaType ApplicationMcpServerCardJson { get; } = new("application/mcp-server-card+json");
 
-    /// <summary>Feature flags enabled for this session, as a map from flag to value.</summary>
-    [JsonPropertyName("features")]
-    public IDictionary<string, string>? Features { get; set; }
+    /// <summary>The legacy MCP server card media type, accepted for compatibility.</summary>
+    public static CatalogMediaType ApplicationMcpServerJson { get; } = new("application/mcp-server+json");
 
-    /// <summary>Event type/kind (e.g. get_completion_with_tools_turn, tool_call_executed).</summary>
-    [JsonPropertyName("kind")]
-    public string Kind { get; set; } = string.Empty;
+    /// <summary>An AI skill card. Representable and searchable, but typed non-installable.</summary>
+    public static CatalogMediaType ApplicationAiSkill { get; } = new("application/ai-skill");
 
-    /// <summary>Numeric metrics as a map from key to value.</summary>
-    [JsonPropertyName("metrics")]
-    public IDictionary<string, double> Metrics { get => field ??= new Dictionary<string, double>(); set; }
+    /// <summary>Returns a value indicating whether two <see cref="CatalogMediaType"/> instances are equivalent.</summary>
+    public static bool operator ==(CatalogMediaType left, CatalogMediaType right) => left.Equals(right);
 
-    /// <summary>Reference to the model call that produced this event.</summary>
-    [JsonPropertyName("model_call_id")]
-    public string? ModelCallId { get; set; }
+    /// <summary>Returns a value indicating whether two <see cref="CatalogMediaType"/> instances are not equivalent.</summary>
+    public static bool operator !=(CatalogMediaType left, CatalogMediaType right) => !(left == right);
 
-    /// <summary>String-valued properties as a map from key to value.</summary>
-    [JsonPropertyName("properties")]
-    public IDictionary<string, string> Properties { get => field ??= new Dictionary<string, string>(); set; }
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is CatalogMediaType other && Equals(other);
 
-    /// <summary>Session identifier the event belongs to.</summary>
-    [JsonPropertyName("session_id")]
-    public string? SessionId { get; set; }
-}
+    /// <inheritdoc />
+    public bool Equals(CatalogMediaType other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
-/// <summary>Payload for a `gitHubTelemetry.event` notification: a single GitHub telemetry event the runtime forwards to a host connection that opted into telemetry forwarding during the `server.connect` handshake.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class GitHubTelemetryNotification
-{
-    /// <summary>The telemetry event, in the runtime's native GitHub-shaped telemetry format.</summary>
-    [JsonPropertyName("event")]
-    public GitHubTelemetryEvent Event { get => field ??= new(); set; }
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
 
-    /// <summary>Whether this is a restricted telemetry event (cli.restricted_telemetry). Hosts must route restricted events to first-party Microsoft stores only.</summary>
-    [JsonPropertyName("restricted")]
-    public bool Restricted { get; set; }
+    /// <inheritdoc />
+    public override string ToString() => Value;
 
-    /// <summary>Session the telemetry event belongs to, when it is session-scoped. Omitted for sessionless events (for example, `server.sendTelemetry` calls with no session id), which are still forwarded to opted-in connections.</summary>
-    [JsonPropertyName("sessionId")]
-    public string? SessionId { get; set; }
+    /// <summary>Provides a <see cref="JsonConverter{CatalogMediaType}"/> for serializing <see cref="CatalogMediaType"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<CatalogMediaType>
+    {
+        /// <inheritdoc />
+        public override CatalogMediaType Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, CatalogMediaType value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CatalogMediaType));
+        }
+    }
 }
 
-/// <summary>Resolved Anthropic adaptive-thinking capability for a model.</summary>
+
+/// <summary>How a card failed validation.</summary>
 [Experimental(Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
-public readonly struct AdaptiveThinkingSupport : IEquatable<AdaptiveThinkingSupport>
+public readonly struct CatalogMalformedCardReason : IEquatable<CatalogMalformedCardReason>
 {
     private readonly string? _value;
 
-    /// <summary>Initializes a new instance of the <see cref="AdaptiveThinkingSupport"/> struct.</summary>
-    /// <param name="value">The value to associate with this <see cref="AdaptiveThinkingSupport"/>.</param>
+    /// <summary>Initializes a new instance of the <see cref="CatalogMalformedCardReason"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CatalogMalformedCardReason"/>.</param>
     [JsonConstructor]
-    public AdaptiveThinkingSupport(string value)
+    public CatalogMalformedCardReason(string value)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(value);
         _value = value;
     }
 
-    /// <summary>Gets the value associated with this <see cref="AdaptiveThinkingSupport"/>.</summary>
+    /// <summary>Gets the value associated with this <see cref="CatalogMalformedCardReason"/>.</summary>
     public string Value => _value ?? string.Empty;
 
-    /// <summary>The model does not accept thinking.type='adaptive'.</summary>
-    public static AdaptiveThinkingSupport Unsupported { get; } = new("unsupported");
+    /// <summary>The document is not well-formed JSON.</summary>
+    public static CatalogMalformedCardReason InvalidJson { get; } = new("invalid-json");
 
-    /// <summary>The model accepts adaptive thinking but also accepts thinking.type='enabled'.</summary>
-    public static AdaptiveThinkingSupport Optional { get; } = new("optional");
+    /// <summary>The document does not satisfy its media type's schema.</summary>
+    public static CatalogMalformedCardReason SchemaViolation { get; } = new("schema-violation");
 
-    /// <summary>The model only accepts adaptive thinking and rejects thinking.type='enabled' with HTTP 400 (e.g. opus-4.7/4.8).</summary>
-    public static AdaptiveThinkingSupport Required { get; } = new("required");
+    /// <summary>The declared media type is not one this runtime understands.</summary>
+    public static CatalogMalformedCardReason UnsupportedMediaType { get; } = new("unsupported-media-type");
 
-    /// <summary>Returns a value indicating whether two <see cref="AdaptiveThinkingSupport"/> instances are equivalent.</summary>
-    public static bool operator ==(AdaptiveThinkingSupport left, AdaptiveThinkingSupport right) => left.Equals(right);
+    /// <summary>A field the media type requires is absent.</summary>
+    public static CatalogMalformedCardReason MissingRequiredField { get; } = new("missing-required-field");
 
-    /// <summary>Returns a value indicating whether two <see cref="AdaptiveThinkingSupport"/> instances are not equivalent.</summary>
-    public static bool operator !=(AdaptiveThinkingSupport left, AdaptiveThinkingSupport right) => !(left == right);
+    /// <summary>The document exceeded the permitted size.</summary>
+    public static CatalogMalformedCardReason SizeLimitExceeded { get; } = new("size-limit-exceeded");
+
+    /// <summary>Returns a value indicating whether two <see cref="CatalogMalformedCardReason"/> instances are equivalent.</summary>
+    public static bool operator ==(CatalogMalformedCardReason left, CatalogMalformedCardReason right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="CatalogMalformedCardReason"/> instances are not equivalent.</summary>
+    public static bool operator !=(CatalogMalformedCardReason left, CatalogMalformedCardReason right) => !(left == right);
 
     /// <inheritdoc />
-    public override bool Equals(object? obj) => obj is AdaptiveThinkingSupport other && Equals(other);
+    public override bool Equals(object? obj) => obj is CatalogMalformedCardReason other && Equals(other);
 
     /// <inheritdoc />
-    public bool Equals(AdaptiveThinkingSupport other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+    public bool Equals(CatalogMalformedCardReason other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
     /// <inheritdoc />
     public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
@@ -16936,65 +20031,68 @@ public AdaptiveThinkingSupport(string value)
     /// <inheritdoc />
     public override string ToString() => Value;
 
-    /// <summary>Provides a <see cref="JsonConverter{AdaptiveThinkingSupport}"/> for serializing <see cref="AdaptiveThinkingSupport"/> instances.</summary>
+    /// <summary>Provides a <see cref="JsonConverter{CatalogMalformedCardReason}"/> for serializing <see cref="CatalogMalformedCardReason"/> instances.</summary>
     [EditorBrowsable(EditorBrowsableState.Never)]
-    public sealed class Converter : JsonConverter<AdaptiveThinkingSupport>
+    public sealed class Converter : JsonConverter<CatalogMalformedCardReason>
     {
         /// <inheritdoc />
-        public override AdaptiveThinkingSupport Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        public override CatalogMalformedCardReason Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
         {
             return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
         }
 
         /// <inheritdoc />
-        public override void Write(Utf8JsonWriter writer, AdaptiveThinkingSupport value, JsonSerializerOptions options)
+        public override void Write(Utf8JsonWriter writer, CatalogMalformedCardReason value, JsonSerializerOptions options)
         {
-            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(AdaptiveThinkingSupport));
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CatalogMalformedCardReason));
         }
     }
 }
 
 
-/// <summary>Model capability category for grouping in the model picker.</summary>
+/// <summary>Which wire-contract rule an upstream response broke.</summary>
 [Experimental(Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
-public readonly struct ModelPickerCategory : IEquatable<ModelPickerCategory>
+public readonly struct CatalogContractViolationReason : IEquatable<CatalogContractViolationReason>
 {
     private readonly string? _value;
 
-    /// <summary>Initializes a new instance of the <see cref="ModelPickerCategory"/> struct.</summary>
-    /// <param name="value">The value to associate with this <see cref="ModelPickerCategory"/>.</param>
+    /// <summary>Initializes a new instance of the <see cref="CatalogContractViolationReason"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CatalogContractViolationReason"/>.</param>
     [JsonConstructor]
-    public ModelPickerCategory(string value)
+    public CatalogContractViolationReason(string value)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(value);
         _value = value;
     }
 
-    /// <summary>Gets the value associated with this <see cref="ModelPickerCategory"/>.</summary>
+    /// <summary>Gets the value associated with this <see cref="CatalogContractViolationReason"/>.</summary>
     public string Value => _value ?? string.Empty;
 
-    /// <summary>Lightweight model category optimized for faster, lower-cost interactions.</summary>
-    public static ModelPickerCategory Lightweight { get; } = new("lightweight");
+    /// <summary>A result carried both a URL and embedded data, when exactly one is permitted.</summary>
+    public static CatalogContractViolationReason BothUrlAndData { get; } = new("both-url-and-data");
 
-    /// <summary>Versatile model category suitable for a broad range of tasks.</summary>
-    public static ModelPickerCategory Versatile { get; } = new("versatile");
+    /// <summary>A result carried neither a URL nor embedded data, when exactly one is required.</summary>
+    public static CatalogContractViolationReason NeitherUrlNorData { get; } = new("neither-url-nor-data");
 
-    /// <summary>Powerful model category optimized for complex tasks.</summary>
-    public static ModelPickerCategory Powerful { get; } = new("powerful");
+    /// <summary>Two results claimed the same normalised identity.</summary>
+    public static CatalogContractViolationReason DuplicateIdentity { get; } = new("duplicate-identity");
 
-    /// <summary>Returns a value indicating whether two <see cref="ModelPickerCategory"/> instances are equivalent.</summary>
-    public static bool operator ==(ModelPickerCategory left, ModelPickerCategory right) => left.Equals(right);
+    /// <summary>A result declared no media type, or one this contract does not model.</summary>
+    public static CatalogContractViolationReason UnknownMediaType { get; } = new("unknown-media-type");
 
-    /// <summary>Returns a value indicating whether two <see cref="ModelPickerCategory"/> instances are not equivalent.</summary>
-    public static bool operator !=(ModelPickerCategory left, ModelPickerCategory right) => !(left == right);
+    /// <summary>Returns a value indicating whether two <see cref="CatalogContractViolationReason"/> instances are equivalent.</summary>
+    public static bool operator ==(CatalogContractViolationReason left, CatalogContractViolationReason right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="CatalogContractViolationReason"/> instances are not equivalent.</summary>
+    public static bool operator !=(CatalogContractViolationReason left, CatalogContractViolationReason right) => !(left == right);
 
     /// <inheritdoc />
-    public override bool Equals(object? obj) => obj is ModelPickerCategory other && Equals(other);
+    public override bool Equals(object? obj) => obj is CatalogContractViolationReason other && Equals(other);
 
     /// <inheritdoc />
-    public bool Equals(ModelPickerCategory other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+    public bool Equals(CatalogContractViolationReason other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
     /// <inheritdoc />
     public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
@@ -17002,68 +20100,65 @@ public ModelPickerCategory(string value)
     /// <inheritdoc />
     public override string ToString() => Value;
 
-    /// <summary>Provides a <see cref="JsonConverter{ModelPickerCategory}"/> for serializing <see cref="ModelPickerCategory"/> instances.</summary>
+    /// <summary>Provides a <see cref="JsonConverter{CatalogContractViolationReason}"/> for serializing <see cref="CatalogContractViolationReason"/> instances.</summary>
     [EditorBrowsable(EditorBrowsableState.Never)]
-    public sealed class Converter : JsonConverter<ModelPickerCategory>
+    public sealed class Converter : JsonConverter<CatalogContractViolationReason>
     {
         /// <inheritdoc />
-        public override ModelPickerCategory Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        public override CatalogContractViolationReason Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
         {
             return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
         }
 
         /// <inheritdoc />
-        public override void Write(Utf8JsonWriter writer, ModelPickerCategory value, JsonSerializerOptions options)
+        public override void Write(Utf8JsonWriter writer, CatalogContractViolationReason value, JsonSerializerOptions options)
         {
-            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(ModelPickerCategory));
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CatalogContractViolationReason));
         }
     }
 }
 
 
-/// <summary>Relative cost tier for token-based billing users.</summary>
+/// <summary>Why no usable transport could be offered.</summary>
 [Experimental(Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
-public readonly struct ModelPickerPriceCategory : IEquatable<ModelPickerPriceCategory>
+public readonly struct CatalogUnavailableTransportReason : IEquatable<CatalogUnavailableTransportReason>
 {
     private readonly string? _value;
 
-    /// <summary>Initializes a new instance of the <see cref="ModelPickerPriceCategory"/> struct.</summary>
-    /// <param name="value">The value to associate with this <see cref="ModelPickerPriceCategory"/>.</param>
+    /// <summary>Initializes a new instance of the <see cref="CatalogUnavailableTransportReason"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CatalogUnavailableTransportReason"/>.</param>
     [JsonConstructor]
-    public ModelPickerPriceCategory(string value)
+    public CatalogUnavailableTransportReason(string value)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(value);
         _value = value;
     }
 
-    /// <summary>Gets the value associated with this <see cref="ModelPickerPriceCategory"/>.</summary>
+    /// <summary>Gets the value associated with this <see cref="CatalogUnavailableTransportReason"/>.</summary>
     public string Value => _value ?? string.Empty;
 
-    /// <summary>Lowest relative token cost tier.</summary>
-    public static ModelPickerPriceCategory Low { get; } = new("low");
-
-    /// <summary>Medium relative token cost tier.</summary>
-    public static ModelPickerPriceCategory Medium { get; } = new("medium");
+    /// <summary>The card advertises no transport this runtime can use.</summary>
+    public static CatalogUnavailableTransportReason NoEligibleTransport { get; } = new("no-eligible-transport");
 
-    /// <summary>High relative token cost tier.</summary>
-    public static ModelPickerPriceCategory High { get; } = new("high");
+    /// <summary>Every advertised transport is of a kind this runtime does not implement.</summary>
+    public static CatalogUnavailableTransportReason TransportNotSupported { get; } = new("transport-not-supported");
 
-    /// <summary>Highest relative token cost tier.</summary>
-    public static ModelPickerPriceCategory VeryHigh { get; } = new("very_high");
+    /// <summary>Eligible remotes could not be enumerated, so no explicit choice can be offered.</summary>
+    public static CatalogUnavailableTransportReason RemoteEnumerationUnavailable { get; } = new("remote-enumeration-unavailable");
 
-    /// <summary>Returns a value indicating whether two <see cref="ModelPickerPriceCategory"/> instances are equivalent.</summary>
-    public static bool operator ==(ModelPickerPriceCategory left, ModelPickerPriceCategory right) => left.Equals(right);
+    /// <summary>Returns a value indicating whether two <see cref="CatalogUnavailableTransportReason"/> instances are equivalent.</summary>
+    public static bool operator ==(CatalogUnavailableTransportReason left, CatalogUnavailableTransportReason right) => left.Equals(right);
 
-    /// <summary>Returns a value indicating whether two <see cref="ModelPickerPriceCategory"/> instances are not equivalent.</summary>
-    public static bool operator !=(ModelPickerPriceCategory left, ModelPickerPriceCategory right) => !(left == right);
+    /// <summary>Returns a value indicating whether two <see cref="CatalogUnavailableTransportReason"/> instances are not equivalent.</summary>
+    public static bool operator !=(CatalogUnavailableTransportReason left, CatalogUnavailableTransportReason right) => !(left == right);
 
     /// <inheritdoc />
-    public override bool Equals(object? obj) => obj is ModelPickerPriceCategory other && Equals(other);
+    public override bool Equals(object? obj) => obj is CatalogUnavailableTransportReason other && Equals(other);
 
     /// <inheritdoc />
-    public bool Equals(ModelPickerPriceCategory other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+    public bool Equals(CatalogUnavailableTransportReason other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
     /// <inheritdoc />
     public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
@@ -17071,65 +20166,65 @@ public ModelPickerPriceCategory(string value)
     /// <inheritdoc />
     public override string ToString() => Value;
 
-    /// <summary>Provides a <see cref="JsonConverter{ModelPickerPriceCategory}"/> for serializing <see cref="ModelPickerPriceCategory"/> instances.</summary>
+    /// <summary>Provides a <see cref="JsonConverter{CatalogUnavailableTransportReason}"/> for serializing <see cref="CatalogUnavailableTransportReason"/> instances.</summary>
     [EditorBrowsable(EditorBrowsableState.Never)]
-    public sealed class Converter : JsonConverter<ModelPickerPriceCategory>
+    public sealed class Converter : JsonConverter<CatalogUnavailableTransportReason>
     {
         /// <inheritdoc />
-        public override ModelPickerPriceCategory Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        public override CatalogUnavailableTransportReason Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
         {
             return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
         }
 
         /// <inheritdoc />
-        public override void Write(Utf8JsonWriter writer, ModelPickerPriceCategory value, JsonSerializerOptions options)
+        public override void Write(Utf8JsonWriter writer, CatalogUnavailableTransportReason value, JsonSerializerOptions options)
         {
-            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(ModelPickerPriceCategory));
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CatalogUnavailableTransportReason));
         }
     }
 }
 
 
-/// <summary>Current policy state for this model.</summary>
+/// <summary>Why a discoverable candidate cannot be installed.</summary>
 [Experimental(Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
-public readonly struct ModelPolicyState : IEquatable<ModelPolicyState>
+public readonly struct CatalogNotInstallableReason : IEquatable<CatalogNotInstallableReason>
 {
     private readonly string? _value;
 
-    /// <summary>Initializes a new instance of the <see cref="ModelPolicyState"/> struct.</summary>
-    /// <param name="value">The value to associate with this <see cref="ModelPolicyState"/>.</param>
+    /// <summary>Initializes a new instance of the <see cref="CatalogNotInstallableReason"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CatalogNotInstallableReason"/>.</param>
     [JsonConstructor]
-    public ModelPolicyState(string value)
+    public CatalogNotInstallableReason(string value)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(value);
         _value = value;
     }
 
-    /// <summary>Gets the value associated with this <see cref="ModelPolicyState"/>.</summary>
+    /// <summary>Gets the value associated with this <see cref="CatalogNotInstallableReason"/>.</summary>
     public string Value => _value ?? string.Empty;
 
-    /// <summary>The model is enabled by policy.</summary>
-    public static ModelPolicyState Enabled { get; } = new("enabled");
+    /// <summary>This kind of resource is not installable through this surface.</summary>
+    public static CatalogNotInstallableReason KindNotInstallable { get; } = new("kind-not-installable");
 
-    /// <summary>The model is disabled by policy.</summary>
-    public static ModelPolicyState Disabled { get; } = new("disabled");
+    /// <summary>AI skills are discoverable but have no typed importer in this phase.</summary>
+    public static CatalogNotInstallableReason AiSkillNotInstallable { get; } = new("ai-skill-not-installable");
 
-    /// <summary>No explicit policy is configured for the model.</summary>
-    public static ModelPolicyState Unconfigured { get; } = new("unconfigured");
+    /// <summary>Policy forbids installing this candidate.</summary>
+    public static CatalogNotInstallableReason PolicyForbids { get; } = new("policy-forbids");
 
-    /// <summary>Returns a value indicating whether two <see cref="ModelPolicyState"/> instances are equivalent.</summary>
-    public static bool operator ==(ModelPolicyState left, ModelPolicyState right) => left.Equals(right);
+    /// <summary>Returns a value indicating whether two <see cref="CatalogNotInstallableReason"/> instances are equivalent.</summary>
+    public static bool operator ==(CatalogNotInstallableReason left, CatalogNotInstallableReason right) => left.Equals(right);
 
-    /// <summary>Returns a value indicating whether two <see cref="ModelPolicyState"/> instances are not equivalent.</summary>
-    public static bool operator !=(ModelPolicyState left, ModelPolicyState right) => !(left == right);
+    /// <summary>Returns a value indicating whether two <see cref="CatalogNotInstallableReason"/> instances are not equivalent.</summary>
+    public static bool operator !=(CatalogNotInstallableReason left, CatalogNotInstallableReason right) => !(left == right);
 
     /// <inheritdoc />
-    public override bool Equals(object? obj) => obj is ModelPolicyState other && Equals(other);
+    public override bool Equals(object? obj) => obj is CatalogNotInstallableReason other && Equals(other);
 
     /// <inheritdoc />
-    public bool Equals(ModelPolicyState other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+    public bool Equals(CatalogNotInstallableReason other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
     /// <inheritdoc />
     public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
@@ -17137,68 +20232,68 @@ public ModelPolicyState(string value)
     /// <inheritdoc />
     public override string ToString() => Value;
 
-    /// <summary>Provides a <see cref="JsonConverter{ModelPolicyState}"/> for serializing <see cref="ModelPolicyState"/> instances.</summary>
+    /// <summary>Provides a <see cref="JsonConverter{CatalogNotInstallableReason}"/> for serializing <see cref="CatalogNotInstallableReason"/> instances.</summary>
     [EditorBrowsable(EditorBrowsableState.Never)]
-    public sealed class Converter : JsonConverter<ModelPolicyState>
+    public sealed class Converter : JsonConverter<CatalogNotInstallableReason>
     {
         /// <inheritdoc />
-        public override ModelPolicyState Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        public override CatalogNotInstallableReason Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
         {
             return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
         }
 
         /// <inheritdoc />
-        public override void Write(Utf8JsonWriter writer, ModelPolicyState value, JsonSerializerOptions options)
+        public override void Write(Utf8JsonWriter writer, CatalogNotInstallableReason value, JsonSerializerOptions options)
         {
-            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(ModelPolicyState));
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CatalogNotInstallableReason));
         }
     }
 }
 
 
-/// <summary>Server transport type: stdio, http, sse (deprecated), or memory.</summary>
+/// <summary>Why a catalog operation is not available on this runtime.</summary>
 [Experimental(Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
-public readonly struct DiscoveredMcpServerType : IEquatable<DiscoveredMcpServerType>
+public readonly struct CatalogUnavailableReason : IEquatable<CatalogUnavailableReason>
 {
     private readonly string? _value;
 
-    /// <summary>Initializes a new instance of the <see cref="DiscoveredMcpServerType"/> struct.</summary>
-    /// <param name="value">The value to associate with this <see cref="DiscoveredMcpServerType"/>.</param>
+    /// <summary>Initializes a new instance of the <see cref="CatalogUnavailableReason"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CatalogUnavailableReason"/>.</param>
     [JsonConstructor]
-    public DiscoveredMcpServerType(string value)
+    public CatalogUnavailableReason(string value)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(value);
         _value = value;
     }
 
-    /// <summary>Gets the value associated with this <see cref="DiscoveredMcpServerType"/>.</summary>
+    /// <summary>Gets the value associated with this <see cref="CatalogUnavailableReason"/>.</summary>
     public string Value => _value ?? string.Empty;
 
-    /// <summary>Server communicates over stdio with a local child process.</summary>
-    public static DiscoveredMcpServerType Stdio { get; } = new("stdio");
+    /// <summary>Bounded search is not wired up on this runtime build.</summary>
+    public static CatalogUnavailableReason SearchUnavailable { get; } = new("search-unavailable");
 
-    /// <summary>Server communicates over streamable HTTP.</summary>
-    public static DiscoveredMcpServerType Http { get; } = new("http");
+    /// <summary>Install planning is not wired up on this runtime build.</summary>
+    public static CatalogUnavailableReason PlanningUnavailable { get; } = new("planning-unavailable");
 
-    /// <summary>Server communicates over Server-Sent Events (deprecated).</summary>
-    public static DiscoveredMcpServerType Sse { get; } = new("sse");
+    /// <summary>No catalog authority is configured for this runtime.</summary>
+    public static CatalogUnavailableReason AuthorityNotConfigured { get; } = new("authority-not-configured");
 
-    /// <summary>Server is backed by an in-memory runtime implementation.</summary>
-    public static DiscoveredMcpServerType Memory { get; } = new("memory");
+    /// <summary>The surface is disabled by policy on this runtime.</summary>
+    public static CatalogUnavailableReason DisabledByPolicy { get; } = new("disabled-by-policy");
 
-    /// <summary>Returns a value indicating whether two <see cref="DiscoveredMcpServerType"/> instances are equivalent.</summary>
-    public static bool operator ==(DiscoveredMcpServerType left, DiscoveredMcpServerType right) => left.Equals(right);
+    /// <summary>Returns a value indicating whether two <see cref="CatalogUnavailableReason"/> instances are equivalent.</summary>
+    public static bool operator ==(CatalogUnavailableReason left, CatalogUnavailableReason right) => left.Equals(right);
 
-    /// <summary>Returns a value indicating whether two <see cref="DiscoveredMcpServerType"/> instances are not equivalent.</summary>
-    public static bool operator !=(DiscoveredMcpServerType left, DiscoveredMcpServerType right) => !(left == right);
+    /// <summary>Returns a value indicating whether two <see cref="CatalogUnavailableReason"/> instances are not equivalent.</summary>
+    public static bool operator !=(CatalogUnavailableReason left, CatalogUnavailableReason right) => !(left == right);
 
     /// <inheritdoc />
-    public override bool Equals(object? obj) => obj is DiscoveredMcpServerType other && Equals(other);
+    public override bool Equals(object? obj) => obj is CatalogUnavailableReason other && Equals(other);
 
     /// <inheritdoc />
-    public bool Equals(DiscoveredMcpServerType other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+    public bool Equals(CatalogUnavailableReason other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
     /// <inheritdoc />
     public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
@@ -17206,20 +20301,20 @@ public DiscoveredMcpServerType(string value)
     /// <inheritdoc />
     public override string ToString() => Value;
 
-    /// <summary>Provides a <see cref="JsonConverter{DiscoveredMcpServerType}"/> for serializing <see cref="DiscoveredMcpServerType"/> instances.</summary>
+    /// <summary>Provides a <see cref="JsonConverter{CatalogUnavailableReason}"/> for serializing <see cref="CatalogUnavailableReason"/> instances.</summary>
     [EditorBrowsable(EditorBrowsableState.Never)]
-    public sealed class Converter : JsonConverter<DiscoveredMcpServerType>
+    public sealed class Converter : JsonConverter<CatalogUnavailableReason>
     {
         /// <inheritdoc />
-        public override DiscoveredMcpServerType Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        public override CatalogUnavailableReason Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
         {
             return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
         }
 
         /// <inheritdoc />
-        public override void Write(Utf8JsonWriter writer, DiscoveredMcpServerType value, JsonSerializerOptions options)
+        public override void Write(Utf8JsonWriter writer, CatalogUnavailableReason value, JsonSerializerOptions options)
         {
-            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(DiscoveredMcpServerType));
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CatalogUnavailableReason));
         }
     }
 }
@@ -17354,6 +20449,132 @@ public override void Write(Utf8JsonWriter writer, DiscoveredExtensionMode value,
 }
 
 
+/// <summary>Whether an MCP server candidate can be planned for installation.</summary>
+[Experimental(Diagnostics.Experimental)]
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct CatalogMcpServerInstallability : IEquatable<CatalogMcpServerInstallability>
+{
+    private readonly string? _value;
+
+    /// <summary>Initializes a new instance of the <see cref="CatalogMcpServerInstallability"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CatalogMcpServerInstallability"/>.</param>
+    [JsonConstructor]
+    public CatalogMcpServerInstallability(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="CatalogMcpServerInstallability"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>An install plan can be computed for this MCP server candidate.</summary>
+    public static CatalogMcpServerInstallability Installable { get; } = new("installable");
+
+    /// <summary>Policy forbids installing this MCP server candidate.</summary>
+    public static CatalogMcpServerInstallability NotInstallablePolicy { get; } = new("not-installable-policy");
+
+    /// <summary>Returns a value indicating whether two <see cref="CatalogMcpServerInstallability"/> instances are equivalent.</summary>
+    public static bool operator ==(CatalogMcpServerInstallability left, CatalogMcpServerInstallability right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="CatalogMcpServerInstallability"/> instances are not equivalent.</summary>
+    public static bool operator !=(CatalogMcpServerInstallability left, CatalogMcpServerInstallability right) => !(left == right);
+
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is CatalogMcpServerInstallability other && Equals(other);
+
+    /// <inheritdoc />
+    public bool Equals(CatalogMcpServerInstallability other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
+
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{CatalogMcpServerInstallability}"/> for serializing <see cref="CatalogMcpServerInstallability"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<CatalogMcpServerInstallability>
+    {
+        /// <inheritdoc />
+        public override CatalogMcpServerInstallability Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, CatalogMcpServerInstallability value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CatalogMcpServerInstallability));
+        }
+    }
+}
+
+
+/// <summary>What kind of resource a catalog candidate describes.</summary>
+[Experimental(Diagnostics.Experimental)]
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct CatalogCandidateKind : IEquatable<CatalogCandidateKind>
+{
+    private readonly string? _value;
+
+    /// <summary>Initializes a new instance of the <see cref="CatalogCandidateKind"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="CatalogCandidateKind"/>.</param>
+    [JsonConstructor]
+    public CatalogCandidateKind(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="CatalogCandidateKind"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>An MCP server, which can be planned for installation.</summary>
+    public static CatalogCandidateKind McpServer { get; } = new("mcp-server");
+
+    /// <summary>An AI skill, which is discoverable but not installable through this surface.</summary>
+    public static CatalogCandidateKind AiSkill { get; } = new("ai-skill");
+
+    /// <summary>Returns a value indicating whether two <see cref="CatalogCandidateKind"/> instances are equivalent.</summary>
+    public static bool operator ==(CatalogCandidateKind left, CatalogCandidateKind right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="CatalogCandidateKind"/> instances are not equivalent.</summary>
+    public static bool operator !=(CatalogCandidateKind left, CatalogCandidateKind right) => !(left == right);
+
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is CatalogCandidateKind other && Equals(other);
+
+    /// <inheritdoc />
+    public bool Equals(CatalogCandidateKind other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
+
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{CatalogCandidateKind}"/> for serializing <see cref="CatalogCandidateKind"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<CatalogCandidateKind>
+    {
+        /// <inheritdoc />
+        public override CatalogCandidateKind Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, CatalogCandidateKind value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(CatalogCandidateKind));
+        }
+    }
+}
+
+
 /// <summary>Which tier this directory belongs to.</summary>
 [Experimental(Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
@@ -23479,8 +26700,8 @@ public PermissionDecisionSource(string value)
     /// <summary>Gets the value associated with this <see cref="PermissionDecisionSource"/>.</summary>
     public string Value => _value ?? string.Empty;
 
-    /// <summary>The response followed the auto-approval judge recommendation.</summary>
-    public static PermissionDecisionSource JudgeRecommendation { get; } = new("judge_recommendation");
+    /// <summary>The response followed the assisted-approval judge recommendation.</summary>
+    public static PermissionDecisionSource AssistedApproval { get; } = new("assisted_approval");
 
     /// <summary>A human supplied the response through an interactive prompt.</summary>
     public static PermissionDecisionSource HumanResponse { get; } = new("human_response");
@@ -23666,115 +26887,49 @@ public override void Write(Utf8JsonWriter writer, PermissionsSetApproveAllSource
 }
 
 
-/// <summary>Current or requested allow-all mode.</summary>
-[Experimental(Diagnostics.Experimental)]
-[JsonConverter(typeof(Converter))]
-[DebuggerDisplay("{Value,nq}")]
-public readonly struct PermissionsAllowAllMode : IEquatable<PermissionsAllowAllMode>
-{
-    private readonly string? _value;
-
-    /// <summary>Initializes a new instance of the <see cref="PermissionsAllowAllMode"/> struct.</summary>
-    /// <param name="value">The value to associate with this <see cref="PermissionsAllowAllMode"/>.</param>
-    [JsonConstructor]
-    public PermissionsAllowAllMode(string value)
-    {
-        ArgumentException.ThrowIfNullOrWhiteSpace(value);
-        _value = value;
-    }
-
-    /// <summary>Gets the value associated with this <see cref="PermissionsAllowAllMode"/>.</summary>
-    public string Value => _value ?? string.Empty;
-
-    /// <summary>Permission requests follow the normal approval flow.</summary>
-    public static PermissionsAllowAllMode Off { get; } = new("off");
-
-    /// <summary>Tool, path, and URL permission requests are automatically approved.</summary>
-    public static PermissionsAllowAllMode On { get; } = new("on");
-
-    /// <summary>Permission requests follow the normal approval flow with an LLM advisory recommendation attached; clients may choose to auto-approve requests the judge evaluated as acceptable.</summary>
-    public static PermissionsAllowAllMode Auto { get; } = new("auto");
-
-    /// <summary>Returns a value indicating whether two <see cref="PermissionsAllowAllMode"/> instances are equivalent.</summary>
-    public static bool operator ==(PermissionsAllowAllMode left, PermissionsAllowAllMode right) => left.Equals(right);
-
-    /// <summary>Returns a value indicating whether two <see cref="PermissionsAllowAllMode"/> instances are not equivalent.</summary>
-    public static bool operator !=(PermissionsAllowAllMode left, PermissionsAllowAllMode right) => !(left == right);
-
-    /// <inheritdoc />
-    public override bool Equals(object? obj) => obj is PermissionsAllowAllMode other && Equals(other);
-
-    /// <inheritdoc />
-    public bool Equals(PermissionsAllowAllMode other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
-
-    /// <inheritdoc />
-    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
-
-    /// <inheritdoc />
-    public override string ToString() => Value;
-
-    /// <summary>Provides a <see cref="JsonConverter{PermissionsAllowAllMode}"/> for serializing <see cref="PermissionsAllowAllMode"/> instances.</summary>
-    [EditorBrowsable(EditorBrowsableState.Never)]
-    public sealed class Converter : JsonConverter<PermissionsAllowAllMode>
-    {
-        /// <inheritdoc />
-        public override PermissionsAllowAllMode Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
-        {
-            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
-        }
-
-        /// <inheritdoc />
-        public override void Write(Utf8JsonWriter writer, PermissionsAllowAllMode value, JsonSerializerOptions options)
-        {
-            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(PermissionsAllowAllMode));
-        }
-    }
-}
-
-
-/// <summary>Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers.</summary>
+/// <summary>Optional source for permission-mode telemetry. Defaults to `rpc` when omitted for SDK callers.</summary>
 [Experimental(Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
-public readonly struct PermissionsSetAllowAllSource : IEquatable<PermissionsSetAllowAllSource>
+public readonly struct PermissionModeSource : IEquatable<PermissionModeSource>
 {
     private readonly string? _value;
 
-    /// <summary>Initializes a new instance of the <see cref="PermissionsSetAllowAllSource"/> struct.</summary>
-    /// <param name="value">The value to associate with this <see cref="PermissionsSetAllowAllSource"/>.</param>
+    /// <summary>Initializes a new instance of the <see cref="PermissionModeSource"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="PermissionModeSource"/>.</param>
     [JsonConstructor]
-    public PermissionsSetAllowAllSource(string value)
+    public PermissionModeSource(string value)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(value);
         _value = value;
     }
 
-    /// <summary>Gets the value associated with this <see cref="PermissionsSetAllowAllSource"/>.</summary>
+    /// <summary>Gets the value associated with this <see cref="PermissionModeSource"/>.</summary>
     public string Value => _value ?? string.Empty;
 
-    /// <summary>Allow-all was enabled from a CLI command-line flag.</summary>
-    public static PermissionsSetAllowAllSource CliFlag { get; } = new("cli_flag");
+    /// <summary>The mode was set from a CLI command-line flag.</summary>
+    public static PermissionModeSource CliFlag { get; } = new("cli_flag");
 
-    /// <summary>Allow-all was enabled by a slash command.</summary>
-    public static PermissionsSetAllowAllSource SlashCommand { get; } = new("slash_command");
+    /// <summary>The mode was set by a slash command.</summary>
+    public static PermissionModeSource SlashCommand { get; } = new("slash_command");
 
-    /// <summary>Allow-all was enabled by confirming autopilot behavior.</summary>
-    public static PermissionsSetAllowAllSource AutopilotConfirmation { get; } = new("autopilot_confirmation");
+    /// <summary>The mode was set by confirming autopilot behavior.</summary>
+    public static PermissionModeSource AutopilotConfirmation { get; } = new("autopilot_confirmation");
 
-    /// <summary>Allow-all was enabled through an RPC caller.</summary>
-    public static PermissionsSetAllowAllSource Rpc { get; } = new("rpc");
+    /// <summary>The mode was set through an RPC caller.</summary>
+    public static PermissionModeSource Rpc { get; } = new("rpc");
 
-    /// <summary>Returns a value indicating whether two <see cref="PermissionsSetAllowAllSource"/> instances are equivalent.</summary>
-    public static bool operator ==(PermissionsSetAllowAllSource left, PermissionsSetAllowAllSource right) => left.Equals(right);
+    /// <summary>Returns a value indicating whether two <see cref="PermissionModeSource"/> instances are equivalent.</summary>
+    public static bool operator ==(PermissionModeSource left, PermissionModeSource right) => left.Equals(right);
 
-    /// <summary>Returns a value indicating whether two <see cref="PermissionsSetAllowAllSource"/> instances are not equivalent.</summary>
-    public static bool operator !=(PermissionsSetAllowAllSource left, PermissionsSetAllowAllSource right) => !(left == right);
+    /// <summary>Returns a value indicating whether two <see cref="PermissionModeSource"/> instances are not equivalent.</summary>
+    public static bool operator !=(PermissionModeSource left, PermissionModeSource right) => !(left == right);
 
     /// <inheritdoc />
-    public override bool Equals(object? obj) => obj is PermissionsSetAllowAllSource other && Equals(other);
+    public override bool Equals(object? obj) => obj is PermissionModeSource other && Equals(other);
 
     /// <inheritdoc />
-    public bool Equals(PermissionsSetAllowAllSource other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+    public bool Equals(PermissionModeSource other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
     /// <inheritdoc />
     public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
@@ -23782,20 +26937,20 @@ public PermissionsSetAllowAllSource(string value)
     /// <inheritdoc />
     public override string ToString() => Value;
 
-    /// <summary>Provides a <see cref="JsonConverter{PermissionsSetAllowAllSource}"/> for serializing <see cref="PermissionsSetAllowAllSource"/> instances.</summary>
+    /// <summary>Provides a <see cref="JsonConverter{PermissionModeSource}"/> for serializing <see cref="PermissionModeSource"/> instances.</summary>
     [EditorBrowsable(EditorBrowsableState.Never)]
-    public sealed class Converter : JsonConverter<PermissionsSetAllowAllSource>
+    public sealed class Converter : JsonConverter<PermissionModeSource>
     {
         /// <inheritdoc />
-        public override PermissionsSetAllowAllSource Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        public override PermissionModeSource Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
         {
             return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
         }
 
         /// <inheritdoc />
-        public override void Write(Utf8JsonWriter writer, PermissionsSetAllowAllSource value, JsonSerializerOptions options)
+        public override void Write(Utf8JsonWriter writer, PermissionModeSource value, JsonSerializerOptions options)
         {
-            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(PermissionsSetAllowAllSource));
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(PermissionModeSource));
         }
     }
 }
@@ -25740,6 +28895,12 @@ public async Task RegisterExtensionLaunchProviderAsync(CancellationToken cancell
         Interlocked.CompareExchange(ref field, new(_rpc), null) ??
         field;
 
+    /// <summary>Catalog APIs.</summary>
+    public ServerCatalogApi Catalog =>
+        field ??
+        Interlocked.CompareExchange(ref field, new(_rpc), null) ??
+        field;
+
     /// <summary>Plugins APIs.</summary>
     public ServerPluginsApi Plugins =>
         field ??
@@ -25977,6 +29138,21 @@ public async Task<McpDiscoverResult> DiscoverAsync(string? workingDirectory = nu
         return await CopilotClient.InvokeRpcAsync<McpDiscoverResult>(_rpc, "mcp.discover", [request], cancellationToken);
     }
 
+    /// <summary>Requests a side-effect-free MCP install plan from a catalog candidate handle or a caller-supplied card. This host-implemented server method is available through SDK/TUI hosts; standalone and C-ABI runtimes whose host does not implement server-method dispatch return JSON-RPC MethodNotFound. A runtime with planning available returns a normalised plan and opaque single-use plan handle; a runtime without it returns the typed planning-unavailable result. A completed plan reports resource identity, provenance, eligible transport choices, the user-scope target, required typed values and secret placeholders, the policy result, the configuration changes installing would make, and whether a reload would be needed. Planning never writes configuration, stores a secret, or reloads MCP servers, so abandoning a plan needs no call and leaves nothing behind.</summary>
+    /// <param name="contract">Protocol version and capabilities the caller requires.</param>
+    /// <param name="source">What to plan: either a candidate handle from a previous search, or a card supplied directly.</param>
+    /// <param name="scope">Configuration scope the plan targets. Defaults to user scope when omitted.</param>
+    /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
+    /// <returns>Outcome of an mcp.planInstall call: either a normalised plan, or one typed refusal. Nothing is written in either case.</returns>
+    public async Task<McpPlanInstallResult> PlanInstallAsync(CatalogClientContract contract, McpPlanInstallSource source, McpPlanScope? scope = null, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(contract);
+        ArgumentNullException.ThrowIfNull(source);
+
+        var request = new McpPlanInstallRequest { Contract = contract, Source = source, Scope = scope };
+        return await CopilotClient.InvokeRpcAsync<McpPlanInstallResult>(_rpc, "mcp.planInstall", [request], cancellationToken);
+    }
+
     /// <summary>Config APIs.</summary>
     public ServerMcpConfigApi Config =>
         field ??
@@ -26112,6 +29288,34 @@ public async Task DisableAsync(IList<string> ids, CancellationToken cancellation
     }
 }
 
+/// <summary>Provides server-scoped Catalog APIs.</summary>
+[Experimental(Diagnostics.Experimental)]
+public sealed class ServerCatalogApi
+{
+    private readonly JsonRpc _rpc;
+
+    internal ServerCatalogApi(JsonRpc rpc)
+    {
+        _rpc = rpc;
+    }
+
+    /// <summary>Requests a bounded catalog search. This host-implemented server method is available through SDK/TUI hosts; standalone and C-ABI runtimes whose host does not implement server-method dispatch return JSON-RPC MethodNotFound. A runtime with search available returns inert candidate summaries, each with an opaque single-use handle scoped to this runtime instance; a runtime without it returns the typed search-unavailable result. Public authorities may be searched anonymously, while an authority that requires credentials yields the typed authentication-required result. All returned text, URLs, and package metadata are untrusted external data and can never trigger instructions, tools, or installation. Read-only: nothing is installed, configured, or persisted.</summary>
+    /// <param name="contract">Protocol version and capabilities the caller requires.</param>
+    /// <param name="query">Free-text search query. Never written to logs or telemetry.</param>
+    /// <param name="limit">Maximum number of candidates to return. Defaults to 10 when omitted.</param>
+    /// <param name="kinds">Restrict results to these candidate kinds. When omitted, every kind the runtime supports is searched.</param>
+    /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
+    /// <returns>Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal. Never a partial success.</returns>
+    public async Task<CatalogSearchResult> SearchAsync(CatalogClientContract contract, string query, int? limit = null, IList<CatalogCandidateKind>? kinds = null, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(contract);
+        ArgumentNullException.ThrowIfNull(query);
+
+        var request = new CatalogSearchRequest { Contract = contract, Query = query, Limit = limit, Kinds = kinds };
+        return await CopilotClient.InvokeRpcAsync<CatalogSearchResult>(_rpc, "catalog.search", [request], cancellationToken);
+    }
+}
+
 /// <summary>Provides server-scoped Plugins APIs.</summary>
 [Experimental(Diagnostics.Experimental)]
 public sealed class ServerPluginsApi
@@ -28865,6 +32069,17 @@ public async Task ReloadAsync(CancellationToken cancellationToken = default)
         await CopilotClient.InvokeRpcAsync(_session.Rpc, "session.mcp.reload", [request], cancellationToken);
     }
 
+    /// <summary>Releases any turns waiting on an in-flight MCP load without cancelling the load, letting the agent proceed while MCP servers finish connecting in the background. No-op when no MCP load is in flight or waiting turns were already released.</summary>
+    /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
+    /// <returns>Result of moving in-flight MCP loading to the background.</returns>
+    public async Task<MoveMcpLoadingToBackgroundResult> MoveLoadingToBackgroundAsync(CancellationToken cancellationToken = default)
+    {
+        _session.ThrowIfDisposed();
+
+        var request = new SessionMcpMoveLoadingToBackgroundRequest { SessionId = _session.SessionId };
+        return await CopilotClient.InvokeRpcAsync<MoveMcpLoadingToBackgroundResult>(_session.Rpc, "session.mcp.moveLoadingToBackground", [request], cancellationToken);
+    }
+
     /// <summary>Reloads MCP server connections for the session with an explicit host-provided configuration.</summary>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
     /// <returns>MCP server startup filtering result.</returns>
@@ -30044,30 +33259,29 @@ public async Task<PermissionsSetApproveAllResult> SetApproveAllAsync(bool enable
         return await CopilotClient.InvokeRpcAsync<PermissionsSetApproveAllResult>(_session.Rpc, "session.permissions.setApproveAll", [request], cancellationToken);
     }
 
-    /// <summary>Sets the allow-all permission mode for the session. Used by attach-mode clients (e.g. LocalRpcSession's `/allow-all` forwarder) to flip the target session's permission state. The `on` mode swaps in unrestricted path and URL managers and emits `session.permissions_changed` on transition; the `auto` mode keeps normal prompt paths active while attaching LLM safety recommendations. The result returns the authoritative post-mutation state so callers can update their local mirrors without racing the `session.permissions_changed` notification on the same wire.</summary>
-    /// <param name="mode">Allow-all mode to apply. `on` enables full allow-all; `auto` enables advisory LLM auto-approval; `off` disables both.</param>
-    /// <param name="enabled">Legacy full allow-all toggle. Prefer `mode`; when `mode` is omitted, `enabled: true` is treated as `mode: "on"` and any other value is treated as `mode: "off"`.</param>
-    /// <param name="model">Optional model id for the `auto` mode auto-approval LLM judging. Only meaningful when `mode` is `auto`; ignored otherwise. When omitted, the session resolves a default judge model: `gpt-5.5` for CAPI sessions and the session's active model for BYOK sessions.</param>
-    /// <param name="source">Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers.</param>
+    /// <summary>Sets the permission mode for the session. `manual` follows the normal approval flow, `assisted` attaches LLM safety recommendations, and `allow-all` automatically approves permission requests. The result returns the authoritative post-mutation mode so callers can update local state without racing the `session.permissions_changed` notification.</summary>
+    /// <param name="mode">Permission mode to apply.</param>
+    /// <param name="assistedApprovalModel">Optional judge model id for assisted mode. When omitted, the session resolves the provider default: `gpt-5.5` for CAPI sessions and the active session model for BYOK sessions.</param>
+    /// <param name="source">Optional source for permission-mode telemetry. Defaults to `rpc` when omitted for SDK callers.</param>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
-    /// <returns>Indicates whether the operation succeeded and reports the post-mutation state.</returns>
-    public async Task<AllowAllPermissionSetResult> SetAllowAllAsync(PermissionsAllowAllMode? mode = null, bool? enabled = null, string? model = null, PermissionsSetAllowAllSource? source = null, CancellationToken cancellationToken = default)
+    /// <returns>Indicates whether the requested permission mode was applied and reports the authoritative post-mutation mode.</returns>
+    public async Task<PermissionsSetModeResult> SetModeAsync(PermissionMode mode, string? assistedApprovalModel = null, PermissionModeSource? source = null, CancellationToken cancellationToken = default)
     {
         _session.ThrowIfDisposed();
 
-        var request = new PermissionsSetAllowAllRequest { SessionId = _session.SessionId, Mode = mode, Enabled = enabled, Model = model, Source = source };
-        return await CopilotClient.InvokeRpcAsync<AllowAllPermissionSetResult>(_session.Rpc, "session.permissions.setAllowAll", [request], cancellationToken);
+        var request = new PermissionsSetModeRequest { SessionId = _session.SessionId, Mode = mode, AssistedApprovalModel = assistedApprovalModel, Source = source };
+        return await CopilotClient.InvokeRpcAsync<PermissionsSetModeResult>(_session.Rpc, "session.permissions.setMode", [request], cancellationToken);
     }
 
-    /// <summary>Returns the current allow-all permission mode for the session.</summary>
+    /// <summary>Returns the current permission mode for the session.</summary>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
-    /// <returns>Current allow-all permission mode.</returns>
-    public async Task<AllowAllPermissionState> GetAllowAllAsync(CancellationToken cancellationToken = default)
+    /// <returns>Current permission mode.</returns>
+    public async Task<PermissionsGetModeResult> GetModeAsync(CancellationToken cancellationToken = default)
     {
         _session.ThrowIfDisposed();
 
-        var request = new PermissionsGetAllowAllRequest { SessionId = _session.SessionId };
-        return await CopilotClient.InvokeRpcAsync<AllowAllPermissionState>(_session.Rpc, "session.permissions.getAllowAll", [request], cancellationToken);
+        var request = new PermissionsGetModeRequest { SessionId = _session.SessionId };
+        return await CopilotClient.InvokeRpcAsync<PermissionsGetModeResult>(_session.Rpc, "session.permissions.getMode", [request], cancellationToken);
     }
 
     /// <summary>Adds or removes session-scoped or location-scoped permission rules.</summary>
@@ -31665,6 +34879,8 @@ public static void RegisterClientGlobalApiHandlers(JsonRpc rpc, ClientGlobalApiH
 [JsonSerializable(typeof(GitHub.Copilot.AssistantUsageData), TypeInfoPropertyName = "SessionEventsAssistantUsageData")]
 [JsonSerializable(typeof(GitHub.Copilot.AssistantUsageEvent), TypeInfoPropertyName = "SessionEventsAssistantUsageEvent")]
 [JsonSerializable(typeof(GitHub.Copilot.AssistantUsageTransport), TypeInfoPropertyName = "SessionEventsAssistantUsageTransport")]
+[JsonSerializable(typeof(GitHub.Copilot.AssistedApprovalJudgeFailureReason), TypeInfoPropertyName = "SessionEventsAssistedApprovalJudgeFailureReason")]
+[JsonSerializable(typeof(GitHub.Copilot.AssistedApprovalRecommendation), TypeInfoPropertyName = "SessionEventsAssistedApprovalRecommendation")]
 [JsonSerializable(typeof(GitHub.Copilot.Attachment), TypeInfoPropertyName = "SessionEventsAttachment")]
 [JsonSerializable(typeof(GitHub.Copilot.AttachmentBlob), TypeInfoPropertyName = "SessionEventsAttachmentBlob")]
 [JsonSerializable(typeof(GitHub.Copilot.AttachmentDirectory), TypeInfoPropertyName = "SessionEventsAttachmentDirectory")]
@@ -31688,8 +34904,6 @@ public static void RegisterClientGlobalApiHandlers(JsonRpc rpc, ClientGlobalApiH
 [JsonSerializable(typeof(GitHub.Copilot.AttachmentSelectionDetails), TypeInfoPropertyName = "SessionEventsAttachmentSelectionDetails")]
 [JsonSerializable(typeof(GitHub.Copilot.AttachmentSelectionDetailsEnd), TypeInfoPropertyName = "SessionEventsAttachmentSelectionDetailsEnd")]
 [JsonSerializable(typeof(GitHub.Copilot.AttachmentSelectionDetailsStart), TypeInfoPropertyName = "SessionEventsAttachmentSelectionDetailsStart")]
-[JsonSerializable(typeof(GitHub.Copilot.AutoApprovalJudgeFailureReason), TypeInfoPropertyName = "SessionEventsAutoApprovalJudgeFailureReason")]
-[JsonSerializable(typeof(GitHub.Copilot.AutoApprovalRecommendation), TypeInfoPropertyName = "SessionEventsAutoApprovalRecommendation")]
 [JsonSerializable(typeof(GitHub.Copilot.AutoModeResolvedReasoningBucket), TypeInfoPropertyName = "SessionEventsAutoModeResolvedReasoningBucket")]
 [JsonSerializable(typeof(GitHub.Copilot.AutoModeSwitchCompletedData), TypeInfoPropertyName = "SessionEventsAutoModeSwitchCompletedData")]
 [JsonSerializable(typeof(GitHub.Copilot.AutoModeSwitchCompletedEvent), TypeInfoPropertyName = "SessionEventsAutoModeSwitchCompletedEvent")]
@@ -31817,10 +35031,10 @@ public static void RegisterClientGlobalApiHandlers(JsonRpc rpc, ClientGlobalApiH
 [JsonSerializable(typeof(GitHub.Copilot.OmittedBinaryType), TypeInfoPropertyName = "SessionEventsOmittedBinaryType")]
 [JsonSerializable(typeof(GitHub.Copilot.PendingMessagesModifiedData), TypeInfoPropertyName = "SessionEventsPendingMessagesModifiedData")]
 [JsonSerializable(typeof(GitHub.Copilot.PendingMessagesModifiedEvent), TypeInfoPropertyName = "SessionEventsPendingMessagesModifiedEvent")]
-[JsonSerializable(typeof(GitHub.Copilot.PermissionAllowAllMode), TypeInfoPropertyName = "SessionEventsPermissionAllowAllMode")]
-[JsonSerializable(typeof(GitHub.Copilot.PermissionAutoApproval), TypeInfoPropertyName = "SessionEventsPermissionAutoApproval")]
+[JsonSerializable(typeof(GitHub.Copilot.PermissionAssistedApproval), TypeInfoPropertyName = "SessionEventsPermissionAssistedApproval")]
 [JsonSerializable(typeof(GitHub.Copilot.PermissionCompletedData), TypeInfoPropertyName = "SessionEventsPermissionCompletedData")]
 [JsonSerializable(typeof(GitHub.Copilot.PermissionCompletedEvent), TypeInfoPropertyName = "SessionEventsPermissionCompletedEvent")]
+[JsonSerializable(typeof(GitHub.Copilot.PermissionMode), TypeInfoPropertyName = "SessionEventsPermissionMode")]
 [JsonSerializable(typeof(GitHub.Copilot.PermissionPromptRequest), TypeInfoPropertyName = "SessionEventsPermissionPromptRequest")]
 [JsonSerializable(typeof(GitHub.Copilot.PermissionPromptRequestCommands), TypeInfoPropertyName = "SessionEventsPermissionPromptRequestCommands")]
 [JsonSerializable(typeof(GitHub.Copilot.PermissionPromptRequestCustomTool), TypeInfoPropertyName = "SessionEventsPermissionPromptRequestCustomTool")]
@@ -32016,8 +35230,6 @@ public static void RegisterClientGlobalApiHandlers(JsonRpc rpc, ClientGlobalApiH
 [JsonSerializable(typeof(AgentSetPromptRequest))]
 [JsonSerializable(typeof(AgentsDiscoverRequest))]
 [JsonSerializable(typeof(AgentsGetDiscoveryPathsRequest))]
-[JsonSerializable(typeof(AllowAllPermissionSetResult))]
-[JsonSerializable(typeof(AllowAllPermissionState))]
 [JsonSerializable(typeof(AuthIdentity))]
 [JsonSerializable(typeof(AuthInfo))]
 [JsonSerializable(typeof(AuthValidationError))]
@@ -32044,6 +35256,15 @@ public static void RegisterClientGlobalApiHandlers(JsonRpc rpc, ClientGlobalApiH
 [JsonSerializable(typeof(CanvasProviderUnregisterRequest))]
 [JsonSerializable(typeof(CanvasSessionContext))]
 [JsonSerializable(typeof(CapiSessionOptions))]
+[JsonSerializable(typeof(CardDigest))]
+[JsonSerializable(typeof(CatalogAiSkillCandidateProvenance))]
+[JsonSerializable(typeof(CatalogCandidate))]
+[JsonSerializable(typeof(CatalogCandidateSource))]
+[JsonSerializable(typeof(CatalogClientContract))]
+[JsonSerializable(typeof(CatalogMcpServerCandidateProvenance))]
+[JsonSerializable(typeof(CatalogNegotiatedContract))]
+[JsonSerializable(typeof(CatalogSearchRequest))]
+[JsonSerializable(typeof(CatalogSearchResult))]
 [JsonSerializable(typeof(CommandList))]
 [JsonSerializable(typeof(CommandsFinalizeInvocationEffectRequest))]
 [JsonSerializable(typeof(CommandsFinalizeInvocationEffectRequestEffect))]
@@ -32242,6 +35463,7 @@ public static void RegisterClientGlobalApiHandlers(JsonRpc rpc, ClientGlobalApiH
 [JsonSerializable(typeof(McpHeadersHandlePendingHeadersRefreshRequestRequest))]
 [JsonSerializable(typeof(McpHeadersHandlePendingHeadersRefreshRequestResult))]
 [JsonSerializable(typeof(McpHostState))]
+[JsonSerializable(typeof(McpInstallPlan))]
 [JsonSerializable(typeof(McpIsServerRunningRequest))]
 [JsonSerializable(typeof(McpIsServerRunningResult))]
 [JsonSerializable(typeof(McpListToolsRequest))]
@@ -32256,6 +35478,17 @@ public static void RegisterClientGlobalApiHandlers(JsonRpc rpc, ClientGlobalApiH
 [JsonSerializable(typeof(McpOauthProbeResult))]
 [JsonSerializable(typeof(McpOauthRespondRequest))]
 [JsonSerializable(typeof(McpOauthRespondResult))]
+[JsonSerializable(typeof(McpPlanConfigurationChange))]
+[JsonSerializable(typeof(McpPlanInstallRequest))]
+[JsonSerializable(typeof(McpPlanInstallResult))]
+[JsonSerializable(typeof(McpPlanInstallSource))]
+[JsonSerializable(typeof(McpPlanPolicyResult))]
+[JsonSerializable(typeof(McpPlanProvenance))]
+[JsonSerializable(typeof(McpPlanRequiredValue))]
+[JsonSerializable(typeof(McpPlanResourceIdentity))]
+[JsonSerializable(typeof(McpPlanSecretPlaceholder))]
+[JsonSerializable(typeof(McpPlanTarget))]
+[JsonSerializable(typeof(McpPlanTransportChoice))]
 [JsonSerializable(typeof(McpRegisterExternalClientRequest))]
 [JsonSerializable(typeof(McpReloadWithConfigRequest))]
 [JsonSerializable(typeof(McpRemoveGitHubResult))]
@@ -32273,6 +35506,7 @@ public static void RegisterClientGlobalApiHandlers(JsonRpc rpc, ClientGlobalApiH
 [JsonSerializable(typeof(McpRestartServerRequest))]
 [JsonSerializable(typeof(McpSamplingExecutionResult))]
 [JsonSerializable(typeof(McpServer))]
+[JsonSerializable(typeof(McpServerCardReference))]
 [JsonSerializable(typeof(McpServerFailureInfo))]
 [JsonSerializable(typeof(McpServerList))]
 [JsonSerializable(typeof(McpServerNeedsAuthInfo))]
@@ -32331,6 +35565,7 @@ public static void RegisterClientGlobalApiHandlers(JsonRpc rpc, ClientGlobalApiH
 [JsonSerializable(typeof(ModelSwitchToRequest))]
 [JsonSerializable(typeof(ModelSwitchToResult))]
 [JsonSerializable(typeof(ModelsListRequest))]
+[JsonSerializable(typeof(MoveMcpLoadingToBackgroundResult))]
 [JsonSerializable(typeof(NameGetResult))]
 [JsonSerializable(typeof(NameSetAutoRequest))]
 [JsonSerializable(typeof(NameSetAutoResult))]
@@ -32371,7 +35606,8 @@ public static void RegisterClientGlobalApiHandlers(JsonRpc rpc, ClientGlobalApiH
 [JsonSerializable(typeof(PermissionsConfigureParams))]
 [JsonSerializable(typeof(PermissionsConfigureResult))]
 [JsonSerializable(typeof(PermissionsFolderTrustAddTrustedResult))]
-[JsonSerializable(typeof(PermissionsGetAllowAllRequest))]
+[JsonSerializable(typeof(PermissionsGetModeRequest))]
+[JsonSerializable(typeof(PermissionsGetModeResult))]
 [JsonSerializable(typeof(PermissionsLocationsAddToolApprovalDetails))]
 [JsonSerializable(typeof(PermissionsLocationsAddToolApprovalResult))]
 [JsonSerializable(typeof(PermissionsModifyRulesParams))]
@@ -32383,9 +35619,10 @@ public static void RegisterClientGlobalApiHandlers(JsonRpc rpc, ClientGlobalApiH
 [JsonSerializable(typeof(PermissionsPendingRequestsRequest))]
 [JsonSerializable(typeof(PermissionsResetSessionApprovalsRequest))]
 [JsonSerializable(typeof(PermissionsResetSessionApprovalsResult))]
-[JsonSerializable(typeof(PermissionsSetAllowAllRequest))]
 [JsonSerializable(typeof(PermissionsSetApproveAllRequest))]
 [JsonSerializable(typeof(PermissionsSetApproveAllResult))]
+[JsonSerializable(typeof(PermissionsSetModeRequest))]
+[JsonSerializable(typeof(PermissionsSetModeResult))]
 [JsonSerializable(typeof(PermissionsSetRequiredRequest))]
 [JsonSerializable(typeof(PermissionsSetRequiredResult))]
 [JsonSerializable(typeof(PermissionsUrlsSetUnrestrictedModeResult))]
@@ -32588,6 +35825,7 @@ public static void RegisterClientGlobalApiHandlers(JsonRpc rpc, ClientGlobalApiH
 [JsonSerializable(typeof(SessionLoadDeferredRepoHooksResult))]
 [JsonSerializable(typeof(SessionMcpAppsGetHostContextRequest))]
 [JsonSerializable(typeof(SessionMcpListRequest))]
+[JsonSerializable(typeof(SessionMcpMoveLoadingToBackgroundRequest))]
 [JsonSerializable(typeof(SessionMcpReloadRequest))]
 [JsonSerializable(typeof(SessionMcpRemoveGitHubRequest))]
 [JsonSerializable(typeof(SessionMetadataActivityRequest))]
diff --git a/dotnet/src/Generated/SessionEvents.cs b/dotnet/src/Generated/SessionEvents.cs
index 7bf9926e09..fa0563a8e4 100644
--- a/dotnet/src/Generated/SessionEvents.cs
+++ b/dotnet/src/Generated/SessionEvents.cs
@@ -382,8 +382,9 @@ public sealed partial class SessionSessionLimitsChangedEvent : SessionEvent
     public required SessionSessionLimitsChangedData Data { get; set; }
 }
 
-/// <summary>Permissions change details carrying the aggregate allow-all transition.</summary>
+/// <summary>Permission-mode transition details.</summary>
 /// <remarks>Represents the <c>session.permissions_changed</c> event.</remarks>
+[Experimental(Diagnostics.Experimental)]
 public sealed partial class SessionPermissionsChangedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -2205,28 +2206,25 @@ public sealed partial class SessionSessionLimitsChangedData
     public SessionLimitsConfig? SessionLimits { get; set; }
 }
 
-/// <summary>Permissions change details carrying the aggregate allow-all transition.</summary>
+/// <summary>Permission-mode transition details.</summary>
+[Experimental(Diagnostics.Experimental)]
 public sealed partial class SessionPermissionsChangedData
 {
-    /// <summary>Allow-all mode after the change.</summary>
+    /// <summary>Explicit LLM judge model override used by assisted mode; omitted when the provider default applies.</summary>
     [Experimental(Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("allowAllPermissionMode")]
-    public PermissionAllowAllMode? AllowAllPermissionMode { get; set; }
-
-    /// <summary>Aggregate allow-all flag after the change.</summary>
-    [JsonPropertyName("allowAllPermissions")]
-    public required bool AllowAllPermissions { get; set; }
+    [JsonPropertyName("assistedApprovalModel")]
+    public string? AssistedApprovalModel { get; set; }
 
-    /// <summary>Allow-all mode before the change.</summary>
+    /// <summary>Permission mode after the change.</summary>
     [Experimental(Diagnostics.Experimental)]
-    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("previousAllowAllPermissionMode")]
-    public PermissionAllowAllMode? PreviousAllowAllPermissionMode { get; set; }
+    [JsonPropertyName("mode")]
+    public required PermissionMode Mode { get; set; }
 
-    /// <summary>Aggregate allow-all flag before the change.</summary>
-    [JsonPropertyName("previousAllowAllPermissions")]
-    public required bool PreviousAllowAllPermissions { get; set; }
+    /// <summary>Permission mode before the change.</summary>
+    [Experimental(Diagnostics.Experimental)]
+    [JsonPropertyName("previousMode")]
+    public required PermissionMode PreviousMode { get; set; }
 }
 
 /// <summary>Plan file operation details indicating what changed.</summary>
@@ -7813,15 +7811,15 @@ public override bool? ManagedApprovalRequired
     public required string Url { get; set; }
 }
 
-/// <summary>Auto-approval judge information attached to a permission request. Present (non-null) only when the session's allow-all mode is "auto"; its absence means auto mode was off and the judge did not evaluate the request. The `recommendation` conveys the judge's disposition for this request.</summary>
-/// <remarks>Nested data type for <c>PermissionAutoApproval</c>.</remarks>
+/// <summary>Assisted-approval judge information attached to a permission request. Present only in assisted mode; its absence means the judge did not evaluate the request. The `recommendation` conveys the judge's disposition for this request.</summary>
+/// <remarks>Nested data type for <c>PermissionAssistedApproval</c>.</remarks>
 [Experimental(Diagnostics.Experimental)]
-public sealed partial class PermissionAutoApproval
+public sealed partial class PermissionAssistedApproval
 {
     /// <summary>Classified cause of an `error` recommendation. Absent for every other recommendation.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("failureReason")]
-    public AutoApprovalJudgeFailureReason? FailureReason { get; set; }
+    public AssistedApprovalJudgeFailureReason? FailureReason { get; set; }
 
     /// <summary>Model id that produced the recommendation, when the judge was consulted and reported one. Absent for `excluded` (the judge was not consulted) and for failures that occurred before a model was selected.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
@@ -7833,9 +7831,9 @@ public sealed partial class PermissionAutoApproval
     [JsonPropertyName("reason")]
     public string? Reason { get; set; }
 
-    /// <summary>The auto-approval safety judge's outcome for this request.</summary>
+    /// <summary>The assisted-approval safety judge's outcome for this request.</summary>
     [JsonPropertyName("recommendation")]
-    public required AutoApprovalRecommendation Recommendation { get; set; }
+    public required AssistedApprovalRecommendation Recommendation { get; set; }
 }
 
 /// <summary>Memory operation permission request.</summary>
@@ -7851,10 +7849,11 @@ public sealed partial class PermissionRequestMemory : PermissionRequest
     [JsonPropertyName("action")]
     public PermissionRequestMemoryAction? Action { get; set; }
 
-    /// <summary>Auto-approval judge information for this request; present only when auto mode is enabled.</summary>
+    /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
+    [Experimental(Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("autoApproval")]
-    public PermissionAutoApproval? AutoApproval { get; set; }
+    [JsonPropertyName("assistedApproval")]
+    public PermissionAssistedApproval? AssistedApproval { get; set; }
 
     /// <summary>Source references for the stored fact (store only).</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
@@ -8153,11 +8152,11 @@ public sealed partial class PermissionPromptRequestCommands : PermissionPromptRe
     [JsonIgnore]
     public override string Kind => "commands";
 
-    /// <summary>Auto-approval judge information for this request; present only when auto mode is enabled.</summary>
+    /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
     [Experimental(Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("autoApproval")]
-    public PermissionAutoApproval? AutoApproval { get; set; }
+    [JsonPropertyName("assistedApproval")]
+    public PermissionAssistedApproval? AssistedApproval { get; set; }
 
     /// <summary>Whether the UI can offer session-wide approval for this command pattern.</summary>
     [JsonPropertyName("canOfferSessionApproval")]
@@ -8199,11 +8198,11 @@ public sealed partial class PermissionPromptRequestWrite : PermissionPromptReque
     [JsonIgnore]
     public override string Kind => "write";
 
-    /// <summary>Auto-approval judge information for this request; present only when auto mode is enabled.</summary>
+    /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
     [Experimental(Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("autoApproval")]
-    public PermissionAutoApproval? AutoApproval { get; set; }
+    [JsonPropertyName("assistedApproval")]
+    public PermissionAssistedApproval? AssistedApproval { get; set; }
 
     /// <summary>Whether the UI can offer session-wide approval for file write operations.</summary>
     [JsonPropertyName("canOfferSessionApproval")]
@@ -8245,11 +8244,11 @@ public sealed partial class PermissionPromptRequestRead : PermissionPromptReques
     [JsonIgnore]
     public override string Kind => "read";
 
-    /// <summary>Auto-approval judge information for this request; present only when auto mode is enabled.</summary>
+    /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
     [Experimental(Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("autoApproval")]
-    public PermissionAutoApproval? AutoApproval { get; set; }
+    [JsonPropertyName("assistedApproval")]
+    public PermissionAssistedApproval? AssistedApproval { get; set; }
 
     /// <summary>Human-readable description of why the file is being read.</summary>
     [JsonPropertyName("intention")]
@@ -8283,11 +8282,11 @@ public sealed partial class PermissionPromptRequestMcp : PermissionPromptRequest
     [JsonPropertyName("args")]
     public JsonElement? Args { get; set; }
 
-    /// <summary>Auto-approval judge information for this request; present only when auto mode is enabled.</summary>
+    /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
     [Experimental(Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("autoApproval")]
-    public PermissionAutoApproval? AutoApproval { get; set; }
+    [JsonPropertyName("assistedApproval")]
+    public PermissionAssistedApproval? AssistedApproval { get; set; }
 
     /// <summary>Advisory runtime permission recommendation. The host remains responsible for deciding the request and may reject it.</summary>
     [Experimental(Diagnostics.Experimental)]
@@ -8321,11 +8320,11 @@ public sealed partial class PermissionPromptRequestUrl : PermissionPromptRequest
     [JsonIgnore]
     public override string Kind => "url";
 
-    /// <summary>Auto-approval judge information for this request; present only when auto mode is enabled.</summary>
+    /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
     [Experimental(Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("autoApproval")]
-    public PermissionAutoApproval? AutoApproval { get; set; }
+    [JsonPropertyName("assistedApproval")]
+    public PermissionAssistedApproval? AssistedApproval { get; set; }
 
     /// <summary>Human-readable description of why the URL is being accessed.</summary>
     [JsonPropertyName("intention")]
@@ -8374,11 +8373,11 @@ public sealed partial class PermissionPromptRequestMemory : PermissionPromptRequ
     [JsonPropertyName("action")]
     public PermissionRequestMemoryAction? Action { get; set; }
 
-    /// <summary>Auto-approval judge information for this request; present only when auto mode is enabled.</summary>
+    /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
     [Experimental(Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("autoApproval")]
-    public PermissionAutoApproval? AutoApproval { get; set; }
+    [JsonPropertyName("assistedApproval")]
+    public PermissionAssistedApproval? AssistedApproval { get; set; }
 
     /// <summary>Source references for the stored fact (store only).</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
@@ -8423,11 +8422,11 @@ public sealed partial class PermissionPromptRequestCustomTool : PermissionPrompt
     [JsonPropertyName("args")]
     public JsonElement? Args { get; set; }
 
-    /// <summary>Auto-approval judge information for this request; present only when auto mode is enabled.</summary>
+    /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
     [Experimental(Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("autoApproval")]
-    public PermissionAutoApproval? AutoApproval { get; set; }
+    [JsonPropertyName("assistedApproval")]
+    public PermissionAssistedApproval? AssistedApproval { get; set; }
 
     /// <summary>Tool call ID that triggered this permission request.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
@@ -8455,11 +8454,11 @@ public sealed partial class PermissionPromptRequestPath : PermissionPromptReques
     [JsonPropertyName("accessKind")]
     public required PermissionPromptRequestPathAccessKind AccessKind { get; set; }
 
-    /// <summary>Auto-approval judge information for this request; present only when auto mode is enabled.</summary>
+    /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
     [Experimental(Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("autoApproval")]
-    public PermissionAutoApproval? AutoApproval { get; set; }
+    [JsonPropertyName("assistedApproval")]
+    public PermissionAssistedApproval? AssistedApproval { get; set; }
 
     /// <summary>File paths that require explicit approval.</summary>
     [JsonPropertyName("paths")]
@@ -8479,11 +8478,11 @@ public sealed partial class PermissionPromptRequestHook : PermissionPromptReques
     [JsonIgnore]
     public override string Kind => "hook";
 
-    /// <summary>Auto-approval judge information for this request; present only when auto mode is enabled.</summary>
+    /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
     [Experimental(Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("autoApproval")]
-    public PermissionAutoApproval? AutoApproval { get; set; }
+    [JsonPropertyName("assistedApproval")]
+    public PermissionAssistedApproval? AssistedApproval { get; set; }
 
     /// <summary>Optional message from the hook explaining why confirmation is needed.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
@@ -8513,11 +8512,11 @@ public sealed partial class PermissionPromptRequestExtensionManagement : Permiss
     [JsonIgnore]
     public override string Kind => "extension-management";
 
-    /// <summary>Auto-approval judge information for this request; present only when auto mode is enabled.</summary>
+    /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
     [Experimental(Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("autoApproval")]
-    public PermissionAutoApproval? AutoApproval { get; set; }
+    [JsonPropertyName("assistedApproval")]
+    public PermissionAssistedApproval? AssistedApproval { get; set; }
 
     /// <summary>Name of the extension being managed.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
@@ -8546,11 +8545,11 @@ public sealed partial class PermissionPromptRequestFactory : PermissionPromptReq
     [JsonPropertyName("approvalKey")]
     public required string ApprovalKey { get; set; }
 
-    /// <summary>Auto-approval judge information for this request; present only when auto mode is enabled.</summary>
+    /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
     [Experimental(Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("autoApproval")]
-    public PermissionAutoApproval? AutoApproval { get; set; }
+    [JsonPropertyName("assistedApproval")]
+    public PermissionAssistedApproval? AssistedApproval { get; set; }
 
     /// <summary>Whether this factory is eligible for persistent approval.</summary>
     [JsonPropertyName("canPersistApproval")]
@@ -8631,11 +8630,11 @@ public sealed partial class PermissionPromptRequestExtensionPermissionAccess : P
     [JsonIgnore]
     public override string Kind => "extension-permission-access";
 
-    /// <summary>Auto-approval judge information for this request; present only when auto mode is enabled.</summary>
+    /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
     [Experimental(Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("autoApproval")]
-    public PermissionAutoApproval? AutoApproval { get; set; }
+    [JsonPropertyName("assistedApproval")]
+    public PermissionAssistedApproval? AssistedApproval { get; set; }
 
     /// <summary>Capabilities the extension is requesting.</summary>
     [JsonPropertyName("capabilities")]
@@ -8659,11 +8658,11 @@ public sealed partial class PermissionPromptRequestExtensionEnvAccess : Permissi
     [JsonIgnore]
     public override string Kind => "extension-env-access";
 
-    /// <summary>Auto-approval judge information for this request; present only when auto mode is enabled.</summary>
+    /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
     [Experimental(Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
-    [JsonPropertyName("autoApproval")]
-    public PermissionAutoApproval? AutoApproval { get; set; }
+    [JsonPropertyName("assistedApproval")]
+    public PermissionAssistedApproval? AssistedApproval { get; set; }
 
     /// <summary>Names of the sensitive environment variables the extension is requesting. Values never appear here.</summary>
     [JsonPropertyName("environmentVariables")]
@@ -10011,46 +10010,46 @@ public override void Write(Utf8JsonWriter writer, SessionMode value, JsonSeriali
     }
 }
 
-/// <summary>Allow-all mode for the session.</summary>
+/// <summary>Permission mode for the session.</summary>
 [Experimental(Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
-public readonly struct PermissionAllowAllMode : IEquatable<PermissionAllowAllMode>
+public readonly struct PermissionMode : IEquatable<PermissionMode>
 {
     private readonly string? _value;
 
-    /// <summary>Initializes a new instance of the <see cref="PermissionAllowAllMode"/> struct.</summary>
-    /// <param name="value">The value to associate with this <see cref="PermissionAllowAllMode"/>.</param>
+    /// <summary>Initializes a new instance of the <see cref="PermissionMode"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="PermissionMode"/>.</param>
     [JsonConstructor]
-    public PermissionAllowAllMode(string value)
+    public PermissionMode(string value)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(value);
         _value = value;
     }
 
-    /// <summary>Gets the value associated with this <see cref="PermissionAllowAllMode"/>.</summary>
+    /// <summary>Gets the value associated with this <see cref="PermissionMode"/>.</summary>
     public string Value => _value ?? string.Empty;
 
     /// <summary>Permission requests follow the normal approval flow.</summary>
-    public static PermissionAllowAllMode Off { get; } = new("off");
+    public static PermissionMode Manual { get; } = new("manual");
 
-    /// <summary>Tool, path, and URL permission requests are automatically approved.</summary>
-    public static PermissionAllowAllMode On { get; } = new("on");
+    /// <summary>Permission requests include an LLM safety recommendation; clients may automatically approve requests judged acceptable.</summary>
+    public static PermissionMode Assisted { get; } = new("assisted");
 
-    /// <summary>Permission requests follow the normal approval flow with an LLM advisory recommendation attached; clients may choose to auto-approve requests the judge evaluated as acceptable.</summary>
-    public static PermissionAllowAllMode Auto { get; } = new("auto");
+    /// <summary>Tool, path, and URL permission requests are automatically approved.</summary>
+    public static PermissionMode AllowAll { get; } = new("allow-all");
 
-    /// <summary>Returns a value indicating whether two <see cref="PermissionAllowAllMode"/> instances are equivalent.</summary>
-    public static bool operator ==(PermissionAllowAllMode left, PermissionAllowAllMode right) => left.Equals(right);
+    /// <summary>Returns a value indicating whether two <see cref="PermissionMode"/> instances are equivalent.</summary>
+    public static bool operator ==(PermissionMode left, PermissionMode right) => left.Equals(right);
 
-    /// <summary>Returns a value indicating whether two <see cref="PermissionAllowAllMode"/> instances are not equivalent.</summary>
-    public static bool operator !=(PermissionAllowAllMode left, PermissionAllowAllMode right) => !(left == right);
+    /// <summary>Returns a value indicating whether two <see cref="PermissionMode"/> instances are not equivalent.</summary>
+    public static bool operator !=(PermissionMode left, PermissionMode right) => !(left == right);
 
     /// <inheritdoc />
-    public override bool Equals(object? obj) => obj is PermissionAllowAllMode other && Equals(other);
+    public override bool Equals(object? obj) => obj is PermissionMode other && Equals(other);
 
     /// <inheritdoc />
-    public bool Equals(PermissionAllowAllMode other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+    public bool Equals(PermissionMode other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
     /// <inheritdoc />
     public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
@@ -10058,20 +10057,20 @@ public PermissionAllowAllMode(string value)
     /// <inheritdoc />
     public override string ToString() => Value;
 
-    /// <summary>Provides a <see cref="JsonConverter{PermissionAllowAllMode}"/> for serializing <see cref="PermissionAllowAllMode"/> instances.</summary>
+    /// <summary>Provides a <see cref="JsonConverter{PermissionMode}"/> for serializing <see cref="PermissionMode"/> instances.</summary>
     [EditorBrowsable(EditorBrowsableState.Never)]
-    public sealed class Converter : JsonConverter<PermissionAllowAllMode>
+    public sealed class Converter : JsonConverter<PermissionMode>
     {
         /// <inheritdoc />
-        public override PermissionAllowAllMode Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        public override PermissionMode Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
         {
             return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
         }
 
         /// <inheritdoc />
-        public override void Write(Utf8JsonWriter writer, PermissionAllowAllMode value, JsonSerializerOptions options)
+        public override void Write(Utf8JsonWriter writer, PermissionMode value, JsonSerializerOptions options)
         {
-            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(PermissionAllowAllMode));
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(PermissionMode));
         }
     }
 }
@@ -12209,52 +12208,52 @@ public override void Write(Utf8JsonWriter writer, PermissionRequestMemoryAction
     }
 }
 
-/// <summary>Why the auto-approval judge produced no usable recommendation. Present only alongside an `error` recommendation, where the human-readable reason is a fixed string and therefore cannot distinguish these cases. Intended to make a judge failure reportable by a consumer that has no access to the host's logs.</summary>
+/// <summary>Why the assisted-approval judge produced no usable recommendation. Present only alongside an `error` recommendation, where the human-readable reason is a fixed string and therefore cannot distinguish these cases. Intended to make a judge failure reportable by a consumer that has no access to the host's logs.</summary>
 [Experimental(Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
-public readonly struct AutoApprovalJudgeFailureReason : IEquatable<AutoApprovalJudgeFailureReason>
+public readonly struct AssistedApprovalJudgeFailureReason : IEquatable<AssistedApprovalJudgeFailureReason>
 {
     private readonly string? _value;
 
-    /// <summary>Initializes a new instance of the <see cref="AutoApprovalJudgeFailureReason"/> struct.</summary>
-    /// <param name="value">The value to associate with this <see cref="AutoApprovalJudgeFailureReason"/>.</param>
+    /// <summary>Initializes a new instance of the <see cref="AssistedApprovalJudgeFailureReason"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="AssistedApprovalJudgeFailureReason"/>.</param>
     [JsonConstructor]
-    public AutoApprovalJudgeFailureReason(string value)
+    public AssistedApprovalJudgeFailureReason(string value)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(value);
         _value = value;
     }
 
-    /// <summary>Gets the value associated with this <see cref="AutoApprovalJudgeFailureReason"/>.</summary>
+    /// <summary>Gets the value associated with this <see cref="AssistedApprovalJudgeFailureReason"/>.</summary>
     public string Value => _value ?? string.Empty;
 
     /// <summary>The judge model call exceeded its deadline.</summary>
-    public static AutoApprovalJudgeFailureReason Timeout { get; } = new("timeout");
+    public static AssistedApprovalJudgeFailureReason Timeout { get; } = new("timeout");
 
     /// <summary>The judge model call was cancelled before it returned.</summary>
-    public static AutoApprovalJudgeFailureReason Abort { get; } = new("abort");
+    public static AssistedApprovalJudgeFailureReason Abort { get; } = new("abort");
 
     /// <summary>The judge model call completed but returned no content.</summary>
-    public static AutoApprovalJudgeFailureReason EmptyResponse { get; } = new("empty_response");
+    public static AssistedApprovalJudgeFailureReason EmptyResponse { get; } = new("empty_response");
 
     /// <summary>The judge model call failed (for example a transport, authentication, or rate-limit error).</summary>
-    public static AutoApprovalJudgeFailureReason ModelError { get; } = new("model_error");
+    public static AssistedApprovalJudgeFailureReason ModelError { get; } = new("model_error");
 
     /// <summary>The judge model replied, but the reply carried no ALLOW/DENY verdict.</summary>
-    public static AutoApprovalJudgeFailureReason ParseError { get; } = new("parse_error");
+    public static AssistedApprovalJudgeFailureReason ParseError { get; } = new("parse_error");
 
-    /// <summary>Returns a value indicating whether two <see cref="AutoApprovalJudgeFailureReason"/> instances are equivalent.</summary>
-    public static bool operator ==(AutoApprovalJudgeFailureReason left, AutoApprovalJudgeFailureReason right) => left.Equals(right);
+    /// <summary>Returns a value indicating whether two <see cref="AssistedApprovalJudgeFailureReason"/> instances are equivalent.</summary>
+    public static bool operator ==(AssistedApprovalJudgeFailureReason left, AssistedApprovalJudgeFailureReason right) => left.Equals(right);
 
-    /// <summary>Returns a value indicating whether two <see cref="AutoApprovalJudgeFailureReason"/> instances are not equivalent.</summary>
-    public static bool operator !=(AutoApprovalJudgeFailureReason left, AutoApprovalJudgeFailureReason right) => !(left == right);
+    /// <summary>Returns a value indicating whether two <see cref="AssistedApprovalJudgeFailureReason"/> instances are not equivalent.</summary>
+    public static bool operator !=(AssistedApprovalJudgeFailureReason left, AssistedApprovalJudgeFailureReason right) => !(left == right);
 
     /// <inheritdoc />
-    public override bool Equals(object? obj) => obj is AutoApprovalJudgeFailureReason other && Equals(other);
+    public override bool Equals(object? obj) => obj is AssistedApprovalJudgeFailureReason other && Equals(other);
 
     /// <inheritdoc />
-    public bool Equals(AutoApprovalJudgeFailureReason other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+    public bool Equals(AssistedApprovalJudgeFailureReason other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
     /// <inheritdoc />
     public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
@@ -12262,67 +12261,67 @@ public AutoApprovalJudgeFailureReason(string value)
     /// <inheritdoc />
     public override string ToString() => Value;
 
-    /// <summary>Provides a <see cref="JsonConverter{AutoApprovalJudgeFailureReason}"/> for serializing <see cref="AutoApprovalJudgeFailureReason"/> instances.</summary>
+    /// <summary>Provides a <see cref="JsonConverter{AssistedApprovalJudgeFailureReason}"/> for serializing <see cref="AssistedApprovalJudgeFailureReason"/> instances.</summary>
     [EditorBrowsable(EditorBrowsableState.Never)]
-    public sealed class Converter : JsonConverter<AutoApprovalJudgeFailureReason>
+    public sealed class Converter : JsonConverter<AssistedApprovalJudgeFailureReason>
     {
         /// <inheritdoc />
-        public override AutoApprovalJudgeFailureReason Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        public override AssistedApprovalJudgeFailureReason Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
         {
             return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
         }
 
         /// <inheritdoc />
-        public override void Write(Utf8JsonWriter writer, AutoApprovalJudgeFailureReason value, JsonSerializerOptions options)
+        public override void Write(Utf8JsonWriter writer, AssistedApprovalJudgeFailureReason value, JsonSerializerOptions options)
         {
-            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(AutoApprovalJudgeFailureReason));
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(AssistedApprovalJudgeFailureReason));
         }
     }
 }
 
-/// <summary>Outcome of the auto-approval safety judge for a permission request. Present only when auto mode is enabled; its absence means the judge did not evaluate the request (auto mode was off).</summary>
+/// <summary>Outcome of the assisted-approval safety judge for a permission request. Present only in assisted mode; its absence means the judge did not evaluate the request.</summary>
 [Experimental(Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
-public readonly struct AutoApprovalRecommendation : IEquatable<AutoApprovalRecommendation>
+public readonly struct AssistedApprovalRecommendation : IEquatable<AssistedApprovalRecommendation>
 {
     private readonly string? _value;
 
-    /// <summary>Initializes a new instance of the <see cref="AutoApprovalRecommendation"/> struct.</summary>
-    /// <param name="value">The value to associate with this <see cref="AutoApprovalRecommendation"/>.</param>
+    /// <summary>Initializes a new instance of the <see cref="AssistedApprovalRecommendation"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="AssistedApprovalRecommendation"/>.</param>
     [JsonConstructor]
-    public AutoApprovalRecommendation(string value)
+    public AssistedApprovalRecommendation(string value)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(value);
         _value = value;
     }
 
-    /// <summary>Gets the value associated with this <see cref="AutoApprovalRecommendation"/>.</summary>
+    /// <summary>Gets the value associated with this <see cref="AssistedApprovalRecommendation"/>.</summary>
     public string Value => _value ?? string.Empty;
 
     /// <summary>The judge evaluated the request and recommends automatically approving it.</summary>
-    public static AutoApprovalRecommendation Approve { get; } = new("approve");
+    public static AssistedApprovalRecommendation Approve { get; } = new("approve");
 
-    /// <summary>The judge evaluated the request and does not recommend auto-approving it; explicit approval is required. Whether that means prompting, denying, or something else is the consumer's decision.</summary>
-    public static AutoApprovalRecommendation RequireApproval { get; } = new("requireApproval");
+    /// <summary>The judge evaluated the request and does not recommend automatically approving it; explicit approval is required. Whether that means prompting, denying, or something else is the consumer's decision.</summary>
+    public static AssistedApprovalRecommendation RequireApproval { get; } = new("requireApproval");
 
-    /// <summary>Auto mode is enabled, but this request category is never auto-approvable (for example, sandbox-bypass requests), so the judge was not consulted.</summary>
-    public static AutoApprovalRecommendation Excluded { get; } = new("excluded");
+    /// <summary>Assisted mode is enabled, but this request category is never automatically approvable (for example, sandbox-bypass requests), so the judge was not consulted.</summary>
+    public static AssistedApprovalRecommendation Excluded { get; } = new("excluded");
 
     /// <summary>The judge was consulted but did not return a usable recommendation, so the request requires explicit approval.</summary>
-    public static AutoApprovalRecommendation Error { get; } = new("error");
+    public static AssistedApprovalRecommendation Error { get; } = new("error");
 
-    /// <summary>Returns a value indicating whether two <see cref="AutoApprovalRecommendation"/> instances are equivalent.</summary>
-    public static bool operator ==(AutoApprovalRecommendation left, AutoApprovalRecommendation right) => left.Equals(right);
+    /// <summary>Returns a value indicating whether two <see cref="AssistedApprovalRecommendation"/> instances are equivalent.</summary>
+    public static bool operator ==(AssistedApprovalRecommendation left, AssistedApprovalRecommendation right) => left.Equals(right);
 
-    /// <summary>Returns a value indicating whether two <see cref="AutoApprovalRecommendation"/> instances are not equivalent.</summary>
-    public static bool operator !=(AutoApprovalRecommendation left, AutoApprovalRecommendation right) => !(left == right);
+    /// <summary>Returns a value indicating whether two <see cref="AssistedApprovalRecommendation"/> instances are not equivalent.</summary>
+    public static bool operator !=(AssistedApprovalRecommendation left, AssistedApprovalRecommendation right) => !(left == right);
 
     /// <inheritdoc />
-    public override bool Equals(object? obj) => obj is AutoApprovalRecommendation other && Equals(other);
+    public override bool Equals(object? obj) => obj is AssistedApprovalRecommendation other && Equals(other);
 
     /// <inheritdoc />
-    public bool Equals(AutoApprovalRecommendation other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+    public bool Equals(AssistedApprovalRecommendation other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
 
     /// <inheritdoc />
     public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
@@ -12330,20 +12329,20 @@ public AutoApprovalRecommendation(string value)
     /// <inheritdoc />
     public override string ToString() => Value;
 
-    /// <summary>Provides a <see cref="JsonConverter{AutoApprovalRecommendation}"/> for serializing <see cref="AutoApprovalRecommendation"/> instances.</summary>
+    /// <summary>Provides a <see cref="JsonConverter{AssistedApprovalRecommendation}"/> for serializing <see cref="AssistedApprovalRecommendation"/> instances.</summary>
     [EditorBrowsable(EditorBrowsableState.Never)]
-    public sealed class Converter : JsonConverter<AutoApprovalRecommendation>
+    public sealed class Converter : JsonConverter<AssistedApprovalRecommendation>
     {
         /// <inheritdoc />
-        public override AutoApprovalRecommendation Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        public override AssistedApprovalRecommendation Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
         {
             return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
         }
 
         /// <inheritdoc />
-        public override void Write(Utf8JsonWriter writer, AutoApprovalRecommendation value, JsonSerializerOptions options)
+        public override void Write(Utf8JsonWriter writer, AssistedApprovalRecommendation value, JsonSerializerOptions options)
         {
-            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(AutoApprovalRecommendation));
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(AssistedApprovalRecommendation));
         }
     }
 }
@@ -13389,14 +13388,14 @@ public ManagedSettingsEnforcedEscalation(string value)
     /// <summary>Gets the value associated with this <see cref="ManagedSettingsEnforcedEscalation"/>.</summary>
     public string Value => _value ?? string.Empty;
 
-    /// <summary>Full allow-all ("/allow-all on") permissions — auto-approving tools, paths, and URLs.</summary>
+    /// <summary>Full allow-all permissions — automatically approving tools, paths, and URLs.</summary>
     public static ManagedSettingsEnforcedEscalation AllowAll { get; } = new("allow_all");
 
-    /// <summary>Auto-approval of all tool permission requests.</summary>
+    /// <summary>Automatic approval of all tool permission requests.</summary>
     public static ManagedSettingsEnforcedEscalation ApproveAll { get; } = new("approve_all");
 
-    /// <summary>Advisory auto-approval ("/allow-all auto") mode — keeps normal prompt paths and adds LLM-advised approval, distinct from full allow-all.</summary>
-    public static ManagedSettingsEnforcedEscalation AutoApproval { get; } = new("auto_approval");
+    /// <summary>Assisted mode — keeps normal prompt paths and adds an LLM recommendation, distinct from allow-all.</summary>
+    public static ManagedSettingsEnforcedEscalation AssistedApproval { get; } = new("assisted_approval");
 
     /// <summary>Unrestricted filesystem access outside the session's allowed directories.</summary>
     public static ManagedSettingsEnforcedEscalation UnrestrictedPaths { get; } = new("unrestricted_paths");
@@ -14155,7 +14154,7 @@ public override void Write(Utf8JsonWriter writer, ExtensionsLoadedExtensionStatu
 [JsonSerializable(typeof(OmittedBinaryResult))]
 [JsonSerializable(typeof(PendingMessagesModifiedData))]
 [JsonSerializable(typeof(PendingMessagesModifiedEvent))]
-[JsonSerializable(typeof(PermissionAutoApproval))]
+[JsonSerializable(typeof(PermissionAssistedApproval))]
 [JsonSerializable(typeof(PermissionCompletedData))]
 [JsonSerializable(typeof(PermissionCompletedEvent))]
 [JsonSerializable(typeof(PermissionPromptRequest))]
diff --git a/dotnet/test/E2E/RewindE2ETests.cs b/dotnet/test/E2E/RewindE2ETests.cs
index ced06b93f7..75aa328abe 100644
--- a/dotnet/test/E2E/RewindE2ETests.cs
+++ b/dotnet/test/E2E/RewindE2ETests.cs
@@ -42,10 +42,13 @@ await TestHelper.WaitForConditionAsync(
             async () =>
             {
                 rewindPoints = await session.Rpc.History.ListRewindPointsAsync();
-                return rewindPoints.UnavailableReason is null;
+                return rewindPoints.UnavailableReason is null
+                    && rewindPoints.Points.Count == 1
+                    && rewindPoints.Points[0].CanRestoreFiles
+                    && rewindPoints.Points[0].FileCount == 1;
             },
             timeout: TimeSpan.FromSeconds(10),
-            timeoutMessage: "Timed out waiting for rewind points to become available.",
+            timeoutMessage: "Timed out waiting for a restorable file rewind point.",
             pollInterval: TimeSpan.FromMilliseconds(100));
 
         Assert.NotNull(rewindPoints);
diff --git a/dotnet/test/E2E/RpcSessionStateExtrasE2ETests.cs b/dotnet/test/E2E/RpcSessionStateExtrasE2ETests.cs
index 28ec9b7cfe..72663c35a4 100644
--- a/dotnet/test/E2E/RpcSessionStateExtrasE2ETests.cs
+++ b/dotnet/test/E2E/RpcSessionStateExtrasE2ETests.cs
@@ -12,7 +12,7 @@ namespace GitHub.Copilot.Test.E2E;
 /// <summary>
 /// E2E coverage for session-scoped RPC methods that were previously untested:
 /// completions, model.list, metadata.activity/context attribution/heaviest messages,
-/// permissions.getAllowAll/setAllowAll, plan.readSqlTodos, provider.add,
+/// permissions.getMode/setMode, plan.readSqlTodos, provider.add,
 /// telemetry.getEngagementId, tools.getCurrentMetadata/updateSubagentSettings,
 /// session visibility, and the session-scoped plugins.reload.
 /// </summary>
@@ -158,22 +158,22 @@ public async Task Should_Get_And_Set_AllowAll_Permissions()
 
         try
         {
-            var initial = await session.Rpc.Permissions.GetAllowAllAsync();
-            Assert.False(initial.Enabled, "Allow-all should be disabled on a fresh session.");
+            var initial = await session.Rpc.Permissions.GetModeAsync();
+            Assert.Equal(PermissionMode.Manual, initial.Mode);
 
-            var enable = await session.Rpc.Permissions.SetAllowAllAsync(enabled: true);
+            var enable = await session.Rpc.Permissions.SetModeAsync(PermissionMode.AllowAll);
             Assert.True(enable.Success);
-            Assert.True(enable.Enabled);
-            Assert.True((await session.Rpc.Permissions.GetAllowAllAsync()).Enabled);
+            Assert.Equal(PermissionMode.AllowAll, enable.Mode);
+            Assert.Equal(PermissionMode.AllowAll, (await session.Rpc.Permissions.GetModeAsync()).Mode);
 
-            var disable = await session.Rpc.Permissions.SetAllowAllAsync(enabled: false);
+            var disable = await session.Rpc.Permissions.SetModeAsync(PermissionMode.Manual);
             Assert.True(disable.Success);
-            Assert.False(disable.Enabled);
-            Assert.False((await session.Rpc.Permissions.GetAllowAllAsync()).Enabled);
+            Assert.Equal(PermissionMode.Manual, disable.Mode);
+            Assert.Equal(PermissionMode.Manual, (await session.Rpc.Permissions.GetModeAsync()).Mode);
         }
         finally
         {
-            await session.Rpc.Permissions.SetAllowAllAsync(enabled: false);
+            await session.Rpc.Permissions.SetModeAsync(PermissionMode.Manual);
         }
     }
 
diff --git a/dotnet/test/E2E/RpcUiEphemeralQueryE2ETests.cs b/dotnet/test/E2E/RpcUiEphemeralQueryE2ETests.cs
index 428cb78526..8fbf0d571d 100644
--- a/dotnet/test/E2E/RpcUiEphemeralQueryE2ETests.cs
+++ b/dotnet/test/E2E/RpcUiEphemeralQueryE2ETests.cs
@@ -19,10 +19,10 @@ namespace GitHub.Copilot.Test.E2E;
 public class RpcUiEphemeralQueryE2ETests(E2ETestFixture fixture, ITestOutputHelper output)
     : E2ETestBase(fixture, "rpc_ui_ephemeral_query", output)
 {
-    // TODO(cli-1.0.81-2): CLI 1.0.81-2 fails session.ui.ephemeralQuery against the recorded
-    // snapshot ("Failed to get response from the AI model"). Re-enable once the runtime
-    // fix ships.
-    [Fact(Skip = "Blocked on CLI 1.0.81-2 session.ui.ephemeralQuery regression")]
+    // TODO(cli-1.0.81-2): CLI 1.0.81-4 still fails session.ui.ephemeralQuery against the
+    // recorded snapshot ("Failed to get response from the AI model"). Re-enable once the
+    // runtime fix ships.
+    [Fact(Skip = "Blocked on CLI 1.0.81-4 session.ui.ephemeralQuery regression")]
     public async Task Should_Answer_Ephemeral_Query()
     {
         await using var session = await CreateSessionAsync();
diff --git a/go/inprocess_disabled.go b/go/inprocess_disabled.go
index b86ed5ca36..d0626a74d3 100644
--- a/go/inprocess_disabled.go
+++ b/go/inprocess_disabled.go
@@ -6,6 +6,8 @@ import "errors"
 
 const inProcessAvailable = false
 
+var errInProcessUnavailable = errors.New("in-process transport unavailable")
+
 func createInProcessHost(string, inProcessHostConfig) (inProcessHost, error) {
-	return nil, errors.New("in-process transport unavailable")
+	return nil, errInProcessUnavailable
 }
diff --git a/go/internal/e2e/abort_e2e_test.go b/go/internal/e2e/abort_e2e_test.go
index 0953456888..569518bca7 100644
--- a/go/internal/e2e/abort_e2e_test.go
+++ b/go/internal/e2e/abort_e2e_test.go
@@ -32,6 +32,7 @@ func TestAbortE2E(t *testing.T) {
 		var mu sync.Mutex
 		var events []copilot.SessionEvent
 		firstDelta := make(chan *copilot.AssistantMessageDeltaData, 1)
+		sessionIdle := make(chan struct{}, 1)
 
 		session.On(func(event copilot.SessionEvent) {
 			mu.Lock()
@@ -43,6 +44,12 @@ func TestAbortE2E(t *testing.T) {
 				default:
 				}
 			}
+			if _, ok := event.Data.(*copilot.SessionIdleData); ok {
+				select {
+				case sessionIdle <- struct{}{}:
+				default:
+				}
+			}
 		})
 
 		// Fire-and-forget — we'll abort before it finishes
@@ -67,6 +74,11 @@ func TestAbortE2E(t *testing.T) {
 		if err := session.Abort(t.Context()); err != nil {
 			t.Fatalf("Abort failed: %v", err)
 		}
+		select {
+		case <-sessionIdle:
+		case <-time.After(60 * time.Second):
+			t.Fatal("Timed out waiting for session to become idle after abort")
+		}
 
 		mu.Lock()
 		snapshot := make([]copilot.SessionEvent, len(events))
@@ -85,33 +97,15 @@ func TestAbortE2E(t *testing.T) {
 			t.Error("Expected at least one assistant.message_delta event before abort")
 		}
 
-		// Session should be usable after abort. Wait for the specific recovery
-		// message rather than racing against a late idle from the aborted turn.
-		recoveryReceived := make(chan *copilot.AssistantMessageData, 1)
-		session.On(func(event copilot.SessionEvent) {
-			if d, ok := event.Data.(*copilot.AssistantMessageData); ok {
-				if strings.Contains(strings.ToLower(d.Content), "abort_recovery_ok") {
-					select {
-					case recoveryReceived <- d:
-					default:
-					}
-				}
-			}
+		// Session should be usable after abort.
+		msg, err := session.SendAndWait(t.Context(), copilot.MessageOptions{
+			Prompt: "Say 'abort_recovery_ok'.",
 		})
-
-		go func() {
-			_, _ = session.Send(t.Context(), copilot.MessageOptions{
-				Prompt: "Say 'abort_recovery_ok'.",
-			})
-		}()
-
-		select {
-		case msg := <-recoveryReceived:
-			if !strings.Contains(strings.ToLower(msg.Content), "abort_recovery_ok") {
-				t.Errorf("Expected recovery message to contain 'abort_recovery_ok', got %q", msg.Content)
-			}
-		case <-time.After(60 * time.Second):
-			t.Fatal("Timed out waiting for recovery message after abort")
+		if err != nil {
+			t.Fatalf("Recovery SendAndWait failed after abort: %v", err)
+		}
+		if content := assistantContent(t, msg); !strings.Contains(strings.ToLower(content), "abort_recovery_ok") {
+			t.Errorf("Expected recovery message to contain 'abort_recovery_ok', got %q", content)
 		}
 	})
 
@@ -144,6 +138,16 @@ func TestAbortE2E(t *testing.T) {
 		}
 		t.Cleanup(func() { _ = session.Disconnect() })
 
+		sessionIdle := make(chan struct{}, 1)
+		session.On(func(event copilot.SessionEvent) {
+			if _, ok := event.Data.(*copilot.SessionIdleData); ok {
+				select {
+				case sessionIdle <- struct{}{}:
+				default:
+				}
+			}
+		})
+
 		// Fire-and-forget
 		go func() {
 			_, _ = session.Send(t.Context(), copilot.MessageOptions{
@@ -172,33 +176,21 @@ func TestAbortE2E(t *testing.T) {
 		case releaseTool <- "RELEASED_AFTER_ABORT":
 		default:
 		}
-
-		// Session should be usable after abort
-		recoveryReceived := make(chan *copilot.AssistantMessageData, 1)
-		session.On(func(event copilot.SessionEvent) {
-			if d, ok := event.Data.(*copilot.AssistantMessageData); ok {
-				if strings.Contains(d.Content, "tool_abort_recovery_ok") {
-					select {
-					case recoveryReceived <- d:
-					default:
-					}
-				}
-			}
-		})
-
-		go func() {
-			_, _ = session.Send(t.Context(), copilot.MessageOptions{
-				Prompt: "Say 'tool_abort_recovery_ok'.",
-			})
-		}()
-
 		select {
-		case msg := <-recoveryReceived:
-			if !strings.Contains(msg.Content, "tool_abort_recovery_ok") {
-				t.Errorf("Expected recovery message to contain 'tool_abort_recovery_ok', got %q", msg.Content)
-			}
+		case <-sessionIdle:
 		case <-time.After(60 * time.Second):
-			t.Fatal("Timed out waiting for recovery message after abort")
+			t.Fatal("Timed out waiting for session to become idle after tool abort")
+		}
+
+		// Session should be usable after abort.
+		msg, err := session.SendAndWait(t.Context(), copilot.MessageOptions{
+			Prompt: "Say 'tool_abort_recovery_ok'.",
+		})
+		if err != nil {
+			t.Fatalf("Recovery SendAndWait failed after tool abort: %v", err)
+		}
+		if content := assistantContent(t, msg); !strings.Contains(content, "tool_abort_recovery_ok") {
+			t.Errorf("Expected recovery message to contain 'tool_abort_recovery_ok', got %q", content)
 		}
 	})
 }
diff --git a/go/internal/e2e/rpc_session_state_extras_e2e_test.go b/go/internal/e2e/rpc_session_state_extras_e2e_test.go
index 1e33e8a8bc..99dc0b7572 100644
--- a/go/internal/e2e/rpc_session_state_extras_e2e_test.go
+++ b/go/internal/e2e/rpc_session_state_extras_e2e_test.go
@@ -70,45 +70,45 @@ func TestRpcSessionStateExtras(t *testing.T) {
 		session := createPortedSession(t, client, nil)
 		defer session.Disconnect()
 		defer func() {
-			_, _ = session.RPC.Permissions.SetAllowAll(t.Context(), &rpc.PermissionsSetAllowAllRequest{Enabled: copilot.Bool(false)})
+			_, _ = session.RPC.Permissions.SetMode(t.Context(), &rpc.PermissionsSetModeRequest{Mode: rpc.PermissionModeManual})
 		}()
 
-		initial, err := session.RPC.Permissions.GetAllowAll(t.Context())
+		initial, err := session.RPC.Permissions.GetMode(t.Context())
 		if err != nil {
-			t.Fatalf("Permissions.GetAllowAll initial failed: %v", err)
+			t.Fatalf("Permissions.GetMode initial failed: %v", err)
 		}
-		if initial.Enabled {
-			t.Fatal("Allow-all should be disabled on a fresh session")
+		if initial.Mode != rpc.PermissionModeManual {
+			t.Fatalf("Expected manual mode on a fresh session, got %q", initial.Mode)
 		}
 
-		enable, err := session.RPC.Permissions.SetAllowAll(t.Context(), &rpc.PermissionsSetAllowAllRequest{Enabled: copilot.Bool(true)})
+		enable, err := session.RPC.Permissions.SetMode(t.Context(), &rpc.PermissionsSetModeRequest{Mode: rpc.PermissionModeAllowAll})
 		if err != nil {
-			t.Fatalf("Permissions.SetAllowAll(true) failed: %v", err)
+			t.Fatalf("Permissions.SetMode(allow-all) failed: %v", err)
 		}
-		if !enable.Success || !enable.Enabled {
-			t.Fatalf("Expected successful enable, got %+v", enable)
+		if !enable.Success || enable.Mode != rpc.PermissionModeAllowAll {
+			t.Fatalf("Expected successful allow-all mode change, got %+v", enable)
 		}
-		afterEnable, err := session.RPC.Permissions.GetAllowAll(t.Context())
+		afterEnable, err := session.RPC.Permissions.GetMode(t.Context())
 		if err != nil {
-			t.Fatalf("Permissions.GetAllowAll after enable failed: %v", err)
+			t.Fatalf("Permissions.GetMode after allow-all failed: %v", err)
 		}
-		if !afterEnable.Enabled {
-			t.Fatal("Expected allow-all to be enabled")
+		if afterEnable.Mode != rpc.PermissionModeAllowAll {
+			t.Fatalf("Expected allow-all mode, got %q", afterEnable.Mode)
 		}
 
-		disable, err := session.RPC.Permissions.SetAllowAll(t.Context(), &rpc.PermissionsSetAllowAllRequest{Enabled: copilot.Bool(false)})
+		disable, err := session.RPC.Permissions.SetMode(t.Context(), &rpc.PermissionsSetModeRequest{Mode: rpc.PermissionModeManual})
 		if err != nil {
-			t.Fatalf("Permissions.SetAllowAll(false) failed: %v", err)
+			t.Fatalf("Permissions.SetMode(manual) failed: %v", err)
 		}
-		if !disable.Success || disable.Enabled {
-			t.Fatalf("Expected successful disable, got %+v", disable)
+		if !disable.Success || disable.Mode != rpc.PermissionModeManual {
+			t.Fatalf("Expected successful manual mode change, got %+v", disable)
 		}
-		afterDisable, err := session.RPC.Permissions.GetAllowAll(t.Context())
+		afterDisable, err := session.RPC.Permissions.GetMode(t.Context())
 		if err != nil {
-			t.Fatalf("Permissions.GetAllowAll after disable failed: %v", err)
+			t.Fatalf("Permissions.GetMode after manual failed: %v", err)
 		}
-		if afterDisable.Enabled {
-			t.Fatal("Expected allow-all to be disabled")
+		if afterDisable.Mode != rpc.PermissionModeManual {
+			t.Fatalf("Expected manual mode, got %q", afterDisable.Mode)
 		}
 	})
 
diff --git a/go/internal/e2e/rpc_ui_ephemeral_query_e2e_test.go b/go/internal/e2e/rpc_ui_ephemeral_query_e2e_test.go
index 073af7d91b..413187abd1 100644
--- a/go/internal/e2e/rpc_ui_ephemeral_query_e2e_test.go
+++ b/go/internal/e2e/rpc_ui_ephemeral_query_e2e_test.go
@@ -14,10 +14,10 @@ func TestRpcUiEphemeralQuery(t *testing.T) {
 	t.Cleanup(func() { client.ForceStop() })
 
 	t.Run("should_answer_ephemeral_query", func(t *testing.T) {
-		// TODO(cli-1.0.81-2): CLI 1.0.81-2 fails session.ui.ephemeralQuery against the
+		// TODO(cli-1.0.81-2): CLI 1.0.81-4 still fails session.ui.ephemeralQuery against the
 		// recorded snapshot ("Failed to get response from the AI model"). Re-enable once
 		// the runtime fix ships.
-		t.Skip("blocked on CLI 1.0.81-2 session.ui.ephemeralQuery regression")
+		t.Skip("blocked on CLI 1.0.81-4 session.ui.ephemeralQuery regression")
 
 		ctx.ConfigureForTest(t)
 		session := createPortedSession(t, client, nil)
diff --git a/go/rpc/zrpc.go b/go/rpc/zrpc.go
index 3a31d4c814..d8735313a9 100644
--- a/go/rpc/zrpc.go
+++ b/go/rpc/zrpc.go
@@ -461,28 +461,6 @@ type AgentsGetDiscoveryPathsRequest struct {
 	ProjectPaths []string `json:"projectPaths,omitzero"`
 }
 
-// Indicates whether the operation succeeded and reports the post-mutation state.
-// Experimental: AllowAllPermissionSetResult is part of an experimental API and may change
-// or be removed.
-type AllowAllPermissionSetResult struct {
-	// Authoritative full allow-all state after the mutation
-	Enabled bool `json:"enabled"`
-	// Authoritative allow-all mode after the mutation
-	Mode *PermissionsAllowAllMode `json:"mode,omitempty"`
-	// Whether the operation succeeded
-	Success bool `json:"success"`
-}
-
-// Current allow-all permission mode.
-// Experimental: AllowAllPermissionState is part of an experimental API and may change or be
-// removed.
-type AllowAllPermissionState struct {
-	// Whether full allow-all permissions are currently active
-	Enabled bool `json:"enabled"`
-	// Current allow-all mode
-	Mode *PermissionsAllowAllMode `json:"mode,omitempty"`
-}
-
 // A user message attachment — a file, directory, code selection, blob, GitHub-anchored
 // pointer, or extension-supplied context payload
 // Experimental: Attachment is part of an experimental API and may change or be removed.
@@ -1366,6 +1344,473 @@ type CapiSessionOptions struct {
 	EnableWebSocketResponses *bool `json:"enableWebSocketResponses,omitempty"`
 }
 
+// Semantic digest of a strictly parsed and schema-validated JSON MCP card. Both URL-backed
+// and embedded cards are canonicalised with RFC 8785 JSON Canonicalization Scheme, encoded
+// as UTF-8, and hashed with SHA-256.
+// Experimental: CardDigest is part of an experimental API and may change or be removed.
+type CardDigest struct {
+	// Digest algorithm and canonical representation
+	Algorithm CardDigestAlgorithm `json:"algorithm"`
+	// SHA-256 digest of the RFC 8785 canonical UTF-8 bytes, encoded as exactly 64 lowercase
+	// hexadecimal characters.
+	Value string `json:"value"`
+}
+
+// SHA-256 digest encoded as exactly 64 lowercase hexadecimal characters.
+// Experimental: CardDigestValue is part of an experimental API and may change or be removed.
+type CardDigestValue string
+
+// Where and when an AI skill catalog reference was observed. Discovery provenance
+// deliberately carries no content digest because search does not establish the exact
+// validated content a later plan will bind.
+// Experimental: CatalogAiSkillCandidateProvenance is part of an experimental API and may
+// change or be removed.
+type CatalogAiSkillCandidateProvenance struct {
+	// Host of the catalog authority that advertised the reference, without path, query, or
+	// credentials. Inert untrusted data.
+	Authority string `json:"authority"`
+	// Media type advertised for the referenced AI skill card
+	MediaType CatalogAiSkillCandidateProvenanceMediaType `json:"mediaType"`
+	// ISO 8601 timestamp at which the runtime observed the catalog reference. This is not a
+	// retrieval or validation timestamp.
+	ObservedAt string `json:"observedAt"`
+}
+
+// One inert catalog result, represented as an MCP server or discovery-only AI skill variant
+// so kind, media type, provenance, and installability cannot contradict each other.
+// Experimental: CatalogCandidate is part of an experimental API and may change or be
+// removed.
+type CatalogCandidate interface {
+	catalogCandidate()
+	Kind() CatalogCandidateKind
+}
+
+type RawCatalogCandidateData struct {
+	Discriminator CatalogCandidateKind
+	Raw           json.RawMessage
+}
+
+func (RawCatalogCandidateData) catalogCandidate() {}
+func (r RawCatalogCandidateData) Kind() CatalogCandidateKind {
+	return r.Discriminator
+}
+
+// An inert AI skill catalog result. AI skills are discovery-only and cannot be represented
+// as installable through this surface.
+// Experimental: CatalogAiSkillCandidate is part of an experimental API and may change or be
+// removed.
+type CatalogAiSkillCandidate struct {
+	// Description taken verbatim from the card. Inert untrusted text.
+	Description *string `json:"description,omitempty"`
+	// Display name taken verbatim from the card. Inert untrusted text.
+	DisplayName string `json:"displayName"`
+	// Opaque, runtime-instance scoped, TTL-bound, single-use handle for this candidate. Carries
+	// no readable information and is rejected when stale, replayed, or presented to a different
+	// runtime instance. Never logged.
+	Handle string `json:"handle"`
+	// ISO 8601 timestamp after which the handle is stale and will be rejected.
+	HandleExpiresAt string `json:"handleExpiresAt"`
+	// AI skills are discovery-only and cannot be installed through this surface
+	Installability CatalogAiSkillCandidateInstallability `json:"installability"`
+	// Media type of the underlying AI skill card
+	MediaType CatalogAiSkillCandidateMediaType `json:"mediaType"`
+	// Where the catalog reference was observed, without the card itself or any content digest.
+	Provenance CatalogAiSkillCandidateProvenance `json:"provenance"`
+	// Publisher taken verbatim from the card. Inert untrusted text.
+	Publisher *string `json:"publisher,omitempty"`
+	// Where the card came from: exactly one of a URL or embedded data, encoded as a tagged
+	// union so neither both nor neither can be represented.
+	Source CatalogCandidateSource `json:"source"`
+}
+
+func (CatalogAiSkillCandidate) catalogCandidate() {}
+func (CatalogAiSkillCandidate) Kind() CatalogCandidateKind {
+	return CatalogCandidateKindAiSkill
+}
+
+// An inert MCP server catalog result. Every free-text field is untrusted external data and
+// must never be treated as an instruction, and the handle is the only way to refer to the
+// candidate in a later operation.
+// Experimental: CatalogMCPServerCandidate is part of an experimental API and may change or
+// be removed.
+type CatalogMCPServerCandidate struct {
+	// Description taken verbatim from the card. Inert untrusted text.
+	Description *string `json:"description,omitempty"`
+	// Display name taken verbatim from the card. Inert untrusted text.
+	DisplayName string `json:"displayName"`
+	// Opaque, runtime-instance scoped, TTL-bound, single-use handle for this candidate. Carries
+	// no readable information and is rejected when stale, replayed, or presented to a different
+	// runtime instance. Never logged.
+	Handle string `json:"handle"`
+	// ISO 8601 timestamp after which the handle is stale and will be rejected.
+	HandleExpiresAt string `json:"handleExpiresAt"`
+	// Whether this MCP server can be planned for installation, and if policy prevents it.
+	Installability CatalogMCPServerInstallability `json:"installability"`
+	// JSON MCP media type of the underlying card.
+	MediaType MCPServerCardMediaType `json:"mediaType"`
+	// Where the catalog reference was observed, without the card itself or any content digest.
+	Provenance CatalogMCPServerCandidateProvenance `json:"provenance"`
+	// Publisher taken verbatim from the card. Inert untrusted text.
+	Publisher *string `json:"publisher,omitempty"`
+	// Where the card came from: exactly one of a URL or embedded data, encoded as a tagged
+	// union so neither both nor neither can be represented.
+	Source CatalogCandidateSource `json:"source"`
+}
+
+func (CatalogMCPServerCandidate) catalogCandidate() {}
+func (CatalogMCPServerCandidate) Kind() CatalogCandidateKind {
+	return CatalogCandidateKindMCPServer
+}
+
+// Where a candidate's card came from. Exactly one of a URL or embedded data: the union has
+// no variant carrying both, and no variant carrying neither, so the rule holds structurally
+// rather than by validation.
+// Experimental: CatalogCandidateSource is part of an experimental API and may change or be
+// removed.
+type CatalogCandidateSource interface {
+	catalogCandidateSource()
+	Kind() CatalogCandidateSourceKind
+}
+
+type RawCatalogCandidateSourceData struct {
+	Discriminator CatalogCandidateSourceKind
+	Raw           json.RawMessage
+}
+
+func (RawCatalogCandidateSourceData) catalogCandidateSource() {}
+func (r RawCatalogCandidateSourceData) Kind() CatalogCandidateSourceKind {
+	return r.Discriminator
+}
+
+// Candidate whose card reference arrived inline. The document and its content-derived
+// properties stay behind the runtime boundary.
+// Experimental: CatalogCandidateSourceEmbedded is part of an experimental API and may
+// change or be removed.
+type CatalogCandidateSourceEmbedded struct {
+}
+
+func (CatalogCandidateSourceEmbedded) catalogCandidateSource() {}
+func (CatalogCandidateSourceEmbedded) Kind() CatalogCandidateSourceKind {
+	return CatalogCandidateSourceKindEmbedded
+}
+
+// Candidate whose card is retrieved from a URL through the runtime's hardened fetch
+// boundary.
+// Experimental: CatalogCandidateSourceURL is part of an experimental API and may change or
+// be removed.
+type CatalogCandidateSourceURL struct {
+	// Card URL as advertised. Inert untrusted data: the runtime retrieves it only through its
+	// own hardened boundary, and it is never logged.
+	URL string `json:"url"`
+}
+
+func (CatalogCandidateSourceURL) catalogCandidateSource() {}
+func (CatalogCandidateSourceURL) Kind() CatalogCandidateSourceKind {
+	return CatalogCandidateSourceKindURL
+}
+
+// Bounded extensible wire-feature identifier. Known values are described by
+// `CatalogCapability`; newer callers may send future identifiers so an older runtime can
+// return a typed negotiation refusal instead of failing schema validation. Capability
+// negotiation establishes contract understanding, while each operation's result separately
+// reports runtime availability.
+// Experimental: CatalogCapabilityID is part of an experimental API and may change or be
+// removed.
+type CatalogCapabilityID string
+
+// The protocol version and capability set a caller requires, supplied on every catalog
+// request so negotiation cannot be skipped by omission.
+// Experimental: CatalogClientContract is part of an experimental API and may change or be
+// removed.
+type CatalogClientContract struct {
+	// SDK protocol version the caller was generated against. A caller below the runtime's
+	// minimum supported version is refused rather than served a partial result.
+	ProtocolVersion int64 `json:"protocolVersion"`
+	// Wire features the caller requires the runtime to understand. Identifiers are bounded but
+	// extensible so a newer caller can negotiate with an older runtime. Requiring an unknown
+	// feature yields a typed refusal listing what is understood, never a partial grant. A grant
+	// does not promise that a deployment has enabled the operation; typed unavailable results
+	// report that separately.
+	RequiredCapabilities []string `json:"requiredCapabilities"`
+}
+
+// Where and when an MCP server catalog reference was observed. Discovery provenance
+// deliberately carries no content digest because search does not establish the exact
+// validated content a later plan will bind.
+// Experimental: CatalogMCPServerCandidateProvenance is part of an experimental API and may
+// change or be removed.
+type CatalogMCPServerCandidateProvenance struct {
+	// Host of the catalog authority that advertised the reference, without path, query, or
+	// credentials. Inert untrusted data.
+	Authority string `json:"authority"`
+	// JSON MCP media type advertised for the referenced card.
+	MediaType MCPServerCardMediaType `json:"mediaType"`
+	// ISO 8601 timestamp at which the runtime observed the catalog reference. This is not a
+	// retrieval or validation timestamp.
+	ObservedAt string `json:"observedAt"`
+}
+
+// The protocol version and capability set the runtime actually honoured for a successful
+// catalog operation.
+// Experimental: CatalogNegotiatedContract is part of an experimental API and may change or
+// be removed.
+type CatalogNegotiatedContract struct {
+	// Wire features the runtime understood for this operation. Always a superset of the
+	// caller's required features, because any shortfall is a refusal instead. Operation
+	// availability remains a separate typed result.
+	GrantedCapabilities []CatalogCapability `json:"grantedCapabilities"`
+	// Protocol version of the runtime that served the request.
+	RuntimeProtocolVersion int64 `json:"runtimeProtocolVersion"`
+}
+
+// A bounded catalog search. Both the query length and the result count are capped by the
+// schema so a caller cannot request an unbounded scan.
+// Experimental: CatalogSearchRequest is part of an experimental API and may change or be
+// removed.
+type CatalogSearchRequest struct {
+	// Protocol version and capabilities the caller requires.
+	Contract CatalogClientContract `json:"contract"`
+	// Restrict results to these candidate kinds. When omitted, every kind the runtime supports
+	// is searched.
+	Kinds []CatalogCandidateKind `json:"kinds,omitzero"`
+	// Maximum number of candidates to return. Defaults to 10 when omitted.
+	Limit *int32 `json:"limit,omitempty"`
+	// Free-text search query. Never written to logs or telemetry.
+	Query string `json:"query"`
+}
+
+// Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal.
+// Never a partial success.
+// Experimental: CatalogSearchResult is part of an experimental API and may change or be
+// removed.
+type CatalogSearchResult interface {
+	catalogSearchResult()
+	Kind() CatalogSearchResultKind
+}
+
+type RawCatalogSearchResultData struct {
+	Discriminator CatalogSearchResultKind
+	Raw           json.RawMessage
+}
+
+func (RawCatalogSearchResultData) catalogSearchResult() {}
+func (r RawCatalogSearchResultData) Kind() CatalogSearchResultKind {
+	return r.Discriminator
+}
+
+// An optional catalog authentication exchange did not establish the caller's identity.
+// Anonymous search remains supported; this refusal is reserved for an operation that cannot
+// continue after the attempted exchange. It is distinct from `policy-rejected` and from a
+// network failure, and the reason identifies the recovery action.
+// Experimental: CatalogAuthenticationRequiredError is part of an experimental API and may
+// change or be removed.
+type CatalogAuthenticationRequiredError struct {
+	// Human-readable explanation, safe to surface. Never contains a credential or token, nor a
+	// query, URL, handle, or secret.
+	Message string `json:"message"`
+	// Why authentication failed. Only an expired credential justifies attempting a silent
+	// refresh; an absent or rejected credential requires sign-in.
+	Reason CatalogAuthenticationRequiredReason `json:"reason"`
+}
+
+func (CatalogAuthenticationRequiredError) catalogSearchResult() {}
+func (CatalogAuthenticationRequiredError) Kind() CatalogSearchResultKind {
+	return CatalogSearchResultKindAuthenticationRequired
+}
+
+// An upstream catalog response broke the wire contract. Most importantly, every result must
+// carry exactly one of a URL or embedded data: a result carrying both, or neither, is
+// refused here rather than being guessed at.
+// Experimental: CatalogContractViolationError is part of an experimental API and may change
+// or be removed.
+type CatalogContractViolationError struct {
+	// Human-readable explanation, safe to surface. Never echoes response content, nor a query,
+	// URL, handle, or secret.
+	Message string `json:"message"`
+	// Which rule the response broke.
+	Reason CatalogContractViolationReason `json:"reason"`
+}
+
+func (CatalogContractViolationError) catalogSearchResult() {}
+func (CatalogContractViolationError) Kind() CatalogSearchResultKind {
+	return CatalogSearchResultKindContractViolation
+}
+
+// The request was rejected before any work was done, because a bounded field fell outside
+// its permitted range or a required field was unusable.
+// Experimental: CatalogInvalidRequestError is part of an experimental API and may change or
+// be removed.
+type CatalogInvalidRequestError struct {
+	// Which request field was rejected.
+	Field CatalogInvalidRequestField `json:"field"`
+	// Human-readable explanation, safe to surface. Never echoes the offending value, nor a
+	// query, URL, handle, or secret.
+	Message string `json:"message"`
+}
+
+func (CatalogInvalidRequestError) catalogSearchResult() {}
+func (CatalogInvalidRequestError) Kind() CatalogSearchResultKind {
+	return CatalogSearchResultKindInvalidRequest
+}
+
+// A card could not be parsed or did not satisfy its declared media type's schema.
+// Experimental: CatalogMalformedCardError is part of an experimental API and may change or
+// be removed.
+type CatalogMalformedCardError struct {
+	// Media type the card was interpreted as, when it declared one this runtime recognises.
+	MediaType *CatalogMediaType `json:"mediaType,omitempty"`
+	// Human-readable explanation, safe to surface. Never echoes card content, nor a query, URL,
+	// handle, or secret.
+	Message string `json:"message"`
+	// How the card failed validation.
+	Reason CatalogMalformedCardReason `json:"reason"`
+}
+
+func (CatalogMalformedCardError) catalogSearchResult() {}
+func (CatalogMalformedCardError) Kind() CatalogSearchResultKind {
+	return CatalogSearchResultKindMalformedCard
+}
+
+// The caller's protocol version or required capabilities cannot be honoured. Returned
+// instead of a partial or ambiguous success.
+// Experimental: CatalogNegotiationRefusedError is part of an experimental API and may
+// change or be removed.
+type CatalogNegotiationRefusedError struct {
+	// Human-readable explanation, safe to surface. Never contains a query, URL, handle, or
+	// secret.
+	Message string `json:"message"`
+	// Lowest caller protocol version this runtime will serve.
+	MinimumSupportedProtocolVersion int64 `json:"minimumSupportedProtocolVersion"`
+	// Whether the version or the capability set was the problem.
+	Reason CatalogNegotiationRefusedReason `json:"reason"`
+	// Protocol version of the runtime that refused the request.
+	RuntimeProtocolVersion int64 `json:"runtimeProtocolVersion"`
+	// Every wire feature this runtime understands, so the caller can retry within that
+	// contract. This list does not imply that every deployment has enabled every operation.
+	SupportedCapabilities []CatalogCapability `json:"supportedCapabilities"`
+	// The subset of the caller's bounded extensible capability identifiers this runtime cannot
+	// honour.
+	UnsupportedCapabilities []string `json:"unsupportedCapabilities"`
+}
+
+func (CatalogNegotiationRefusedError) catalogSearchResult() {}
+func (CatalogNegotiationRefusedError) Kind() CatalogSearchResultKind {
+	return CatalogSearchResultKindNegotiationRefused
+}
+
+// The runtime could not reach the catalog authority or retrieve a card. Covers being
+// offline as well as transport-level failure.
+// Experimental: CatalogNetworkFailureError is part of an experimental API and may change or
+// be removed.
+type CatalogNetworkFailureError struct {
+	// Human-readable explanation, safe to surface. Never contains a query, URL, handle, or
+	// secret.
+	Message string `json:"message"`
+	// Categorised failure, low cardinality so it can be aggregated without carrying a URL.
+	Reason CatalogNetworkFailureReason `json:"reason"`
+	// HTTP status code, when the failure was a rejected response.
+	StatusCode *int32 `json:"statusCode,omitempty"`
+}
+
+func (CatalogNetworkFailureError) catalogSearchResult() {}
+func (CatalogNetworkFailureError) Kind() CatalogSearchResultKind {
+	return CatalogSearchResultKindNetworkFailure
+}
+
+// Registry or enterprise policy refused the operation.
+// Experimental: CatalogPolicyRejectedError is part of an experimental API and may change or
+// be removed.
+type CatalogPolicyRejectedError struct {
+	// Human-readable explanation, safe to surface. Never contains a query, URL, handle, or
+	// secret.
+	Message string `json:"message"`
+	// Which authority produced the decision.
+	Source MCPPlanPolicySource `json:"source"`
+}
+
+func (CatalogPolicyRejectedError) catalogSearchResult() {}
+func (CatalogPolicyRejectedError) Kind() CatalogSearchResultKind {
+	return CatalogSearchResultKindPolicyRejected
+}
+
+// A completed catalog search: inert candidate summaries, each carrying a single-use handle.
+// Experimental: CatalogSearchSucceeded is part of an experimental API and may change or be
+// removed.
+type CatalogSearchSucceeded struct {
+	// Matching candidates, never more than the requested limit. All text is inert untrusted
+	// data.
+	Candidates []CatalogCandidate `json:"candidates"`
+	// Protocol version and capabilities the runtime honoured.
+	Negotiated CatalogNegotiatedContract `json:"negotiated"`
+	// Pseudonymous identifier for this search, issued by the runtime or by the catalog
+	// authority it queried and never by the caller, so it cannot be forged or replayed to
+	// attribute an install to a search that never happened. Always present on a success, so a
+	// result set can be tied to the installs it leads to. It identifies a search rather than a
+	// person: it is derived from no user, account, device, or query data, and must never be
+	// joined with user identity to re-identify anyone.
+	SearchID string `json:"searchId"`
+	// Whether further matches existed beyond the requested limit.
+	Truncated bool `json:"truncated"`
+}
+
+func (CatalogSearchSucceeded) catalogSearchResult() {}
+func (CatalogSearchSucceeded) Kind() CatalogSearchResultKind {
+	return CatalogSearchResultKindSucceeded
+}
+
+// The operation is not available on this runtime. Distinct from a network failure: nothing
+// was attempted.
+// Experimental: CatalogUnavailableError is part of an experimental API and may change or be
+// removed.
+type CatalogUnavailableError struct {
+	// Human-readable explanation, safe to surface. Never contains a query, URL, handle, or
+	// secret.
+	Message string `json:"message"`
+	// Why the operation is unavailable.
+	Reason CatalogUnavailableReason `json:"reason"`
+}
+
+func (CatalogUnavailableError) catalogSearchResult() {}
+func (CatalogUnavailableError) Kind() CatalogSearchResultKind {
+	return CatalogSearchResultKindUnavailable
+}
+
+// Retrieval was refused by the runtime's hardened fetch boundary before any request left
+// the process, or before a redirect was followed.
+// Experimental: CatalogUnsafeRetrievalError is part of an experimental API and may change
+// or be removed.
+type CatalogUnsafeRetrievalError struct {
+	// Human-readable explanation, safe to surface. Never contains the refused URL, nor a query,
+	// handle, or secret.
+	Message string `json:"message"`
+	// Which control refused the retrieval, low cardinality so it can be aggregated without
+	// carrying a URL.
+	Reason CatalogUnsafeRetrievalReason `json:"reason"`
+}
+
+func (CatalogUnsafeRetrievalError) catalogSearchResult() {}
+func (CatalogUnsafeRetrievalError) Kind() CatalogSearchResultKind {
+	return CatalogSearchResultKindUnsafeRetrieval
+}
+
+// The request asked for a candidate kind this runtime does not serve.
+// Experimental: CatalogUnsupportedKindError is part of an experimental API and may change
+// or be removed.
+type CatalogUnsupportedKindError struct {
+	// Human-readable explanation, safe to surface. Never contains a query, URL, handle, or
+	// secret.
+	Message string `json:"message"`
+	// The kinds from the request that are not supported.
+	RequestedKinds []CatalogCandidateKind `json:"requestedKinds"`
+	// Every candidate kind this runtime can serve.
+	SupportedKinds []CatalogCandidateKind `json:"supportedKinds"`
+}
+
+func (CatalogUnsupportedKindError) catalogSearchResult() {}
+func (CatalogUnsupportedKindError) Kind() CatalogSearchResultKind {
+	return CatalogSearchResultKindUnsupportedKind
+}
+
 // Slash commands available in the session, after applying any include/exclude filters.
 // Experimental: CommandList is part of an experimental API and may change or be removed.
 type CommandList struct {
@@ -4628,6 +5073,44 @@ type MCPHostState struct {
 	PendingConnections []string `json:"pendingConnections"`
 }
 
+// A normalised, inert description of what installing an MCP server would involve. Carries
+// no raw card, no install specification, and no secret value.
+// Experimental: MCPInstallPlan is part of an experimental API and may change or be removed.
+type MCPInstallPlan struct {
+	// The configuration changes installing would make, described rather than serialised, so the
+	// mutable configuration payload stays behind the runtime boundary.
+	ConfigurationChanges []MCPPlanConfigurationChange `json:"configurationChanges"`
+	// Normalised identity of the server the plan would install.
+	Identity MCPPlanResourceIdentity `json:"identity"`
+	// Opaque, runtime-instance scoped, TTL-bound, single-use handle for this plan. Rejected
+	// when stale, replayed, or presented to a different runtime instance. Never logged.
+	PlanHandle string `json:"planHandle"`
+	// ISO 8601 timestamp after which the plan handle is stale and will be rejected. Abandoning
+	// a plan needs no call: an unused handle simply expires, so cancellation before commit is
+	// side-effect free.
+	PlanHandleExpiresAt string `json:"planHandleExpiresAt"`
+	// Outcome of evaluating the server against registry and enterprise policy.
+	Policy MCPPlanPolicyResult `json:"policy"`
+	// Origin and semantic digest of the exact validated JSON MCP card content bound to this
+	// plan.
+	Provenance MCPPlanProvenance `json:"provenance"`
+	// Identifier of the choice the runtime would pick by default. Omitted when there is no
+	// eligible transport, or when the runtime expresses no preference.
+	RecommendedTransportChoiceID *string `json:"recommendedTransportChoiceId,omitempty"`
+	// Whether applying this plan would require an MCP reload to take effect. Planning itself
+	// never reloads.
+	ReloadRequired bool `json:"reloadRequired"`
+	// Whether the plan cannot be applied without further input, because a required value has no
+	// default or a secret must be supplied.
+	RequiresInteractiveConfiguration bool `json:"requiresInteractiveConfiguration"`
+	// Configuration scope and key the plan would write to.
+	Target MCPPlanTarget `json:"target"`
+	// Every eligible transport, so a host can present an explicit choice. A completed plan
+	// always has at least one; when none is eligible, planning returns
+	// `CatalogUnavailableTransportError` instead.
+	TransportChoices []MCPPlanTransportChoice `json:"transportChoices"`
+}
+
 // Server name to check running status for.
 // Experimental: MCPIsServerRunningRequest is part of an experimental API and may change or
 // be removed.
@@ -4875,6 +5358,439 @@ type MCPOauthRespondResult struct {
 	Success bool `json:"success"`
 }
 
+// One change applying the plan would make, described rather than serialised so the
+// configuration payload stays behind the runtime boundary.
+// Experimental: MCPPlanConfigurationChange is part of an experimental API and may change or
+// be removed.
+type MCPPlanConfigurationChange struct {
+	// Names of the configuration fields the change would set, without their values.
+	ChangedFields []string `json:"changedFields"`
+	// Configuration key the change applies to.
+	ConfigKey string `json:"configKey"`
+	// Whether the change would create a new entry or modify an existing one.
+	Operation MCPPlanConfigurationOperation `json:"operation"`
+	// Scope the change would be written to.
+	Scope MCPPlanScope `json:"scope"`
+	// Secret placeholders the written configuration would reference. The constrained
+	// placeholder type cannot carry a literal secret value.
+	SecretReferences []string `json:"secretReferences"`
+}
+
+// A side-effect-free request for an MCP install plan. Computing a plan never writes
+// configuration, stores a secret, or reloads MCP servers.
+// Experimental: MCPPlanInstallRequest is part of an experimental API and may change or be
+// removed.
+type MCPPlanInstallRequest struct {
+	// Protocol version and capabilities the caller requires.
+	Contract CatalogClientContract `json:"contract"`
+	// Configuration scope the plan targets. Defaults to user scope when omitted.
+	Scope *MCPPlanScope `json:"scope,omitempty"`
+	// What to plan: either a candidate handle from a previous search, or a card supplied
+	// directly.
+	Source MCPPlanInstallSource `json:"source"`
+}
+
+// Outcome of an mcp.planInstall call: either a normalised plan, or one typed refusal.
+// Nothing is written in either case.
+// Experimental: MCPPlanInstallResult is part of an experimental API and may change or be
+// removed.
+type MCPPlanInstallResult interface {
+	mcpPlanInstallResult()
+	mcpPlanInstallResultKind() MCPPlanInstallResultKind
+}
+
+type RawMCPPlanInstallResultData struct {
+	Discriminator MCPPlanInstallResultKind
+	Raw           json.RawMessage
+}
+
+func (RawMCPPlanInstallResultData) mcpPlanInstallResult() {}
+func (r RawMCPPlanInstallResultData) mcpPlanInstallResultKind() MCPPlanInstallResultKind {
+	return r.Discriminator
+}
+func (CatalogAuthenticationRequiredError) mcpPlanInstallResult() {}
+func (CatalogAuthenticationRequiredError) mcpPlanInstallResultKind() MCPPlanInstallResultKind {
+	return MCPPlanInstallResultKindAuthenticationRequired
+}
+func (CatalogContractViolationError) mcpPlanInstallResult() {}
+func (CatalogContractViolationError) mcpPlanInstallResultKind() MCPPlanInstallResultKind {
+	return MCPPlanInstallResultKindContractViolation
+}
+
+// A presented handle was not accepted. Handles are runtime-instance scoped, TTL-bound, and
+// single-use, so each way of failing is reported distinctly.
+// Experimental: CatalogHandleRejectedError is part of an experimental API and may change or
+// be removed.
+type CatalogHandleRejectedError struct {
+	// Which kind of handle was presented.
+	HandleType CatalogHandleType `json:"handleType"`
+	// Human-readable explanation, safe to surface. Never contains the handle itself, nor a
+	// query, URL, or secret.
+	Message string `json:"message"`
+	// Why the handle was rejected.
+	Reason CatalogHandleRejectionReason `json:"reason"`
+}
+
+func (CatalogHandleRejectedError) mcpPlanInstallResult() {}
+func (CatalogHandleRejectedError) mcpPlanInstallResultKind() MCPPlanInstallResultKind {
+	return MCPPlanInstallResultKindHandleRejected
+}
+func (CatalogInvalidRequestError) mcpPlanInstallResult() {}
+func (CatalogInvalidRequestError) mcpPlanInstallResultKind() MCPPlanInstallResultKind {
+	return MCPPlanInstallResultKindInvalidRequest
+}
+func (CatalogMalformedCardError) mcpPlanInstallResult() {}
+func (CatalogMalformedCardError) mcpPlanInstallResultKind() MCPPlanInstallResultKind {
+	return MCPPlanInstallResultKindMalformedCard
+}
+func (CatalogNegotiationRefusedError) mcpPlanInstallResult() {}
+func (CatalogNegotiationRefusedError) mcpPlanInstallResultKind() MCPPlanInstallResultKind {
+	return MCPPlanInstallResultKindNegotiationRefused
+}
+func (CatalogNetworkFailureError) mcpPlanInstallResult() {}
+func (CatalogNetworkFailureError) mcpPlanInstallResultKind() MCPPlanInstallResultKind {
+	return MCPPlanInstallResultKindNetworkFailure
+}
+
+// The candidate is discoverable but cannot be installed. `application/ai-skill` resolves
+// here, because it stays searchable while remaining typed non-installable.
+// Experimental: CatalogNotInstallableError is part of an experimental API and may change or
+// be removed.
+type CatalogNotInstallableError struct {
+	// Human-readable explanation, safe to surface. Never contains a query, URL, handle, or
+	// secret.
+	Message string `json:"message"`
+	// Why the candidate cannot be installed.
+	Reason CatalogNotInstallableReason `json:"reason"`
+}
+
+func (CatalogNotInstallableError) mcpPlanInstallResult() {}
+func (CatalogNotInstallableError) mcpPlanInstallResultKind() MCPPlanInstallResultKind {
+	return MCPPlanInstallResultKindNotInstallable
+}
+func (CatalogPolicyRejectedError) mcpPlanInstallResult() {}
+func (CatalogPolicyRejectedError) mcpPlanInstallResultKind() MCPPlanInstallResultKind {
+	return MCPPlanInstallResultKindPolicyRejected
+}
+func (CatalogUnavailableError) mcpPlanInstallResult() {}
+func (CatalogUnavailableError) mcpPlanInstallResultKind() MCPPlanInstallResultKind {
+	return MCPPlanInstallResultKindUnavailable
+}
+
+// No transport this runtime can use is available for the requested server.
+// Experimental: CatalogUnavailableTransportError is part of an experimental API and may
+// change or be removed.
+type CatalogUnavailableTransportError struct {
+	// Human-readable explanation, safe to surface. Never contains a query, URL, handle, or
+	// secret.
+	Message string `json:"message"`
+	// Why no transport could be offered.
+	Reason CatalogUnavailableTransportReason `json:"reason"`
+}
+
+func (CatalogUnavailableTransportError) mcpPlanInstallResult() {}
+func (CatalogUnavailableTransportError) mcpPlanInstallResultKind() MCPPlanInstallResultKind {
+	return MCPPlanInstallResultKindUnavailableTransport
+}
+func (CatalogUnsafeRetrievalError) mcpPlanInstallResult() {}
+func (CatalogUnsafeRetrievalError) mcpPlanInstallResultKind() MCPPlanInstallResultKind {
+	return MCPPlanInstallResultKindUnsafeRetrieval
+}
+
+// A computed MCP install plan. Nothing has been applied: the plan describes what installing
+// would change, and the plan handle is what a later apply operation would consume.
+// Experimental: MCPPlanInstallPlanned is part of an experimental API and may change or be
+// removed.
+type MCPPlanInstallPlanned struct {
+	// Protocol version and capabilities the runtime honoured.
+	Negotiated CatalogNegotiatedContract `json:"negotiated"`
+	// The normalised plan.
+	Plan MCPInstallPlan `json:"plan"`
+}
+
+func (MCPPlanInstallPlanned) mcpPlanInstallResult() {}
+func (MCPPlanInstallPlanned) mcpPlanInstallResultKind() MCPPlanInstallResultKind {
+	return MCPPlanInstallResultKindPlanned
+}
+
+// What an install plan is computed from: a candidate handle from a previous search, or a
+// card supplied directly.
+// Experimental: MCPPlanInstallSource is part of an experimental API and may change or be
+// removed.
+type MCPPlanInstallSource interface {
+	mcpPlanInstallSource()
+	Kind() MCPPlanInstallSourceKind
+}
+
+type RawMCPPlanInstallSourceData struct {
+	Discriminator MCPPlanInstallSourceKind
+	Raw           json.RawMessage
+}
+
+func (RawMCPPlanInstallSourceData) mcpPlanInstallSource() {}
+func (r RawMCPPlanInstallSourceData) Kind() MCPPlanInstallSourceKind {
+	return r.Discriminator
+}
+
+// Plan from a candidate returned by a previous catalog search.
+// Experimental: MCPPlanInstallSourceCandidate is part of an experimental API and may change
+// or be removed.
+type MCPPlanInstallSourceCandidate struct {
+	// Single-use candidate handle. Consumed by this call, so a replay of the same handle is
+	// rejected.
+	CandidateHandle string `json:"candidateHandle"`
+	// The runtime- or authority-minted `searchId` returned with the search that produced this
+	// candidate. A search implementation binds it to private candidate-handle context; a
+	// planning implementation must verify that context before returning a plan. The unavailable
+	// planning implementation in this contract layer validates presence but does not claim the
+	// verification has occurred. It identifies a search rather than a person and must never be
+	// joined with user identity to re-identify anyone.
+	SearchID string `json:"searchId"`
+}
+
+func (MCPPlanInstallSourceCandidate) mcpPlanInstallSource() {}
+func (MCPPlanInstallSourceCandidate) Kind() MCPPlanInstallSourceKind {
+	return MCPPlanInstallSourceKindCandidate
+}
+
+// Plan from a card supplied directly by the caller, without a preceding search.
+// Experimental: MCPPlanInstallSourceCard is part of an experimental API and may change or
+// be removed.
+type MCPPlanInstallSourceCard struct {
+	// The card to plan from: exactly one of a URL or embedded data.
+	Card MCPServerCardReference `json:"card"`
+}
+
+func (MCPPlanInstallSourceCard) mcpPlanInstallSource() {}
+func (MCPPlanInstallSourceCard) Kind() MCPPlanInstallSourceKind {
+	return MCPPlanInstallSourceKindCard
+}
+
+// Outcome of evaluating the planned server against registry and enterprise policy.
+// Evaluation is read-only.
+// Experimental: MCPPlanPolicyResult is part of an experimental API and may change or be
+// removed.
+type MCPPlanPolicyResult struct {
+	// What policy decided for this server.
+	Decision MCPPlanPolicyDecision `json:"decision"`
+	// Human-readable explanation, safe to surface. Never contains a query, URL, handle, or
+	// secret.
+	Reason *string `json:"reason,omitempty"`
+	// Which authority produced the decision.
+	Source MCPPlanPolicySource `json:"source"`
+}
+
+// Provenance of the exact validated JSON MCP card content bound privately to a completed
+// plan and its opaque handle.
+// Experimental: MCPPlanProvenance is part of an experimental API and may change or be
+// removed.
+type MCPPlanProvenance struct {
+	// Authority associated with the validated card, without path, query, or credentials. Inert
+	// untrusted data.
+	Authority string `json:"authority"`
+	// Semantic digest of the exact validated JSON content bound to the plan handle.
+	CardDigest CardDigest `json:"cardDigest"`
+	// JSON MCP media type the validated card was interpreted as.
+	MediaType MCPServerCardMediaType `json:"mediaType"`
+	// ISO 8601 timestamp at which the runtime completed strict parsing and schema validation of
+	// the card content.
+	ValidatedAt string `json:"validatedAt"`
+}
+
+// One non-secret value a transport choice needs, represented as a scalar or enumerated
+// variant so enum values cannot be missing or attached to another type.
+// Experimental: MCPPlanRequiredValue is part of an experimental API and may change or be
+// removed.
+type MCPPlanRequiredValue interface {
+	mcpPlanRequiredValue()
+	Kind() MCPPlanRequiredValueKind
+}
+
+type RawMCPPlanRequiredValueData struct {
+	Discriminator MCPPlanRequiredValueKind
+	Raw           json.RawMessage
+}
+
+func (RawMCPPlanRequiredValueData) mcpPlanRequiredValue() {}
+func (r RawMCPPlanRequiredValueData) Kind() MCPPlanRequiredValueKind {
+	return r.Discriminator
+}
+
+// One enumerated non-secret value a transport choice needs before it can be applied. The
+// permitted values are structurally required.
+// Experimental: MCPPlanRequiredValueEnum is part of an experimental API and may change or
+// be removed.
+type MCPPlanRequiredValueEnum struct {
+	// Where the value is applied when the server is launched.
+	Category MCPPlanValueCategory `json:"category"`
+	// Default supplied by the card, when the value can be resolved without input. Presence is
+	// the authoritative indication that a default exists. Inert untrusted data.
+	DefaultValue *string `json:"defaultValue,omitempty"`
+	// Human-readable explanation from the card. Inert untrusted text.
+	Description *string `json:"description,omitempty"`
+	// Non-empty permitted value set. Inert untrusted data.
+	EnumValues []string `json:"enumValues"`
+	// Whether the value may be supplied more than once.
+	IsRepeated bool `json:"isRepeated"`
+	// Key the value is supplied under. Inert untrusted data.
+	Key string `json:"key"`
+	// Whether the value must be present for the plan to be applicable.
+	Required bool `json:"required"`
+	// Human-readable label from the card. Inert untrusted text.
+	Title *string `json:"title,omitempty"`
+	// Discriminator: the value must be one of `enumValues`.
+	ValueType MCPPlanEnumValueType `json:"valueType"`
+}
+
+func (MCPPlanRequiredValueEnum) mcpPlanRequiredValue() {}
+func (MCPPlanRequiredValueEnum) Kind() MCPPlanRequiredValueKind {
+	return MCPPlanRequiredValueKindEnum
+}
+
+// One non-secret scalar value a transport choice needs before it can be applied.
+// Experimental: MCPPlanRequiredValueScalar is part of an experimental API and may change or
+// be removed.
+type MCPPlanRequiredValueScalar struct {
+	// Where the value is applied when the server is launched.
+	Category MCPPlanValueCategory `json:"category"`
+	// Default supplied by the card, when the value can be resolved without input. Presence is
+	// the authoritative indication that a default exists. Inert untrusted data.
+	DefaultValue *string `json:"defaultValue,omitempty"`
+	// Human-readable explanation from the card. Inert untrusted text.
+	Description *string `json:"description,omitempty"`
+	// Whether the value may be supplied more than once.
+	IsRepeated bool `json:"isRepeated"`
+	// Key the value is supplied under. Inert untrusted data.
+	Key string `json:"key"`
+	// Whether the value must be present for the plan to be applicable.
+	Required bool `json:"required"`
+	// Human-readable label from the card. Inert untrusted text.
+	Title *string `json:"title,omitempty"`
+	// Scalar type the value must conform to.
+	ValueType MCPPlanScalarValueType `json:"valueType"`
+}
+
+func (MCPPlanRequiredValueScalar) mcpPlanRequiredValue() {}
+func (MCPPlanRequiredValueScalar) Kind() MCPPlanRequiredValueKind {
+	return MCPPlanRequiredValueKindScalar
+}
+
+// Normalised identity of the MCP server a plan targets, independent of how the card spelled
+// it.
+// Experimental: MCPPlanResourceIdentity is part of an experimental API and may change or be
+// removed.
+type MCPPlanResourceIdentity struct {
+	// Canonical, normalised name of the server, for example `io.github.owner/server`.
+	CanonicalName string `json:"canonicalName"`
+	// Registry identifier of the server, when it came from a registry.
+	RegistryID *string `json:"registryId,omitempty"`
+	// Local configuration key the server would be recorded under.
+	ServerName string `json:"serverName"`
+	// Version advertised by the card, when it declares one.
+	Version *string `json:"version,omitempty"`
+}
+
+// A secret a transport choice needs, referenced by placeholder. No secret value ever
+// appears in a plan, and the placeholder resolves against the keychain only when a plan is
+// applied.
+// Experimental: MCPPlanSecretPlaceholder is part of an experimental API and may change or
+// be removed.
+type MCPPlanSecretPlaceholder struct {
+	// Key the secret is supplied under. Inert untrusted data.
+	Key string `json:"key"`
+	// The runtime-assigned `${secret:<id>}` placeholder written into configuration in place of
+	// the value.
+	Placeholder string `json:"placeholder"`
+	// Human-readable label from the card. Inert untrusted text.
+	Title *string `json:"title,omitempty"`
+}
+
+// A runtime-assigned secret placeholder. The identifier is carried once, inside the
+// placeholder, so it cannot contradict a separate secret-id field.
+// Experimental: MCPPlanSecretReference is part of an experimental API and may change or be
+// removed.
+type MCPPlanSecretReference string
+
+// Where a plan would be written.
+// Experimental: MCPPlanTarget is part of an experimental API and may change or be removed.
+type MCPPlanTarget struct {
+	// Configuration key the server would be recorded under within that scope.
+	ConfigKey string `json:"configKey"`
+	// Configuration scope the plan targets.
+	Scope MCPPlanScope `json:"scope"`
+}
+
+// One eligible way to run the server, represented as a tagged package or remote variant so
+// package identity and endpoint states cannot contradict the install method.
+// Experimental: MCPPlanTransportChoice is part of an experimental API and may change or be
+// removed.
+type MCPPlanTransportChoice interface {
+	mcpPlanTransportChoice()
+	Transport() MCPPlanTransportChoiceTransport
+}
+
+type RawMCPPlanTransportChoiceData struct {
+	Discriminator MCPPlanTransportChoiceTransport
+	Raw           json.RawMessage
+}
+
+func (RawMCPPlanTransportChoiceData) mcpPlanTransportChoice() {}
+func (r RawMCPPlanTransportChoiceData) Transport() MCPPlanTransportChoiceTransport {
+	return r.Discriminator
+}
+
+// An eligible local-package transport choice. Package identity is required and a remote
+// endpoint cannot be represented.
+// Experimental: MCPPlanTransportChoicePackage is part of an experimental API and may change
+// or be removed.
+type MCPPlanTransportChoicePackage struct {
+	// Stable identifier for this choice within the plan, used to select it when the plan is
+	// applied.
+	ChoiceID string `json:"choiceId"`
+	// Discriminator: this choice runs a local package
+	InstallMethod MCPPlanPackageInstallMethod `json:"installMethod"`
+	// Package identifier. Inert untrusted data.
+	PackageIdentifier string `json:"packageIdentifier"`
+	// Packaging ecosystem, for example `oci` or `npm`.
+	PackageType string `json:"packageType"`
+	// Typed values this choice requires, excluding secrets.
+	RequiredValues []MCPPlanRequiredValue `json:"requiredValues"`
+	// Secrets this choice requires, referenced by placeholder only.
+	SecretPlaceholders []MCPPlanSecretPlaceholder `json:"secretPlaceholders"`
+}
+
+func (MCPPlanTransportChoicePackage) mcpPlanTransportChoice() {}
+func (MCPPlanTransportChoicePackage) Transport() MCPPlanTransportChoiceTransport {
+	return MCPPlanTransportChoiceTransportStdio
+}
+
+// An eligible remote-endpoint transport choice. The endpoint is required and package
+// identity cannot be represented.
+// Experimental: MCPPlanTransportChoiceRemote is part of an experimental API and may change
+// or be removed.
+type MCPPlanTransportChoiceRemote struct {
+	// Stable identifier for this choice within the plan, used to select it when the plan is
+	// applied.
+	ChoiceID string `json:"choiceId"`
+	// Endpoint URL. Inert untrusted data.
+	Endpoint string `json:"endpoint"`
+	// Discriminator: this choice connects to a remote endpoint
+	InstallMethod MCPPlanRemoteInstallMethod `json:"installMethod"`
+	// Typed values this choice requires, excluding secrets.
+	RequiredValues []MCPPlanRequiredValue `json:"requiredValues"`
+	// Secrets this choice requires, referenced by placeholder only.
+	SecretPlaceholders []MCPPlanSecretPlaceholder `json:"secretPlaceholders"`
+	Discriminator      MCPPlanRemoteTransport     `json:"transport,omitempty"`
+}
+
+func (MCPPlanTransportChoiceRemote) mcpPlanTransportChoice() {}
+func (r MCPPlanTransportChoiceRemote) Transport() MCPPlanTransportChoiceTransport {
+	if r.Discriminator == "" {
+		return MCPPlanTransportChoiceTransportHTTP
+	}
+	return MCPPlanTransportChoiceTransport(r.Discriminator)
+}
+
 // Registration parameters for an external MCP client.
 // Experimental: MCPRegisterExternalClientRequest is part of an experimental API and may
 // change or be removed.
@@ -5328,6 +6244,59 @@ type MCPServerAuthConfigRedirectPort struct {
 	RedirectPort *int32 `json:"redirectPort,omitempty"`
 }
 
+// A card supplied directly by the caller. Exactly one of a URL or embedded data, encoded
+// structurally so neither both nor neither can be expressed.
+// Experimental: MCPServerCardReference is part of an experimental API and may change or be
+// removed.
+type MCPServerCardReference interface {
+	mcpServerCardReference()
+	Kind() MCPServerCardReferenceKind
+}
+
+type RawMCPServerCardReferenceData struct {
+	Discriminator MCPServerCardReferenceKind
+	Raw           json.RawMessage
+}
+
+func (RawMCPServerCardReferenceData) mcpServerCardReference() {}
+func (r RawMCPServerCardReferenceData) Kind() MCPServerCardReferenceKind {
+	return r.Discriminator
+}
+
+// An MCP server card supplied inline as an inert document.
+// Experimental: MCPServerCardEmbedded is part of an experimental API and may change or be
+// removed.
+type MCPServerCardEmbedded struct {
+	// The card document verbatim, treated as inert untrusted bytes. The runtime parses and
+	// validates it; the host is not expected to interpret it. Never logged.
+	Data string `json:"data"`
+	// Media type the card is expected to conform to.
+	MediaType MCPServerCardMediaType `json:"mediaType"`
+}
+
+func (MCPServerCardEmbedded) mcpServerCardReference() {}
+func (MCPServerCardEmbedded) Kind() MCPServerCardReferenceKind {
+	return MCPServerCardReferenceKindEmbedded
+}
+
+// An MCP server card to be retrieved from a URL through the runtime's hardened fetch
+// boundary.
+// Experimental: MCPServerCardURL is part of an experimental API and may change or be
+// removed.
+type MCPServerCardURL struct {
+	// Media type the card is expected to conform to.
+	MediaType MCPServerCardMediaType `json:"mediaType"`
+	// Card URL. Retrieved only through the runtime's hardened boundary, with scheme,
+	// credential, address-range, redirect, timeout, and response-size controls applied. Never
+	// logged.
+	URL string `json:"url"`
+}
+
+func (MCPServerCardURL) mcpServerCardReference() {}
+func (MCPServerCardURL) Kind() MCPServerCardReferenceKind {
+	return MCPServerCardReferenceKindURL
+}
+
 // MCP server configuration (stdio, remote HTTP/SSE, or in-process)
 // Experimental: MCPServerConfig is part of an experimental API and may change or be removed.
 type MCPServerConfig interface {
@@ -6128,6 +7097,16 @@ type ModeSetResult struct {
 	Warning *string `json:"warning,omitempty"`
 }
 
+// Result of moving in-flight MCP loading to the background.
+// Experimental: MoveMCPLoadingToBackgroundResult is part of an experimental API and may
+// change or be removed.
+type MoveMCPLoadingToBackgroundResult struct {
+	// Whether an in-flight MCP load was moved to the background, releasing turns that were
+	// waiting on it. False when no MCP load was in flight or the waiting turns had already been
+	// released.
+	MovedToBackground bool `json:"movedToBackground"`
+}
+
 // External SDK input for a named custom model provider. Ingested by the native protocol
 // boundary before host dispatch.
 // Experimental: NamedProviderConfig is part of an experimental API and may change or be
@@ -7147,9 +8126,17 @@ type PermissionsFolderTrustAddTrustedResult struct {
 }
 
 // No parameters.
-// Experimental: PermissionsGetAllowAllRequest is part of an experimental API and may change
-// or be removed.
-type PermissionsGetAllowAllRequest struct {
+// Experimental: PermissionsGetModeRequest is part of an experimental API and may change or
+// be removed.
+type PermissionsGetModeRequest struct {
+}
+
+// Current permission mode.
+// Experimental: PermissionsGetModeResult is part of an experimental API and may change or
+// be removed.
+type PermissionsGetModeResult struct {
+	// Current permission mode
+	Mode PermissionMode `json:"mode"`
 }
 
 // Tool approval to persist and apply
@@ -7412,24 +8399,6 @@ type PermissionsResetSessionApprovalsResult struct {
 	Success bool `json:"success"`
 }
 
-// Allow-all mode to apply for the session.
-// Experimental: PermissionsSetAllowAllRequest is part of an experimental API and may change
-// or be removed.
-type PermissionsSetAllowAllRequest struct {
-	// Legacy full allow-all toggle. Prefer `mode`; when `mode` is omitted, `enabled: true` is
-	// treated as `mode: "on"` and any other value is treated as `mode: "off"`.
-	Enabled *bool `json:"enabled,omitempty"`
-	// Allow-all mode to apply. `on` enables full allow-all; `auto` enables advisory LLM
-	// auto-approval; `off` disables both.
-	Mode *PermissionsAllowAllMode `json:"mode,omitempty"`
-	// Optional model id for the `auto` mode auto-approval LLM judging. Only meaningful when
-	// `mode` is `auto`; ignored otherwise. When omitted, the session resolves a default judge
-	// model: `gpt-5.5` for CAPI sessions and the session's active model for BYOK sessions.
-	Model *string `json:"model,omitempty"`
-	// Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers.
-	Source *PermissionsSetAllowAllSource `json:"source,omitempty"`
-}
-
 // Allow-all toggle for tool permission requests, with an optional telemetry source.
 // Experimental: PermissionsSetApproveAllRequest is part of an experimental API and may
 // change or be removed.
@@ -7448,6 +8417,32 @@ type PermissionsSetApproveAllResult struct {
 	Success bool `json:"success"`
 }
 
+// Permission mode to apply for the session.
+// Experimental: PermissionsSetModeRequest is part of an experimental API and may change or
+// be removed.
+type PermissionsSetModeRequest struct {
+	// Optional judge model id for assisted mode. When omitted, the session resolves the
+	// provider default: `gpt-5.5` for CAPI sessions and the active session model for BYOK
+	// sessions.
+	AssistedApprovalModel *string `json:"assistedApprovalModel,omitempty"`
+	// Permission mode to apply
+	Mode PermissionMode `json:"mode"`
+	// Optional source for permission-mode telemetry. Defaults to `rpc` when omitted for SDK
+	// callers.
+	Source *PermissionModeSource `json:"source,omitempty"`
+}
+
+// Indicates whether the requested permission mode was applied and reports the authoritative
+// post-mutation mode.
+// Experimental: PermissionsSetModeResult is part of an experimental API and may change or
+// be removed.
+type PermissionsSetModeResult struct {
+	// Authoritative permission mode after the mutation
+	Mode PermissionMode `json:"mode"`
+	// Whether the operation succeeded
+	Success bool `json:"success"`
+}
+
 // Toggles whether permission prompts should be bridged into session events for this client.
 // Experimental: PermissionsSetRequiredRequest is part of an experimental API and may change
 // or be removed.
@@ -7565,6 +8560,11 @@ type PlanSQLTodoDependency struct {
 // because the SQL schema is best-effort and the agent may not have populated every column.
 // Experimental: PlanSQLTodosRow is part of an experimental API and may change or be removed.
 type PlanSQLTodosRow struct {
+	// Todo creation time, as stored by the session SQL schema's `datetime('now')` default:
+	// `YYYY-MM-DD HH:MM:SS` in UTC. Lets clients attribute todos to the work item that created
+	// them (e.g. scoping a goal's progress to the todos it produced) rather than to the whole
+	// session.
+	CreatedAt *string `json:"createdAt,omitempty"`
 	// Todo description.
 	Description *string `json:"description,omitempty"`
 	// Todo identifier.
@@ -14503,73 +15503,389 @@ const (
 	AgentRegistrySpawnValidationErrorReasonYoloNotAllowed AgentRegistrySpawnValidationErrorReason = "yolo-not-allowed"
 )
 
-// Type of GitHub reference
-// Experimental: AttachmentGitHubReferenceType is part of an experimental API and may change
-// or be removed.
-type AttachmentGitHubReferenceType string
+// Type of GitHub reference
+// Experimental: AttachmentGitHubReferenceType is part of an experimental API and may change
+// or be removed.
+type AttachmentGitHubReferenceType string
+
+const (
+	// GitHub discussion reference.
+	AttachmentGitHubReferenceTypeDiscussion AttachmentGitHubReferenceType = "discussion"
+	// GitHub issue reference.
+	AttachmentGitHubReferenceTypeIssue AttachmentGitHubReferenceType = "issue"
+	// GitHub pull request reference.
+	AttachmentGitHubReferenceTypePr AttachmentGitHubReferenceType = "pr"
+)
+
+// Type discriminator for Attachment.
+type AttachmentType string
+
+const (
+	AttachmentTypeBlob                 AttachmentType = "blob"
+	AttachmentTypeDirectory            AttachmentType = "directory"
+	AttachmentTypeExtensionContext     AttachmentType = "extension_context"
+	AttachmentTypeFile                 AttachmentType = "file"
+	AttachmentTypeGitHubActionsJob     AttachmentType = "github_actions_job"
+	AttachmentTypeGitHubCommit         AttachmentType = "github_commit"
+	AttachmentTypeGitHubFile           AttachmentType = "github_file"
+	AttachmentTypeGitHubFileDiff       AttachmentType = "github_file_diff"
+	AttachmentTypeGitHubReference      AttachmentType = "github_reference"
+	AttachmentTypeGitHubRelease        AttachmentType = "github_release"
+	AttachmentTypeGitHubRepository     AttachmentType = "github_repository"
+	AttachmentTypeGitHubSnippet        AttachmentType = "github_snippet"
+	AttachmentTypeGitHubTreeComparison AttachmentType = "github_tree_comparison"
+	AttachmentTypeGitHubURL            AttachmentType = "github_url"
+	AttachmentTypeSelection            AttachmentType = "selection"
+)
+
+// Type discriminator for AuthInfo.
+// Experimental: AuthInfoType is part of an experimental API and may change or be removed.
+type AuthInfoType string
+
+const (
+	AuthInfoTypeAPIKey          AuthInfoType = "api-key"
+	AuthInfoTypeCopilotAPIToken AuthInfoType = "copilot-api-token"
+	AuthInfoTypeEnv             AuthInfoType = "env"
+	AuthInfoTypeGhCLI           AuthInfoType = "gh-cli"
+	AuthInfoTypeHMAC            AuthInfoType = "hmac"
+	AuthInfoTypeToken           AuthInfoType = "token"
+	AuthInfoTypeUser            AuthInfoType = "user"
+)
+
+// Custom input-format kind.
+// Experimental: BuiltinToolFormatType is part of an experimental API and may change or be
+// removed.
+type BuiltinToolFormatType string
+
+const (
+	// The tool input is parsed with the supplied grammar.
+	BuiltinToolFormatTypeGrammar BuiltinToolFormatType = "grammar"
+)
+
+// Root JSON Schema type for a built-in tool input.
+// Experimental: BuiltinToolInputSchemaType is part of an experimental API and may change or
+// be removed.
+type BuiltinToolInputSchemaType string
+
+const (
+	// The tool accepts a JSON object.
+	BuiltinToolInputSchemaTypeObject BuiltinToolInputSchemaType = "object"
+)
+
+// Canonical digest algorithm for a validated MCP card
+// Experimental: CardDigestAlgorithm is part of an experimental API and may change or be
+// removed.
+type CardDigestAlgorithm string
+
+const (
+	// SHA-256 over RFC 8785 canonical JSON encoded as UTF-8.
+	CardDigestAlgorithmSha256Rfc8785 CardDigestAlgorithm = "sha256-rfc8785"
+)
+
+// AI skills are discovery-only and cannot be installed through this surface
+type CatalogAiSkillCandidateInstallability string
+
+const (
+	CatalogAiSkillCandidateInstallabilityNotInstallableKind CatalogAiSkillCandidateInstallability = "not-installable-kind"
+)
+
+// Media type of the underlying AI skill card
+type CatalogAiSkillCandidateMediaType string
+
+const (
+	CatalogAiSkillCandidateMediaTypeApplicationAiSkill CatalogAiSkillCandidateMediaType = "application/ai-skill"
+)
+
+// Media type advertised for the referenced AI skill card
+type CatalogAiSkillCandidateProvenanceMediaType string
+
+const (
+	CatalogAiSkillCandidateProvenanceMediaTypeApplicationAiSkill CatalogAiSkillCandidateProvenanceMediaType = "application/ai-skill"
+)
+
+// Why the catalog authority did not accept the caller's identity
+// Experimental: CatalogAuthenticationRequiredReason is part of an experimental API and may
+// change or be removed.
+type CatalogAuthenticationRequiredReason string
+
+const (
+	// A credential was presented and its lifetime has elapsed. A silent refresh is worth
+	// attempting before prompting anyone.
+	CatalogAuthenticationRequiredReasonCredentialExpired CatalogAuthenticationRequiredReason = "credential-expired"
+	// A credential was presented and the authority refused it, for example because it was
+	// revoked, malformed, or issued for another audience. Refreshing the same rejected
+	// credential is not useful; the caller must sign in again.
+	CatalogAuthenticationRequiredReasonCredentialRejected CatalogAuthenticationRequiredReason = "credential-rejected"
+	// No credential was presented, so there is nothing to refresh and the caller must sign in.
+	CatalogAuthenticationRequiredReasonNoCredential CatalogAuthenticationRequiredReason = "no-credential"
+)
+
+// Kind discriminator for CatalogCandidate.
+// Experimental: CatalogCandidateKind is part of an experimental API and may change or be
+// removed.
+type CatalogCandidateKind string
+
+const (
+	CatalogCandidateKindAiSkill   CatalogCandidateKind = "ai-skill"
+	CatalogCandidateKindMCPServer CatalogCandidateKind = "mcp-server"
+)
+
+// Kind discriminator for CatalogCandidateSource.
+type CatalogCandidateSourceKind string
+
+const (
+	CatalogCandidateSourceKindEmbedded CatalogCandidateSourceKind = "embedded"
+	CatalogCandidateSourceKindURL      CatalogCandidateSourceKind = "url"
+)
+
+// A wire feature a caller can require of the catalog surface, negotiated per request. A
+// grant means the runtime understands the feature's contract, not that the deployment has
+// enabled the operation; typed unavailable results report availability separately.
+// Experimental: CatalogCapability is part of an experimental API and may change or be
+// removed.
+type CatalogCapability string
+
+const (
+	// Understands `application/ai-skill` candidates as discovery-only and typed non-installable.
+	CatalogCapabilityAiSkillDiscovery CatalogCapability = "ai-skill-discovery"
+	// Understands the legacy `application/mcp-server+json` media type.
+	CatalogCapabilityLegacyMCPServerCard CatalogCapability = "legacy-mcp-server-card"
+	// Understands side-effect-free MCP install-plan requests, results, and plan handles;
+	// `planning-unavailable` separately reports that planning is not enabled.
+	CatalogCapabilityMCPInstallPlanning CatalogCapability = "mcp-install-planning"
+	// Understands the current `application/mcp-server-card+json` media type.
+	CatalogCapabilityMCPServerCard CatalogCapability = "mcp-server-card"
+	// Understands plans that enumerate every eligible transport rather than a single preferred
+	// one.
+	CatalogCapabilityMultipleTransportChoice CatalogCapability = "multiple-transport-choice"
+)
+
+// Which wire-contract rule an upstream response broke
+// Experimental: CatalogContractViolationReason is part of an experimental API and may
+// change or be removed.
+type CatalogContractViolationReason string
+
+const (
+	// A result carried both a URL and embedded data, when exactly one is permitted.
+	CatalogContractViolationReasonBothURLAndData CatalogContractViolationReason = "both-url-and-data"
+	// Two results claimed the same normalised identity.
+	CatalogContractViolationReasonDuplicateIdentity CatalogContractViolationReason = "duplicate-identity"
+	// A result carried neither a URL nor embedded data, when exactly one is required.
+	CatalogContractViolationReasonNeitherURLNorData CatalogContractViolationReason = "neither-url-nor-data"
+	// A result declared no media type, or one this contract does not model.
+	CatalogContractViolationReasonUnknownMediaType CatalogContractViolationReason = "unknown-media-type"
+)
+
+// Why a presented handle was rejected
+// Experimental: CatalogHandleRejectionReason is part of an experimental API and may change
+// or be removed.
+type CatalogHandleRejectionReason string
+
+const (
+	// The handle was issued by a different runtime instance.
+	CatalogHandleRejectionReasonForeign CatalogHandleRejectionReason = "foreign"
+	// The handle is unparseable, unknown, or was issued for a different operation.
+	CatalogHandleRejectionReasonInvalid CatalogHandleRejectionReason = "invalid"
+	// The handle has already been used, and handles are single-use.
+	CatalogHandleRejectionReasonReplayed CatalogHandleRejectionReason = "replayed"
+	// The handle's time to live has elapsed.
+	CatalogHandleRejectionReasonStale CatalogHandleRejectionReason = "stale"
+)
+
+// Which kind of opaque handle was presented
+// Experimental: CatalogHandleType is part of an experimental API and may change or be
+// removed.
+type CatalogHandleType string
+
+const (
+	// A search candidate handle.
+	CatalogHandleTypeCandidate CatalogHandleType = "candidate"
+	// An install plan handle.
+	CatalogHandleTypePlan CatalogHandleType = "plan"
+)
+
+// Which request field was rejected before any work was done
+// Experimental: CatalogInvalidRequestField is part of an experimental API and may change or
+// be removed.
+type CatalogInvalidRequestField string
+
+const (
+	// The supplied card was missing its media type, URL, or data.
+	CatalogInvalidRequestFieldCard CatalogInvalidRequestField = "card"
+	// The negotiation block was missing or malformed.
+	CatalogInvalidRequestFieldContract CatalogInvalidRequestField = "contract"
+	// The requested candidate kinds were empty or contained a duplicate.
+	CatalogInvalidRequestFieldKinds CatalogInvalidRequestField = "kinds"
+	// The requested result count fell outside its permitted range.
+	CatalogInvalidRequestFieldLimit CatalogInvalidRequestField = "limit"
+	// The search query was empty or longer than permitted.
+	CatalogInvalidRequestFieldQuery CatalogInvalidRequestField = "query"
+	// The requested configuration scope is not one this runtime writes.
+	CatalogInvalidRequestFieldScope CatalogInvalidRequestField = "scope"
+	// The plan source was missing or malformed.
+	CatalogInvalidRequestFieldSource CatalogInvalidRequestField = "source"
+)
+
+// How a card failed validation
+// Experimental: CatalogMalformedCardReason is part of an experimental API and may change or
+// be removed.
+type CatalogMalformedCardReason string
+
+const (
+	// The document is not well-formed JSON.
+	CatalogMalformedCardReasonInvalidJSON CatalogMalformedCardReason = "invalid-json"
+	// A field the media type requires is absent.
+	CatalogMalformedCardReasonMissingRequiredField CatalogMalformedCardReason = "missing-required-field"
+	// The document does not satisfy its media type's schema.
+	CatalogMalformedCardReasonSchemaViolation CatalogMalformedCardReason = "schema-violation"
+	// The document exceeded the permitted size.
+	CatalogMalformedCardReasonSizeLimitExceeded CatalogMalformedCardReason = "size-limit-exceeded"
+	// The declared media type is not one this runtime understands.
+	CatalogMalformedCardReasonUnsupportedMediaType CatalogMalformedCardReason = "unsupported-media-type"
+)
+
+// Whether an MCP server candidate can be planned for installation
+// Experimental: CatalogMCPServerInstallability is part of an experimental API and may
+// change or be removed.
+type CatalogMCPServerInstallability string
+
+const (
+	// An install plan can be computed for this MCP server candidate.
+	CatalogMCPServerInstallabilityInstallable CatalogMCPServerInstallability = "installable"
+	// Policy forbids installing this MCP server candidate.
+	CatalogMCPServerInstallabilityNotInstallablePolicy CatalogMCPServerInstallability = "not-installable-policy"
+)
+
+// Media type a catalog card is interpreted as
+// Experimental: CatalogMediaType is part of an experimental API and may change or be
+// removed.
+type CatalogMediaType string
+
+const (
+	// An AI skill card. Representable and searchable, but typed non-installable.
+	CatalogMediaTypeApplicationAiSkill CatalogMediaType = "application/ai-skill"
+	// The current MCP server card media type.
+	CatalogMediaTypeApplicationMCPServerCardJSON CatalogMediaType = "application/mcp-server-card+json"
+	// The legacy MCP server card media type, accepted for compatibility.
+	CatalogMediaTypeApplicationMCPServerJSON CatalogMediaType = "application/mcp-server+json"
+)
+
+// Why capability and protocol-version negotiation refused a caller
+// Experimental: CatalogNegotiationRefusedReason is part of an experimental API and may
+// change or be removed.
+type CatalogNegotiationRefusedReason string
 
 const (
-	// GitHub discussion reference.
-	AttachmentGitHubReferenceTypeDiscussion AttachmentGitHubReferenceType = "discussion"
-	// GitHub issue reference.
-	AttachmentGitHubReferenceTypeIssue AttachmentGitHubReferenceType = "issue"
-	// GitHub pull request reference.
-	AttachmentGitHubReferenceTypePr AttachmentGitHubReferenceType = "pr"
+	// The caller requires at least one capability this runtime cannot honour.
+	CatalogNegotiationRefusedReasonUnsupportedCapability CatalogNegotiationRefusedReason = "unsupported-capability"
+	// The caller's protocol version is below the lowest this runtime serves.
+	CatalogNegotiationRefusedReasonUnsupportedProtocolVersion CatalogNegotiationRefusedReason = "unsupported-protocol-version"
 )
 
-// Type discriminator for Attachment.
-type AttachmentType string
+// Categorised network failure, low cardinality so it can be aggregated without carrying a
+// URL
+// Experimental: CatalogNetworkFailureReason is part of an experimental API and may change
+// or be removed.
+type CatalogNetworkFailureReason string
 
 const (
-	AttachmentTypeBlob                 AttachmentType = "blob"
-	AttachmentTypeDirectory            AttachmentType = "directory"
-	AttachmentTypeExtensionContext     AttachmentType = "extension_context"
-	AttachmentTypeFile                 AttachmentType = "file"
-	AttachmentTypeGitHubActionsJob     AttachmentType = "github_actions_job"
-	AttachmentTypeGitHubCommit         AttachmentType = "github_commit"
-	AttachmentTypeGitHubFile           AttachmentType = "github_file"
-	AttachmentTypeGitHubFileDiff       AttachmentType = "github_file_diff"
-	AttachmentTypeGitHubReference      AttachmentType = "github_reference"
-	AttachmentTypeGitHubRelease        AttachmentType = "github_release"
-	AttachmentTypeGitHubRepository     AttachmentType = "github_repository"
-	AttachmentTypeGitHubSnippet        AttachmentType = "github_snippet"
-	AttachmentTypeGitHubTreeComparison AttachmentType = "github_tree_comparison"
-	AttachmentTypeGitHubURL            AttachmentType = "github_url"
-	AttachmentTypeSelection            AttachmentType = "selection"
+	// The connection was refused or reset.
+	CatalogNetworkFailureReasonConnectionRefused CatalogNetworkFailureReason = "connection-refused"
+	// The authority's name could not be resolved.
+	CatalogNetworkFailureReasonDns CatalogNetworkFailureReason = "dns"
+	// The authority returned a status the runtime treats as a failure.
+	CatalogNetworkFailureReasonHTTPStatus CatalogNetworkFailureReason = "http-status"
+	// No network is available, so nothing was attempted.
+	CatalogNetworkFailureReasonOffline CatalogNetworkFailureReason = "offline"
+	// A redirect was refused by the runtime's redirect policy.
+	CatalogNetworkFailureReasonRedirectRejected CatalogNetworkFailureReason = "redirect-rejected"
+	// The response exceeded the permitted size.
+	CatalogNetworkFailureReasonResponseTooLarge CatalogNetworkFailureReason = "response-too-large"
+	// The request exceeded its time budget.
+	CatalogNetworkFailureReasonTimeout CatalogNetworkFailureReason = "timeout"
+	// The TLS handshake or certificate validation failed.
+	CatalogNetworkFailureReasonTls CatalogNetworkFailureReason = "tls"
 )
 
-// Type discriminator for AuthInfo.
-// Experimental: AuthInfoType is part of an experimental API and may change or be removed.
-type AuthInfoType string
+// Why a discoverable candidate cannot be installed
+// Experimental: CatalogNotInstallableReason is part of an experimental API and may change
+// or be removed.
+type CatalogNotInstallableReason string
 
 const (
-	AuthInfoTypeAPIKey          AuthInfoType = "api-key"
-	AuthInfoTypeCopilotAPIToken AuthInfoType = "copilot-api-token"
-	AuthInfoTypeEnv             AuthInfoType = "env"
-	AuthInfoTypeGhCLI           AuthInfoType = "gh-cli"
-	AuthInfoTypeHMAC            AuthInfoType = "hmac"
-	AuthInfoTypeToken           AuthInfoType = "token"
-	AuthInfoTypeUser            AuthInfoType = "user"
+	// AI skills are discoverable but have no typed importer in this phase.
+	CatalogNotInstallableReasonAiSkillNotInstallable CatalogNotInstallableReason = "ai-skill-not-installable"
+	// This kind of resource is not installable through this surface.
+	CatalogNotInstallableReasonKindNotInstallable CatalogNotInstallableReason = "kind-not-installable"
+	// Policy forbids installing this candidate.
+	CatalogNotInstallableReasonPolicyForbids CatalogNotInstallableReason = "policy-forbids"
 )
 
-// Custom input-format kind.
-// Experimental: BuiltinToolFormatType is part of an experimental API and may change or be
-// removed.
-type BuiltinToolFormatType string
+// Kind discriminator for CatalogSearchResult.
+type CatalogSearchResultKind string
 
 const (
-	// The tool input is parsed with the supplied grammar.
-	BuiltinToolFormatTypeGrammar BuiltinToolFormatType = "grammar"
+	CatalogSearchResultKindAuthenticationRequired CatalogSearchResultKind = "authentication-required"
+	CatalogSearchResultKindContractViolation      CatalogSearchResultKind = "contract-violation"
+	CatalogSearchResultKindInvalidRequest         CatalogSearchResultKind = "invalid-request"
+	CatalogSearchResultKindMalformedCard          CatalogSearchResultKind = "malformed-card"
+	CatalogSearchResultKindNegotiationRefused     CatalogSearchResultKind = "negotiation-refused"
+	CatalogSearchResultKindNetworkFailure         CatalogSearchResultKind = "network-failure"
+	CatalogSearchResultKindPolicyRejected         CatalogSearchResultKind = "policy-rejected"
+	CatalogSearchResultKindSucceeded              CatalogSearchResultKind = "succeeded"
+	CatalogSearchResultKindUnavailable            CatalogSearchResultKind = "unavailable"
+	CatalogSearchResultKindUnsafeRetrieval        CatalogSearchResultKind = "unsafe-retrieval"
+	CatalogSearchResultKindUnsupportedKind        CatalogSearchResultKind = "unsupported-kind"
 )
 
-// Root JSON Schema type for a built-in tool input.
-// Experimental: BuiltinToolInputSchemaType is part of an experimental API and may change or
+// Why a catalog operation is not available on this runtime
+// Experimental: CatalogUnavailableReason is part of an experimental API and may change or
 // be removed.
-type BuiltinToolInputSchemaType string
+type CatalogUnavailableReason string
 
 const (
-	// The tool accepts a JSON object.
-	BuiltinToolInputSchemaTypeObject BuiltinToolInputSchemaType = "object"
+	// No catalog authority is configured for this runtime.
+	CatalogUnavailableReasonAuthorityNotConfigured CatalogUnavailableReason = "authority-not-configured"
+	// The surface is disabled by policy on this runtime.
+	CatalogUnavailableReasonDisabledByPolicy CatalogUnavailableReason = "disabled-by-policy"
+	// Install planning is not wired up on this runtime build.
+	CatalogUnavailableReasonPlanningUnavailable CatalogUnavailableReason = "planning-unavailable"
+	// Bounded search is not wired up on this runtime build.
+	CatalogUnavailableReasonSearchUnavailable CatalogUnavailableReason = "search-unavailable"
+)
+
+// Why no usable transport could be offered
+// Experimental: CatalogUnavailableTransportReason is part of an experimental API and may
+// change or be removed.
+type CatalogUnavailableTransportReason string
+
+const (
+	// The card advertises no transport this runtime can use.
+	CatalogUnavailableTransportReasonNoEligibleTransport CatalogUnavailableTransportReason = "no-eligible-transport"
+	// Eligible remotes could not be enumerated, so no explicit choice can be offered.
+	CatalogUnavailableTransportReasonRemoteEnumerationUnavailable CatalogUnavailableTransportReason = "remote-enumeration-unavailable"
+	// Every advertised transport is of a kind this runtime does not implement.
+	CatalogUnavailableTransportReasonTransportNotSupported CatalogUnavailableTransportReason = "transport-not-supported"
+)
+
+// Which hardened-fetch control refused a retrieval
+// Experimental: CatalogUnsafeRetrievalReason is part of an experimental API and may change
+// or be removed.
+type CatalogUnsafeRetrievalReason string
+
+const (
+	// The URL resolved to a loopback, private, link-local, or cloud metadata address.
+	CatalogUnsafeRetrievalReasonBlockedAddress CatalogUnsafeRetrievalReason = "blocked-address"
+	// The URL used a scheme the runtime refuses to fetch.
+	CatalogUnsafeRetrievalReasonBlockedScheme CatalogUnsafeRetrievalReason = "blocked-scheme"
+	// The URL embedded credentials.
+	CatalogUnsafeRetrievalReasonCredentialsInURL CatalogUnsafeRetrievalReason = "credentials-in-url"
+	// The authority is not permitted for card retrieval.
+	CatalogUnsafeRetrievalReasonHostNotPermitted CatalogUnsafeRetrievalReason = "host-not-permitted"
+	// The configured proxy policy refused the request.
+	CatalogUnsafeRetrievalReasonProxyRejected CatalogUnsafeRetrievalReason = "proxy-rejected"
+	// A redirect target resolved to a blocked address.
+	CatalogUnsafeRetrievalReasonRedirectToBlockedAddress CatalogUnsafeRetrievalReason = "redirect-to-blocked-address"
 )
 
 // Whether a pending slash-command invocation effect was applied or cancelled by the host.
@@ -15406,6 +16722,230 @@ const (
 	MCPOauthProbeResultStatusNoAuthRequired MCPOauthProbeResultStatus = "no-auth-required"
 )
 
+// Whether a planned configuration change would create or modify an entry
+// Experimental: MCPPlanConfigurationOperation is part of an experimental API and may change
+// or be removed.
+type MCPPlanConfigurationOperation string
+
+const (
+	// Creates a configuration entry that does not exist yet.
+	MCPPlanConfigurationOperationAdd MCPPlanConfigurationOperation = "add"
+	// Modifies a configuration entry that already exists.
+	MCPPlanConfigurationOperationUpdate MCPPlanConfigurationOperation = "update"
+)
+
+// Discriminator for an enumerated required value
+// Experimental: MCPPlanEnumValueType is part of an experimental API and may change or be
+// removed.
+type MCPPlanEnumValueType string
+
+const (
+	// One of a fixed, non-empty set of permitted values.
+	MCPPlanEnumValueTypeEnum MCPPlanEnumValueType = "enum"
+)
+
+// Kind discriminator for MCPPlanInstallResult.
+type MCPPlanInstallResultKind string
+
+const (
+	MCPPlanInstallResultKindAuthenticationRequired MCPPlanInstallResultKind = "authentication-required"
+	MCPPlanInstallResultKindContractViolation      MCPPlanInstallResultKind = "contract-violation"
+	MCPPlanInstallResultKindHandleRejected         MCPPlanInstallResultKind = "handle-rejected"
+	MCPPlanInstallResultKindInvalidRequest         MCPPlanInstallResultKind = "invalid-request"
+	MCPPlanInstallResultKindMalformedCard          MCPPlanInstallResultKind = "malformed-card"
+	MCPPlanInstallResultKindNegotiationRefused     MCPPlanInstallResultKind = "negotiation-refused"
+	MCPPlanInstallResultKindNetworkFailure         MCPPlanInstallResultKind = "network-failure"
+	MCPPlanInstallResultKindNotInstallable         MCPPlanInstallResultKind = "not-installable"
+	MCPPlanInstallResultKindPlanned                MCPPlanInstallResultKind = "planned"
+	MCPPlanInstallResultKindPolicyRejected         MCPPlanInstallResultKind = "policy-rejected"
+	MCPPlanInstallResultKindUnavailable            MCPPlanInstallResultKind = "unavailable"
+	MCPPlanInstallResultKindUnavailableTransport   MCPPlanInstallResultKind = "unavailable-transport"
+	MCPPlanInstallResultKindUnsafeRetrieval        MCPPlanInstallResultKind = "unsafe-retrieval"
+)
+
+// Discriminator for a candidate-backed install-plan source
+// Experimental: MCPPlanInstallSourceCandidateKind is part of an experimental API and may
+// change or be removed.
+type MCPPlanInstallSourceCandidateKind string
+
+const (
+	// Plan from a candidate returned by catalog search.
+	MCPPlanInstallSourceCandidateKindCandidate MCPPlanInstallSourceCandidateKind = "candidate"
+)
+
+// Discriminator for a caller-supplied-card install-plan source
+// Experimental: MCPPlanInstallSourceCardKind is part of an experimental API and may change
+// or be removed.
+type MCPPlanInstallSourceCardKind string
+
+const (
+	// Plan directly from a caller-supplied card.
+	MCPPlanInstallSourceCardKindCard MCPPlanInstallSourceCardKind = "card"
+)
+
+// Kind discriminator for MCPPlanInstallSource.
+type MCPPlanInstallSourceKind string
+
+const (
+	MCPPlanInstallSourceKindCandidate MCPPlanInstallSourceKind = "candidate"
+	MCPPlanInstallSourceKindCard      MCPPlanInstallSourceKind = "card"
+)
+
+// Discriminator for a package-backed transport choice
+// Experimental: MCPPlanPackageInstallMethod is part of an experimental API and may change
+// or be removed.
+type MCPPlanPackageInstallMethod string
+
+const (
+	// Install and run a local package.
+	MCPPlanPackageInstallMethodPackage MCPPlanPackageInstallMethod = "package"
+)
+
+// Transport exposed by a locally launched package
+// Experimental: MCPPlanPackageTransport is part of an experimental API and may change or be
+// removed.
+type MCPPlanPackageTransport string
+
+const (
+	// A locally launched process spoken to over standard input and output.
+	MCPPlanPackageTransportStdio MCPPlanPackageTransport = "stdio"
+)
+
+// What policy decided for a planned server
+// Experimental: MCPPlanPolicyDecision is part of an experimental API and may change or be
+// removed.
+type MCPPlanPolicyDecision string
+
+const (
+	// Policy permits the server.
+	MCPPlanPolicyDecisionAllowed MCPPlanPolicyDecision = "allowed"
+	// Policy forbids the server, so the plan cannot be applied.
+	MCPPlanPolicyDecisionBlocked MCPPlanPolicyDecision = "blocked"
+	// Policy permits the server only after an explicit approval.
+	MCPPlanPolicyDecisionRequiresApproval MCPPlanPolicyDecision = "requires-approval"
+)
+
+// Which authority produced a policy decision
+// Experimental: MCPPlanPolicySource is part of an experimental API and may change or be
+// removed.
+type MCPPlanPolicySource string
+
+const (
+	// An enterprise allowlist evaluated the server.
+	MCPPlanPolicySourceEnterpriseAllowlist MCPPlanPolicySource = "enterprise-allowlist"
+	// Local trust settings evaluated the server.
+	MCPPlanPolicySourceLocalTrust MCPPlanPolicySource = "local-trust"
+	// No policy applied, so the server is permitted by default.
+	MCPPlanPolicySourceNone MCPPlanPolicySource = "none"
+	// The registry the card came from evaluated the server.
+	MCPPlanPolicySourceRegistryPolicy MCPPlanPolicySource = "registry-policy"
+)
+
+// Discriminator for a remote-endpoint transport choice
+// Experimental: MCPPlanRemoteInstallMethod is part of an experimental API and may change or
+// be removed.
+type MCPPlanRemoteInstallMethod string
+
+const (
+	// Connect to a remote endpoint.
+	MCPPlanRemoteInstallMethodRemote MCPPlanRemoteInstallMethod = "remote"
+)
+
+// Transport exposed by a remote endpoint
+// Experimental: MCPPlanRemoteTransport is part of an experimental API and may change or be
+// removed.
+type MCPPlanRemoteTransport string
+
+const (
+	// An HTTP endpoint.
+	MCPPlanRemoteTransportHTTP MCPPlanRemoteTransport = "http"
+	// A server-sent events endpoint.
+	MCPPlanRemoteTransportSSE MCPPlanRemoteTransport = "sse"
+	// A streamable HTTP endpoint.
+	MCPPlanRemoteTransportStreamableHTTP MCPPlanRemoteTransport = "streamable-http"
+)
+
+// Discriminator for an enumerated required value
+// Experimental: MCPPlanRequiredValueEnumKind is part of an experimental API and may change
+// or be removed.
+type MCPPlanRequiredValueEnumKind string
+
+const (
+	// The value uses a fixed non-empty enumeration.
+	MCPPlanRequiredValueEnumKindEnum MCPPlanRequiredValueEnumKind = "enum"
+)
+
+// Kind discriminator for MCPPlanRequiredValue.
+type MCPPlanRequiredValueKind string
+
+const (
+	MCPPlanRequiredValueKindEnum   MCPPlanRequiredValueKind = "enum"
+	MCPPlanRequiredValueKindScalar MCPPlanRequiredValueKind = "scalar"
+)
+
+// Discriminator for a scalar required value
+// Experimental: MCPPlanRequiredValueScalarKind is part of an experimental API and may
+// change or be removed.
+type MCPPlanRequiredValueScalarKind string
+
+const (
+	// The value uses one scalar type.
+	MCPPlanRequiredValueScalarKindScalar MCPPlanRequiredValueScalarKind = "scalar"
+)
+
+// Scalar type a required value must conform to
+// Experimental: MCPPlanScalarValueType is part of an experimental API and may change or be
+// removed.
+type MCPPlanScalarValueType string
+
+const (
+	// A boolean.
+	MCPPlanScalarValueTypeBoolean MCPPlanScalarValueType = "boolean"
+	// A number.
+	MCPPlanScalarValueTypeNumber MCPPlanScalarValueType = "number"
+	// A filesystem path.
+	MCPPlanScalarValueTypePath MCPPlanScalarValueType = "path"
+	// Free text.
+	MCPPlanScalarValueTypeString MCPPlanScalarValueType = "string"
+)
+
+// Configuration scope an MCP install plan targets
+// Experimental: MCPPlanScope is part of an experimental API and may change or be removed.
+type MCPPlanScope string
+
+const (
+	// The user's own MCP configuration.
+	MCPPlanScopeUser MCPPlanScope = "user"
+)
+
+// Transport discriminator for MCPPlanTransportChoice.
+type MCPPlanTransportChoiceTransport string
+
+const (
+	MCPPlanTransportChoiceTransportHTTP           MCPPlanTransportChoiceTransport = "http"
+	MCPPlanTransportChoiceTransportSSE            MCPPlanTransportChoiceTransport = "sse"
+	MCPPlanTransportChoiceTransportStdio          MCPPlanTransportChoiceTransport = "stdio"
+	MCPPlanTransportChoiceTransportStreamableHTTP MCPPlanTransportChoiceTransport = "streamable-http"
+)
+
+// Where a required value is applied when the planned server is launched
+// Experimental: MCPPlanValueCategory is part of an experimental API and may change or be
+// removed.
+type MCPPlanValueCategory string
+
+const (
+	// Set as an environment variable on the launched process.
+	MCPPlanValueCategoryEnvironmentVariable MCPPlanValueCategory = "environment-variable"
+	// Sent as a request header to a remote endpoint.
+	MCPPlanValueCategoryHeader MCPPlanValueCategory = "header"
+	// Passed to the packaged server itself.
+	MCPPlanValueCategoryPackageArgument MCPPlanValueCategory = "package-argument"
+	// Passed to the runtime that launches the package.
+	MCPPlanValueCategoryRuntimeArgument MCPPlanValueCategory = "runtime-argument"
+	// Substituted into the remote endpoint URL.
+	MCPPlanValueCategoryURLVariable MCPPlanValueCategory = "url-variable"
+)
+
 // Outcome of the sampling inference. 'success' produced a response; 'failure' encountered
 // an error (including agent-side rejection by content filter or criteria); 'cancelled' the
 // caller cancelled this execution via cancelSamplingExecution.
@@ -15422,6 +16962,46 @@ const (
 	MCPSamplingExecutionActionSuccess MCPSamplingExecutionAction = "success"
 )
 
+// Discriminator for an embedded MCP server card
+// Experimental: MCPServerCardEmbeddedKind is part of an experimental API and may change or
+// be removed.
+type MCPServerCardEmbeddedKind string
+
+const (
+	// Use the embedded card document.
+	MCPServerCardEmbeddedKindEmbedded MCPServerCardEmbeddedKind = "embedded"
+)
+
+// JSON MCP card media type accepted for install planning
+// Experimental: MCPServerCardMediaType is part of an experimental API and may change or be
+// removed.
+type MCPServerCardMediaType string
+
+const (
+	// The current MCP server card media type.
+	MCPServerCardMediaTypeApplicationMCPServerCardJSON MCPServerCardMediaType = "application/mcp-server-card+json"
+	// The legacy MCP server card media type, accepted for compatibility.
+	MCPServerCardMediaTypeApplicationMCPServerJSON MCPServerCardMediaType = "application/mcp-server+json"
+)
+
+// Kind discriminator for MCPServerCardReference.
+type MCPServerCardReferenceKind string
+
+const (
+	MCPServerCardReferenceKindEmbedded MCPServerCardReferenceKind = "embedded"
+	MCPServerCardReferenceKindURL      MCPServerCardReferenceKind = "url"
+)
+
+// Discriminator for a URL-backed MCP server card
+// Experimental: MCPServerCardURLKind is part of an experimental API and may change or be
+// removed.
+type MCPServerCardURLKind string
+
+const (
+	// Retrieve the card from its URL.
+	MCPServerCardURLKindURL MCPServerCardURLKind = "url"
+)
+
 // Controls if tools provided by this server can be loaded on demand via tool search (auto)
 // or always included in the initial tool list (never)
 // Experimental: MCPServerConfigDeferTools is part of an experimental API and may change or
@@ -15808,13 +17388,13 @@ const (
 type PermissionDecisionSource string
 
 const (
+	// The response followed the assisted-approval judge recommendation.
+	PermissionDecisionSourceAssistedApproval PermissionDecisionSource = "assisted_approval"
 	// The host applied a standing policy or override rather than a judge recommendation or
 	// human decision.
 	PermissionDecisionSourceHostPolicy PermissionDecisionSource = "host_policy"
 	// A human supplied the response through an interactive prompt.
 	PermissionDecisionSourceHumanResponse PermissionDecisionSource = "human_response"
-	// The response followed the auto-approval judge recommendation.
-	PermissionDecisionSourceJudgeRecommendation PermissionDecisionSource = "judge_recommendation"
 	// The host denied the request because no interactive user response was available.
 	PermissionDecisionSourceUnattendedFallback PermissionDecisionSource = "unattended_fallback"
 )
@@ -15847,19 +17427,35 @@ const (
 	PermissionLocationTypeRepo PermissionLocationType = "repo"
 )
 
-// Current or requested allow-all mode.
-// Experimental: PermissionsAllowAllMode is part of an experimental API and may change or be
-// removed.
-type PermissionsAllowAllMode string
+// Current or requested permission mode.
+// Experimental: PermissionMode is part of an experimental API and may change or be removed.
+type PermissionMode string
 
 const (
-	// Permission requests follow the normal approval flow with an LLM advisory recommendation
-	// attached; clients may choose to auto-approve requests the judge evaluated as acceptable.
-	PermissionsAllowAllModeAuto PermissionsAllowAllMode = "auto"
-	// Permission requests follow the normal approval flow.
-	PermissionsAllowAllModeOff PermissionsAllowAllMode = "off"
 	// Tool, path, and URL permission requests are automatically approved.
-	PermissionsAllowAllModeOn PermissionsAllowAllMode = "on"
+	PermissionModeAllowAll PermissionMode = "allow-all"
+	// Permission requests include an LLM safety recommendation; clients may automatically
+	// approve requests judged acceptable.
+	PermissionModeAssisted PermissionMode = "assisted"
+	// Permission requests follow the normal approval flow.
+	PermissionModeManual PermissionMode = "manual"
+)
+
+// Optional source for permission-mode telemetry. Defaults to `rpc` when omitted for SDK
+// callers.
+// Experimental: PermissionModeSource is part of an experimental API and may change or be
+// removed.
+type PermissionModeSource string
+
+const (
+	// The mode was set by confirming autopilot behavior.
+	PermissionModeSourceAutopilotConfirmation PermissionModeSource = "autopilot_confirmation"
+	// The mode was set from a CLI command-line flag.
+	PermissionModeSourceCLIFlag PermissionModeSource = "cli_flag"
+	// The mode was set through an RPC caller.
+	PermissionModeSourceRPC PermissionModeSource = "rpc"
+	// The mode was set by a slash command.
+	PermissionModeSourceSlashCommand PermissionModeSource = "slash_command"
 )
 
 // Allowed values for the `PermissionsConfigureAdditionalContentExclusionPolicyScope`
@@ -15905,22 +17501,6 @@ const (
 	PermissionsModifyRulesScopeSession PermissionsModifyRulesScope = "session"
 )
 
-// Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers.
-// Experimental: PermissionsSetAllowAllSource is part of an experimental API and may change
-// or be removed.
-type PermissionsSetAllowAllSource string
-
-const (
-	// Allow-all was enabled by confirming autopilot behavior.
-	PermissionsSetAllowAllSourceAutopilotConfirmation PermissionsSetAllowAllSource = "autopilot_confirmation"
-	// Allow-all was enabled from a CLI command-line flag.
-	PermissionsSetAllowAllSourceCLIFlag PermissionsSetAllowAllSource = "cli_flag"
-	// Allow-all was enabled through an RPC caller.
-	PermissionsSetAllowAllSourceRPC PermissionsSetAllowAllSource = "rpc"
-	// Allow-all was enabled by a slash command.
-	PermissionsSetAllowAllSourceSlashCommand PermissionsSetAllowAllSource = "slash_command"
-)
-
 // Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers.
 // Experimental: PermissionsSetApproveAllSource is part of an experimental API and may
 // change or be removed.
@@ -17211,6 +18791,38 @@ func (a *ServerAgentsAPI) GetDiscoveryPaths(ctx context.Context, params *AgentsG
 	return &result, nil
 }
 
+// Experimental: ServerCatalogAPI contains experimental APIs that may change or be removed.
+type ServerCatalogAPI serverAPI
+
+// Search requests a bounded catalog search. This host-implemented server method is
+// available through SDK/TUI hosts; standalone and C-ABI runtimes whose host does not
+// implement server-method dispatch return JSON-RPC MethodNotFound. A runtime with search
+// available returns inert candidate summaries, each with an opaque single-use handle scoped
+// to this runtime instance; a runtime without it returns the typed search-unavailable
+// result. Public authorities may be searched anonymously, while an authority that requires
+// credentials yields the typed authentication-required result. All returned text, URLs, and
+// package metadata are untrusted external data and can never trigger instructions, tools,
+// or installation. Read-only: nothing is installed, configured, or persisted.
+//
+// RPC method: catalog.search.
+//
+// Parameters: A bounded catalog search. Both the query length and the result count are
+// capped by the schema so a caller cannot request an unbounded scan.
+//
+// Returns: Outcome of a catalog.search call: either bounded inert candidates, or one typed
+// refusal. Never a partial success.
+func (a *ServerCatalogAPI) Search(ctx context.Context, params *CatalogSearchRequest) (CatalogSearchResult, error) {
+	raw, err := a.client.Request(ctx, "catalog.search", params)
+	if err != nil {
+		return nil, err
+	}
+	result, err := unmarshalCatalogSearchResult(raw)
+	if err != nil {
+		return nil, err
+	}
+	return result, nil
+}
+
 // Experimental: ServerCommandsAPI contains experimental APIs that may change or be removed.
 type ServerCommandsAPI serverAPI
 
@@ -17451,6 +19063,36 @@ func (a *ServerMCPAPI) Discover(ctx context.Context, params *MCPDiscoverRequest)
 	return &result, nil
 }
 
+// PlanInstall requests a side-effect-free MCP install plan from a catalog candidate handle
+// or a caller-supplied card. This host-implemented server method is available through
+// SDK/TUI hosts; standalone and C-ABI runtimes whose host does not implement server-method
+// dispatch return JSON-RPC MethodNotFound. A runtime with planning available returns a
+// normalised plan and opaque single-use plan handle; a runtime without it returns the typed
+// planning-unavailable result. A completed plan reports resource identity, provenance,
+// eligible transport choices, the user-scope target, required typed values and secret
+// placeholders, the policy result, the configuration changes installing would make, and
+// whether a reload would be needed. Planning never writes configuration, stores a secret,
+// or reloads MCP servers, so abandoning a plan needs no call and leaves nothing behind.
+//
+// RPC method: mcp.planInstall.
+//
+// Parameters: A side-effect-free request for an MCP install plan. Computing a plan never
+// writes configuration, stores a secret, or reloads MCP servers.
+//
+// Returns: Outcome of an mcp.planInstall call: either a normalised plan, or one typed
+// refusal. Nothing is written in either case.
+func (a *ServerMCPAPI) PlanInstall(ctx context.Context, params *MCPPlanInstallRequest) (MCPPlanInstallResult, error) {
+	raw, err := a.client.Request(ctx, "mcp.planInstall", params)
+	if err != nil {
+		return nil, err
+	}
+	result, err := unmarshalMCPPlanInstallResult(raw)
+	if err != nil {
+		return nil, err
+	}
+	return result, nil
+}
+
 // Experimental: ServerMCPConfigAPI contains experimental APIs that may change or be removed.
 type ServerMCPConfigAPI serverAPI
 
@@ -18619,6 +20261,7 @@ type ServerRPC struct {
 	Account         *ServerAccountAPI
 	AgentRegistry   *ServerAgentRegistryAPI
 	Agents          *ServerAgentsAPI
+	Catalog         *ServerCatalogAPI
 	Commands        *ServerCommandsAPI
 	Extensions      *ServerExtensionsAPI
 	Instructions    *ServerInstructionsAPI
@@ -18682,6 +20325,7 @@ func NewServerRPC(client *jsonrpc2.Client) *ServerRPC {
 	r.Account = (*ServerAccountAPI)(&r.common)
 	r.AgentRegistry = (*ServerAgentRegistryAPI)(&r.common)
 	r.Agents = (*ServerAgentsAPI)(&r.common)
+	r.Catalog = (*ServerCatalogAPI)(&r.common)
 	r.Commands = (*ServerCommandsAPI)(&r.common)
 	r.Extensions = (*ServerExtensionsAPI)(&r.common)
 	r.Instructions = (*ServerInstructionsAPI)(&r.common)
@@ -20585,6 +22229,26 @@ func (a *MCPAPI) ListTools(ctx context.Context, params *MCPListToolsRequest) (*M
 	return &result, nil
 }
 
+// MoveLoadingToBackground releases any turns waiting on an in-flight MCP load without
+// cancelling the load, letting the agent proceed while MCP servers finish connecting in the
+// background. No-op when no MCP load is in flight or waiting turns were already released.
+//
+// RPC method: session.mcp.moveLoadingToBackground.
+//
+// Returns: Result of moving in-flight MCP loading to the background.
+func (a *MCPAPI) MoveLoadingToBackground(ctx context.Context) (*MoveMCPLoadingToBackgroundResult, error) {
+	req := map[string]any{"sessionId": a.sessionID}
+	raw, err := a.client.Request(ctx, "session.mcp.moveLoadingToBackground", req)
+	if err != nil {
+		return nil, err
+	}
+	var result MoveMCPLoadingToBackgroundResult
+	if err := json.Unmarshal(raw, &result); err != nil {
+		return nil, err
+	}
+	return &result, nil
+}
+
 // Reloads MCP server connections for the session.
 //
 // RPC method: session.mcp.reload.
@@ -21925,18 +23589,18 @@ func (a *PermissionsAPI) Configure(ctx context.Context, params *PermissionsConfi
 	return &result, nil
 }
 
-// GetAllowAll returns the current allow-all permission mode for the session.
+// GetMode returns the current permission mode for the session.
 //
-// RPC method: session.permissions.getAllowAll.
+// RPC method: session.permissions.getMode.
 //
-// Returns: Current allow-all permission mode.
-func (a *PermissionsAPI) GetAllowAll(ctx context.Context) (*AllowAllPermissionState, error) {
+// Returns: Current permission mode.
+func (a *PermissionsAPI) GetMode(ctx context.Context) (*PermissionsGetModeResult, error) {
 	req := map[string]any{"sessionId": a.sessionID}
-	raw, err := a.client.Request(ctx, "session.permissions.getAllowAll", req)
+	raw, err := a.client.Request(ctx, "session.permissions.getMode", req)
 	if err != nil {
 		return nil, err
 	}
-	var result AllowAllPermissionState
+	var result PermissionsGetModeResult
 	if err := json.Unmarshal(raw, &result); err != nil {
 		return nil, err
 	}
@@ -22075,68 +23739,62 @@ func (a *PermissionsAPI) ResetSessionApprovals(ctx context.Context, params *Perm
 	return &result, nil
 }
 
-// SetAllowAll sets the allow-all permission mode for the session. Used by attach-mode
-// clients (e.g. LocalRpcSession's `/allow-all` forwarder) to flip the target session's
-// permission state. The `on` mode swaps in unrestricted path and URL managers and emits
-// `session.permissions_changed` on transition; the `auto` mode keeps normal prompt paths
-// active while attaching LLM safety recommendations. The result returns the authoritative
-// post-mutation state so callers can update their local mirrors without racing the
-// `session.permissions_changed` notification on the same wire.
+// SetApproveAll enables or disables automatic approval of tool permission requests for the
+// session.
 //
-// RPC method: session.permissions.setAllowAll.
+// RPC method: session.permissions.setApproveAll.
 //
-// Parameters: Allow-all mode to apply for the session.
+// Parameters: Allow-all toggle for tool permission requests, with an optional telemetry
+// source.
 //
-// Returns: Indicates whether the operation succeeded and reports the post-mutation state.
-func (a *PermissionsAPI) SetAllowAll(ctx context.Context, params *PermissionsSetAllowAllRequest) (*AllowAllPermissionSetResult, error) {
+// Returns: Indicates whether the operation succeeded.
+func (a *PermissionsAPI) SetApproveAll(ctx context.Context, params *PermissionsSetApproveAllRequest) (*PermissionsSetApproveAllResult, error) {
 	req := map[string]any{"sessionId": a.sessionID}
 	if params != nil {
-		if params.Enabled != nil {
-			req["enabled"] = *params.Enabled
-		}
-		if params.Mode != nil {
-			req["mode"] = *params.Mode
-		}
-		if params.Model != nil {
-			req["model"] = *params.Model
-		}
+		req["enabled"] = params.Enabled
 		if params.Source != nil {
 			req["source"] = *params.Source
 		}
 	}
-	raw, err := a.client.Request(ctx, "session.permissions.setAllowAll", req)
+	raw, err := a.client.Request(ctx, "session.permissions.setApproveAll", req)
 	if err != nil {
 		return nil, err
 	}
-	var result AllowAllPermissionSetResult
+	var result PermissionsSetApproveAllResult
 	if err := json.Unmarshal(raw, &result); err != nil {
 		return nil, err
 	}
 	return &result, nil
 }
 
-// SetApproveAll enables or disables automatic approval of tool permission requests for the
-// session.
+// SetMode sets the permission mode for the session. `manual` follows the normal approval
+// flow, `assisted` attaches LLM safety recommendations, and `allow-all` automatically
+// approves permission requests. The result returns the authoritative post-mutation mode so
+// callers can update local state without racing the `session.permissions_changed`
+// notification.
 //
-// RPC method: session.permissions.setApproveAll.
+// RPC method: session.permissions.setMode.
 //
-// Parameters: Allow-all toggle for tool permission requests, with an optional telemetry
-// source.
+// Parameters: Permission mode to apply for the session.
 //
-// Returns: Indicates whether the operation succeeded.
-func (a *PermissionsAPI) SetApproveAll(ctx context.Context, params *PermissionsSetApproveAllRequest) (*PermissionsSetApproveAllResult, error) {
+// Returns: Indicates whether the requested permission mode was applied and reports the
+// authoritative post-mutation mode.
+func (a *PermissionsAPI) SetMode(ctx context.Context, params *PermissionsSetModeRequest) (*PermissionsSetModeResult, error) {
 	req := map[string]any{"sessionId": a.sessionID}
 	if params != nil {
-		req["enabled"] = params.Enabled
+		if params.AssistedApprovalModel != nil {
+			req["assistedApprovalModel"] = *params.AssistedApprovalModel
+		}
+		req["mode"] = params.Mode
 		if params.Source != nil {
 			req["source"] = *params.Source
 		}
 	}
-	raw, err := a.client.Request(ctx, "session.permissions.setApproveAll", req)
+	raw, err := a.client.Request(ctx, "session.permissions.setMode", req)
 	if err != nil {
 		return nil, err
 	}
-	var result PermissionsSetApproveAllResult
+	var result PermissionsSetModeResult
 	if err := json.Unmarshal(raw, &result); err != nil {
 		return nil, err
 	}
diff --git a/go/rpc/zrpc_encoding.go b/go/rpc/zrpc_encoding.go
index 7f0dc9e1e1..fadbc5da1b 100644
--- a/go/rpc/zrpc_encoding.go
+++ b/go/rpc/zrpc_encoding.go
@@ -654,6 +654,443 @@ func (r *BuiltinToolDescriptor) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
+func unmarshalCatalogCandidate(data []byte) (CatalogCandidate, error) {
+	if string(data) == "null" {
+		return nil, nil
+	}
+	type rawUnion struct {
+		Kind CatalogCandidateKind `json:"kind"`
+	}
+	var raw rawUnion
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return nil, err
+	}
+
+	switch raw.Kind {
+	case CatalogCandidateKindAiSkill:
+		var d CatalogAiSkillCandidate
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case CatalogCandidateKindMCPServer:
+		var d CatalogMCPServerCandidate
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	default:
+		return &RawCatalogCandidateData{Discriminator: raw.Kind, Raw: data}, nil
+	}
+}
+
+func (r RawCatalogCandidateData) MarshalJSON() ([]byte, error) {
+	if r.Raw != nil {
+		return r.Raw, nil
+	}
+	return json.Marshal(struct {
+		Kind CatalogCandidateKind `json:"kind"`
+	}{
+		Kind: r.Discriminator,
+	})
+}
+
+func unmarshalCatalogCandidateSource(data []byte) (CatalogCandidateSource, error) {
+	if string(data) == "null" {
+		return nil, nil
+	}
+	type rawUnion struct {
+		Kind CatalogCandidateSourceKind `json:"kind"`
+	}
+	var raw rawUnion
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return nil, err
+	}
+
+	switch raw.Kind {
+	case CatalogCandidateSourceKindEmbedded:
+		var d CatalogCandidateSourceEmbedded
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case CatalogCandidateSourceKindURL:
+		var d CatalogCandidateSourceURL
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	default:
+		return &RawCatalogCandidateSourceData{Discriminator: raw.Kind, Raw: data}, nil
+	}
+}
+
+func (r RawCatalogCandidateSourceData) MarshalJSON() ([]byte, error) {
+	if r.Raw != nil {
+		return r.Raw, nil
+	}
+	return json.Marshal(struct {
+		Kind CatalogCandidateSourceKind `json:"kind"`
+	}{
+		Kind: r.Discriminator,
+	})
+}
+
+func (r CatalogCandidateSourceEmbedded) MarshalJSON() ([]byte, error) {
+	type alias CatalogCandidateSourceEmbedded
+	return json.Marshal(struct {
+		Kind CatalogCandidateSourceKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func (r CatalogCandidateSourceURL) MarshalJSON() ([]byte, error) {
+	type alias CatalogCandidateSourceURL
+	return json.Marshal(struct {
+		Kind CatalogCandidateSourceKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func (r *CatalogAiSkillCandidate) UnmarshalJSON(data []byte) error {
+	type rawCatalogAiSkillCandidate struct {
+		Description     *string                               `json:"description,omitempty"`
+		DisplayName     string                                `json:"displayName"`
+		Handle          string                                `json:"handle"`
+		HandleExpiresAt string                                `json:"handleExpiresAt"`
+		Installability  CatalogAiSkillCandidateInstallability `json:"installability"`
+		MediaType       CatalogAiSkillCandidateMediaType      `json:"mediaType"`
+		Provenance      CatalogAiSkillCandidateProvenance     `json:"provenance"`
+		Publisher       *string                               `json:"publisher,omitempty"`
+		Source          json.RawMessage                       `json:"source"`
+	}
+	var raw rawCatalogAiSkillCandidate
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return err
+	}
+	r.Description = raw.Description
+	r.DisplayName = raw.DisplayName
+	r.Handle = raw.Handle
+	r.HandleExpiresAt = raw.HandleExpiresAt
+	r.Installability = raw.Installability
+	r.MediaType = raw.MediaType
+	r.Provenance = raw.Provenance
+	r.Publisher = raw.Publisher
+	if raw.Source != nil {
+		value, err := unmarshalCatalogCandidateSource(raw.Source)
+		if err != nil {
+			return err
+		}
+		r.Source = value
+	}
+	return nil
+}
+
+func (r CatalogAiSkillCandidate) MarshalJSON() ([]byte, error) {
+	type alias CatalogAiSkillCandidate
+	return json.Marshal(struct {
+		Kind CatalogCandidateKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func (r *CatalogMCPServerCandidate) UnmarshalJSON(data []byte) error {
+	type rawCatalogMCPServerCandidate struct {
+		Description     *string                             `json:"description,omitempty"`
+		DisplayName     string                              `json:"displayName"`
+		Handle          string                              `json:"handle"`
+		HandleExpiresAt string                              `json:"handleExpiresAt"`
+		Installability  CatalogMCPServerInstallability      `json:"installability"`
+		MediaType       MCPServerCardMediaType              `json:"mediaType"`
+		Provenance      CatalogMCPServerCandidateProvenance `json:"provenance"`
+		Publisher       *string                             `json:"publisher,omitempty"`
+		Source          json.RawMessage                     `json:"source"`
+	}
+	var raw rawCatalogMCPServerCandidate
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return err
+	}
+	r.Description = raw.Description
+	r.DisplayName = raw.DisplayName
+	r.Handle = raw.Handle
+	r.HandleExpiresAt = raw.HandleExpiresAt
+	r.Installability = raw.Installability
+	r.MediaType = raw.MediaType
+	r.Provenance = raw.Provenance
+	r.Publisher = raw.Publisher
+	if raw.Source != nil {
+		value, err := unmarshalCatalogCandidateSource(raw.Source)
+		if err != nil {
+			return err
+		}
+		r.Source = value
+	}
+	return nil
+}
+
+func (r CatalogMCPServerCandidate) MarshalJSON() ([]byte, error) {
+	type alias CatalogMCPServerCandidate
+	return json.Marshal(struct {
+		Kind CatalogCandidateKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func unmarshalCatalogSearchResult(data []byte) (CatalogSearchResult, error) {
+	if string(data) == "null" {
+		return nil, nil
+	}
+	type rawUnion struct {
+		Kind CatalogSearchResultKind `json:"kind"`
+	}
+	var raw rawUnion
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return nil, err
+	}
+
+	switch raw.Kind {
+	case CatalogSearchResultKindAuthenticationRequired:
+		var d CatalogAuthenticationRequiredError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case CatalogSearchResultKindContractViolation:
+		var d CatalogContractViolationError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case CatalogSearchResultKindInvalidRequest:
+		var d CatalogInvalidRequestError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case CatalogSearchResultKindMalformedCard:
+		var d CatalogMalformedCardError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case CatalogSearchResultKindNegotiationRefused:
+		var d CatalogNegotiationRefusedError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case CatalogSearchResultKindNetworkFailure:
+		var d CatalogNetworkFailureError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case CatalogSearchResultKindPolicyRejected:
+		var d CatalogPolicyRejectedError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case CatalogSearchResultKindSucceeded:
+		var d CatalogSearchSucceeded
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case CatalogSearchResultKindUnavailable:
+		var d CatalogUnavailableError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case CatalogSearchResultKindUnsafeRetrieval:
+		var d CatalogUnsafeRetrievalError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case CatalogSearchResultKindUnsupportedKind:
+		var d CatalogUnsupportedKindError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	default:
+		return &RawCatalogSearchResultData{Discriminator: raw.Kind, Raw: data}, nil
+	}
+}
+
+func (r RawCatalogSearchResultData) MarshalJSON() ([]byte, error) {
+	if r.Raw != nil {
+		return r.Raw, nil
+	}
+	return json.Marshal(struct {
+		Kind CatalogSearchResultKind `json:"kind"`
+	}{
+		Kind: r.Discriminator,
+	})
+}
+
+func (r CatalogAuthenticationRequiredError) MarshalJSON() ([]byte, error) {
+	type alias CatalogAuthenticationRequiredError
+	return json.Marshal(struct {
+		Kind CatalogSearchResultKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func (r CatalogContractViolationError) MarshalJSON() ([]byte, error) {
+	type alias CatalogContractViolationError
+	return json.Marshal(struct {
+		Kind CatalogSearchResultKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func (r CatalogInvalidRequestError) MarshalJSON() ([]byte, error) {
+	type alias CatalogInvalidRequestError
+	return json.Marshal(struct {
+		Kind CatalogSearchResultKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func (r CatalogMalformedCardError) MarshalJSON() ([]byte, error) {
+	type alias CatalogMalformedCardError
+	return json.Marshal(struct {
+		Kind CatalogSearchResultKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func (r CatalogNegotiationRefusedError) MarshalJSON() ([]byte, error) {
+	type alias CatalogNegotiationRefusedError
+	return json.Marshal(struct {
+		Kind CatalogSearchResultKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func (r CatalogNetworkFailureError) MarshalJSON() ([]byte, error) {
+	type alias CatalogNetworkFailureError
+	return json.Marshal(struct {
+		Kind CatalogSearchResultKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func (r CatalogPolicyRejectedError) MarshalJSON() ([]byte, error) {
+	type alias CatalogPolicyRejectedError
+	return json.Marshal(struct {
+		Kind CatalogSearchResultKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func (r *CatalogSearchSucceeded) UnmarshalJSON(data []byte) error {
+	type rawCatalogSearchSucceeded struct {
+		Candidates []json.RawMessage         `json:"candidates"`
+		Negotiated CatalogNegotiatedContract `json:"negotiated"`
+		SearchID   string                    `json:"searchId"`
+		Truncated  bool                      `json:"truncated"`
+	}
+	var raw rawCatalogSearchSucceeded
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return err
+	}
+	if raw.Candidates != nil {
+		r.Candidates = make([]CatalogCandidate, 0, len(raw.Candidates))
+		for _, rawItem := range raw.Candidates {
+			value, err := unmarshalCatalogCandidate(rawItem)
+			if err != nil {
+				return err
+			}
+			r.Candidates = append(r.Candidates, value)
+		}
+	}
+	r.Negotiated = raw.Negotiated
+	r.SearchID = raw.SearchID
+	r.Truncated = raw.Truncated
+	return nil
+}
+
+func (r CatalogSearchSucceeded) MarshalJSON() ([]byte, error) {
+	type alias CatalogSearchSucceeded
+	return json.Marshal(struct {
+		Kind CatalogSearchResultKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func (r CatalogUnavailableError) MarshalJSON() ([]byte, error) {
+	type alias CatalogUnavailableError
+	return json.Marshal(struct {
+		Kind CatalogSearchResultKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func (r CatalogUnsafeRetrievalError) MarshalJSON() ([]byte, error) {
+	type alias CatalogUnsafeRetrievalError
+	return json.Marshal(struct {
+		Kind CatalogSearchResultKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func (r CatalogUnsupportedKindError) MarshalJSON() ([]byte, error) {
+	type alias CatalogUnsupportedKindError
+	return json.Marshal(struct {
+		Kind CatalogSearchResultKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
 func unmarshalQueuedCommandResult(data []byte) (QueuedCommandResult, error) {
 	if string(data) == "null" {
 		return nil, nil
@@ -1736,41 +2173,282 @@ func (r RawMCPHeadersHandlePendingHeadersRefreshRequestData) MarshalJSON() ([]by
 func (r MCPHeadersHandlePendingHeadersRefreshRequestHeaders) MarshalJSON() ([]byte, error) {
 	type alias MCPHeadersHandlePendingHeadersRefreshRequestHeaders
 	return json.Marshal(struct {
-		Kind MCPHeadersHandlePendingHeadersRefreshRequestKind `json:"kind"`
+		Kind MCPHeadersHandlePendingHeadersRefreshRequestKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func (r MCPHeadersHandlePendingHeadersRefreshRequestNone) MarshalJSON() ([]byte, error) {
+	type alias MCPHeadersHandlePendingHeadersRefreshRequestNone
+	return json.Marshal(struct {
+		Kind MCPHeadersHandlePendingHeadersRefreshRequestKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func (r *MCPHeadersHandlePendingHeadersRefreshRequestRequest) UnmarshalJSON(data []byte) error {
+	type rawMCPHeadersHandlePendingHeadersRefreshRequestRequest struct {
+		RequestID string          `json:"requestId"`
+		Result    json.RawMessage `json:"result"`
+	}
+	var raw rawMCPHeadersHandlePendingHeadersRefreshRequestRequest
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return err
+	}
+	r.RequestID = raw.RequestID
+	if raw.Result != nil {
+		value, err := unmarshalMCPHeadersHandlePendingHeadersRefreshRequest(raw.Result)
+		if err != nil {
+			return err
+		}
+		r.Result = value
+	}
+	return nil
+}
+
+func unmarshalMCPPlanTransportChoice(data []byte) (MCPPlanTransportChoice, error) {
+	if string(data) == "null" {
+		return nil, nil
+	}
+	type rawUnion struct {
+		Transport MCPPlanTransportChoiceTransport `json:"transport"`
+	}
+	var raw rawUnion
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return nil, err
+	}
+
+	switch raw.Transport {
+	case MCPPlanTransportChoiceTransportHTTP:
+		var d MCPPlanTransportChoiceRemote
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case MCPPlanTransportChoiceTransportSSE:
+		var d MCPPlanTransportChoiceRemote
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case MCPPlanTransportChoiceTransportStdio:
+		var d MCPPlanTransportChoicePackage
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case MCPPlanTransportChoiceTransportStreamableHTTP:
+		var d MCPPlanTransportChoiceRemote
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	default:
+		return &RawMCPPlanTransportChoiceData{Discriminator: raw.Transport, Raw: data}, nil
+	}
+}
+
+func (r RawMCPPlanTransportChoiceData) MarshalJSON() ([]byte, error) {
+	if r.Raw != nil {
+		return r.Raw, nil
+	}
+	return json.Marshal(struct {
+		Transport MCPPlanTransportChoiceTransport `json:"transport"`
+	}{
+		Transport: r.Discriminator,
+	})
+}
+
+func unmarshalMCPPlanRequiredValue(data []byte) (MCPPlanRequiredValue, error) {
+	if string(data) == "null" {
+		return nil, nil
+	}
+	type rawUnion struct {
+		Kind MCPPlanRequiredValueKind `json:"kind"`
+	}
+	var raw rawUnion
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return nil, err
+	}
+
+	switch raw.Kind {
+	case MCPPlanRequiredValueKindEnum:
+		var d MCPPlanRequiredValueEnum
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case MCPPlanRequiredValueKindScalar:
+		var d MCPPlanRequiredValueScalar
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	default:
+		return &RawMCPPlanRequiredValueData{Discriminator: raw.Kind, Raw: data}, nil
+	}
+}
+
+func (r RawMCPPlanRequiredValueData) MarshalJSON() ([]byte, error) {
+	if r.Raw != nil {
+		return r.Raw, nil
+	}
+	return json.Marshal(struct {
+		Kind MCPPlanRequiredValueKind `json:"kind"`
+	}{
+		Kind: r.Discriminator,
+	})
+}
+
+func (r MCPPlanRequiredValueEnum) MarshalJSON() ([]byte, error) {
+	type alias MCPPlanRequiredValueEnum
+	return json.Marshal(struct {
+		Kind MCPPlanRequiredValueKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func (r MCPPlanRequiredValueScalar) MarshalJSON() ([]byte, error) {
+	type alias MCPPlanRequiredValueScalar
+	return json.Marshal(struct {
+		Kind MCPPlanRequiredValueKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func (r *MCPPlanTransportChoicePackage) UnmarshalJSON(data []byte) error {
+	type rawMCPPlanTransportChoicePackage struct {
+		ChoiceID           string                      `json:"choiceId"`
+		InstallMethod      MCPPlanPackageInstallMethod `json:"installMethod"`
+		PackageIdentifier  string                      `json:"packageIdentifier"`
+		PackageType        string                      `json:"packageType"`
+		RequiredValues     []json.RawMessage           `json:"requiredValues"`
+		SecretPlaceholders []MCPPlanSecretPlaceholder  `json:"secretPlaceholders"`
+	}
+	var raw rawMCPPlanTransportChoicePackage
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return err
+	}
+	r.ChoiceID = raw.ChoiceID
+	r.InstallMethod = raw.InstallMethod
+	r.PackageIdentifier = raw.PackageIdentifier
+	r.PackageType = raw.PackageType
+	if raw.RequiredValues != nil {
+		r.RequiredValues = make([]MCPPlanRequiredValue, 0, len(raw.RequiredValues))
+		for _, rawItem := range raw.RequiredValues {
+			value, err := unmarshalMCPPlanRequiredValue(rawItem)
+			if err != nil {
+				return err
+			}
+			r.RequiredValues = append(r.RequiredValues, value)
+		}
+	}
+	r.SecretPlaceholders = raw.SecretPlaceholders
+	return nil
+}
+
+func (r MCPPlanTransportChoicePackage) MarshalJSON() ([]byte, error) {
+	type alias MCPPlanTransportChoicePackage
+	return json.Marshal(struct {
+		Transport MCPPlanTransportChoiceTransport `json:"transport"`
 		alias
 	}{
-		Kind:  r.Kind(),
-		alias: alias(r),
+		Transport: r.Transport(),
+		alias:     alias(r),
 	})
 }
 
-func (r MCPHeadersHandlePendingHeadersRefreshRequestNone) MarshalJSON() ([]byte, error) {
-	type alias MCPHeadersHandlePendingHeadersRefreshRequestNone
+func (r *MCPPlanTransportChoiceRemote) UnmarshalJSON(data []byte) error {
+	type rawMCPPlanTransportChoiceRemote struct {
+		ChoiceID           string                     `json:"choiceId"`
+		Endpoint           string                     `json:"endpoint"`
+		InstallMethod      MCPPlanRemoteInstallMethod `json:"installMethod"`
+		RequiredValues     []json.RawMessage          `json:"requiredValues"`
+		SecretPlaceholders []MCPPlanSecretPlaceholder `json:"secretPlaceholders"`
+		Discriminator      MCPPlanRemoteTransport     `json:"transport,omitempty"`
+	}
+	var raw rawMCPPlanTransportChoiceRemote
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return err
+	}
+	r.ChoiceID = raw.ChoiceID
+	r.Endpoint = raw.Endpoint
+	r.InstallMethod = raw.InstallMethod
+	if raw.RequiredValues != nil {
+		r.RequiredValues = make([]MCPPlanRequiredValue, 0, len(raw.RequiredValues))
+		for _, rawItem := range raw.RequiredValues {
+			value, err := unmarshalMCPPlanRequiredValue(rawItem)
+			if err != nil {
+				return err
+			}
+			r.RequiredValues = append(r.RequiredValues, value)
+		}
+	}
+	r.SecretPlaceholders = raw.SecretPlaceholders
+	r.Discriminator = raw.Discriminator
+	return nil
+}
+
+func (r MCPPlanTransportChoiceRemote) MarshalJSON() ([]byte, error) {
+	type alias MCPPlanTransportChoiceRemote
 	return json.Marshal(struct {
-		Kind MCPHeadersHandlePendingHeadersRefreshRequestKind `json:"kind"`
+		Transport MCPPlanTransportChoiceTransport `json:"transport"`
 		alias
 	}{
-		Kind:  r.Kind(),
-		alias: alias(r),
+		Transport: r.Transport(),
+		alias:     alias(r),
 	})
 }
 
-func (r *MCPHeadersHandlePendingHeadersRefreshRequestRequest) UnmarshalJSON(data []byte) error {
-	type rawMCPHeadersHandlePendingHeadersRefreshRequestRequest struct {
-		RequestID string          `json:"requestId"`
-		Result    json.RawMessage `json:"result"`
+func (r *MCPInstallPlan) UnmarshalJSON(data []byte) error {
+	type rawMCPInstallPlan struct {
+		ConfigurationChanges             []MCPPlanConfigurationChange `json:"configurationChanges"`
+		Identity                         MCPPlanResourceIdentity      `json:"identity"`
+		PlanHandle                       string                       `json:"planHandle"`
+		PlanHandleExpiresAt              string                       `json:"planHandleExpiresAt"`
+		Policy                           MCPPlanPolicyResult          `json:"policy"`
+		Provenance                       MCPPlanProvenance            `json:"provenance"`
+		RecommendedTransportChoiceID     *string                      `json:"recommendedTransportChoiceId,omitempty"`
+		ReloadRequired                   bool                         `json:"reloadRequired"`
+		RequiresInteractiveConfiguration bool                         `json:"requiresInteractiveConfiguration"`
+		Target                           MCPPlanTarget                `json:"target"`
+		TransportChoices                 []json.RawMessage            `json:"transportChoices"`
 	}
-	var raw rawMCPHeadersHandlePendingHeadersRefreshRequestRequest
+	var raw rawMCPInstallPlan
 	if err := json.Unmarshal(data, &raw); err != nil {
 		return err
 	}
-	r.RequestID = raw.RequestID
-	if raw.Result != nil {
-		value, err := unmarshalMCPHeadersHandlePendingHeadersRefreshRequest(raw.Result)
-		if err != nil {
-			return err
+	r.ConfigurationChanges = raw.ConfigurationChanges
+	r.Identity = raw.Identity
+	r.PlanHandle = raw.PlanHandle
+	r.PlanHandleExpiresAt = raw.PlanHandleExpiresAt
+	r.Policy = raw.Policy
+	r.Provenance = raw.Provenance
+	r.RecommendedTransportChoiceID = raw.RecommendedTransportChoiceID
+	r.ReloadRequired = raw.ReloadRequired
+	r.RequiresInteractiveConfiguration = raw.RequiresInteractiveConfiguration
+	r.Target = raw.Target
+	if raw.TransportChoices != nil {
+		r.TransportChoices = make([]MCPPlanTransportChoice, 0, len(raw.TransportChoices))
+		for _, rawItem := range raw.TransportChoices {
+			value, err := unmarshalMCPPlanTransportChoice(rawItem)
+			if err != nil {
+				return err
+			}
+			r.TransportChoices = append(r.TransportChoices, value)
 		}
-		r.Result = value
 	}
 	return nil
 }
@@ -1955,6 +2633,323 @@ func (r MCPOauthProbeResultNoAuthRequired) MarshalJSON() ([]byte, error) {
 	})
 }
 
+func unmarshalMCPPlanInstallSource(data []byte) (MCPPlanInstallSource, error) {
+	if string(data) == "null" {
+		return nil, nil
+	}
+	type rawUnion struct {
+		Kind MCPPlanInstallSourceKind `json:"kind"`
+	}
+	var raw rawUnion
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return nil, err
+	}
+
+	switch raw.Kind {
+	case MCPPlanInstallSourceKindCandidate:
+		var d MCPPlanInstallSourceCandidate
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case MCPPlanInstallSourceKindCard:
+		var d MCPPlanInstallSourceCard
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	default:
+		return &RawMCPPlanInstallSourceData{Discriminator: raw.Kind, Raw: data}, nil
+	}
+}
+
+func (r RawMCPPlanInstallSourceData) MarshalJSON() ([]byte, error) {
+	if r.Raw != nil {
+		return r.Raw, nil
+	}
+	return json.Marshal(struct {
+		Kind MCPPlanInstallSourceKind `json:"kind"`
+	}{
+		Kind: r.Discriminator,
+	})
+}
+
+func (r MCPPlanInstallSourceCandidate) MarshalJSON() ([]byte, error) {
+	type alias MCPPlanInstallSourceCandidate
+	return json.Marshal(struct {
+		Kind MCPPlanInstallSourceKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func unmarshalMCPServerCardReference(data []byte) (MCPServerCardReference, error) {
+	if string(data) == "null" {
+		return nil, nil
+	}
+	type rawUnion struct {
+		Kind MCPServerCardReferenceKind `json:"kind"`
+	}
+	var raw rawUnion
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return nil, err
+	}
+
+	switch raw.Kind {
+	case MCPServerCardReferenceKindEmbedded:
+		var d MCPServerCardEmbedded
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case MCPServerCardReferenceKindURL:
+		var d MCPServerCardURL
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	default:
+		return &RawMCPServerCardReferenceData{Discriminator: raw.Kind, Raw: data}, nil
+	}
+}
+
+func (r RawMCPServerCardReferenceData) MarshalJSON() ([]byte, error) {
+	if r.Raw != nil {
+		return r.Raw, nil
+	}
+	return json.Marshal(struct {
+		Kind MCPServerCardReferenceKind `json:"kind"`
+	}{
+		Kind: r.Discriminator,
+	})
+}
+
+func (r MCPServerCardEmbedded) MarshalJSON() ([]byte, error) {
+	type alias MCPServerCardEmbedded
+	return json.Marshal(struct {
+		Kind MCPServerCardReferenceKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func (r MCPServerCardURL) MarshalJSON() ([]byte, error) {
+	type alias MCPServerCardURL
+	return json.Marshal(struct {
+		Kind MCPServerCardReferenceKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func (r *MCPPlanInstallSourceCard) UnmarshalJSON(data []byte) error {
+	type rawMCPPlanInstallSourceCard struct {
+		Card json.RawMessage `json:"card"`
+	}
+	var raw rawMCPPlanInstallSourceCard
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return err
+	}
+	if raw.Card != nil {
+		value, err := unmarshalMCPServerCardReference(raw.Card)
+		if err != nil {
+			return err
+		}
+		r.Card = value
+	}
+	return nil
+}
+
+func (r MCPPlanInstallSourceCard) MarshalJSON() ([]byte, error) {
+	type alias MCPPlanInstallSourceCard
+	return json.Marshal(struct {
+		Kind MCPPlanInstallSourceKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.Kind(),
+		alias: alias(r),
+	})
+}
+
+func (r *MCPPlanInstallRequest) UnmarshalJSON(data []byte) error {
+	type rawMCPPlanInstallRequest struct {
+		Contract CatalogClientContract `json:"contract"`
+		Scope    *MCPPlanScope         `json:"scope,omitempty"`
+		Source   json.RawMessage       `json:"source"`
+	}
+	var raw rawMCPPlanInstallRequest
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return err
+	}
+	r.Contract = raw.Contract
+	r.Scope = raw.Scope
+	if raw.Source != nil {
+		value, err := unmarshalMCPPlanInstallSource(raw.Source)
+		if err != nil {
+			return err
+		}
+		r.Source = value
+	}
+	return nil
+}
+
+func unmarshalMCPPlanInstallResult(data []byte) (MCPPlanInstallResult, error) {
+	if string(data) == "null" {
+		return nil, nil
+	}
+	type rawUnion struct {
+		Kind MCPPlanInstallResultKind `json:"kind"`
+	}
+	var raw rawUnion
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return nil, err
+	}
+
+	switch raw.Kind {
+	case MCPPlanInstallResultKindAuthenticationRequired:
+		var d CatalogAuthenticationRequiredError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case MCPPlanInstallResultKindContractViolation:
+		var d CatalogContractViolationError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case MCPPlanInstallResultKindHandleRejected:
+		var d CatalogHandleRejectedError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case MCPPlanInstallResultKindInvalidRequest:
+		var d CatalogInvalidRequestError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case MCPPlanInstallResultKindMalformedCard:
+		var d CatalogMalformedCardError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case MCPPlanInstallResultKindNegotiationRefused:
+		var d CatalogNegotiationRefusedError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case MCPPlanInstallResultKindNetworkFailure:
+		var d CatalogNetworkFailureError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case MCPPlanInstallResultKindNotInstallable:
+		var d CatalogNotInstallableError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case MCPPlanInstallResultKindPlanned:
+		var d MCPPlanInstallPlanned
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case MCPPlanInstallResultKindPolicyRejected:
+		var d CatalogPolicyRejectedError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case MCPPlanInstallResultKindUnavailable:
+		var d CatalogUnavailableError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case MCPPlanInstallResultKindUnavailableTransport:
+		var d CatalogUnavailableTransportError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	case MCPPlanInstallResultKindUnsafeRetrieval:
+		var d CatalogUnsafeRetrievalError
+		if err := json.Unmarshal(data, &d); err != nil {
+			return nil, err
+		}
+		return &d, nil
+	default:
+		return &RawMCPPlanInstallResultData{Discriminator: raw.Kind, Raw: data}, nil
+	}
+}
+
+func (r RawMCPPlanInstallResultData) MarshalJSON() ([]byte, error) {
+	if r.Raw != nil {
+		return r.Raw, nil
+	}
+	return json.Marshal(struct {
+		Kind MCPPlanInstallResultKind `json:"kind"`
+	}{
+		Kind: r.Discriminator,
+	})
+}
+
+func (r CatalogHandleRejectedError) MarshalJSON() ([]byte, error) {
+	type alias CatalogHandleRejectedError
+	return json.Marshal(struct {
+		Kind MCPPlanInstallResultKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.mcpPlanInstallResultKind(),
+		alias: alias(r),
+	})
+}
+
+func (r CatalogNotInstallableError) MarshalJSON() ([]byte, error) {
+	type alias CatalogNotInstallableError
+	return json.Marshal(struct {
+		Kind MCPPlanInstallResultKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.mcpPlanInstallResultKind(),
+		alias: alias(r),
+	})
+}
+
+func (r CatalogUnavailableTransportError) MarshalJSON() ([]byte, error) {
+	type alias CatalogUnavailableTransportError
+	return json.Marshal(struct {
+		Kind MCPPlanInstallResultKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.mcpPlanInstallResultKind(),
+		alias: alias(r),
+	})
+}
+
+func (r MCPPlanInstallPlanned) MarshalJSON() ([]byte, error) {
+	type alias MCPPlanInstallPlanned
+	return json.Marshal(struct {
+		Kind MCPPlanInstallResultKind `json:"kind"`
+		alias
+	}{
+		Kind:  r.mcpPlanInstallResultKind(),
+		alias: alias(r),
+	})
+}
+
 func matchesMCPServerConfigHTTP(data []byte) bool {
 	var rawGroup0 struct {
 		Command        json.RawMessage `json:"command"`
diff --git a/go/rpc/zsession_events.go b/go/rpc/zsession_events.go
index fac17cfad1..82b0470dbf 100644
--- a/go/rpc/zsession_events.go
+++ b/go/rpc/zsession_events.go
@@ -161,41 +161,43 @@ const (
 	SessionEventTypeSessionMCPServerStatusChanged  SessionEventType = "session.mcp_server_status_changed"
 	SessionEventTypeSessionModeChanged             SessionEventType = "session.mode_changed"
 	SessionEventTypeSessionModelChange             SessionEventType = "session.model_change"
-	SessionEventTypeSessionPermissionsChanged      SessionEventType = "session.permissions_changed"
-	SessionEventTypeSessionPlanChanged             SessionEventType = "session.plan_changed"
-	SessionEventTypeSessionRemoteSteerableChanged  SessionEventType = "session.remote_steerable_changed"
-	SessionEventTypeSessionResume                  SessionEventType = "session.resume"
-	SessionEventTypeSessionScheduleCancelled       SessionEventType = "session.schedule_cancelled"
-	SessionEventTypeSessionScheduleCreated         SessionEventType = "session.schedule_created"
-	SessionEventTypeSessionScheduleRearmed         SessionEventType = "session.schedule_rearmed"
-	SessionEventTypeSessionSessionLimitsChanged    SessionEventType = "session.session_limits_changed"
-	SessionEventTypeSessionShutdown                SessionEventType = "session.shutdown"
-	SessionEventTypeSessionSkillsLoaded            SessionEventType = "session.skills_loaded"
-	SessionEventTypeSessionSnapshotRewind          SessionEventType = "session.snapshot_rewind"
-	SessionEventTypeSessionStart                   SessionEventType = "session.start"
-	SessionEventTypeSessionTaskComplete            SessionEventType = "session.task_complete"
-	SessionEventTypeSessionTitleChanged            SessionEventType = "session.title_changed"
-	SessionEventTypeSessionTodosChanged            SessionEventType = "session.todos_changed"
-	SessionEventTypeSessionToolsUpdated            SessionEventType = "session.tools_updated"
-	SessionEventTypeSessionTruncation              SessionEventType = "session.truncation"
-	SessionEventTypeSessionUsageCheckpoint         SessionEventType = "session.usage_checkpoint"
-	SessionEventTypeSessionUsageInfo               SessionEventType = "session.usage_info"
-	SessionEventTypeSessionWarning                 SessionEventType = "session.warning"
-	SessionEventTypeSessionWorkspaceFileChanged    SessionEventType = "session.workspace_file_changed"
-	SessionEventTypeSkillInvoked                   SessionEventType = "skill.invoked"
-	SessionEventTypeSubagentCompleted              SessionEventType = "subagent.completed"
-	SessionEventTypeSubagentDeselected             SessionEventType = "subagent.deselected"
-	SessionEventTypeSubagentFailed                 SessionEventType = "subagent.failed"
-	SessionEventTypeSubagentSelected               SessionEventType = "subagent.selected"
-	SessionEventTypeSubagentStarted                SessionEventType = "subagent.started"
-	SessionEventTypeSystemMessage                  SessionEventType = "system.message"
-	SessionEventTypeSystemNotification             SessionEventType = "system.notification"
-	SessionEventTypeToolExecutionComplete          SessionEventType = "tool.execution_complete"
-	SessionEventTypeToolExecutionPartialResult     SessionEventType = "tool.execution_partial_result"
-	SessionEventTypeToolExecutionProgress          SessionEventType = "tool.execution_progress"
-	SessionEventTypeToolExecutionStart             SessionEventType = "tool.execution_start"
-	SessionEventTypeToolSearchActivated            SessionEventType = "tool_search.activated"
-	SessionEventTypeToolUserRequested              SessionEventType = "tool.user_requested"
+	// Experimental: SessionEventTypeSessionPermissionsChanged identifies an experimental event
+	// that may change or be removed.
+	SessionEventTypeSessionPermissionsChanged     SessionEventType = "session.permissions_changed"
+	SessionEventTypeSessionPlanChanged            SessionEventType = "session.plan_changed"
+	SessionEventTypeSessionRemoteSteerableChanged SessionEventType = "session.remote_steerable_changed"
+	SessionEventTypeSessionResume                 SessionEventType = "session.resume"
+	SessionEventTypeSessionScheduleCancelled      SessionEventType = "session.schedule_cancelled"
+	SessionEventTypeSessionScheduleCreated        SessionEventType = "session.schedule_created"
+	SessionEventTypeSessionScheduleRearmed        SessionEventType = "session.schedule_rearmed"
+	SessionEventTypeSessionSessionLimitsChanged   SessionEventType = "session.session_limits_changed"
+	SessionEventTypeSessionShutdown               SessionEventType = "session.shutdown"
+	SessionEventTypeSessionSkillsLoaded           SessionEventType = "session.skills_loaded"
+	SessionEventTypeSessionSnapshotRewind         SessionEventType = "session.snapshot_rewind"
+	SessionEventTypeSessionStart                  SessionEventType = "session.start"
+	SessionEventTypeSessionTaskComplete           SessionEventType = "session.task_complete"
+	SessionEventTypeSessionTitleChanged           SessionEventType = "session.title_changed"
+	SessionEventTypeSessionTodosChanged           SessionEventType = "session.todos_changed"
+	SessionEventTypeSessionToolsUpdated           SessionEventType = "session.tools_updated"
+	SessionEventTypeSessionTruncation             SessionEventType = "session.truncation"
+	SessionEventTypeSessionUsageCheckpoint        SessionEventType = "session.usage_checkpoint"
+	SessionEventTypeSessionUsageInfo              SessionEventType = "session.usage_info"
+	SessionEventTypeSessionWarning                SessionEventType = "session.warning"
+	SessionEventTypeSessionWorkspaceFileChanged   SessionEventType = "session.workspace_file_changed"
+	SessionEventTypeSkillInvoked                  SessionEventType = "skill.invoked"
+	SessionEventTypeSubagentCompleted             SessionEventType = "subagent.completed"
+	SessionEventTypeSubagentDeselected            SessionEventType = "subagent.deselected"
+	SessionEventTypeSubagentFailed                SessionEventType = "subagent.failed"
+	SessionEventTypeSubagentSelected              SessionEventType = "subagent.selected"
+	SessionEventTypeSubagentStarted               SessionEventType = "subagent.started"
+	SessionEventTypeSystemMessage                 SessionEventType = "system.message"
+	SessionEventTypeSystemNotification            SessionEventType = "system.notification"
+	SessionEventTypeToolExecutionComplete         SessionEventType = "tool.execution_complete"
+	SessionEventTypeToolExecutionPartialResult    SessionEventType = "tool.execution_partial_result"
+	SessionEventTypeToolExecutionProgress         SessionEventType = "tool.execution_progress"
+	SessionEventTypeToolExecutionStart            SessionEventType = "tool.execution_start"
+	SessionEventTypeToolSearchActivated           SessionEventType = "tool_search.activated"
+	SessionEventTypeToolUserRequested             SessionEventType = "tool.user_requested"
 	// Experimental: SessionEventTypeUIEphemeralQuery identifies an experimental event that may
 	// change or be removed.
 	SessionEventTypeUIEphemeralQuery   SessionEventType = "ui.ephemeral_query"
@@ -1554,18 +1556,18 @@ type PermissionRequestedData struct {
 func (*PermissionRequestedData) sessionEventData()      {}
 func (*PermissionRequestedData) Type() SessionEventType { return SessionEventTypePermissionRequested }
 
-// Permissions change details carrying the aggregate allow-all transition.
+// Permission-mode transition details.
+// Experimental: SessionPermissionsChangedData is part of an experimental API and may change or be removed.
 type SessionPermissionsChangedData struct {
-	// Allow-all mode after the change
-	// Experimental: AllowAllPermissionMode is part of an experimental API and may change or be removed.
-	AllowAllPermissionMode *PermissionAllowAllMode `json:"allowAllPermissionMode,omitempty"`
-	// Aggregate allow-all flag after the change
-	AllowAllPermissions bool `json:"allowAllPermissions"`
-	// Allow-all mode before the change
-	// Experimental: PreviousAllowAllPermissionMode is part of an experimental API and may change or be removed.
-	PreviousAllowAllPermissionMode *PermissionAllowAllMode `json:"previousAllowAllPermissionMode,omitempty"`
-	// Aggregate allow-all flag before the change
-	PreviousAllowAllPermissions bool `json:"previousAllowAllPermissions"`
+	// Explicit LLM judge model override used by assisted mode; omitted when the provider default applies
+	// Experimental: AssistedApprovalModel is part of an experimental API and may change or be removed.
+	AssistedApprovalModel *string `json:"assistedApprovalModel,omitempty"`
+	// Permission mode after the change
+	// Experimental: Mode is part of an experimental API and may change or be removed.
+	Mode PermissionMode `json:"mode"`
+	// Permission mode before the change
+	// Experimental: PreviousMode is part of an experimental API and may change or be removed.
+	PreviousMode PermissionMode `json:"previousMode"`
 }
 
 func (*SessionPermissionsChangedData) sessionEventData() {}
@@ -2906,17 +2908,17 @@ type ModelCallFailureRequestFingerprint struct {
 	ToolResultMessageCount int64 `json:"toolResultMessageCount"`
 }
 
-// Auto-approval judge information attached to a permission request. Present (non-null) only when the session's allow-all mode is "auto"; its absence means auto mode was off and the judge did not evaluate the request. The `recommendation` conveys the judge's disposition for this request.
-// Experimental: PermissionAutoApproval is part of an experimental API and may change or be removed.
-type PermissionAutoApproval struct {
+// Assisted-approval judge information attached to a permission request. Present only in assisted mode; its absence means the judge did not evaluate the request. The `recommendation` conveys the judge's disposition for this request.
+// Experimental: PermissionAssistedApproval is part of an experimental API and may change or be removed.
+type PermissionAssistedApproval struct {
 	// Classified cause of an `error` recommendation. Absent for every other recommendation.
-	FailureReason *AutoApprovalJudgeFailureReason `json:"failureReason,omitempty"`
+	FailureReason *AssistedApprovalJudgeFailureReason `json:"failureReason,omitempty"`
 	// Model id that produced the recommendation, when the judge was consulted and reported one. Absent for `excluded` (the judge was not consulted) and for failures that occurred before a model was selected.
 	Model *string `json:"model,omitempty"`
 	// Human-readable reason for the judge's recommendation, when available.
 	Reason *string `json:"reason,omitempty"`
-	// The auto-approval safety judge's outcome for this request.
-	Recommendation AutoApprovalRecommendation `json:"recommendation"`
+	// The assisted-approval safety judge's outcome for this request.
+	Recommendation AssistedApprovalRecommendation `json:"recommendation"`
 }
 
 // Derived user-facing permission prompt details for UI consumers
@@ -2937,9 +2939,9 @@ func (r RawPermissionPromptRequest) Kind() PermissionPromptRequestKind {
 
 // Shell command permission prompt
 type PermissionPromptRequestCommands struct {
-	// Auto-approval judge information for this request; present only when auto mode is enabled.
-	// Experimental: AutoApproval is part of an experimental API and may change or be removed.
-	AutoApproval *PermissionAutoApproval `json:"autoApproval,omitempty"`
+	// Assisted-approval judge information for this request; present only in assisted mode.
+	// Experimental: AssistedApproval is part of an experimental API and may change or be removed.
+	AssistedApproval *PermissionAssistedApproval `json:"assistedApproval,omitempty"`
 	// Whether the UI can offer session-wide approval for this command pattern
 	CanOfferSessionApproval bool `json:"canOfferSessionApproval"`
 	// Command identifiers covered by this approval prompt
@@ -2965,9 +2967,9 @@ func (PermissionPromptRequestCommands) Kind() PermissionPromptRequestKind {
 type PermissionPromptRequestCustomTool struct {
 	// Arguments to pass to the custom tool
 	Args any `json:"args,omitempty"`
-	// Auto-approval judge information for this request; present only when auto mode is enabled.
-	// Experimental: AutoApproval is part of an experimental API and may change or be removed.
-	AutoApproval *PermissionAutoApproval `json:"autoApproval,omitempty"`
+	// Assisted-approval judge information for this request; present only in assisted mode.
+	// Experimental: AssistedApproval is part of an experimental API and may change or be removed.
+	AssistedApproval *PermissionAssistedApproval `json:"assistedApproval,omitempty"`
 	// Tool call ID that triggered this permission request
 	ToolCallID *string `json:"toolCallId,omitempty"`
 	// Description of what the custom tool does
@@ -2983,9 +2985,9 @@ func (PermissionPromptRequestCustomTool) Kind() PermissionPromptRequestKind {
 
 // Extension sensitive environment variable access prompt
 type PermissionPromptRequestExtensionEnvAccess struct {
-	// Auto-approval judge information for this request; present only when auto mode is enabled.
-	// Experimental: AutoApproval is part of an experimental API and may change or be removed.
-	AutoApproval *PermissionAutoApproval `json:"autoApproval,omitempty"`
+	// Assisted-approval judge information for this request; present only in assisted mode.
+	// Experimental: AssistedApproval is part of an experimental API and may change or be removed.
+	AssistedApproval *PermissionAssistedApproval `json:"assistedApproval,omitempty"`
 	// Names of the sensitive environment variables the extension is requesting. Values never appear here.
 	EnvironmentVariables []string `json:"environmentVariables"`
 	// Name of the extension requesting environment variable access
@@ -3001,9 +3003,9 @@ func (PermissionPromptRequestExtensionEnvAccess) Kind() PermissionPromptRequestK
 
 // Extension management permission prompt
 type PermissionPromptRequestExtensionManagement struct {
-	// Auto-approval judge information for this request; present only when auto mode is enabled.
-	// Experimental: AutoApproval is part of an experimental API and may change or be removed.
-	AutoApproval *PermissionAutoApproval `json:"autoApproval,omitempty"`
+	// Assisted-approval judge information for this request; present only in assisted mode.
+	// Experimental: AssistedApproval is part of an experimental API and may change or be removed.
+	AssistedApproval *PermissionAssistedApproval `json:"assistedApproval,omitempty"`
 	// Name of the extension being managed
 	ExtensionName *string `json:"extensionName,omitempty"`
 	// The extension management operation (scaffold, reload)
@@ -3019,9 +3021,9 @@ func (PermissionPromptRequestExtensionManagement) Kind() PermissionPromptRequest
 
 // Extension permission access prompt
 type PermissionPromptRequestExtensionPermissionAccess struct {
-	// Auto-approval judge information for this request; present only when auto mode is enabled.
-	// Experimental: AutoApproval is part of an experimental API and may change or be removed.
-	AutoApproval *PermissionAutoApproval `json:"autoApproval,omitempty"`
+	// Assisted-approval judge information for this request; present only in assisted mode.
+	// Experimental: AssistedApproval is part of an experimental API and may change or be removed.
+	AssistedApproval *PermissionAssistedApproval `json:"assistedApproval,omitempty"`
 	// Capabilities the extension is requesting
 	Capabilities []string `json:"capabilities"`
 	// Name of the extension requesting permission access
@@ -3039,9 +3041,9 @@ func (PermissionPromptRequestExtensionPermissionAccess) Kind() PermissionPromptR
 type PermissionPromptRequestFactory struct {
 	// Canonical key used for scoped factory approvals
 	ApprovalKey string `json:"approvalKey"`
-	// Auto-approval judge information for this request; present only when auto mode is enabled.
-	// Experimental: AutoApproval is part of an experimental API and may change or be removed.
-	AutoApproval *PermissionAutoApproval `json:"autoApproval,omitempty"`
+	// Assisted-approval judge information for this request; present only in assisted mode.
+	// Experimental: AssistedApproval is part of an experimental API and may change or be removed.
+	AssistedApproval *PermissionAssistedApproval `json:"assistedApproval,omitempty"`
 	// Whether this factory is eligible for persistent approval
 	CanPersistApproval bool `json:"canPersistApproval"`
 	// Factory-declared AI-credit limit before any run/resume caller override is applied.
@@ -3081,9 +3083,9 @@ func (PermissionPromptRequestFactory) Kind() PermissionPromptRequestKind {
 
 // Hook confirmation permission prompt
 type PermissionPromptRequestHook struct {
-	// Auto-approval judge information for this request; present only when auto mode is enabled.
-	// Experimental: AutoApproval is part of an experimental API and may change or be removed.
-	AutoApproval *PermissionAutoApproval `json:"autoApproval,omitempty"`
+	// Assisted-approval judge information for this request; present only in assisted mode.
+	// Experimental: AssistedApproval is part of an experimental API and may change or be removed.
+	AssistedApproval *PermissionAssistedApproval `json:"assistedApproval,omitempty"`
 	// Optional message from the hook explaining why confirmation is needed
 	HookMessage *string `json:"hookMessage,omitempty"`
 	// Arguments of the tool call being gated
@@ -3103,9 +3105,9 @@ func (PermissionPromptRequestHook) Kind() PermissionPromptRequestKind {
 type PermissionPromptRequestMCP struct {
 	// Arguments to pass to the MCP tool
 	Args any `json:"args,omitempty"`
-	// Auto-approval judge information for this request; present only when auto mode is enabled.
-	// Experimental: AutoApproval is part of an experimental API and may change or be removed.
-	AutoApproval *PermissionAutoApproval `json:"autoApproval,omitempty"`
+	// Assisted-approval judge information for this request; present only in assisted mode.
+	// Experimental: AssistedApproval is part of an experimental API and may change or be removed.
+	AssistedApproval *PermissionAssistedApproval `json:"assistedApproval,omitempty"`
 	// Advisory runtime permission recommendation. The host remains responsible for deciding the request and may reject it.
 	// Experimental: PermissionRecommendation is part of an experimental API and may change or be removed.
 	PermissionRecommendation *PermissionRecommendation `json:"permissionRecommendation,omitempty"`
@@ -3128,9 +3130,9 @@ func (PermissionPromptRequestMCP) Kind() PermissionPromptRequestKind {
 type PermissionPromptRequestMemory struct {
 	// Whether this is a store or vote memory operation
 	Action *PermissionRequestMemoryAction `json:"action,omitempty"`
-	// Auto-approval judge information for this request; present only when auto mode is enabled.
-	// Experimental: AutoApproval is part of an experimental API and may change or be removed.
-	AutoApproval *PermissionAutoApproval `json:"autoApproval,omitempty"`
+	// Assisted-approval judge information for this request; present only in assisted mode.
+	// Experimental: AssistedApproval is part of an experimental API and may change or be removed.
+	AssistedApproval *PermissionAssistedApproval `json:"assistedApproval,omitempty"`
 	// Source references for the stored fact (store only)
 	Citations *string `json:"citations,omitempty"`
 	// Vote direction (vote only)
@@ -3154,9 +3156,9 @@ func (PermissionPromptRequestMemory) Kind() PermissionPromptRequestKind {
 type PermissionPromptRequestPath struct {
 	// Underlying permission kind that needs path approval
 	AccessKind PermissionPromptRequestPathAccessKind `json:"accessKind"`
-	// Auto-approval judge information for this request; present only when auto mode is enabled.
-	// Experimental: AutoApproval is part of an experimental API and may change or be removed.
-	AutoApproval *PermissionAutoApproval `json:"autoApproval,omitempty"`
+	// Assisted-approval judge information for this request; present only in assisted mode.
+	// Experimental: AssistedApproval is part of an experimental API and may change or be removed.
+	AssistedApproval *PermissionAssistedApproval `json:"assistedApproval,omitempty"`
 	// File paths that require explicit approval
 	Paths []string `json:"paths"`
 	// Tool call ID that triggered this permission request
@@ -3170,9 +3172,9 @@ func (PermissionPromptRequestPath) Kind() PermissionPromptRequestKind {
 
 // File read permission prompt
 type PermissionPromptRequestRead struct {
-	// Auto-approval judge information for this request; present only when auto mode is enabled.
-	// Experimental: AutoApproval is part of an experimental API and may change or be removed.
-	AutoApproval *PermissionAutoApproval `json:"autoApproval,omitempty"`
+	// Assisted-approval judge information for this request; present only in assisted mode.
+	// Experimental: AssistedApproval is part of an experimental API and may change or be removed.
+	AssistedApproval *PermissionAssistedApproval `json:"assistedApproval,omitempty"`
 	// Human-readable description of why the file is being read
 	Intention string `json:"intention"`
 	// Whether managed policy requires a human response and forbids host auto-approval
@@ -3190,9 +3192,9 @@ func (PermissionPromptRequestRead) Kind() PermissionPromptRequestKind {
 
 // URL access permission prompt
 type PermissionPromptRequestURL struct {
-	// Auto-approval judge information for this request; present only when auto mode is enabled.
-	// Experimental: AutoApproval is part of an experimental API and may change or be removed.
-	AutoApproval *PermissionAutoApproval `json:"autoApproval,omitempty"`
+	// Assisted-approval judge information for this request; present only in assisted mode.
+	// Experimental: AssistedApproval is part of an experimental API and may change or be removed.
+	AssistedApproval *PermissionAssistedApproval `json:"assistedApproval,omitempty"`
 	// Human-readable description of why the URL is being accessed
 	Intention string `json:"intention"`
 	// Whether managed policy requires a human response and forbids host auto-approval
@@ -3216,9 +3218,9 @@ func (PermissionPromptRequestURL) Kind() PermissionPromptRequestKind {
 
 // File write permission prompt
 type PermissionPromptRequestWrite struct {
-	// Auto-approval judge information for this request; present only when auto mode is enabled.
-	// Experimental: AutoApproval is part of an experimental API and may change or be removed.
-	AutoApproval *PermissionAutoApproval `json:"autoApproval,omitempty"`
+	// Assisted-approval judge information for this request; present only in assisted mode.
+	// Experimental: AssistedApproval is part of an experimental API and may change or be removed.
+	AssistedApproval *PermissionAssistedApproval `json:"assistedApproval,omitempty"`
 	// Whether the UI can offer session-wide approval for file write operations
 	CanOfferSessionApproval bool `json:"canOfferSessionApproval"`
 	// Unified diff showing the proposed changes
@@ -3419,8 +3421,9 @@ func (PermissionRequestMCP) Kind() PermissionRequestKind {
 type PermissionRequestMemory struct {
 	// Whether this is a store or vote memory operation
 	Action *PermissionRequestMemoryAction `json:"action,omitempty"`
-	// Auto-approval judge information for this request; present only when auto mode is enabled.
-	AutoApproval *PermissionAutoApproval `json:"autoApproval,omitempty"`
+	// Assisted-approval judge information for this request; present only in assisted mode.
+	// Experimental: AssistedApproval is part of an experimental API and may change or be removed.
+	AssistedApproval *PermissionAssistedApproval `json:"assistedApproval,omitempty"`
 	// Source references for the stored fact (store only)
 	Citations *string `json:"citations,omitempty"`
 	// Vote direction (vote only)
@@ -4443,36 +4446,36 @@ const (
 	AssistantUsageTransportWebsocket AssistantUsageTransport = "websocket"
 )
 
-// Why the auto-approval judge produced no usable recommendation. Present only alongside an `error` recommendation, where the human-readable reason is a fixed string and therefore cannot distinguish these cases. Intended to make a judge failure reportable by a consumer that has no access to the host's logs.
-// Experimental: AutoApprovalJudgeFailureReason is part of an experimental API and may change or be removed.
-type AutoApprovalJudgeFailureReason string
+// Why the assisted-approval judge produced no usable recommendation. Present only alongside an `error` recommendation, where the human-readable reason is a fixed string and therefore cannot distinguish these cases. Intended to make a judge failure reportable by a consumer that has no access to the host's logs.
+// Experimental: AssistedApprovalJudgeFailureReason is part of an experimental API and may change or be removed.
+type AssistedApprovalJudgeFailureReason string
 
 const (
 	// The judge model call was cancelled before it returned.
-	AutoApprovalJudgeFailureReasonAbort AutoApprovalJudgeFailureReason = "abort"
+	AssistedApprovalJudgeFailureReasonAbort AssistedApprovalJudgeFailureReason = "abort"
 	// The judge model call completed but returned no content.
-	AutoApprovalJudgeFailureReasonEmptyResponse AutoApprovalJudgeFailureReason = "empty_response"
+	AssistedApprovalJudgeFailureReasonEmptyResponse AssistedApprovalJudgeFailureReason = "empty_response"
 	// The judge model call failed (for example a transport, authentication, or rate-limit error).
-	AutoApprovalJudgeFailureReasonModelError AutoApprovalJudgeFailureReason = "model_error"
+	AssistedApprovalJudgeFailureReasonModelError AssistedApprovalJudgeFailureReason = "model_error"
 	// The judge model replied, but the reply carried no ALLOW/DENY verdict.
-	AutoApprovalJudgeFailureReasonParseError AutoApprovalJudgeFailureReason = "parse_error"
+	AssistedApprovalJudgeFailureReasonParseError AssistedApprovalJudgeFailureReason = "parse_error"
 	// The judge model call exceeded its deadline.
-	AutoApprovalJudgeFailureReasonTimeout AutoApprovalJudgeFailureReason = "timeout"
+	AssistedApprovalJudgeFailureReasonTimeout AssistedApprovalJudgeFailureReason = "timeout"
 )
 
-// Outcome of the auto-approval safety judge for a permission request. Present only when auto mode is enabled; its absence means the judge did not evaluate the request (auto mode was off).
-// Experimental: AutoApprovalRecommendation is part of an experimental API and may change or be removed.
-type AutoApprovalRecommendation string
+// Outcome of the assisted-approval safety judge for a permission request. Present only in assisted mode; its absence means the judge did not evaluate the request.
+// Experimental: AssistedApprovalRecommendation is part of an experimental API and may change or be removed.
+type AssistedApprovalRecommendation string
 
 const (
 	// The judge evaluated the request and recommends automatically approving it.
-	AutoApprovalRecommendationApprove AutoApprovalRecommendation = "approve"
+	AssistedApprovalRecommendationApprove AssistedApprovalRecommendation = "approve"
 	// The judge was consulted but did not return a usable recommendation, so the request requires explicit approval.
-	AutoApprovalRecommendationError AutoApprovalRecommendation = "error"
-	// Auto mode is enabled, but this request category is never auto-approvable (for example, sandbox-bypass requests), so the judge was not consulted.
-	AutoApprovalRecommendationExcluded AutoApprovalRecommendation = "excluded"
-	// The judge evaluated the request and does not recommend auto-approving it; explicit approval is required. Whether that means prompting, denying, or something else is the consumer's decision.
-	AutoApprovalRecommendationRequireApproval AutoApprovalRecommendation = "requireApproval"
+	AssistedApprovalRecommendationError AssistedApprovalRecommendation = "error"
+	// Assisted mode is enabled, but this request category is never automatically approvable (for example, sandbox-bypass requests), so the judge was not consulted.
+	AssistedApprovalRecommendationExcluded AssistedApprovalRecommendation = "excluded"
+	// The judge evaluated the request and does not recommend automatically approving it; explicit approval is required. Whether that means prompting, denying, or something else is the consumer's decision.
+	AssistedApprovalRecommendationRequireApproval AssistedApprovalRecommendation = "requireApproval"
 )
 
 // Coarse request-difficulty bucket for UX explainability
@@ -4701,12 +4704,12 @@ const (
 type ManagedSettingsEnforcedEscalation string
 
 const (
-	// Full allow-all ("/allow-all on") permissions — auto-approving tools, paths, and URLs.
+	// Full allow-all permissions — automatically approving tools, paths, and URLs.
 	ManagedSettingsEnforcedEscalationAllowAll ManagedSettingsEnforcedEscalation = "allow_all"
-	// Auto-approval of all tool permission requests.
+	// Automatic approval of all tool permission requests.
 	ManagedSettingsEnforcedEscalationApproveAll ManagedSettingsEnforcedEscalation = "approve_all"
-	// Advisory auto-approval ("/allow-all auto") mode — keeps normal prompt paths and adds LLM-advised approval, distinct from full allow-all.
-	ManagedSettingsEnforcedEscalationAutoApproval ManagedSettingsEnforcedEscalation = "auto_approval"
+	// Assisted mode — keeps normal prompt paths and adds an LLM recommendation, distinct from allow-all.
+	ManagedSettingsEnforcedEscalationAssistedApproval ManagedSettingsEnforcedEscalation = "assisted_approval"
 	// Unrestricted filesystem access outside the session's allowed directories.
 	ManagedSettingsEnforcedEscalationUnrestrictedPaths ManagedSettingsEnforcedEscalation = "unrestricted_paths"
 	// Unrestricted URL fetch access.
@@ -4850,19 +4853,6 @@ const (
 	OmittedBinaryTypeResource OmittedBinaryType = "resource"
 )
 
-// Allow-all mode for the session.
-// Experimental: PermissionAllowAllMode is part of an experimental API and may change or be removed.
-type PermissionAllowAllMode string
-
-const (
-	// Permission requests follow the normal approval flow with an LLM advisory recommendation attached; clients may choose to auto-approve requests the judge evaluated as acceptable.
-	PermissionAllowAllModeAuto PermissionAllowAllMode = "auto"
-	// Permission requests follow the normal approval flow.
-	PermissionAllowAllModeOff PermissionAllowAllMode = "off"
-	// Tool, path, and URL permission requests are automatically approved.
-	PermissionAllowAllModeOn PermissionAllowAllMode = "on"
-)
-
 // Kind discriminator for PermissionPromptRequest.
 type PermissionPromptRequestKind string
 
diff --git a/go/types.go b/go/types.go
index 1fca9d1796..60781d1da8 100644
--- a/go/types.go
+++ b/go/types.go
@@ -408,10 +408,10 @@ const (
 type PermissionDecisionSource = rpc.PermissionDecisionSource
 
 const (
-	PermissionDecisionSourceHostPolicy          = rpc.PermissionDecisionSourceHostPolicy
-	PermissionDecisionSourceHumanResponse       = rpc.PermissionDecisionSourceHumanResponse
-	PermissionDecisionSourceJudgeRecommendation = rpc.PermissionDecisionSourceJudgeRecommendation
-	PermissionDecisionSourceUnattendedFallback  = rpc.PermissionDecisionSourceUnattendedFallback
+	PermissionDecisionSourceAssistedApproval   = rpc.PermissionDecisionSourceAssistedApproval
+	PermissionDecisionSourceHostPolicy         = rpc.PermissionDecisionSourceHostPolicy
+	PermissionDecisionSourceHumanResponse      = rpc.PermissionDecisionSourceHumanResponse
+	PermissionDecisionSourceUnattendedFallback = rpc.PermissionDecisionSourceUnattendedFallback
 )
 
 // PermissionDecisionSurface identifies the client surface that submitted a
diff --git a/go/zsession_events.go b/go/zsession_events.go
index 51b892eff0..711943b45d 100644
--- a/go/zsession_events.go
+++ b/go/zsession_events.go
@@ -33,6 +33,8 @@ type (
 	AssistantUsageCopilotUsageTokenDetail                          = rpc.AssistantUsageCopilotUsageTokenDetail
 	AssistantUsageData                                             = rpc.AssistantUsageData
 	AssistantUsageTransport                                        = rpc.AssistantUsageTransport
+	AssistedApprovalJudgeFailureReason                             = rpc.AssistedApprovalJudgeFailureReason
+	AssistedApprovalRecommendation                                 = rpc.AssistedApprovalRecommendation
 	Attachment                                                     = rpc.Attachment
 	AttachmentBlob                                                 = rpc.AttachmentBlob
 	AttachmentDirectory                                            = rpc.AttachmentDirectory
@@ -57,8 +59,6 @@ type (
 	AttachmentSelectionDetailsEnd                                  = rpc.AttachmentSelectionDetailsEnd
 	AttachmentSelectionDetailsStart                                = rpc.AttachmentSelectionDetailsStart
 	AttachmentType                                                 = rpc.AttachmentType
-	AutoApprovalJudgeFailureReason                                 = rpc.AutoApprovalJudgeFailureReason
-	AutoApprovalRecommendation                                     = rpc.AutoApprovalRecommendation
 	AutoModeResolvedReasoningBucket                                = rpc.AutoModeResolvedReasoningBucket
 	AutoModeSwitchCompletedData                                    = rpc.AutoModeSwitchCompletedData
 	AutoModeSwitchRequestedData                                    = rpc.AutoModeSwitchRequestedData
@@ -161,11 +161,10 @@ type (
 	OmittedBinaryResult                                            = rpc.OmittedBinaryResult
 	OmittedBinaryType                                              = rpc.OmittedBinaryType
 	PendingMessagesModifiedData                                    = rpc.PendingMessagesModifiedData
-	PermissionAllowAllMode                                         = rpc.PermissionAllowAllMode
 	PermissionApproved                                             = rpc.PermissionApproved
 	PermissionApprovedForLocation                                  = rpc.PermissionApprovedForLocation
 	PermissionApprovedForSession                                   = rpc.PermissionApprovedForSession
-	PermissionAutoApproval                                         = rpc.PermissionAutoApproval
+	PermissionAssistedApproval                                     = rpc.PermissionAssistedApproval
 	PermissionCancelled                                            = rpc.PermissionCancelled
 	PermissionCompletedData                                        = rpc.PermissionCompletedData
 	PermissionDeniedByContentExclusionPolicy                       = rpc.PermissionDeniedByContentExclusionPolicy
@@ -173,6 +172,7 @@ type (
 	PermissionDeniedByRules                                        = rpc.PermissionDeniedByRules
 	PermissionDeniedInteractivelyByUser                            = rpc.PermissionDeniedInteractivelyByUser
 	PermissionDeniedNoApprovalRuleAndCouldNotRequestFromUser       = rpc.PermissionDeniedNoApprovalRuleAndCouldNotRequestFromUser
+	PermissionMode                                                 = rpc.PermissionMode
 	PermissionPromptRequest                                        = rpc.PermissionPromptRequest
 	PermissionPromptRequestCommands                                = rpc.PermissionPromptRequestCommands
 	PermissionPromptRequestCustomTool                              = rpc.PermissionPromptRequestCustomTool
@@ -411,6 +411,15 @@ const (
 	AssistantUsageAPIEndpointWsResponses                               = rpc.AssistantUsageAPIEndpointWsResponses
 	AssistantUsageTransportHTTP                                        = rpc.AssistantUsageTransportHTTP
 	AssistantUsageTransportWebsocket                                   = rpc.AssistantUsageTransportWebsocket
+	AssistedApprovalJudgeFailureReasonAbort                            = rpc.AssistedApprovalJudgeFailureReasonAbort
+	AssistedApprovalJudgeFailureReasonEmptyResponse                    = rpc.AssistedApprovalJudgeFailureReasonEmptyResponse
+	AssistedApprovalJudgeFailureReasonModelError                       = rpc.AssistedApprovalJudgeFailureReasonModelError
+	AssistedApprovalJudgeFailureReasonParseError                       = rpc.AssistedApprovalJudgeFailureReasonParseError
+	AssistedApprovalJudgeFailureReasonTimeout                          = rpc.AssistedApprovalJudgeFailureReasonTimeout
+	AssistedApprovalRecommendationApprove                              = rpc.AssistedApprovalRecommendationApprove
+	AssistedApprovalRecommendationError                                = rpc.AssistedApprovalRecommendationError
+	AssistedApprovalRecommendationExcluded                             = rpc.AssistedApprovalRecommendationExcluded
+	AssistedApprovalRecommendationRequireApproval                      = rpc.AssistedApprovalRecommendationRequireApproval
 	AttachmentGitHubReferenceTypeDiscussion                            = rpc.AttachmentGitHubReferenceTypeDiscussion
 	AttachmentGitHubReferenceTypeIssue                                 = rpc.AttachmentGitHubReferenceTypeIssue
 	AttachmentGitHubReferenceTypePr                                    = rpc.AttachmentGitHubReferenceTypePr
@@ -429,15 +438,6 @@ const (
 	AttachmentTypeGitHubTreeComparison                                 = rpc.AttachmentTypeGitHubTreeComparison
 	AttachmentTypeGitHubURL                                            = rpc.AttachmentTypeGitHubURL
 	AttachmentTypeSelection                                            = rpc.AttachmentTypeSelection
-	AutoApprovalJudgeFailureReasonAbort                                = rpc.AutoApprovalJudgeFailureReasonAbort
-	AutoApprovalJudgeFailureReasonEmptyResponse                        = rpc.AutoApprovalJudgeFailureReasonEmptyResponse
-	AutoApprovalJudgeFailureReasonModelError                           = rpc.AutoApprovalJudgeFailureReasonModelError
-	AutoApprovalJudgeFailureReasonParseError                           = rpc.AutoApprovalJudgeFailureReasonParseError
-	AutoApprovalJudgeFailureReasonTimeout                              = rpc.AutoApprovalJudgeFailureReasonTimeout
-	AutoApprovalRecommendationApprove                                  = rpc.AutoApprovalRecommendationApprove
-	AutoApprovalRecommendationError                                    = rpc.AutoApprovalRecommendationError
-	AutoApprovalRecommendationExcluded                                 = rpc.AutoApprovalRecommendationExcluded
-	AutoApprovalRecommendationRequireApproval                          = rpc.AutoApprovalRecommendationRequireApproval
 	AutoModeResolvedReasoningBucketHigh                                = rpc.AutoModeResolvedReasoningBucketHigh
 	AutoModeResolvedReasoningBucketLow                                 = rpc.AutoModeResolvedReasoningBucketLow
 	AutoModeResolvedReasoningBucketMedium                              = rpc.AutoModeResolvedReasoningBucketMedium
@@ -497,7 +497,7 @@ const (
 	ManagedSettingsEnforcedActionBypassPermissionsBlocked              = rpc.ManagedSettingsEnforcedActionBypassPermissionsBlocked
 	ManagedSettingsEnforcedEscalationAllowAll                          = rpc.ManagedSettingsEnforcedEscalationAllowAll
 	ManagedSettingsEnforcedEscalationApproveAll                        = rpc.ManagedSettingsEnforcedEscalationApproveAll
-	ManagedSettingsEnforcedEscalationAutoApproval                      = rpc.ManagedSettingsEnforcedEscalationAutoApproval
+	ManagedSettingsEnforcedEscalationAssistedApproval                  = rpc.ManagedSettingsEnforcedEscalationAssistedApproval
 	ManagedSettingsEnforcedEscalationUnrestrictedPaths                 = rpc.ManagedSettingsEnforcedEscalationUnrestrictedPaths
 	ManagedSettingsEnforcedEscalationUnrestrictedURLs                  = rpc.ManagedSettingsEnforcedEscalationUnrestrictedURLs
 	ManagedSettingsResolvedSourceClient                                = rpc.ManagedSettingsResolvedSourceClient
@@ -557,9 +557,9 @@ const (
 	OmittedBinaryOmittedReasonTooLarge                                 = rpc.OmittedBinaryOmittedReasonTooLarge
 	OmittedBinaryTypeImage                                             = rpc.OmittedBinaryTypeImage
 	OmittedBinaryTypeResource                                          = rpc.OmittedBinaryTypeResource
-	PermissionAllowAllModeAuto                                         = rpc.PermissionAllowAllModeAuto
-	PermissionAllowAllModeOff                                          = rpc.PermissionAllowAllModeOff
-	PermissionAllowAllModeOn                                           = rpc.PermissionAllowAllModeOn
+	PermissionModeAllowAll                                             = rpc.PermissionModeAllowAll
+	PermissionModeAssisted                                             = rpc.PermissionModeAssisted
+	PermissionModeManual                                               = rpc.PermissionModeManual
 	PermissionPromptRequestKindCommands                                = rpc.PermissionPromptRequestKindCommands
 	PermissionPromptRequestKindCustomTool                              = rpc.PermissionPromptRequestKindCustomTool
 	PermissionPromptRequestKindExtensionEnvAccess                      = rpc.PermissionPromptRequestKindExtensionEnvAccess
diff --git a/java/pom.xml b/java/pom.xml
index 9f909300c5..df47ef1a45 100644
--- a/java/pom.xml
+++ b/java/pom.xml
@@ -63,7 +63,7 @@
             DO NOT EDIT MANUALLY. Updated by the update-copilot-dependency
             workflow.
         -->
-        <readonly-copilot-sdk-ref-impl-version-from-lastmerge-file-updated-by-reference-impl-sync>^1.0.81-2</readonly-copilot-sdk-ref-impl-version-from-lastmerge-file-updated-by-reference-impl-sync>
+        <readonly-copilot-sdk-ref-impl-version-from-lastmerge-file-updated-by-reference-impl-sync>^1.0.81-4</readonly-copilot-sdk-ref-impl-version-from-lastmerge-file-updated-by-reference-impl-sync>
         <!-- The parent POM is not published to Maven Central. -->
         <maven.deploy.skip>true</maven.deploy.skip>
     </properties>
diff --git a/java/scripts/codegen/java.ts b/java/scripts/codegen/java.ts
index f9e96f4148..785049afa1 100644
--- a/java/scripts/codegen/java.ts
+++ b/java/scripts/codegen/java.ts
@@ -167,7 +167,9 @@ function toCamelCase(name: string): string {
 }
 
 function toEnumConstant(value: string): string {
-    return value.toUpperCase().replace(/[-. /:]/g, "_").replace(/^_+/, "").replace(/_+/g, "_");
+    const constant = value.toUpperCase().replace(/[^A-Z0-9]/g, "_").replace(/^_+/, "").replace(/_+/g, "_");
+    if (constant.length === 0) return "_";
+    return /^[0-9]/.test(constant) ? `_${constant}` : constant;
 }
 
 // ── Schema path resolution ───────────────────────────────────────────────────
diff --git a/java/scripts/codegen/package-lock.json b/java/scripts/codegen/package-lock.json
index 17c12ba7d8..ae260cb1cf 100644
--- a/java/scripts/codegen/package-lock.json
+++ b/java/scripts/codegen/package-lock.json
@@ -6,7 +6,7 @@
     "": {
       "name": "copilot-sdk-java-codegen",
       "dependencies": {
-        "@github/copilot": "^1.0.81-2",
+        "@github/copilot": "^1.0.81-4",
         "json-schema": "^0.4.0",
         "tsx": "^4.23.1"
       }
@@ -428,9 +428,9 @@
       }
     },
     "node_modules/@github/copilot": {
-      "version": "1.0.81-2",
-      "resolved": "https://registry.npmjs.org/@github/copilot/-/copilot-1.0.81-2.tgz",
-      "integrity": "sha512-FeeCKM0Pcm1mwC6uJQ/nkI5Bc33xe10dn3rtvYl3+ZzyKtAS7I8IeGvGrA773bsAgiHiyfj+KEQQlqKsBCgtPQ==",
+      "version": "1.0.81-4",
+      "resolved": "https://registry.npmjs.org/@github/copilot/-/copilot-1.0.81-4.tgz",
+      "integrity": "sha512-XSHSlWqDhoajHMjRouZv0gqPfG3MVJvLFCoWToT8/fbQ7rmE9rB4w0sefzmh30CrQANCWd+uiIUOe9H3QL32WA==",
       "license": "SEE LICENSE IN LICENSE.md",
       "dependencies": {
         "detect-libc": "^2.1.2"
@@ -439,20 +439,20 @@
         "copilot": "npm-loader.js"
       },
       "optionalDependencies": {
-        "@github/copilot-darwin-arm64": "1.0.81-2",
-        "@github/copilot-darwin-x64": "1.0.81-2",
-        "@github/copilot-linux-arm64": "1.0.81-2",
-        "@github/copilot-linux-x64": "1.0.81-2",
-        "@github/copilot-linuxmusl-arm64": "1.0.81-2",
-        "@github/copilot-linuxmusl-x64": "1.0.81-2",
-        "@github/copilot-win32-arm64": "1.0.81-2",
-        "@github/copilot-win32-x64": "1.0.81-2"
+        "@github/copilot-darwin-arm64": "1.0.81-4",
+        "@github/copilot-darwin-x64": "1.0.81-4",
+        "@github/copilot-linux-arm64": "1.0.81-4",
+        "@github/copilot-linux-x64": "1.0.81-4",
+        "@github/copilot-linuxmusl-arm64": "1.0.81-4",
+        "@github/copilot-linuxmusl-x64": "1.0.81-4",
+        "@github/copilot-win32-arm64": "1.0.81-4",
+        "@github/copilot-win32-x64": "1.0.81-4"
       }
     },
     "node_modules/@github/copilot-darwin-arm64": {
-      "version": "1.0.81-2",
-      "resolved": "https://registry.npmjs.org/@github/copilot-darwin-arm64/-/copilot-darwin-arm64-1.0.81-2.tgz",
-      "integrity": "sha512-BS7LPiXvOYd8H4VoD7BCOJ/R+JGIO9JxFMYn/ICXGpL/405s8eX+QXj6GNtFIOAEXPWr0fBweIVi9ExrKMiimQ==",
+      "version": "1.0.81-4",
+      "resolved": "https://registry.npmjs.org/@github/copilot-darwin-arm64/-/copilot-darwin-arm64-1.0.81-4.tgz",
+      "integrity": "sha512-6XEOnrQdqdZ/tbhKU2D37tk0PGwKdNT5LGLvjjrWx+TDCFO/xZSu85+Rxl4AZP1SHKwWJRZdamDmETj4vn4VWQ==",
       "cpu": [
         "arm64"
       ],
@@ -466,9 +466,9 @@
       }
     },
     "node_modules/@github/copilot-darwin-x64": {
-      "version": "1.0.81-2",
-      "resolved": "https://registry.npmjs.org/@github/copilot-darwin-x64/-/copilot-darwin-x64-1.0.81-2.tgz",
-      "integrity": "sha512-geVSBY7KlT4je8Xct1DTiisWQmfvj2Mjf1kWim81bp9W4Z18MEsEGXFeHAeYE2ZSwhdfMZCJprDF66orrHJ92w==",
+      "version": "1.0.81-4",
+      "resolved": "https://registry.npmjs.org/@github/copilot-darwin-x64/-/copilot-darwin-x64-1.0.81-4.tgz",
+      "integrity": "sha512-o1ghvv7EUGO3CGbZyGyQJgu9mCFEyXq9FUUmvcxsBXxfjk7PR1CywK4cJVeZxac8LL//DQ/q42JzkaSfXU29Wg==",
       "cpu": [
         "x64"
       ],
@@ -482,9 +482,9 @@
       }
     },
     "node_modules/@github/copilot-linux-arm64": {
-      "version": "1.0.81-2",
-      "resolved": "https://registry.npmjs.org/@github/copilot-linux-arm64/-/copilot-linux-arm64-1.0.81-2.tgz",
-      "integrity": "sha512-uov9YOKlhyiaQfbgi6SzyAGjBLXegYRNJkgckG/7Xq/TbxF0Bmve3/lSuzve+p/EOnzPVwR1kGPDEuGU3g97Rw==",
+      "version": "1.0.81-4",
+      "resolved": "https://registry.npmjs.org/@github/copilot-linux-arm64/-/copilot-linux-arm64-1.0.81-4.tgz",
+      "integrity": "sha512-pHCwhBe+IVtliSxOEiwhS+GQXRvLuJxOQzdqAZYhbaEJKWeqWTw40LnhqaQFaGhOp1GAJF+6FodG/SfUZYAx5g==",
       "cpu": [
         "arm64"
       ],
@@ -498,9 +498,9 @@
       }
     },
     "node_modules/@github/copilot-linux-x64": {
-      "version": "1.0.81-2",
-      "resolved": "https://registry.npmjs.org/@github/copilot-linux-x64/-/copilot-linux-x64-1.0.81-2.tgz",
-      "integrity": "sha512-wsuXQDnMBdc0Q/hoO5+n+GaBPClzmgcxD2pVvM7i8JxgDAOm3NxHxGF9eYt1h5I+42/Y16t23n12PGARGupfAA==",
+      "version": "1.0.81-4",
+      "resolved": "https://registry.npmjs.org/@github/copilot-linux-x64/-/copilot-linux-x64-1.0.81-4.tgz",
+      "integrity": "sha512-icy4c4jfQzXNShlGptRiUPKpHUhGX9qBxc+118WBv3H68o38Pi//6UP/ZRq9PvcVrPwxbA9HkFASNwBiEzshdA==",
       "cpu": [
         "x64"
       ],
@@ -514,9 +514,9 @@
       }
     },
     "node_modules/@github/copilot-linuxmusl-arm64": {
-      "version": "1.0.81-2",
-      "resolved": "https://registry.npmjs.org/@github/copilot-linuxmusl-arm64/-/copilot-linuxmusl-arm64-1.0.81-2.tgz",
-      "integrity": "sha512-Wi0u31vhBqxajGqpjODhTEwzzqDnfS1mRhKJ/FflH5ieMKsS8YLVHiCUaZFNFZtN1FIFU0ixIQqgUXCvaBP+0Q==",
+      "version": "1.0.81-4",
+      "resolved": "https://registry.npmjs.org/@github/copilot-linuxmusl-arm64/-/copilot-linuxmusl-arm64-1.0.81-4.tgz",
+      "integrity": "sha512-k54g1q9Umz7eFGTpOqG5H1l1m2eNSs8jqFLuEpvGGdu7SU5g6Cz0aWq2VM27l+HcChyjp2dGenhQe/s7KxLSMw==",
       "cpu": [
         "arm64"
       ],
@@ -530,9 +530,9 @@
       }
     },
     "node_modules/@github/copilot-linuxmusl-x64": {
-      "version": "1.0.81-2",
-      "resolved": "https://registry.npmjs.org/@github/copilot-linuxmusl-x64/-/copilot-linuxmusl-x64-1.0.81-2.tgz",
-      "integrity": "sha512-wbb1+aM/jSTE3tDCqwiADe/aUqosGsPzQZIliG/CMsByT02nbwl0CMZGocnsYyDcoKragGmAHqHxgD6sWsJB1g==",
+      "version": "1.0.81-4",
+      "resolved": "https://registry.npmjs.org/@github/copilot-linuxmusl-x64/-/copilot-linuxmusl-x64-1.0.81-4.tgz",
+      "integrity": "sha512-ETjiiuMGDdO6ZdytQ3w8u7wvtkDQCLc0zSnZXXYWxnG4y9qLut8VHFoTJ+P07lBrHKXo7tZsJ6W0d1gOQTBnvw==",
       "cpu": [
         "x64"
       ],
@@ -546,9 +546,9 @@
       }
     },
     "node_modules/@github/copilot-win32-arm64": {
-      "version": "1.0.81-2",
-      "resolved": "https://registry.npmjs.org/@github/copilot-win32-arm64/-/copilot-win32-arm64-1.0.81-2.tgz",
-      "integrity": "sha512-gyONPnQf3Im0lTkC+1NW79P6p8A1F4Cs7dO3ruVBbtDG8SPFJXWNs4LkKIIN/laIa28xYQPraD+hdM/qLZ4E6w==",
+      "version": "1.0.81-4",
+      "resolved": "https://registry.npmjs.org/@github/copilot-win32-arm64/-/copilot-win32-arm64-1.0.81-4.tgz",
+      "integrity": "sha512-/Md1/LN56gORjyGwHXjZ6suY6om7NVL8+j9D/X/xb6Ar2acagyivL8Dm3tesgUMYLniLgn7dyEXPVYS/bqkpmQ==",
       "cpu": [
         "arm64"
       ],
@@ -562,9 +562,9 @@
       }
     },
     "node_modules/@github/copilot-win32-x64": {
-      "version": "1.0.81-2",
-      "resolved": "https://registry.npmjs.org/@github/copilot-win32-x64/-/copilot-win32-x64-1.0.81-2.tgz",
-      "integrity": "sha512-+EcwzwOmJvQ1t2HpDEe93hyMLzvQTUkINnfy/v7EIJu9i2i49m144DyHIafGPcwiEW+AzYpY+6aRqSnNwrGx7Q==",
+      "version": "1.0.81-4",
+      "resolved": "https://registry.npmjs.org/@github/copilot-win32-x64/-/copilot-win32-x64-1.0.81-4.tgz",
+      "integrity": "sha512-CrHbH0fRl2tlreKbDbm6+NmK/3HwMZR7BE86WTmYHJMXt3PcEWRtklU/fQuH0qjURtW4wX6PWrdmjcyVOkRJcA==",
       "cpu": [
         "x64"
       ],
diff --git a/java/scripts/codegen/package.json b/java/scripts/codegen/package.json
index 71063b782f..d726548d0e 100644
--- a/java/scripts/codegen/package.json
+++ b/java/scripts/codegen/package.json
@@ -7,7 +7,7 @@
     "generate:java": "tsx java.ts"
   },
   "dependencies": {
-    "@github/copilot": "^1.0.81-2",
+    "@github/copilot": "^1.0.81-4",
     "json-schema": "^0.4.0",
     "tsx": "^4.23.1"
   }
diff --git a/java/sdk/pom.xml b/java/sdk/pom.xml
index 3988639287..f3bb516403 100644
--- a/java/sdk/pom.xml
+++ b/java/sdk/pom.xml
@@ -630,20 +630,11 @@ did not produce the multi-release output. Re-build on JDK 25+ and verify the
                             <forkCount>1</forkCount>
                             <parallel>none</parallel>
                             <!--
-                                TODO(cli-1.0.81-2): @github/copilot 1.0.81-2 never
-                                completes a model-driven turn when the runtime is hosted
-                                in-process against the CAPI backend, so every test that
-                                sends a prompt times out. A full run produced 94 errors,
-                                all Timeout, and took ~284 minutes because surefire
-                                retries each one three times at 60s.
-
-                                The defect is transport-and-backend specific: in-process
-                                against a BYOK backend is unaffected, and these same
-                                classes pass over stdio in the java-sdk job. Pure-RPC
-                                in-process coverage below still runs, which is what keeps
-                                the FFI host itself under test.
-
-                                Delete this list once a fixed CLI build is picked up.
+                                TODO(cli-1.0.81-4): model-driven turns eventually stop
+                                completing when the runtime is hosted in-process against
+                                CAPI. The shared runtime then poisons every later
+                                model-driven test. These classes still run over stdio;
+                                pure-RPC in-process coverage remains enabled.
                             -->
                             <excludes>
                                 <exclude>**/AskUserTest.java</exclude>
@@ -680,12 +671,8 @@ did not produce the multi-release output. Re-build on JDK 25+ and verify the
                             <forkCount>1</forkCount>
                             <parallel>none</parallel>
                             <!--
-                                TODO(cli-1.0.81-2): same in-process turn hang as the
-                                surefire excludes above, reached through the failsafe
-                                integration tests. Each of these calls sendAndWait and
-                                times out after 60s (30s for RewindIT).
-
-                                Delete this list once a fixed CLI build is picked up.
+                                TODO(cli-1.0.81-4): same in-process CAPI turn hang as the
+                                Surefire exclusions above.
                             -->
                             <excludes>
                                 <exclude>**/ErgonomicToolDefinitionIT.java</exclude>
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/ManagedSettingsEnforcedEscalation.java b/java/sdk/src/generated/java/com/github/copilot/generated/ManagedSettingsEnforcedEscalation.java
index cdeea72b4f..3b4f9917fc 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/ManagedSettingsEnforcedEscalation.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/ManagedSettingsEnforcedEscalation.java
@@ -20,8 +20,8 @@ public enum ManagedSettingsEnforcedEscalation {
     ALLOW_ALL("allow_all"),
     /** The {@code approve_all} variant. */
     APPROVE_ALL("approve_all"),
-    /** The {@code auto_approval} variant. */
-    AUTO_APPROVAL("auto_approval"),
+    /** The {@code assisted_approval} variant. */
+    ASSISTED_APPROVAL("assisted_approval"),
     /** The {@code unrestricted_paths} variant. */
     UNRESTRICTED_PATHS("unrestricted_paths"),
     /** The {@code unrestricted_urls} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/PermissionAllowAllMode.java b/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMode.java
similarity index 59%
rename from java/sdk/src/generated/java/com/github/copilot/generated/PermissionAllowAllMode.java
rename to java/sdk/src/generated/java/com/github/copilot/generated/PermissionMode.java
index d05b936e6a..421ad76139 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/PermissionAllowAllMode.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMode.java
@@ -10,28 +10,28 @@
 import javax.annotation.processing.Generated;
 
 /**
- * Allow-all mode for the session.
+ * Permission mode for the session.
  *
  * @since 1.0.0
  */
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
-public enum PermissionAllowAllMode {
-    /** The {@code off} variant. */
-    OFF("off"),
-    /** The {@code on} variant. */
-    ON("on"),
-    /** The {@code auto} variant. */
-    AUTO("auto");
+public enum PermissionMode {
+    /** The {@code manual} variant. */
+    MANUAL("manual"),
+    /** The {@code assisted} variant. */
+    ASSISTED("assisted"),
+    /** The {@code allow-all} variant. */
+    ALLOW_ALL("allow-all");
 
     private final String value;
-    PermissionAllowAllMode(String value) { this.value = value; }
+    PermissionMode(String value) { this.value = value; }
     @com.fasterxml.jackson.annotation.JsonValue
     public String getValue() { return value; }
     @com.fasterxml.jackson.annotation.JsonCreator
-    public static PermissionAllowAllMode fromValue(String value) {
-        for (PermissionAllowAllMode v : values()) {
+    public static PermissionMode fromValue(String value) {
+        for (PermissionMode v : values()) {
             if (v.value.equals(value)) return v;
         }
-        throw new IllegalArgumentException("Unknown PermissionAllowAllMode value: " + value);
+        throw new IllegalArgumentException("Unknown PermissionMode value: " + value);
     }
 }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/SessionPermissionsChangedEvent.java b/java/sdk/src/generated/java/com/github/copilot/generated/SessionPermissionsChangedEvent.java
index c1f82f5af7..ef332617ac 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/SessionPermissionsChangedEvent.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/SessionPermissionsChangedEvent.java
@@ -13,7 +13,7 @@
 import javax.annotation.processing.Generated;
 
 /**
- * Session event "session.permissions_changed". Permissions change details carrying the aggregate allow-all transition.
+ * Session event "session.permissions_changed". Permission-mode transition details.
  * @since 1.0.0
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
@@ -34,14 +34,12 @@ public final class SessionPermissionsChangedEvent extends SessionEvent {
     @JsonIgnoreProperties(ignoreUnknown = true)
     @JsonInclude(JsonInclude.Include.NON_NULL)
     public record SessionPermissionsChangedEventData(
-        /** Aggregate allow-all flag before the change */
-        @JsonProperty("previousAllowAllPermissions") Boolean previousAllowAllPermissions,
-        /** Aggregate allow-all flag after the change */
-        @JsonProperty("allowAllPermissions") Boolean allowAllPermissions,
-        /** Allow-all mode before the change */
-        @JsonProperty("previousAllowAllPermissionMode") PermissionAllowAllMode previousAllowAllPermissionMode,
-        /** Allow-all mode after the change */
-        @JsonProperty("allowAllPermissionMode") PermissionAllowAllMode allowAllPermissionMode
+        /** Permission mode before the change */
+        @JsonProperty("previousMode") PermissionMode previousMode,
+        /** Permission mode after the change */
+        @JsonProperty("mode") PermissionMode mode,
+        /** Explicit LLM judge model override used by assisted mode; omitted when the provider default applies */
+        @JsonProperty("assistedApprovalModel") String assistedApprovalModel
     ) {
     }
 }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CardDigest.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CardDigest.java
new file mode 100644
index 0000000000..f14f9abdfc
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CardDigest.java
@@ -0,0 +1,29 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * Semantic digest of a strictly parsed and schema-validated JSON MCP card. Both URL-backed and embedded cards are canonicalised with RFC 8785 JSON Canonicalization Scheme, encoded as UTF-8, and hashed with SHA-256.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record CardDigest(
+    /** Digest algorithm and canonical representation */
+    @JsonProperty("algorithm") CardDigestAlgorithm algorithm,
+    /** SHA-256 digest of the RFC 8785 canonical UTF-8 bytes, encoded as exactly 64 lowercase hexadecimal characters. */
+    @JsonProperty("value") String value
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionsAllowAllMode.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CardDigestAlgorithm.java
similarity index 59%
rename from java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionsAllowAllMode.java
rename to java/sdk/src/generated/java/com/github/copilot/generated/rpc/CardDigestAlgorithm.java
index db24a2bad1..83a691705b 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionsAllowAllMode.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CardDigestAlgorithm.java
@@ -10,28 +10,24 @@
 import javax.annotation.processing.Generated;
 
 /**
- * Current or requested allow-all mode.
+ * Canonical digest algorithm for a validated MCP card
  *
  * @since 1.0.0
  */
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
-public enum PermissionsAllowAllMode {
-    /** The {@code off} variant. */
-    OFF("off"),
-    /** The {@code on} variant. */
-    ON("on"),
-    /** The {@code auto} variant. */
-    AUTO("auto");
+public enum CardDigestAlgorithm {
+    /** The {@code sha256-rfc8785} variant. */
+    SHA256_RFC8785("sha256-rfc8785");
 
     private final String value;
-    PermissionsAllowAllMode(String value) { this.value = value; }
+    CardDigestAlgorithm(String value) { this.value = value; }
     @com.fasterxml.jackson.annotation.JsonValue
     public String getValue() { return value; }
     @com.fasterxml.jackson.annotation.JsonCreator
-    public static PermissionsAllowAllMode fromValue(String value) {
-        for (PermissionsAllowAllMode v : values()) {
+    public static CardDigestAlgorithm fromValue(String value) {
+        for (CardDigestAlgorithm v : values()) {
             if (v.value.equals(value)) return v;
         }
-        throw new IllegalArgumentException("Unknown PermissionsAllowAllMode value: " + value);
+        throw new IllegalArgumentException("Unknown CardDigestAlgorithm value: " + value);
     }
 }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogAuthenticationRequiredError.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogAuthenticationRequiredError.java
new file mode 100644
index 0000000000..3433f0e977
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogAuthenticationRequiredError.java
@@ -0,0 +1,44 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * An optional catalog authentication exchange did not establish the caller's identity. Anonymous search remains supported; this refusal is reserved for an operation that cannot continue after the attempted exchange. It is distinct from `policy-rejected` and from a network failure, and the reason identifies the recovery action.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogAuthenticationRequiredError extends CatalogSearchResult {
+
+    @JsonProperty("kind")
+    private final String kind = "authentication-required";
+
+    @Override
+    public String getKind() { return kind; }
+
+    /** Why authentication failed. Only an expired credential justifies attempting a silent refresh; an absent or rejected credential requires sign-in. */
+    @JsonProperty("reason")
+    private CatalogAuthenticationRequiredReason reason;
+
+    /** Human-readable explanation, safe to surface. Never contains a credential or token, nor a query, URL, handle, or secret. */
+    @JsonProperty("message")
+    private String message;
+
+    public CatalogAuthenticationRequiredReason getReason() { return reason; }
+    public void setReason(CatalogAuthenticationRequiredReason reason) { this.reason = reason; }
+
+    public String getMessage() { return message; }
+    public void setMessage(String message) { this.message = message; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogAuthenticationRequiredReason.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogAuthenticationRequiredReason.java
new file mode 100644
index 0000000000..1c87593273
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogAuthenticationRequiredReason.java
@@ -0,0 +1,37 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Why the catalog authority did not accept the caller's identity
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum CatalogAuthenticationRequiredReason {
+    /** The {@code no-credential} variant. */
+    NO_CREDENTIAL("no-credential"),
+    /** The {@code credential-expired} variant. */
+    CREDENTIAL_EXPIRED("credential-expired"),
+    /** The {@code credential-rejected} variant. */
+    CREDENTIAL_REJECTED("credential-rejected");
+
+    private final String value;
+    CatalogAuthenticationRequiredReason(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static CatalogAuthenticationRequiredReason fromValue(String value) {
+        for (CatalogAuthenticationRequiredReason v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown CatalogAuthenticationRequiredReason value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogCandidateKind.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogCandidateKind.java
new file mode 100644
index 0000000000..e7316cf872
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogCandidateKind.java
@@ -0,0 +1,35 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * What kind of resource a catalog candidate describes
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum CatalogCandidateKind {
+    /** The {@code mcp-server} variant. */
+    MCP_SERVER("mcp-server"),
+    /** The {@code ai-skill} variant. */
+    AI_SKILL("ai-skill");
+
+    private final String value;
+    CatalogCandidateKind(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static CatalogCandidateKind fromValue(String value) {
+        for (CatalogCandidateKind v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown CatalogCandidateKind value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogCapability.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogCapability.java
new file mode 100644
index 0000000000..bb1662ba27
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogCapability.java
@@ -0,0 +1,41 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * A wire feature a caller can require of the catalog surface, negotiated per request. A grant means the runtime understands the feature's contract, not that the deployment has enabled the operation; typed unavailable results report availability separately.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum CatalogCapability {
+    /** The {@code mcp-server-card} variant. */
+    MCP_SERVER_CARD("mcp-server-card"),
+    /** The {@code legacy-mcp-server-card} variant. */
+    LEGACY_MCP_SERVER_CARD("legacy-mcp-server-card"),
+    /** The {@code ai-skill-discovery} variant. */
+    AI_SKILL_DISCOVERY("ai-skill-discovery"),
+    /** The {@code mcp-install-planning} variant. */
+    MCP_INSTALL_PLANNING("mcp-install-planning"),
+    /** The {@code multiple-transport-choice} variant. */
+    MULTIPLE_TRANSPORT_CHOICE("multiple-transport-choice");
+
+    private final String value;
+    CatalogCapability(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static CatalogCapability fromValue(String value) {
+        for (CatalogCapability v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown CatalogCapability value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogClientContract.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogClientContract.java
new file mode 100644
index 0000000000..62cf8db22c
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogClientContract.java
@@ -0,0 +1,30 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import java.util.List;
+import javax.annotation.processing.Generated;
+
+/**
+ * The protocol version and capability set a caller requires, supplied on every catalog request so negotiation cannot be skipped by omission.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record CatalogClientContract(
+    /** SDK protocol version the caller was generated against. A caller below the runtime's minimum supported version is refused rather than served a partial result. */
+    @JsonProperty("protocolVersion") Long protocolVersion,
+    /** Wire features the caller requires the runtime to understand. Identifiers are bounded but extensible so a newer caller can negotiate with an older runtime. Requiring an unknown feature yields a typed refusal listing what is understood, never a partial grant. A grant does not promise that a deployment has enabled the operation; typed unavailable results report that separately. */
+    @JsonProperty("requiredCapabilities") List<String> requiredCapabilities
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogContractViolationError.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogContractViolationError.java
new file mode 100644
index 0000000000..5951d75a5e
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogContractViolationError.java
@@ -0,0 +1,44 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * An upstream catalog response broke the wire contract. Most importantly, every result must carry exactly one of a URL or embedded data: a result carrying both, or neither, is refused here rather than being guessed at.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogContractViolationError extends CatalogSearchResult {
+
+    @JsonProperty("kind")
+    private final String kind = "contract-violation";
+
+    @Override
+    public String getKind() { return kind; }
+
+    /** Which rule the response broke. */
+    @JsonProperty("reason")
+    private CatalogContractViolationReason reason;
+
+    /** Human-readable explanation, safe to surface. Never echoes response content, nor a query, URL, handle, or secret. */
+    @JsonProperty("message")
+    private String message;
+
+    public CatalogContractViolationReason getReason() { return reason; }
+    public void setReason(CatalogContractViolationReason reason) { this.reason = reason; }
+
+    public String getMessage() { return message; }
+    public void setMessage(String message) { this.message = message; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogContractViolationReason.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogContractViolationReason.java
new file mode 100644
index 0000000000..f289d67666
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogContractViolationReason.java
@@ -0,0 +1,39 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Which wire-contract rule an upstream response broke
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum CatalogContractViolationReason {
+    /** The {@code both-url-and-data} variant. */
+    BOTH_URL_AND_DATA("both-url-and-data"),
+    /** The {@code neither-url-nor-data} variant. */
+    NEITHER_URL_NOR_DATA("neither-url-nor-data"),
+    /** The {@code duplicate-identity} variant. */
+    DUPLICATE_IDENTITY("duplicate-identity"),
+    /** The {@code unknown-media-type} variant. */
+    UNKNOWN_MEDIA_TYPE("unknown-media-type");
+
+    private final String value;
+    CatalogContractViolationReason(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static CatalogContractViolationReason fromValue(String value) {
+        for (CatalogContractViolationReason v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown CatalogContractViolationReason value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogHandleRejectedError.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogHandleRejectedError.java
new file mode 100644
index 0000000000..7469d6194d
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogHandleRejectedError.java
@@ -0,0 +1,51 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * A presented handle was not accepted. Handles are runtime-instance scoped, TTL-bound, and single-use, so each way of failing is reported distinctly.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogHandleRejectedError extends McpPlanInstallResult {
+
+    @JsonProperty("kind")
+    private final String kind = "handle-rejected";
+
+    @Override
+    public String getKind() { return kind; }
+
+    /** Which kind of handle was presented. */
+    @JsonProperty("handleType")
+    private CatalogHandleType handleType;
+
+    /** Why the handle was rejected. */
+    @JsonProperty("reason")
+    private CatalogHandleRejectionReason reason;
+
+    /** Human-readable explanation, safe to surface. Never contains the handle itself, nor a query, URL, or secret. */
+    @JsonProperty("message")
+    private String message;
+
+    public CatalogHandleType getHandleType() { return handleType; }
+    public void setHandleType(CatalogHandleType handleType) { this.handleType = handleType; }
+
+    public CatalogHandleRejectionReason getReason() { return reason; }
+    public void setReason(CatalogHandleRejectionReason reason) { this.reason = reason; }
+
+    public String getMessage() { return message; }
+    public void setMessage(String message) { this.message = message; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogHandleRejectionReason.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogHandleRejectionReason.java
new file mode 100644
index 0000000000..6db6b69365
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogHandleRejectionReason.java
@@ -0,0 +1,39 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Why a presented handle was rejected
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum CatalogHandleRejectionReason {
+    /** The {@code invalid} variant. */
+    INVALID("invalid"),
+    /** The {@code stale} variant. */
+    STALE("stale"),
+    /** The {@code replayed} variant. */
+    REPLAYED("replayed"),
+    /** The {@code foreign} variant. */
+    FOREIGN("foreign");
+
+    private final String value;
+    CatalogHandleRejectionReason(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static CatalogHandleRejectionReason fromValue(String value) {
+        for (CatalogHandleRejectionReason v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown CatalogHandleRejectionReason value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogHandleType.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogHandleType.java
new file mode 100644
index 0000000000..a14ceef85b
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogHandleType.java
@@ -0,0 +1,35 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Which kind of opaque handle was presented
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum CatalogHandleType {
+    /** The {@code candidate} variant. */
+    CANDIDATE("candidate"),
+    /** The {@code plan} variant. */
+    PLAN("plan");
+
+    private final String value;
+    CatalogHandleType(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static CatalogHandleType fromValue(String value) {
+        for (CatalogHandleType v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown CatalogHandleType value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogInvalidRequestError.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogInvalidRequestError.java
new file mode 100644
index 0000000000..0f9eb7e769
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogInvalidRequestError.java
@@ -0,0 +1,44 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * The request was rejected before any work was done, because a bounded field fell outside its permitted range or a required field was unusable.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogInvalidRequestError extends CatalogSearchResult {
+
+    @JsonProperty("kind")
+    private final String kind = "invalid-request";
+
+    @Override
+    public String getKind() { return kind; }
+
+    /** Which request field was rejected. */
+    @JsonProperty("field")
+    private CatalogInvalidRequestField field;
+
+    /** Human-readable explanation, safe to surface. Never echoes the offending value, nor a query, URL, handle, or secret. */
+    @JsonProperty("message")
+    private String message;
+
+    public CatalogInvalidRequestField getField() { return field; }
+    public void setField(CatalogInvalidRequestField field) { this.field = field; }
+
+    public String getMessage() { return message; }
+    public void setMessage(String message) { this.message = message; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogInvalidRequestField.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogInvalidRequestField.java
new file mode 100644
index 0000000000..b930640163
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogInvalidRequestField.java
@@ -0,0 +1,45 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Which request field was rejected before any work was done
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum CatalogInvalidRequestField {
+    /** The {@code query} variant. */
+    QUERY("query"),
+    /** The {@code limit} variant. */
+    LIMIT("limit"),
+    /** The {@code kinds} variant. */
+    KINDS("kinds"),
+    /** The {@code contract} variant. */
+    CONTRACT("contract"),
+    /** The {@code source} variant. */
+    SOURCE("source"),
+    /** The {@code card} variant. */
+    CARD("card"),
+    /** The {@code scope} variant. */
+    SCOPE("scope");
+
+    private final String value;
+    CatalogInvalidRequestField(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static CatalogInvalidRequestField fromValue(String value) {
+        for (CatalogInvalidRequestField v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown CatalogInvalidRequestField value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogMalformedCardError.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogMalformedCardError.java
new file mode 100644
index 0000000000..24cb5cae13
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogMalformedCardError.java
@@ -0,0 +1,51 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * A card could not be parsed or did not satisfy its declared media type's schema.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogMalformedCardError extends CatalogSearchResult {
+
+    @JsonProperty("kind")
+    private final String kind = "malformed-card";
+
+    @Override
+    public String getKind() { return kind; }
+
+    /** How the card failed validation. */
+    @JsonProperty("reason")
+    private CatalogMalformedCardReason reason;
+
+    /** Media type the card was interpreted as, when it declared one this runtime recognises. */
+    @JsonProperty("mediaType")
+    private CatalogMediaType mediaType;
+
+    /** Human-readable explanation, safe to surface. Never echoes card content, nor a query, URL, handle, or secret. */
+    @JsonProperty("message")
+    private String message;
+
+    public CatalogMalformedCardReason getReason() { return reason; }
+    public void setReason(CatalogMalformedCardReason reason) { this.reason = reason; }
+
+    public CatalogMediaType getMediaType() { return mediaType; }
+    public void setMediaType(CatalogMediaType mediaType) { this.mediaType = mediaType; }
+
+    public String getMessage() { return message; }
+    public void setMessage(String message) { this.message = message; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogMalformedCardReason.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogMalformedCardReason.java
new file mode 100644
index 0000000000..17c1a05407
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogMalformedCardReason.java
@@ -0,0 +1,41 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * How a card failed validation
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum CatalogMalformedCardReason {
+    /** The {@code invalid-json} variant. */
+    INVALID_JSON("invalid-json"),
+    /** The {@code schema-violation} variant. */
+    SCHEMA_VIOLATION("schema-violation"),
+    /** The {@code unsupported-media-type} variant. */
+    UNSUPPORTED_MEDIA_TYPE("unsupported-media-type"),
+    /** The {@code missing-required-field} variant. */
+    MISSING_REQUIRED_FIELD("missing-required-field"),
+    /** The {@code size-limit-exceeded} variant. */
+    SIZE_LIMIT_EXCEEDED("size-limit-exceeded");
+
+    private final String value;
+    CatalogMalformedCardReason(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static CatalogMalformedCardReason fromValue(String value) {
+        for (CatalogMalformedCardReason v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown CatalogMalformedCardReason value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogMediaType.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogMediaType.java
new file mode 100644
index 0000000000..1528b052ee
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogMediaType.java
@@ -0,0 +1,37 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Media type a catalog card is interpreted as
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum CatalogMediaType {
+    /** The {@code application/mcp-server-card+json} variant. */
+    APPLICATION_MCP_SERVER_CARD_JSON("application/mcp-server-card+json"),
+    /** The {@code application/mcp-server+json} variant. */
+    APPLICATION_MCP_SERVER_JSON("application/mcp-server+json"),
+    /** The {@code application/ai-skill} variant. */
+    APPLICATION_AI_SKILL("application/ai-skill");
+
+    private final String value;
+    CatalogMediaType(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static CatalogMediaType fromValue(String value) {
+        for (CatalogMediaType v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown CatalogMediaType value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNegotiatedContract.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNegotiatedContract.java
new file mode 100644
index 0000000000..379525fc28
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNegotiatedContract.java
@@ -0,0 +1,30 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import java.util.List;
+import javax.annotation.processing.Generated;
+
+/**
+ * The protocol version and capability set the runtime actually honoured for a successful catalog operation.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record CatalogNegotiatedContract(
+    /** Protocol version of the runtime that served the request. */
+    @JsonProperty("runtimeProtocolVersion") Long runtimeProtocolVersion,
+    /** Wire features the runtime understood for this operation. Always a superset of the caller's required features, because any shortfall is a refusal instead. Operation availability remains a separate typed result. */
+    @JsonProperty("grantedCapabilities") List<CatalogCapability> grantedCapabilities
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNegotiationRefusedError.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNegotiationRefusedError.java
new file mode 100644
index 0000000000..56e20d3b4e
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNegotiationRefusedError.java
@@ -0,0 +1,73 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import java.util.List;
+import javax.annotation.processing.Generated;
+
+/**
+ * The caller's protocol version or required capabilities cannot be honoured. Returned instead of a partial or ambiguous success.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogNegotiationRefusedError extends CatalogSearchResult {
+
+    @JsonProperty("kind")
+    private final String kind = "negotiation-refused";
+
+    @Override
+    public String getKind() { return kind; }
+
+    /** Whether the version or the capability set was the problem. */
+    @JsonProperty("reason")
+    private CatalogNegotiationRefusedReason reason;
+
+    /** Protocol version of the runtime that refused the request. */
+    @JsonProperty("runtimeProtocolVersion")
+    private Long runtimeProtocolVersion;
+
+    /** Lowest caller protocol version this runtime will serve. */
+    @JsonProperty("minimumSupportedProtocolVersion")
+    private Long minimumSupportedProtocolVersion;
+
+    /** Every wire feature this runtime understands, so the caller can retry within that contract. This list does not imply that every deployment has enabled every operation. */
+    @JsonProperty("supportedCapabilities")
+    private List<CatalogCapability> supportedCapabilities;
+
+    /** The subset of the caller's bounded extensible capability identifiers this runtime cannot honour. */
+    @JsonProperty("unsupportedCapabilities")
+    private List<String> unsupportedCapabilities;
+
+    /** Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret. */
+    @JsonProperty("message")
+    private String message;
+
+    public CatalogNegotiationRefusedReason getReason() { return reason; }
+    public void setReason(CatalogNegotiationRefusedReason reason) { this.reason = reason; }
+
+    public Long getRuntimeProtocolVersion() { return runtimeProtocolVersion; }
+    public void setRuntimeProtocolVersion(Long runtimeProtocolVersion) { this.runtimeProtocolVersion = runtimeProtocolVersion; }
+
+    public Long getMinimumSupportedProtocolVersion() { return minimumSupportedProtocolVersion; }
+    public void setMinimumSupportedProtocolVersion(Long minimumSupportedProtocolVersion) { this.minimumSupportedProtocolVersion = minimumSupportedProtocolVersion; }
+
+    public List<CatalogCapability> getSupportedCapabilities() { return supportedCapabilities; }
+    public void setSupportedCapabilities(List<CatalogCapability> supportedCapabilities) { this.supportedCapabilities = supportedCapabilities; }
+
+    public List<String> getUnsupportedCapabilities() { return unsupportedCapabilities; }
+    public void setUnsupportedCapabilities(List<String> unsupportedCapabilities) { this.unsupportedCapabilities = unsupportedCapabilities; }
+
+    public String getMessage() { return message; }
+    public void setMessage(String message) { this.message = message; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNegotiationRefusedReason.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNegotiationRefusedReason.java
new file mode 100644
index 0000000000..ee86246b4a
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNegotiationRefusedReason.java
@@ -0,0 +1,35 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Why capability and protocol-version negotiation refused a caller
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum CatalogNegotiationRefusedReason {
+    /** The {@code unsupported-protocol-version} variant. */
+    UNSUPPORTED_PROTOCOL_VERSION("unsupported-protocol-version"),
+    /** The {@code unsupported-capability} variant. */
+    UNSUPPORTED_CAPABILITY("unsupported-capability");
+
+    private final String value;
+    CatalogNegotiationRefusedReason(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static CatalogNegotiationRefusedReason fromValue(String value) {
+        for (CatalogNegotiationRefusedReason v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown CatalogNegotiationRefusedReason value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNetworkFailureError.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNetworkFailureError.java
new file mode 100644
index 0000000000..d4afb32c3d
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNetworkFailureError.java
@@ -0,0 +1,51 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * The runtime could not reach the catalog authority or retrieve a card. Covers being offline as well as transport-level failure.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogNetworkFailureError extends CatalogSearchResult {
+
+    @JsonProperty("kind")
+    private final String kind = "network-failure";
+
+    @Override
+    public String getKind() { return kind; }
+
+    /** Categorised failure, low cardinality so it can be aggregated without carrying a URL. */
+    @JsonProperty("reason")
+    private CatalogNetworkFailureReason reason;
+
+    /** HTTP status code, when the failure was a rejected response. */
+    @JsonProperty("statusCode")
+    private Long statusCode;
+
+    /** Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret. */
+    @JsonProperty("message")
+    private String message;
+
+    public CatalogNetworkFailureReason getReason() { return reason; }
+    public void setReason(CatalogNetworkFailureReason reason) { this.reason = reason; }
+
+    public Long getStatusCode() { return statusCode; }
+    public void setStatusCode(Long statusCode) { this.statusCode = statusCode; }
+
+    public String getMessage() { return message; }
+    public void setMessage(String message) { this.message = message; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNetworkFailureReason.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNetworkFailureReason.java
new file mode 100644
index 0000000000..c28d1cc4a7
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNetworkFailureReason.java
@@ -0,0 +1,47 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Categorised network failure, low cardinality so it can be aggregated without carrying a URL
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum CatalogNetworkFailureReason {
+    /** The {@code offline} variant. */
+    OFFLINE("offline"),
+    /** The {@code dns} variant. */
+    DNS("dns"),
+    /** The {@code timeout} variant. */
+    TIMEOUT("timeout"),
+    /** The {@code tls} variant. */
+    TLS("tls"),
+    /** The {@code connection-refused} variant. */
+    CONNECTION_REFUSED("connection-refused"),
+    /** The {@code http-status} variant. */
+    HTTP_STATUS("http-status"),
+    /** The {@code response-too-large} variant. */
+    RESPONSE_TOO_LARGE("response-too-large"),
+    /** The {@code redirect-rejected} variant. */
+    REDIRECT_REJECTED("redirect-rejected");
+
+    private final String value;
+    CatalogNetworkFailureReason(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static CatalogNetworkFailureReason fromValue(String value) {
+        for (CatalogNetworkFailureReason v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown CatalogNetworkFailureReason value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNotInstallableError.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNotInstallableError.java
new file mode 100644
index 0000000000..2ba3c84ec4
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNotInstallableError.java
@@ -0,0 +1,44 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * The candidate is discoverable but cannot be installed. `application/ai-skill` resolves here, because it stays searchable while remaining typed non-installable.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogNotInstallableError extends McpPlanInstallResult {
+
+    @JsonProperty("kind")
+    private final String kind = "not-installable";
+
+    @Override
+    public String getKind() { return kind; }
+
+    /** Why the candidate cannot be installed. */
+    @JsonProperty("reason")
+    private CatalogNotInstallableReason reason;
+
+    /** Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret. */
+    @JsonProperty("message")
+    private String message;
+
+    public CatalogNotInstallableReason getReason() { return reason; }
+    public void setReason(CatalogNotInstallableReason reason) { this.reason = reason; }
+
+    public String getMessage() { return message; }
+    public void setMessage(String message) { this.message = message; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNotInstallableReason.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNotInstallableReason.java
new file mode 100644
index 0000000000..75abb619e2
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogNotInstallableReason.java
@@ -0,0 +1,37 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Why a discoverable candidate cannot be installed
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum CatalogNotInstallableReason {
+    /** The {@code kind-not-installable} variant. */
+    KIND_NOT_INSTALLABLE("kind-not-installable"),
+    /** The {@code ai-skill-not-installable} variant. */
+    AI_SKILL_NOT_INSTALLABLE("ai-skill-not-installable"),
+    /** The {@code policy-forbids} variant. */
+    POLICY_FORBIDS("policy-forbids");
+
+    private final String value;
+    CatalogNotInstallableReason(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static CatalogNotInstallableReason fromValue(String value) {
+        for (CatalogNotInstallableReason v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown CatalogNotInstallableReason value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogPolicyRejectedError.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogPolicyRejectedError.java
new file mode 100644
index 0000000000..56542ba46e
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogPolicyRejectedError.java
@@ -0,0 +1,44 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * Registry or enterprise policy refused the operation.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogPolicyRejectedError extends CatalogSearchResult {
+
+    @JsonProperty("kind")
+    private final String kind = "policy-rejected";
+
+    @Override
+    public String getKind() { return kind; }
+
+    /** Which authority produced the decision. */
+    @JsonProperty("source")
+    private McpPlanPolicySource source;
+
+    /** Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret. */
+    @JsonProperty("message")
+    private String message;
+
+    public McpPlanPolicySource getSource() { return source; }
+    public void setSource(McpPlanPolicySource source) { this.source = source; }
+
+    public String getMessage() { return message; }
+    public void setMessage(String message) { this.message = message; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogSearchParams.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogSearchParams.java
new file mode 100644
index 0000000000..ee5e703621
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogSearchParams.java
@@ -0,0 +1,37 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
+import java.util.List;
+import javax.annotation.processing.Generated;
+
+/**
+ * A bounded catalog search. Both the query length and the result count are capped by the schema so a caller cannot request an unbounded scan.
+ *
+ * @apiNote This method is experimental and may change in a future version.
+ * @since 1.0.0
+ */
+@CopilotExperimental
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record CatalogSearchParams(
+    /** Protocol version and capabilities the caller requires. */
+    @JsonProperty("contract") CatalogClientContract contract,
+    /** Free-text search query. Never written to logs or telemetry. */
+    @JsonProperty("query") String query,
+    /** Maximum number of candidates to return. Defaults to 10 when omitted. */
+    @JsonProperty("limit") Long limit,
+    /** Restrict results to these candidate kinds. When omitted, every kind the runtime supports is searched. */
+    @JsonProperty("kinds") List<CatalogCandidateKind> kinds
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogSearchResult.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogSearchResult.java
new file mode 100644
index 0000000000..4bfbf32701
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogSearchResult.java
@@ -0,0 +1,44 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonSubTypes;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import javax.annotation.processing.Generated;
+
+/**
+ * Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal. Never a partial success.
+ *
+ * @since 1.0.0
+ */
+@JsonTypeInfo(use = JsonTypeInfo.Id.NAME, property = "kind", visible = true)
+@JsonSubTypes({
+    @JsonSubTypes.Type(value = CatalogSearchSucceeded.class, name = "succeeded"),
+    @JsonSubTypes.Type(value = CatalogNegotiationRefusedError.class, name = "negotiation-refused"),
+    @JsonSubTypes.Type(value = CatalogUnsupportedKindError.class, name = "unsupported-kind"),
+    @JsonSubTypes.Type(value = CatalogInvalidRequestError.class, name = "invalid-request"),
+    @JsonSubTypes.Type(value = CatalogAuthenticationRequiredError.class, name = "authentication-required"),
+    @JsonSubTypes.Type(value = CatalogPolicyRejectedError.class, name = "policy-rejected"),
+    @JsonSubTypes.Type(value = CatalogNetworkFailureError.class, name = "network-failure"),
+    @JsonSubTypes.Type(value = CatalogUnsafeRetrievalError.class, name = "unsafe-retrieval"),
+    @JsonSubTypes.Type(value = CatalogMalformedCardError.class, name = "malformed-card"),
+    @JsonSubTypes.Type(value = CatalogContractViolationError.class, name = "contract-violation"),
+    @JsonSubTypes.Type(value = CatalogUnavailableError.class, name = "unavailable")
+})
+@JsonIgnoreProperties(ignoreUnknown = true)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public abstract class CatalogSearchResult {
+
+    /**
+     * Returns the discriminator value for this variant.
+     *
+     * @return the kind discriminator
+     */
+    public abstract String getKind();
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogSearchSucceeded.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogSearchSucceeded.java
new file mode 100644
index 0000000000..8ecd11788a
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogSearchSucceeded.java
@@ -0,0 +1,59 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import java.util.List;
+import javax.annotation.processing.Generated;
+
+/**
+ * A completed catalog search: inert candidate summaries, each carrying a single-use handle.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogSearchSucceeded extends CatalogSearchResult {
+
+    @JsonProperty("kind")
+    private final String kind = "succeeded";
+
+    @Override
+    public String getKind() { return kind; }
+
+    /** Pseudonymous identifier for this search, issued by the runtime or by the catalog authority it queried and never by the caller, so it cannot be forged or replayed to attribute an install to a search that never happened. Always present on a success, so a result set can be tied to the installs it leads to. It identifies a search rather than a person: it is derived from no user, account, device, or query data, and must never be joined with user identity to re-identify anyone. */
+    @JsonProperty("searchId")
+    private String searchId;
+
+    /** Matching candidates, never more than the requested limit. All text is inert untrusted data. */
+    @JsonProperty("candidates")
+    private List<Object> candidates;
+
+    /** Whether further matches existed beyond the requested limit. */
+    @JsonProperty("truncated")
+    private Boolean truncated;
+
+    /** Protocol version and capabilities the runtime honoured. */
+    @JsonProperty("negotiated")
+    private CatalogNegotiatedContract negotiated;
+
+    public String getSearchId() { return searchId; }
+    public void setSearchId(String searchId) { this.searchId = searchId; }
+
+    public List<Object> getCandidates() { return candidates; }
+    public void setCandidates(List<Object> candidates) { this.candidates = candidates; }
+
+    public Boolean getTruncated() { return truncated; }
+    public void setTruncated(Boolean truncated) { this.truncated = truncated; }
+
+    public CatalogNegotiatedContract getNegotiated() { return negotiated; }
+    public void setNegotiated(CatalogNegotiatedContract negotiated) { this.negotiated = negotiated; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnavailableError.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnavailableError.java
new file mode 100644
index 0000000000..7f21c57085
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnavailableError.java
@@ -0,0 +1,44 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * The operation is not available on this runtime. Distinct from a network failure: nothing was attempted.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogUnavailableError extends CatalogSearchResult {
+
+    @JsonProperty("kind")
+    private final String kind = "unavailable";
+
+    @Override
+    public String getKind() { return kind; }
+
+    /** Why the operation is unavailable. */
+    @JsonProperty("reason")
+    private CatalogUnavailableReason reason;
+
+    /** Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret. */
+    @JsonProperty("message")
+    private String message;
+
+    public CatalogUnavailableReason getReason() { return reason; }
+    public void setReason(CatalogUnavailableReason reason) { this.reason = reason; }
+
+    public String getMessage() { return message; }
+    public void setMessage(String message) { this.message = message; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnavailableReason.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnavailableReason.java
new file mode 100644
index 0000000000..c7bf4dcd76
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnavailableReason.java
@@ -0,0 +1,39 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Why a catalog operation is not available on this runtime
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum CatalogUnavailableReason {
+    /** The {@code search-unavailable} variant. */
+    SEARCH_UNAVAILABLE("search-unavailable"),
+    /** The {@code planning-unavailable} variant. */
+    PLANNING_UNAVAILABLE("planning-unavailable"),
+    /** The {@code authority-not-configured} variant. */
+    AUTHORITY_NOT_CONFIGURED("authority-not-configured"),
+    /** The {@code disabled-by-policy} variant. */
+    DISABLED_BY_POLICY("disabled-by-policy");
+
+    private final String value;
+    CatalogUnavailableReason(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static CatalogUnavailableReason fromValue(String value) {
+        for (CatalogUnavailableReason v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown CatalogUnavailableReason value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnavailableTransportError.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnavailableTransportError.java
new file mode 100644
index 0000000000..3c40687eac
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnavailableTransportError.java
@@ -0,0 +1,44 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * No transport this runtime can use is available for the requested server.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogUnavailableTransportError extends McpPlanInstallResult {
+
+    @JsonProperty("kind")
+    private final String kind = "unavailable-transport";
+
+    @Override
+    public String getKind() { return kind; }
+
+    /** Why no transport could be offered. */
+    @JsonProperty("reason")
+    private CatalogUnavailableTransportReason reason;
+
+    /** Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret. */
+    @JsonProperty("message")
+    private String message;
+
+    public CatalogUnavailableTransportReason getReason() { return reason; }
+    public void setReason(CatalogUnavailableTransportReason reason) { this.reason = reason; }
+
+    public String getMessage() { return message; }
+    public void setMessage(String message) { this.message = message; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnavailableTransportReason.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnavailableTransportReason.java
new file mode 100644
index 0000000000..d532967313
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnavailableTransportReason.java
@@ -0,0 +1,37 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Why no usable transport could be offered
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum CatalogUnavailableTransportReason {
+    /** The {@code no-eligible-transport} variant. */
+    NO_ELIGIBLE_TRANSPORT("no-eligible-transport"),
+    /** The {@code transport-not-supported} variant. */
+    TRANSPORT_NOT_SUPPORTED("transport-not-supported"),
+    /** The {@code remote-enumeration-unavailable} variant. */
+    REMOTE_ENUMERATION_UNAVAILABLE("remote-enumeration-unavailable");
+
+    private final String value;
+    CatalogUnavailableTransportReason(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static CatalogUnavailableTransportReason fromValue(String value) {
+        for (CatalogUnavailableTransportReason v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown CatalogUnavailableTransportReason value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnsafeRetrievalError.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnsafeRetrievalError.java
new file mode 100644
index 0000000000..513ce5b80f
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnsafeRetrievalError.java
@@ -0,0 +1,44 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * Retrieval was refused by the runtime's hardened fetch boundary before any request left the process, or before a redirect was followed.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogUnsafeRetrievalError extends CatalogSearchResult {
+
+    @JsonProperty("kind")
+    private final String kind = "unsafe-retrieval";
+
+    @Override
+    public String getKind() { return kind; }
+
+    /** Which control refused the retrieval, low cardinality so it can be aggregated without carrying a URL. */
+    @JsonProperty("reason")
+    private CatalogUnsafeRetrievalReason reason;
+
+    /** Human-readable explanation, safe to surface. Never contains the refused URL, nor a query, handle, or secret. */
+    @JsonProperty("message")
+    private String message;
+
+    public CatalogUnsafeRetrievalReason getReason() { return reason; }
+    public void setReason(CatalogUnsafeRetrievalReason reason) { this.reason = reason; }
+
+    public String getMessage() { return message; }
+    public void setMessage(String message) { this.message = message; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnsafeRetrievalReason.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnsafeRetrievalReason.java
new file mode 100644
index 0000000000..e05931dac1
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnsafeRetrievalReason.java
@@ -0,0 +1,43 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Which hardened-fetch control refused a retrieval
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum CatalogUnsafeRetrievalReason {
+    /** The {@code blocked-scheme} variant. */
+    BLOCKED_SCHEME("blocked-scheme"),
+    /** The {@code credentials-in-url} variant. */
+    CREDENTIALS_IN_URL("credentials-in-url"),
+    /** The {@code blocked-address} variant. */
+    BLOCKED_ADDRESS("blocked-address"),
+    /** The {@code redirect-to-blocked-address} variant. */
+    REDIRECT_TO_BLOCKED_ADDRESS("redirect-to-blocked-address"),
+    /** The {@code proxy-rejected} variant. */
+    PROXY_REJECTED("proxy-rejected"),
+    /** The {@code host-not-permitted} variant. */
+    HOST_NOT_PERMITTED("host-not-permitted");
+
+    private final String value;
+    CatalogUnsafeRetrievalReason(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static CatalogUnsafeRetrievalReason fromValue(String value) {
+        for (CatalogUnsafeRetrievalReason v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown CatalogUnsafeRetrievalReason value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnsupportedKindError.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnsupportedKindError.java
new file mode 100644
index 0000000000..06cc7bc5a8
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CatalogUnsupportedKindError.java
@@ -0,0 +1,52 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import java.util.List;
+import javax.annotation.processing.Generated;
+
+/**
+ * The request asked for a candidate kind this runtime does not serve.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class CatalogUnsupportedKindError extends CatalogSearchResult {
+
+    @JsonProperty("kind")
+    private final String kind = "unsupported-kind";
+
+    @Override
+    public String getKind() { return kind; }
+
+    /** The kinds from the request that are not supported. */
+    @JsonProperty("requestedKinds")
+    private List<CatalogCandidateKind> requestedKinds;
+
+    /** Every candidate kind this runtime can serve. */
+    @JsonProperty("supportedKinds")
+    private List<CatalogCandidateKind> supportedKinds;
+
+    /** Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret. */
+    @JsonProperty("message")
+    private String message;
+
+    public List<CatalogCandidateKind> getRequestedKinds() { return requestedKinds; }
+    public void setRequestedKinds(List<CatalogCandidateKind> requestedKinds) { this.requestedKinds = requestedKinds; }
+
+    public List<CatalogCandidateKind> getSupportedKinds() { return supportedKinds; }
+    public void setSupportedKinds(List<CatalogCandidateKind> supportedKinds) { this.supportedKinds = supportedKinds; }
+
+    public String getMessage() { return message; }
+    public void setMessage(String message) { this.message = message; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpInstallPlan.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpInstallPlan.java
new file mode 100644
index 0000000000..7274ce2b7f
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpInstallPlan.java
@@ -0,0 +1,48 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import java.util.List;
+import javax.annotation.processing.Generated;
+
+/**
+ * A normalised, inert description of what installing an MCP server would involve. Carries no raw card, no install specification, and no secret value.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record McpInstallPlan(
+    /** Opaque, runtime-instance scoped, TTL-bound, single-use handle for this plan. Rejected when stale, replayed, or presented to a different runtime instance. Never logged. */
+    @JsonProperty("planHandle") String planHandle,
+    /** ISO 8601 timestamp after which the plan handle is stale and will be rejected. Abandoning a plan needs no call: an unused handle simply expires, so cancellation before commit is side-effect free. */
+    @JsonProperty("planHandleExpiresAt") String planHandleExpiresAt,
+    /** Normalised identity of the server the plan would install. */
+    @JsonProperty("identity") McpPlanResourceIdentity identity,
+    /** Origin and semantic digest of the exact validated JSON MCP card content bound to this plan. */
+    @JsonProperty("provenance") McpPlanProvenance provenance,
+    /** Every eligible transport, so a host can present an explicit choice. A completed plan always has at least one; when none is eligible, planning returns `CatalogUnavailableTransportError` instead. */
+    @JsonProperty("transportChoices") List<Object> transportChoices,
+    /** Identifier of the choice the runtime would pick by default. Omitted when there is no eligible transport, or when the runtime expresses no preference. */
+    @JsonProperty("recommendedTransportChoiceId") String recommendedTransportChoiceId,
+    /** Configuration scope and key the plan would write to. */
+    @JsonProperty("target") McpPlanTarget target,
+    /** Outcome of evaluating the server against registry and enterprise policy. */
+    @JsonProperty("policy") McpPlanPolicyResult policy,
+    /** The configuration changes installing would make, described rather than serialised, so the mutable configuration payload stays behind the runtime boundary. */
+    @JsonProperty("configurationChanges") List<McpPlanConfigurationChange> configurationChanges,
+    /** Whether applying this plan would require an MCP reload to take effect. Planning itself never reloads. */
+    @JsonProperty("reloadRequired") Boolean reloadRequired,
+    /** Whether the plan cannot be applied without further input, because a required value has no default or a secret must be supplied. */
+    @JsonProperty("requiresInteractiveConfiguration") Boolean requiresInteractiveConfiguration
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanConfigurationChange.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanConfigurationChange.java
new file mode 100644
index 0000000000..d419772111
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanConfigurationChange.java
@@ -0,0 +1,36 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import java.util.List;
+import javax.annotation.processing.Generated;
+
+/**
+ * One change applying the plan would make, described rather than serialised so the configuration payload stays behind the runtime boundary.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record McpPlanConfigurationChange(
+    /** Whether the change would create a new entry or modify an existing one. */
+    @JsonProperty("operation") McpPlanConfigurationOperation operation,
+    /** Scope the change would be written to. */
+    @JsonProperty("scope") McpPlanScope scope,
+    /** Configuration key the change applies to. */
+    @JsonProperty("configKey") String configKey,
+    /** Names of the configuration fields the change would set, without their values. */
+    @JsonProperty("changedFields") List<String> changedFields,
+    /** Secret placeholders the written configuration would reference. The constrained placeholder type cannot carry a literal secret value. */
+    @JsonProperty("secretReferences") List<String> secretReferences
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanConfigurationOperation.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanConfigurationOperation.java
new file mode 100644
index 0000000000..a661db48ab
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanConfigurationOperation.java
@@ -0,0 +1,35 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Whether a planned configuration change would create or modify an entry
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum McpPlanConfigurationOperation {
+    /** The {@code add} variant. */
+    ADD("add"),
+    /** The {@code update} variant. */
+    UPDATE("update");
+
+    private final String value;
+    McpPlanConfigurationOperation(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static McpPlanConfigurationOperation fromValue(String value) {
+        for (McpPlanConfigurationOperation v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown McpPlanConfigurationOperation value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanInstallParams.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanInstallParams.java
new file mode 100644
index 0000000000..7b182fe2d6
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanInstallParams.java
@@ -0,0 +1,34 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
+import javax.annotation.processing.Generated;
+
+/**
+ * A side-effect-free request for an MCP install plan. Computing a plan never writes configuration, stores a secret, or reloads MCP servers.
+ *
+ * @apiNote This method is experimental and may change in a future version.
+ * @since 1.0.0
+ */
+@CopilotExperimental
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record McpPlanInstallParams(
+    /** Protocol version and capabilities the caller requires. */
+    @JsonProperty("contract") CatalogClientContract contract,
+    /** What to plan: either a candidate handle from a previous search, or a card supplied directly. */
+    @JsonProperty("source") Object source,
+    /** Configuration scope the plan targets. Defaults to user scope when omitted. */
+    @JsonProperty("scope") McpPlanScope scope
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanInstallPlanned.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanInstallPlanned.java
new file mode 100644
index 0000000000..571353a384
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanInstallPlanned.java
@@ -0,0 +1,44 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * A computed MCP install plan. Nothing has been applied: the plan describes what installing would change, and the plan handle is what a later apply operation would consume.
+ *
+ * @since 1.0.0
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class McpPlanInstallPlanned extends McpPlanInstallResult {
+
+    @JsonProperty("kind")
+    private final String kind = "planned";
+
+    @Override
+    public String getKind() { return kind; }
+
+    /** The normalised plan. */
+    @JsonProperty("plan")
+    private McpInstallPlan plan;
+
+    /** Protocol version and capabilities the runtime honoured. */
+    @JsonProperty("negotiated")
+    private CatalogNegotiatedContract negotiated;
+
+    public McpInstallPlan getPlan() { return plan; }
+    public void setPlan(McpInstallPlan plan) { this.plan = plan; }
+
+    public CatalogNegotiatedContract getNegotiated() { return negotiated; }
+    public void setNegotiated(CatalogNegotiatedContract negotiated) { this.negotiated = negotiated; }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanInstallResult.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanInstallResult.java
new file mode 100644
index 0000000000..d257703477
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanInstallResult.java
@@ -0,0 +1,46 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonSubTypes;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import javax.annotation.processing.Generated;
+
+/**
+ * Outcome of an mcp.planInstall call: either a normalised plan, or one typed refusal. Nothing is written in either case.
+ *
+ * @since 1.0.0
+ */
+@JsonTypeInfo(use = JsonTypeInfo.Id.NAME, property = "kind", visible = true)
+@JsonSubTypes({
+    @JsonSubTypes.Type(value = McpPlanInstallPlanned.class, name = "planned"),
+    @JsonSubTypes.Type(value = CatalogNegotiationRefusedError.class, name = "negotiation-refused"),
+    @JsonSubTypes.Type(value = CatalogHandleRejectedError.class, name = "handle-rejected"),
+    @JsonSubTypes.Type(value = CatalogInvalidRequestError.class, name = "invalid-request"),
+    @JsonSubTypes.Type(value = CatalogAuthenticationRequiredError.class, name = "authentication-required"),
+    @JsonSubTypes.Type(value = CatalogPolicyRejectedError.class, name = "policy-rejected"),
+    @JsonSubTypes.Type(value = CatalogNetworkFailureError.class, name = "network-failure"),
+    @JsonSubTypes.Type(value = CatalogUnsafeRetrievalError.class, name = "unsafe-retrieval"),
+    @JsonSubTypes.Type(value = CatalogMalformedCardError.class, name = "malformed-card"),
+    @JsonSubTypes.Type(value = CatalogContractViolationError.class, name = "contract-violation"),
+    @JsonSubTypes.Type(value = CatalogUnavailableTransportError.class, name = "unavailable-transport"),
+    @JsonSubTypes.Type(value = CatalogNotInstallableError.class, name = "not-installable"),
+    @JsonSubTypes.Type(value = CatalogUnavailableError.class, name = "unavailable")
+})
+@JsonIgnoreProperties(ignoreUnknown = true)
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public abstract class McpPlanInstallResult {
+
+    /**
+     * Returns the discriminator value for this variant.
+     *
+     * @return the kind discriminator
+     */
+    public abstract String getKind();
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanPolicyDecision.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanPolicyDecision.java
new file mode 100644
index 0000000000..be32c283a0
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanPolicyDecision.java
@@ -0,0 +1,37 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * What policy decided for a planned server
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum McpPlanPolicyDecision {
+    /** The {@code allowed} variant. */
+    ALLOWED("allowed"),
+    /** The {@code blocked} variant. */
+    BLOCKED("blocked"),
+    /** The {@code requires-approval} variant. */
+    REQUIRES_APPROVAL("requires-approval");
+
+    private final String value;
+    McpPlanPolicyDecision(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static McpPlanPolicyDecision fromValue(String value) {
+        for (McpPlanPolicyDecision v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown McpPlanPolicyDecision value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanPolicyResult.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanPolicyResult.java
new file mode 100644
index 0000000000..ee8d2ff0c1
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanPolicyResult.java
@@ -0,0 +1,31 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * Outcome of evaluating the planned server against registry and enterprise policy. Evaluation is read-only.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record McpPlanPolicyResult(
+    /** What policy decided for this server. */
+    @JsonProperty("decision") McpPlanPolicyDecision decision,
+    /** Which authority produced the decision. */
+    @JsonProperty("source") McpPlanPolicySource source,
+    /** Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret. */
+    @JsonProperty("reason") String reason
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanPolicySource.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanPolicySource.java
new file mode 100644
index 0000000000..f6c0498f3b
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanPolicySource.java
@@ -0,0 +1,39 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Which authority produced a policy decision
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum McpPlanPolicySource {
+    /** The {@code none} variant. */
+    NONE("none"),
+    /** The {@code enterprise-allowlist} variant. */
+    ENTERPRISE_ALLOWLIST("enterprise-allowlist"),
+    /** The {@code registry-policy} variant. */
+    REGISTRY_POLICY("registry-policy"),
+    /** The {@code local-trust} variant. */
+    LOCAL_TRUST("local-trust");
+
+    private final String value;
+    McpPlanPolicySource(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static McpPlanPolicySource fromValue(String value) {
+        for (McpPlanPolicySource v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown McpPlanPolicySource value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanProvenance.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanProvenance.java
new file mode 100644
index 0000000000..5b7d6531d3
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanProvenance.java
@@ -0,0 +1,33 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * Provenance of the exact validated JSON MCP card content bound privately to a completed plan and its opaque handle.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record McpPlanProvenance(
+    /** Authority associated with the validated card, without path, query, or credentials. Inert untrusted data. */
+    @JsonProperty("authority") String authority,
+    /** ISO 8601 timestamp at which the runtime completed strict parsing and schema validation of the card content. */
+    @JsonProperty("validatedAt") String validatedAt,
+    /** Semantic digest of the exact validated JSON content bound to the plan handle. */
+    @JsonProperty("cardDigest") CardDigest cardDigest,
+    /** JSON MCP media type the validated card was interpreted as. */
+    @JsonProperty("mediaType") McpServerCardMediaType mediaType
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanResourceIdentity.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanResourceIdentity.java
new file mode 100644
index 0000000000..abe525c1dc
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanResourceIdentity.java
@@ -0,0 +1,33 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * Normalised identity of the MCP server a plan targets, independent of how the card spelled it.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record McpPlanResourceIdentity(
+    /** Canonical, normalised name of the server, for example `io.github.owner/server`. */
+    @JsonProperty("canonicalName") String canonicalName,
+    /** Local configuration key the server would be recorded under. */
+    @JsonProperty("serverName") String serverName,
+    /** Version advertised by the card, when it declares one. */
+    @JsonProperty("version") String version,
+    /** Registry identifier of the server, when it came from a registry. */
+    @JsonProperty("registryId") String registryId
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanScope.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanScope.java
new file mode 100644
index 0000000000..41f5d72016
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanScope.java
@@ -0,0 +1,33 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Configuration scope an MCP install plan targets
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum McpPlanScope {
+    /** The {@code user} variant. */
+    USER("user");
+
+    private final String value;
+    McpPlanScope(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static McpPlanScope fromValue(String value) {
+        for (McpPlanScope v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown McpPlanScope value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanTarget.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanTarget.java
new file mode 100644
index 0000000000..95362a4cca
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpPlanTarget.java
@@ -0,0 +1,29 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * Where a plan would be written.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record McpPlanTarget(
+    /** Configuration scope the plan targets. */
+    @JsonProperty("scope") McpPlanScope scope,
+    /** Configuration key the server would be recorded under within that scope. */
+    @JsonProperty("configKey") String configKey
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpServerCardMediaType.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpServerCardMediaType.java
new file mode 100644
index 0000000000..4258f7d4d4
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpServerCardMediaType.java
@@ -0,0 +1,35 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * JSON MCP card media type accepted for install planning
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum McpServerCardMediaType {
+    /** The {@code application/mcp-server-card+json} variant. */
+    APPLICATION_MCP_SERVER_CARD_JSON("application/mcp-server-card+json"),
+    /** The {@code application/mcp-server+json} variant. */
+    APPLICATION_MCP_SERVER_JSON("application/mcp-server+json");
+
+    private final String value;
+    McpServerCardMediaType(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static McpServerCardMediaType fromValue(String value) {
+        for (McpServerCardMediaType v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown McpServerCardMediaType value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionDecisionSource.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionDecisionSource.java
index ee807b095f..56f5793c5e 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionDecisionSource.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionDecisionSource.java
@@ -16,8 +16,8 @@
  */
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum PermissionDecisionSource {
-    /** The {@code judge_recommendation} variant. */
-    JUDGE_RECOMMENDATION("judge_recommendation"),
+    /** The {@code assisted_approval} variant. */
+    ASSISTED_APPROVAL("assisted_approval"),
     /** The {@code human_response} variant. */
     HUMAN_RESPONSE("human_response"),
     /** The {@code host_policy} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionMode.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionMode.java
new file mode 100644
index 0000000000..1f4ea9b6bc
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionMode.java
@@ -0,0 +1,37 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Current or requested permission mode.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum PermissionMode {
+    /** The {@code manual} variant. */
+    MANUAL("manual"),
+    /** The {@code assisted} variant. */
+    ASSISTED("assisted"),
+    /** The {@code allow-all} variant. */
+    ALLOW_ALL("allow-all");
+
+    private final String value;
+    PermissionMode(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static PermissionMode fromValue(String value) {
+        for (PermissionMode v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown PermissionMode value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionsSetAllowAllSource.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionModeSource.java
similarity index 70%
rename from java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionsSetAllowAllSource.java
rename to java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionModeSource.java
index a7ff9ae9aa..2174e7fc29 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionsSetAllowAllSource.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionModeSource.java
@@ -10,12 +10,12 @@
 import javax.annotation.processing.Generated;
 
 /**
- * Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers.
+ * Optional source for permission-mode telemetry. Defaults to `rpc` when omitted for SDK callers.
  *
  * @since 1.0.0
  */
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
-public enum PermissionsSetAllowAllSource {
+public enum PermissionModeSource {
     /** The {@code cli_flag} variant. */
     CLI_FLAG("cli_flag"),
     /** The {@code slash_command} variant. */
@@ -26,14 +26,14 @@ public enum PermissionsSetAllowAllSource {
     RPC("rpc");
 
     private final String value;
-    PermissionsSetAllowAllSource(String value) { this.value = value; }
+    PermissionModeSource(String value) { this.value = value; }
     @com.fasterxml.jackson.annotation.JsonValue
     public String getValue() { return value; }
     @com.fasterxml.jackson.annotation.JsonCreator
-    public static PermissionsSetAllowAllSource fromValue(String value) {
-        for (PermissionsSetAllowAllSource v : values()) {
+    public static PermissionModeSource fromValue(String value) {
+        for (PermissionModeSource v : values()) {
             if (v.value.equals(value)) return v;
         }
-        throw new IllegalArgumentException("Unknown PermissionsSetAllowAllSource value: " + value);
+        throw new IllegalArgumentException("Unknown PermissionModeSource value: " + value);
     }
 }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PlanSqlTodosRow.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PlanSqlTodosRow.java
index bee0a48546..56e0e3dfcc 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PlanSqlTodosRow.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PlanSqlTodosRow.java
@@ -28,6 +28,8 @@ public record PlanSqlTodosRow(
     /** Todo description. */
     @JsonProperty("description") String description,
     /** Todo status. */
-    @JsonProperty("status") String status
+    @JsonProperty("status") String status,
+    /** Todo creation time, as stored by the session SQL schema's `datetime('now')` default: `YYYY-MM-DD HH:MM:SS` in UTC. Lets clients attribute todos to the work item that created them (e.g. scoping a goal's progress to the todos it produced) rather than to the whole session. */
+    @JsonProperty("createdAt") String createdAt
 ) {
 }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ServerCatalogApi.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ServerCatalogApi.java
new file mode 100644
index 0000000000..9b320cbb39
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ServerCatalogApi.java
@@ -0,0 +1,40 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.github.copilot.CopilotExperimental;
+import java.util.concurrent.CompletableFuture;
+import javax.annotation.processing.Generated;
+
+/**
+ * API methods for the {@code catalog} namespace.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class ServerCatalogApi {
+
+    private final RpcCaller caller;
+
+    /** @param caller the RPC transport function */
+    ServerCatalogApi(RpcCaller caller) {
+        this.caller = caller;
+    }
+
+    /**
+     * A bounded catalog search. Both the query length and the result count are capped by the schema so a caller cannot request an unbounded scan.
+     *
+     * @apiNote This method is experimental and may change in a future version.
+     * @since 1.0.0
+     */
+    @CopilotExperimental
+    public CompletableFuture<CatalogSearchResult> search(CatalogSearchParams params) {
+        return caller.invoke("catalog.search", params, CatalogSearchResult.class);
+    }
+
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ServerMcpApi.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ServerMcpApi.java
index b29c27fa4c..88dd7621fd 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ServerMcpApi.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ServerMcpApi.java
@@ -41,4 +41,15 @@ public CompletableFuture<McpDiscoverResult> discover(McpDiscoverParams params) {
         return caller.invoke("mcp.discover", params, McpDiscoverResult.class);
     }
 
+    /**
+     * A side-effect-free request for an MCP install plan. Computing a plan never writes configuration, stores a secret, or reloads MCP servers.
+     *
+     * @apiNote This method is experimental and may change in a future version.
+     * @since 1.0.0
+     */
+    @CopilotExperimental
+    public CompletableFuture<McpPlanInstallResult> planInstall(McpPlanInstallParams params) {
+        return caller.invoke("mcp.planInstall", params, McpPlanInstallResult.class);
+    }
+
 }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ServerRpc.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ServerRpc.java
index 1307ece6b4..111cee2560 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ServerRpc.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ServerRpc.java
@@ -37,6 +37,8 @@ public final class ServerRpc {
     public final ServerMcpApi mcp;
     /** API methods for the {@code extensions} namespace. */
     public final ServerExtensionsApi extensions;
+    /** API methods for the {@code catalog} namespace. */
+    public final ServerCatalogApi catalog;
     /** API methods for the {@code plugins} namespace. */
     public final ServerPluginsApi plugins;
     /** API methods for the {@code skills} namespace. */
@@ -75,6 +77,7 @@ public ServerRpc(RpcCaller caller) {
         this.secrets = new ServerSecretsApi(caller);
         this.mcp = new ServerMcpApi(caller);
         this.extensions = new ServerExtensionsApi(caller);
+        this.catalog = new ServerCatalogApi(caller);
         this.plugins = new ServerPluginsApi(caller);
         this.skills = new ServerSkillsApi(caller);
         this.agents = new ServerAgentsApi(caller);
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionMcpApi.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionMcpApi.java
index 2f50a62125..ed66b7bc15 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionMcpApi.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionMcpApi.java
@@ -113,6 +113,17 @@ public CompletableFuture<Void> reload() {
         return caller.invoke("session.mcp.reload", java.util.Map.of("sessionId", this.sessionId), Void.class);
     }
 
+    /**
+     * Identifies the target session.
+     *
+     * @apiNote This method is experimental and may change in a future version.
+     * @since 1.0.0
+     */
+    @CopilotExperimental
+    public CompletableFuture<SessionMcpMoveLoadingToBackgroundResult> moveLoadingToBackground() {
+        return caller.invoke("session.mcp.moveLoadingToBackground", java.util.Map.of("sessionId", this.sessionId), SessionMcpMoveLoadingToBackgroundResult.class);
+    }
+
     /**
      * Opaque MCP reload configuration.
      * <p>
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsGetAllowAllResult.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionMcpMoveLoadingToBackgroundParams.java
similarity index 75%
rename from java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsGetAllowAllResult.java
rename to java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionMcpMoveLoadingToBackgroundParams.java
index 28d9915df2..9c3305c3bd 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsGetAllowAllResult.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionMcpMoveLoadingToBackgroundParams.java
@@ -14,7 +14,7 @@
 import javax.annotation.processing.Generated;
 
 /**
- * Current allow-all permission mode.
+ * Identifies the target session.
  *
  * @apiNote This method is experimental and may change in a future version.
  * @since 1.0.0
@@ -23,10 +23,8 @@
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
-public record SessionPermissionsGetAllowAllResult(
-    /** Whether full allow-all permissions are currently active */
-    @JsonProperty("enabled") Boolean enabled,
-    /** Current allow-all mode */
-    @JsonProperty("mode") PermissionsAllowAllMode mode
+public record SessionMcpMoveLoadingToBackgroundParams(
+    /** Target session identifier */
+    @JsonProperty("sessionId") String sessionId
 ) {
 }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionMcpMoveLoadingToBackgroundResult.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionMcpMoveLoadingToBackgroundResult.java
new file mode 100644
index 0000000000..8890481647
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionMcpMoveLoadingToBackgroundResult.java
@@ -0,0 +1,30 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
+import javax.annotation.processing.Generated;
+
+/**
+ * Result of moving in-flight MCP loading to the background.
+ *
+ * @apiNote This method is experimental and may change in a future version.
+ * @since 1.0.0
+ */
+@CopilotExperimental
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record SessionMcpMoveLoadingToBackgroundResult(
+    /** Whether an in-flight MCP load was moved to the background, releasing turns that were waiting on it. False when no MCP load was in flight or the waiting turns had already been released. */
+    @JsonProperty("movedToBackground") Boolean movedToBackground
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsApi.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsApi.java
index 25d2e36666..8b397f2d4d 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsApi.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsApi.java
@@ -103,7 +103,7 @@ public CompletableFuture<SessionPermissionsSetApproveAllResult> setApproveAll(Se
     }
 
     /**
-     * Allow-all mode to apply for the session.
+     * Permission mode to apply for the session.
      * <p>
      * Note: the {@code sessionId} field in the params record is overridden
      * by the session-scoped wrapper; any value provided is ignored.
@@ -112,10 +112,10 @@ public CompletableFuture<SessionPermissionsSetApproveAllResult> setApproveAll(Se
      * @since 1.0.0
      */
     @CopilotExperimental
-    public CompletableFuture<SessionPermissionsSetAllowAllResult> setAllowAll(SessionPermissionsSetAllowAllParams params) {
+    public CompletableFuture<SessionPermissionsSetModeResult> setMode(SessionPermissionsSetModeParams params) {
         com.fasterxml.jackson.databind.node.ObjectNode _p = MAPPER.valueToTree(params);
         _p.put("sessionId", this.sessionId);
-        return caller.invoke("session.permissions.setAllowAll", _p, SessionPermissionsSetAllowAllResult.class);
+        return caller.invoke("session.permissions.setMode", _p, SessionPermissionsSetModeResult.class);
     }
 
     /**
@@ -125,8 +125,8 @@ public CompletableFuture<SessionPermissionsSetAllowAllResult> setAllowAll(Sessio
      * @since 1.0.0
      */
     @CopilotExperimental
-    public CompletableFuture<SessionPermissionsGetAllowAllResult> getAllowAll() {
-        return caller.invoke("session.permissions.getAllowAll", java.util.Map.of("sessionId", this.sessionId), SessionPermissionsGetAllowAllResult.class);
+    public CompletableFuture<SessionPermissionsGetModeResult> getMode() {
+        return caller.invoke("session.permissions.getMode", java.util.Map.of("sessionId", this.sessionId), SessionPermissionsGetModeResult.class);
     }
 
     /**
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsGetAllowAllParams.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsGetModeParams.java
similarity index 95%
rename from java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsGetAllowAllParams.java
rename to java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsGetModeParams.java
index 761640a4fb..5d41d3c6a2 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsGetAllowAllParams.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsGetModeParams.java
@@ -23,7 +23,7 @@
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
-public record SessionPermissionsGetAllowAllParams(
+public record SessionPermissionsGetModeParams(
     /** Target session identifier */
     @JsonProperty("sessionId") String sessionId
 ) {
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsGetModeResult.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsGetModeResult.java
new file mode 100644
index 0000000000..1ccb45375c
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsGetModeResult.java
@@ -0,0 +1,30 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
+import javax.annotation.processing.Generated;
+
+/**
+ * Current permission mode.
+ *
+ * @apiNote This method is experimental and may change in a future version.
+ * @since 1.0.0
+ */
+@CopilotExperimental
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record SessionPermissionsGetModeResult(
+    /** Current permission mode */
+    @JsonProperty("mode") PermissionMode mode
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsSetAllowAllParams.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsSetModeParams.java
similarity index 50%
rename from java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsSetAllowAllParams.java
rename to java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsSetModeParams.java
index f31646f766..712d460243 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsSetAllowAllParams.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsSetModeParams.java
@@ -14,7 +14,7 @@
 import javax.annotation.processing.Generated;
 
 /**
- * Allow-all mode to apply for the session.
+ * Permission mode to apply for the session.
  *
  * @apiNote This method is experimental and may change in a future version.
  * @since 1.0.0
@@ -23,16 +23,14 @@
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
-public record SessionPermissionsSetAllowAllParams(
+public record SessionPermissionsSetModeParams(
     /** Target session identifier */
     @JsonProperty("sessionId") String sessionId,
-    /** Allow-all mode to apply. `on` enables full allow-all; `auto` enables advisory LLM auto-approval; `off` disables both. */
-    @JsonProperty("mode") PermissionsAllowAllMode mode,
-    /** Legacy full allow-all toggle. Prefer `mode`; when `mode` is omitted, `enabled: true` is treated as `mode: "on"` and any other value is treated as `mode: "off"`. */
-    @JsonProperty("enabled") Boolean enabled,
-    /** Optional model id for the `auto` mode auto-approval LLM judging. Only meaningful when `mode` is `auto`; ignored otherwise. When omitted, the session resolves a default judge model: `gpt-5.5` for CAPI sessions and the session's active model for BYOK sessions. */
-    @JsonProperty("model") String model,
-    /** Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers. */
-    @JsonProperty("source") PermissionsSetAllowAllSource source
+    /** Permission mode to apply */
+    @JsonProperty("mode") PermissionMode mode,
+    /** Optional judge model id for assisted mode. When omitted, the session resolves the provider default: `gpt-5.5` for CAPI sessions and the active session model for BYOK sessions. */
+    @JsonProperty("assistedApprovalModel") String assistedApprovalModel,
+    /** Optional source for permission-mode telemetry. Defaults to `rpc` when omitted for SDK callers. */
+    @JsonProperty("source") PermissionModeSource source
 ) {
 }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsSetAllowAllResult.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsSetModeResult.java
similarity index 73%
rename from java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsSetAllowAllResult.java
rename to java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsSetModeResult.java
index 9b14d8f6ad..1ee34568ea 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsSetAllowAllResult.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionPermissionsSetModeResult.java
@@ -14,7 +14,7 @@
 import javax.annotation.processing.Generated;
 
 /**
- * Indicates whether the operation succeeded and reports the post-mutation state.
+ * Indicates whether the requested permission mode was applied and reports the authoritative post-mutation mode.
  *
  * @apiNote This method is experimental and may change in a future version.
  * @since 1.0.0
@@ -23,12 +23,10 @@
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
-public record SessionPermissionsSetAllowAllResult(
+public record SessionPermissionsSetModeResult(
     /** Whether the operation succeeded */
     @JsonProperty("success") Boolean success,
-    /** Authoritative full allow-all state after the mutation */
-    @JsonProperty("enabled") Boolean enabled,
-    /** Authoritative allow-all mode after the mutation */
-    @JsonProperty("mode") PermissionsAllowAllMode mode
+    /** Authoritative permission mode after the mutation */
+    @JsonProperty("mode") PermissionMode mode
 ) {
 }
diff --git a/nodejs/package-lock.json b/nodejs/package-lock.json
index a3665c091f..3d51d6d238 100644
--- a/nodejs/package-lock.json
+++ b/nodejs/package-lock.json
@@ -9,7 +9,7 @@
             "version": "0.0.0-dev",
             "license": "MIT",
             "dependencies": {
-                "@github/copilot": "^1.0.81-2",
+                "@github/copilot": "^1.0.81-4",
                 "koffi": "^3.1.0",
                 "vscode-jsonrpc": "^8.2.1",
                 "zod": "^4.3.6"
@@ -658,8 +658,8 @@
             }
         },
         "node_modules/@github/copilot": {
-            "version": "1.0.81-2",
-            "integrity": "sha512-FeeCKM0Pcm1mwC6uJQ/nkI5Bc33xe10dn3rtvYl3+ZzyKtAS7I8IeGvGrA773bsAgiHiyfj+KEQQlqKsBCgtPQ==",
+            "version": "1.0.81-4",
+            "integrity": "sha512-XSHSlWqDhoajHMjRouZv0gqPfG3MVJvLFCoWToT8/fbQ7rmE9rB4w0sefzmh30CrQANCWd+uiIUOe9H3QL32WA==",
             "license": "SEE LICENSE IN LICENSE.md",
             "dependencies": {
                 "detect-libc": "^2.1.2"
@@ -668,19 +668,19 @@
                 "copilot": "npm-loader.js"
             },
             "optionalDependencies": {
-                "@github/copilot-darwin-arm64": "1.0.81-2",
-                "@github/copilot-darwin-x64": "1.0.81-2",
-                "@github/copilot-linux-arm64": "1.0.81-2",
-                "@github/copilot-linux-x64": "1.0.81-2",
-                "@github/copilot-linuxmusl-arm64": "1.0.81-2",
-                "@github/copilot-linuxmusl-x64": "1.0.81-2",
-                "@github/copilot-win32-arm64": "1.0.81-2",
-                "@github/copilot-win32-x64": "1.0.81-2"
+                "@github/copilot-darwin-arm64": "1.0.81-4",
+                "@github/copilot-darwin-x64": "1.0.81-4",
+                "@github/copilot-linux-arm64": "1.0.81-4",
+                "@github/copilot-linux-x64": "1.0.81-4",
+                "@github/copilot-linuxmusl-arm64": "1.0.81-4",
+                "@github/copilot-linuxmusl-x64": "1.0.81-4",
+                "@github/copilot-win32-arm64": "1.0.81-4",
+                "@github/copilot-win32-x64": "1.0.81-4"
             }
         },
         "node_modules/@github/copilot-darwin-arm64": {
-            "version": "1.0.81-2",
-            "integrity": "sha512-BS7LPiXvOYd8H4VoD7BCOJ/R+JGIO9JxFMYn/ICXGpL/405s8eX+QXj6GNtFIOAEXPWr0fBweIVi9ExrKMiimQ==",
+            "version": "1.0.81-4",
+            "integrity": "sha512-6XEOnrQdqdZ/tbhKU2D37tk0PGwKdNT5LGLvjjrWx+TDCFO/xZSu85+Rxl4AZP1SHKwWJRZdamDmETj4vn4VWQ==",
             "cpu": [
                 "arm64"
             ],
@@ -694,8 +694,8 @@
             }
         },
         "node_modules/@github/copilot-darwin-x64": {
-            "version": "1.0.81-2",
-            "integrity": "sha512-geVSBY7KlT4je8Xct1DTiisWQmfvj2Mjf1kWim81bp9W4Z18MEsEGXFeHAeYE2ZSwhdfMZCJprDF66orrHJ92w==",
+            "version": "1.0.81-4",
+            "integrity": "sha512-o1ghvv7EUGO3CGbZyGyQJgu9mCFEyXq9FUUmvcxsBXxfjk7PR1CywK4cJVeZxac8LL//DQ/q42JzkaSfXU29Wg==",
             "cpu": [
                 "x64"
             ],
@@ -709,8 +709,8 @@
             }
         },
         "node_modules/@github/copilot-linux-arm64": {
-            "version": "1.0.81-2",
-            "integrity": "sha512-uov9YOKlhyiaQfbgi6SzyAGjBLXegYRNJkgckG/7Xq/TbxF0Bmve3/lSuzve+p/EOnzPVwR1kGPDEuGU3g97Rw==",
+            "version": "1.0.81-4",
+            "integrity": "sha512-pHCwhBe+IVtliSxOEiwhS+GQXRvLuJxOQzdqAZYhbaEJKWeqWTw40LnhqaQFaGhOp1GAJF+6FodG/SfUZYAx5g==",
             "cpu": [
                 "arm64"
             ],
@@ -724,8 +724,8 @@
             }
         },
         "node_modules/@github/copilot-linux-x64": {
-            "version": "1.0.81-2",
-            "integrity": "sha512-wsuXQDnMBdc0Q/hoO5+n+GaBPClzmgcxD2pVvM7i8JxgDAOm3NxHxGF9eYt1h5I+42/Y16t23n12PGARGupfAA==",
+            "version": "1.0.81-4",
+            "integrity": "sha512-icy4c4jfQzXNShlGptRiUPKpHUhGX9qBxc+118WBv3H68o38Pi//6UP/ZRq9PvcVrPwxbA9HkFASNwBiEzshdA==",
             "cpu": [
                 "x64"
             ],
@@ -739,8 +739,8 @@
             }
         },
         "node_modules/@github/copilot-linuxmusl-arm64": {
-            "version": "1.0.81-2",
-            "integrity": "sha512-Wi0u31vhBqxajGqpjODhTEwzzqDnfS1mRhKJ/FflH5ieMKsS8YLVHiCUaZFNFZtN1FIFU0ixIQqgUXCvaBP+0Q==",
+            "version": "1.0.81-4",
+            "integrity": "sha512-k54g1q9Umz7eFGTpOqG5H1l1m2eNSs8jqFLuEpvGGdu7SU5g6Cz0aWq2VM27l+HcChyjp2dGenhQe/s7KxLSMw==",
             "cpu": [
                 "arm64"
             ],
@@ -754,8 +754,8 @@
             }
         },
         "node_modules/@github/copilot-linuxmusl-x64": {
-            "version": "1.0.81-2",
-            "integrity": "sha512-wbb1+aM/jSTE3tDCqwiADe/aUqosGsPzQZIliG/CMsByT02nbwl0CMZGocnsYyDcoKragGmAHqHxgD6sWsJB1g==",
+            "version": "1.0.81-4",
+            "integrity": "sha512-ETjiiuMGDdO6ZdytQ3w8u7wvtkDQCLc0zSnZXXYWxnG4y9qLut8VHFoTJ+P07lBrHKXo7tZsJ6W0d1gOQTBnvw==",
             "cpu": [
                 "x64"
             ],
@@ -769,8 +769,8 @@
             }
         },
         "node_modules/@github/copilot-win32-arm64": {
-            "version": "1.0.81-2",
-            "integrity": "sha512-gyONPnQf3Im0lTkC+1NW79P6p8A1F4Cs7dO3ruVBbtDG8SPFJXWNs4LkKIIN/laIa28xYQPraD+hdM/qLZ4E6w==",
+            "version": "1.0.81-4",
+            "integrity": "sha512-/Md1/LN56gORjyGwHXjZ6suY6om7NVL8+j9D/X/xb6Ar2acagyivL8Dm3tesgUMYLniLgn7dyEXPVYS/bqkpmQ==",
             "cpu": [
                 "arm64"
             ],
@@ -784,8 +784,8 @@
             }
         },
         "node_modules/@github/copilot-win32-x64": {
-            "version": "1.0.81-2",
-            "integrity": "sha512-+EcwzwOmJvQ1t2HpDEe93hyMLzvQTUkINnfy/v7EIJu9i2i49m144DyHIafGPcwiEW+AzYpY+6aRqSnNwrGx7Q==",
+            "version": "1.0.81-4",
+            "integrity": "sha512-CrHbH0fRl2tlreKbDbm6+NmK/3HwMZR7BE86WTmYHJMXt3PcEWRtklU/fQuH0qjURtW4wX6PWrdmjcyVOkRJcA==",
             "cpu": [
                 "x64"
             ],
diff --git a/nodejs/package.json b/nodejs/package.json
index 58e39bc618..304b6857b7 100644
--- a/nodejs/package.json
+++ b/nodejs/package.json
@@ -56,7 +56,7 @@
     "author": "GitHub",
     "license": "MIT",
     "dependencies": {
-        "@github/copilot": "^1.0.81-2",
+        "@github/copilot": "^1.0.81-4",
         "koffi": "^3.1.0",
         "vscode-jsonrpc": "^8.2.1",
         "zod": "^4.3.6"
diff --git a/nodejs/samples/package-lock.json b/nodejs/samples/package-lock.json
index c82bd2fbdd..2f64e44aae 100644
--- a/nodejs/samples/package-lock.json
+++ b/nodejs/samples/package-lock.json
@@ -18,7 +18,7 @@
             "version": "0.0.0-dev",
             "license": "MIT",
             "dependencies": {
-                "@github/copilot": "^1.0.81-2",
+                "@github/copilot": "^1.0.81-4",
                 "koffi": "^3.1.0",
                 "vscode-jsonrpc": "^8.2.1",
                 "zod": "^4.3.6"
diff --git a/nodejs/src/generated/rpc.ts b/nodejs/src/generated/rpc.ts
index 2d2c6fd4aa..3e91ca8e06 100644
--- a/nodejs/src/generated/rpc.ts
+++ b/nodejs/src/generated/rpc.ts
@@ -5,7 +5,7 @@
 
 import type { MessageConnection } from "vscode-jsonrpc/node.js";
 
-import type { AbortReason, Attachment, ContextTier, EmbeddedBlobResourceContents, EmbeddedTextResourceContents, McpOauthHttpResponse, McpOauthWWWAuthenticateParams, McpServerSource, McpServerStatus, ModelChangeSource, PermissionPromptRequest, PermissionRule, ReasoningSummary, SessionEvent, SessionLimitsConfig, SessionMode, ShutdownType, SkillSource, TaskCompleteData, TaskCompletionOutcome, UserToolSessionApproval, Verbosity } from "./session-events.js";
+import type { AbortReason, Attachment, ContextTier, EmbeddedBlobResourceContents, EmbeddedTextResourceContents, McpOauthHttpResponse, McpOauthWWWAuthenticateParams, McpServerSource, McpServerStatus, ModelChangeSource, PermissionMode, PermissionPromptRequest, PermissionRule, ReasoningSummary, SessionEvent, SessionLimitsConfig, SessionMode, ShutdownType, SkillSource, TaskCompleteData, TaskCompletionOutcome, UserToolSessionApproval, Verbosity } from "./session-events.js";
 
 /** A value that can be represented losslessly on the SDK JSON wire. */
 export type JsonValue = null | boolean | number | string | JsonValue[] | { [key: string]: JsonValue };
@@ -243,20 +243,6 @@ export type AgentRegistrySpawnValidationErrorField =
   | "model"
   /** The permissionMode parameter */
   | "permissionMode";
-/**
- * Current or requested allow-all mode.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "PermissionsAllowAllMode".
- */
-/** @experimental */
-export type PermissionsAllowAllMode =
-  /** Permission requests follow the normal approval flow. */
-  | "off"
-  /** Tool, path, and URL permission requests are automatically approved. */
-  | "on"
-  /** Permission requests follow the normal approval flow with an LLM advisory recommendation attached; clients may choose to auto-approve requests the judge evaluated as acceptable. */
-  | "auto";
 /**
  * Authentication type
  *
@@ -327,6 +313,347 @@ export type CanvasJsonSchema = JsonValue;
  */
 /** @experimental */
 export type CanvasActionInvokeResult = JsonValue;
+/**
+ * Canonical digest algorithm for a validated MCP card
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CardDigestAlgorithm".
+ */
+/** @experimental */
+export type CardDigestAlgorithm = /** SHA-256 over RFC 8785 canonical JSON encoded as UTF-8. */ "sha256-rfc8785";
+/**
+ * SHA-256 digest encoded as exactly 64 lowercase hexadecimal characters.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CardDigestValue".
+ */
+/** @experimental */
+export type CardDigestValue = string;
+/**
+ * Where a candidate's card came from. Exactly one of a URL or embedded data: the union has no variant carrying both, and no variant carrying neither, so the rule holds structurally rather than by validation.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogCandidateSource".
+ */
+/** @experimental */
+export type CatalogCandidateSource = CatalogCandidateSourceUrl | CatalogCandidateSourceEmbedded;
+/**
+ * Why the catalog authority did not accept the caller's identity
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogAuthenticationRequiredReason".
+ */
+/** @experimental */
+export type CatalogAuthenticationRequiredReason =
+  /** No credential was presented, so there is nothing to refresh and the caller must sign in. */
+  | "no-credential"
+  /** A credential was presented and its lifetime has elapsed. A silent refresh is worth attempting before prompting anyone. */
+  | "credential-expired"
+  /** A credential was presented and the authority refused it, for example because it was revoked, malformed, or issued for another audience. Refreshing the same rejected credential is not useful; the caller must sign in again. */
+  | "credential-rejected";
+/**
+ * One inert catalog result, represented as an MCP server or discovery-only AI skill variant so kind, media type, provenance, and installability cannot contradict each other.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogCandidate".
+ */
+/** @experimental */
+export type CatalogCandidate = CatalogMcpServerCandidate | CatalogAiSkillCandidate;
+/**
+ * JSON MCP card media type accepted for install planning
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpServerCardMediaType".
+ */
+/** @experimental */
+export type McpServerCardMediaType =
+  /** The current MCP server card media type. */
+  | "application/mcp-server-card+json"
+  /** The legacy MCP server card media type, accepted for compatibility. */
+  | "application/mcp-server+json";
+/**
+ * Whether an MCP server candidate can be planned for installation
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogMcpServerInstallability".
+ */
+/** @experimental */
+export type CatalogMcpServerInstallability =
+  /** An install plan can be computed for this MCP server candidate. */
+  | "installable"
+  /** Policy forbids installing this MCP server candidate. */
+  | "not-installable-policy";
+/**
+ * What kind of resource a catalog candidate describes
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogCandidateKind".
+ */
+/** @experimental */
+export type CatalogCandidateKind =
+  /** An MCP server, which can be planned for installation. */
+  | "mcp-server"
+  /** An AI skill, which is discoverable but not installable through this surface. */
+  | "ai-skill";
+/**
+ * A wire feature a caller can require of the catalog surface, negotiated per request. A grant means the runtime understands the feature's contract, not that the deployment has enabled the operation; typed unavailable results report availability separately.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogCapability".
+ */
+/** @experimental */
+export type CatalogCapability =
+  /** Understands the current `application/mcp-server-card+json` media type. */
+  | "mcp-server-card"
+  /** Understands the legacy `application/mcp-server+json` media type. */
+  | "legacy-mcp-server-card"
+  /** Understands `application/ai-skill` candidates as discovery-only and typed non-installable. */
+  | "ai-skill-discovery"
+  /** Understands side-effect-free MCP install-plan requests, results, and plan handles; `planning-unavailable` separately reports that planning is not enabled. */
+  | "mcp-install-planning"
+  /** Understands plans that enumerate every eligible transport rather than a single preferred one. */
+  | "multiple-transport-choice";
+/**
+ * Bounded extensible wire-feature identifier. Known values are described by `CatalogCapability`; newer callers may send future identifiers so an older runtime can return a typed negotiation refusal instead of failing schema validation. Capability negotiation establishes contract understanding, while each operation's result separately reports runtime availability.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogCapabilityId".
+ */
+/** @experimental */
+export type CatalogCapabilityId = string;
+/**
+ * Which wire-contract rule an upstream response broke
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogContractViolationReason".
+ */
+/** @experimental */
+export type CatalogContractViolationReason =
+  /** A result carried both a URL and embedded data, when exactly one is permitted. */
+  | "both-url-and-data"
+  /** A result carried neither a URL nor embedded data, when exactly one is required. */
+  | "neither-url-nor-data"
+  /** Two results claimed the same normalised identity. */
+  | "duplicate-identity"
+  /** A result declared no media type, or one this contract does not model. */
+  | "unknown-media-type";
+/**
+ * Which kind of opaque handle was presented
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogHandleType".
+ */
+/** @experimental */
+export type CatalogHandleType =
+  /** A search candidate handle. */
+  | "candidate"
+  /** An install plan handle. */
+  | "plan";
+/**
+ * Why a presented handle was rejected
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogHandleRejectionReason".
+ */
+/** @experimental */
+export type CatalogHandleRejectionReason =
+  /** The handle is unparseable, unknown, or was issued for a different operation. */
+  | "invalid"
+  /** The handle's time to live has elapsed. */
+  | "stale"
+  /** The handle has already been used, and handles are single-use. */
+  | "replayed"
+  /** The handle was issued by a different runtime instance. */
+  | "foreign";
+/**
+ * Which request field was rejected before any work was done
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogInvalidRequestField".
+ */
+/** @experimental */
+export type CatalogInvalidRequestField =
+  /** The search query was empty or longer than permitted. */
+  | "query"
+  /** The requested result count fell outside its permitted range. */
+  | "limit"
+  /** The requested candidate kinds were empty or contained a duplicate. */
+  | "kinds"
+  /** The negotiation block was missing or malformed. */
+  | "contract"
+  /** The plan source was missing or malformed. */
+  | "source"
+  /** The supplied card was missing its media type, URL, or data. */
+  | "card"
+  /** The requested configuration scope is not one this runtime writes. */
+  | "scope";
+/**
+ * How a card failed validation
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogMalformedCardReason".
+ */
+/** @experimental */
+export type CatalogMalformedCardReason =
+  /** The document is not well-formed JSON. */
+  | "invalid-json"
+  /** The document does not satisfy its media type's schema. */
+  | "schema-violation"
+  /** The declared media type is not one this runtime understands. */
+  | "unsupported-media-type"
+  /** A field the media type requires is absent. */
+  | "missing-required-field"
+  /** The document exceeded the permitted size. */
+  | "size-limit-exceeded";
+/**
+ * Media type a catalog card is interpreted as
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogMediaType".
+ */
+/** @experimental */
+export type CatalogMediaType =
+  /** The current MCP server card media type. */
+  | "application/mcp-server-card+json"
+  /** The legacy MCP server card media type, accepted for compatibility. */
+  | "application/mcp-server+json"
+  /** An AI skill card. Representable and searchable, but typed non-installable. */
+  | "application/ai-skill";
+/**
+ * Why capability and protocol-version negotiation refused a caller
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogNegotiationRefusedReason".
+ */
+/** @experimental */
+export type CatalogNegotiationRefusedReason =
+  /** The caller's protocol version is below the lowest this runtime serves. */
+  | "unsupported-protocol-version"
+  /** The caller requires at least one capability this runtime cannot honour. */
+  | "unsupported-capability";
+/**
+ * Categorised network failure, low cardinality so it can be aggregated without carrying a URL
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogNetworkFailureReason".
+ */
+/** @experimental */
+export type CatalogNetworkFailureReason =
+  /** No network is available, so nothing was attempted. */
+  | "offline"
+  /** The authority's name could not be resolved. */
+  | "dns"
+  /** The request exceeded its time budget. */
+  | "timeout"
+  /** The TLS handshake or certificate validation failed. */
+  | "tls"
+  /** The connection was refused or reset. */
+  | "connection-refused"
+  /** The authority returned a status the runtime treats as a failure. */
+  | "http-status"
+  /** The response exceeded the permitted size. */
+  | "response-too-large"
+  /** A redirect was refused by the runtime's redirect policy. */
+  | "redirect-rejected";
+/**
+ * Why a discoverable candidate cannot be installed
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogNotInstallableReason".
+ */
+/** @experimental */
+export type CatalogNotInstallableReason =
+  /** This kind of resource is not installable through this surface. */
+  | "kind-not-installable"
+  /** AI skills are discoverable but have no typed importer in this phase. */
+  | "ai-skill-not-installable"
+  /** Policy forbids installing this candidate. */
+  | "policy-forbids";
+/**
+ * Which authority produced a policy decision
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanPolicySource".
+ */
+/** @experimental */
+export type McpPlanPolicySource =
+  /** No policy applied, so the server is permitted by default. */
+  | "none"
+  /** An enterprise allowlist evaluated the server. */
+  | "enterprise-allowlist"
+  /** The registry the card came from evaluated the server. */
+  | "registry-policy"
+  /** Local trust settings evaluated the server. */
+  | "local-trust";
+/**
+ * Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal. Never a partial success.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogSearchResult".
+ */
+/** @experimental */
+export type CatalogSearchResult =
+  | CatalogSearchSucceeded
+  | CatalogNegotiationRefusedError
+  | CatalogUnsupportedKindError
+  | CatalogInvalidRequestError
+  | CatalogAuthenticationRequiredError
+  | CatalogPolicyRejectedError
+  | CatalogNetworkFailureError
+  | CatalogUnsafeRetrievalError
+  | CatalogMalformedCardError
+  | CatalogContractViolationError
+  | CatalogUnavailableError;
+/**
+ * Which hardened-fetch control refused a retrieval
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogUnsafeRetrievalReason".
+ */
+/** @experimental */
+export type CatalogUnsafeRetrievalReason =
+  /** The URL used a scheme the runtime refuses to fetch. */
+  | "blocked-scheme"
+  /** The URL embedded credentials. */
+  | "credentials-in-url"
+  /** The URL resolved to a loopback, private, link-local, or cloud metadata address. */
+  | "blocked-address"
+  /** A redirect target resolved to a blocked address. */
+  | "redirect-to-blocked-address"
+  /** The configured proxy policy refused the request. */
+  | "proxy-rejected"
+  /** The authority is not permitted for card retrieval. */
+  | "host-not-permitted";
+/**
+ * Why a catalog operation is not available on this runtime
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogUnavailableReason".
+ */
+/** @experimental */
+export type CatalogUnavailableReason =
+  /** Bounded search is not wired up on this runtime build. */
+  | "search-unavailable"
+  /** Install planning is not wired up on this runtime build. */
+  | "planning-unavailable"
+  /** No catalog authority is configured for this runtime. */
+  | "authority-not-configured"
+  /** The surface is disabled by policy on this runtime. */
+  | "disabled-by-policy";
+/**
+ * Why no usable transport could be offered
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogUnavailableTransportReason".
+ */
+/** @experimental */
+export type CatalogUnavailableTransportReason =
+  /** The card advertises no transport this runtime can use. */
+  | "no-eligible-transport"
+  /** Every advertised transport is of a kind this runtime does not implement. */
+  | "transport-not-supported"
+  /** Eligible remotes could not be enumerated, so no explicit choice can be offered. */
+  | "remote-enumeration-unavailable";
 /**
  * Coarse command category for grouping and behavior: runtime built-in, skill-backed command, or SDK/client-owned command
  *
@@ -1334,6 +1661,162 @@ export type McpHeadersHandlePendingHeadersRefreshRequest =
        */
       kind: "none";
     };
+/**
+ * One eligible way to run the server, represented as a tagged package or remote variant so package identity and endpoint states cannot contradict the install method.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanTransportChoice".
+ */
+/** @experimental */
+export type McpPlanTransportChoice = McpPlanTransportChoicePackage | McpPlanTransportChoiceRemote;
+/**
+ * Transport exposed by a locally launched package
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanPackageTransport".
+ */
+/** @experimental */
+export type McpPlanPackageTransport =
+  /** A locally launched process spoken to over standard input and output. */
+  "stdio";
+/**
+ * Discriminator for a package-backed transport choice
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanPackageInstallMethod".
+ */
+/** @experimental */
+export type McpPlanPackageInstallMethod = /** Install and run a local package. */ "package";
+/**
+ * One non-secret value a transport choice needs, represented as a scalar or enumerated variant so enum values cannot be missing or attached to another type.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanRequiredValue".
+ */
+/** @experimental */
+export type McpPlanRequiredValue = McpPlanRequiredValueScalar | McpPlanRequiredValueEnum;
+/**
+ * Discriminator for a scalar required value
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanRequiredValueScalarKind".
+ */
+/** @experimental */
+export type McpPlanRequiredValueScalarKind = /** The value uses one scalar type. */ "scalar";
+/**
+ * Where a required value is applied when the planned server is launched
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanValueCategory".
+ */
+/** @experimental */
+export type McpPlanValueCategory =
+  /** Set as an environment variable on the launched process. */
+  | "environment-variable"
+  /** Passed to the runtime that launches the package. */
+  | "runtime-argument"
+  /** Passed to the packaged server itself. */
+  | "package-argument"
+  /** Sent as a request header to a remote endpoint. */
+  | "header"
+  /** Substituted into the remote endpoint URL. */
+  | "url-variable";
+/**
+ * Scalar type a required value must conform to
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanScalarValueType".
+ */
+/** @experimental */
+export type McpPlanScalarValueType =
+  /** Free text. */
+  | "string"
+  /** A number. */
+  | "number"
+  /** A boolean. */
+  | "boolean"
+  /** A filesystem path. */
+  | "path";
+/**
+ * Discriminator for an enumerated required value
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanRequiredValueEnumKind".
+ */
+/** @experimental */
+export type McpPlanRequiredValueEnumKind = /** The value uses a fixed non-empty enumeration. */ "enum";
+/**
+ * Discriminator for an enumerated required value
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanEnumValueType".
+ */
+/** @experimental */
+export type McpPlanEnumValueType = /** One of a fixed, non-empty set of permitted values. */ "enum";
+/**
+ * A runtime-assigned secret placeholder. The identifier is carried once, inside the placeholder, so it cannot contradict a separate secret-id field.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanSecretReference".
+ */
+/** @experimental */
+export type McpPlanSecretReference = string;
+/**
+ * Transport exposed by a remote endpoint
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanRemoteTransport".
+ */
+/** @experimental */
+export type McpPlanRemoteTransport =
+  /** An HTTP endpoint. */
+  | "http"
+  /** A streamable HTTP endpoint. */
+  | "streamable-http"
+  /** A server-sent events endpoint. */
+  | "sse";
+/**
+ * Discriminator for a remote-endpoint transport choice
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanRemoteInstallMethod".
+ */
+/** @experimental */
+export type McpPlanRemoteInstallMethod = /** Connect to a remote endpoint. */ "remote";
+/**
+ * Configuration scope an MCP install plan targets
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanScope".
+ */
+/** @experimental */
+export type McpPlanScope = /** The user's own MCP configuration. */ "user";
+/**
+ * What policy decided for a planned server
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanPolicyDecision".
+ */
+/** @experimental */
+export type McpPlanPolicyDecision =
+  /** Policy permits the server. */
+  | "allowed"
+  /** Policy forbids the server, so the plan cannot be applied. */
+  | "blocked"
+  /** Policy permits the server only after an explicit approval. */
+  | "requires-approval";
+/**
+ * Whether a planned configuration change would create or modify an entry
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanConfigurationOperation".
+ */
+/** @experimental */
+export type McpPlanConfigurationOperation =
+  /** Creates a configuration entry that does not exist yet. */
+  | "add"
+  /** Modifies a configuration entry that already exists. */
+  | "update";
 /**
  * Consumer allowed to call an MCP tool.
  *
@@ -1446,6 +1929,75 @@ export type McpOauthProbeResult =
        */
       status: "failed";
     };
+/**
+ * What an install plan is computed from: a candidate handle from a previous search, or a card supplied directly.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanInstallSource".
+ */
+/** @experimental */
+export type McpPlanInstallSource = McpPlanInstallSourceCandidate | McpPlanInstallSourceCard;
+/**
+ * Discriminator for a candidate-backed install-plan source
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanInstallSourceCandidateKind".
+ */
+/** @experimental */
+export type McpPlanInstallSourceCandidateKind = /** Plan from a candidate returned by catalog search. */ "candidate";
+/**
+ * Discriminator for a caller-supplied-card install-plan source
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanInstallSourceCardKind".
+ */
+/** @experimental */
+export type McpPlanInstallSourceCardKind = /** Plan directly from a caller-supplied card. */ "card";
+/**
+ * A card supplied directly by the caller. Exactly one of a URL or embedded data, encoded structurally so neither both nor neither can be expressed.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpServerCardReference".
+ */
+/** @experimental */
+export type McpServerCardReference = McpServerCardUrl | McpServerCardEmbedded;
+/**
+ * Discriminator for a URL-backed MCP server card
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpServerCardUrlKind".
+ */
+/** @experimental */
+export type McpServerCardUrlKind = /** Retrieve the card from its URL. */ "url";
+/**
+ * Discriminator for an embedded MCP server card
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpServerCardEmbeddedKind".
+ */
+/** @experimental */
+export type McpServerCardEmbeddedKind = /** Use the embedded card document. */ "embedded";
+/**
+ * Outcome of an mcp.planInstall call: either a normalised plan, or one typed refusal. Nothing is written in either case.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanInstallResult".
+ */
+/** @experimental */
+export type McpPlanInstallResult =
+  | McpPlanInstallPlanned
+  | CatalogNegotiationRefusedError
+  | CatalogHandleRejectedError
+  | CatalogInvalidRequestError
+  | CatalogAuthenticationRequiredError
+  | CatalogPolicyRejectedError
+  | CatalogNetworkFailureError
+  | CatalogUnsafeRetrievalError
+  | CatalogMalformedCardError
+  | CatalogContractViolationError
+  | CatalogUnavailableTransportError
+  | CatalogNotInstallableError
+  | CatalogUnavailableError;
 /**
  * MCP server configuration (stdio, remote HTTP/SSE, or in-process)
  *
@@ -1930,8 +2482,8 @@ export type PermissionDecisionOutcome =
  */
 /** @experimental */
 export type PermissionDecisionSource =
-  /** The response followed the auto-approval judge recommendation. */
-  | "judge_recommendation"
+  /** The response followed the assisted-approval judge recommendation. */
+  | "assisted_approval"
   /** A human supplied the response through an interactive prompt. */
   | "human_response"
   /** The host applied a standing policy or override rather than a judge recommendation or human decision. */
@@ -1985,6 +2537,22 @@ export type PermissionLocationType =
   | "repo"
   /** The permission location is persisted at the working directory. */
   | "dir";
+/**
+ * Optional source for permission-mode telemetry. Defaults to `rpc` when omitted for SDK callers.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PermissionModeSource".
+ */
+/** @experimental */
+export type PermissionModeSource =
+  /** The mode was set from a CLI command-line flag. */
+  | "cli_flag"
+  /** The mode was set by a slash command. */
+  | "slash_command"
+  /** The mode was set by confirming autopilot behavior. */
+  | "autopilot_confirmation"
+  /** The mode was set through an RPC caller. */
+  | "rpc";
 /**
  * Allowed values for the `PermissionsConfigureAdditionalContentExclusionPolicyScope` enumeration.
  *
@@ -2013,10 +2581,10 @@ export type PermissionsModifyRulesScope =
  * Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "PermissionsSetAllowAllSource".
+ * via the `definition` "PermissionsSetApproveAllSource".
  */
 /** @experimental */
-export type PermissionsSetAllowAllSource =
+export type PermissionsSetApproveAllSource =
   /** Allow-all was enabled from a CLI command-line flag. */
   | "cli_flag"
   /** Allow-all was enabled by a slash command. */
@@ -2026,23 +2594,7 @@ export type PermissionsSetAllowAllSource =
   /** Allow-all was enabled through an RPC caller. */
   | "rpc";
 /**
- * Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "PermissionsSetApproveAllSource".
- */
-/** @experimental */
-export type PermissionsSetApproveAllSource =
-  /** Allow-all was enabled from a CLI command-line flag. */
-  | "cli_flag"
-  /** Allow-all was enabled by a slash command. */
-  | "slash_command"
-  /** Allow-all was enabled by confirming autopilot behavior. */
-  | "autopilot_confirmation"
-  /** Allow-all was enabled through an RPC caller. */
-  | "rpc";
-/**
- * Optional flags controlling which side effects the reload performs.
+ * Optional flags controlling which side effects the reload performs.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "PluginsReloadRequest".
@@ -4254,38 +4806,6 @@ export interface AgentsGetDiscoveryPathsRequest {
    */
   excludeHostAgents?: boolean;
 }
-/**
- * Indicates whether the operation succeeded and reports the post-mutation state.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AllowAllPermissionSetResult".
- */
-/** @experimental */
-export interface AllowAllPermissionSetResult {
-  /**
-   * Whether the operation succeeded
-   */
-  success: boolean;
-  /**
-   * Authoritative full allow-all state after the mutation
-   */
-  enabled: boolean;
-  mode?: PermissionsAllowAllMode;
-}
-/**
- * Current allow-all permission mode.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AllowAllPermissionState".
- */
-/** @experimental */
-export interface AllowAllPermissionState {
-  /**
-   * Whether full allow-all permissions are currently active
-   */
-  enabled: boolean;
-  mode?: PermissionsAllowAllMode;
-}
 /**
  * Credential-free authentication identity safe to expose to hosts and user interfaces.
  *
@@ -4754,91 +5274,605 @@ export interface CanvasProviderOpenRequest {
    */
   sessionId: string;
   /**
-   * Owning provider identifier
+   * Owning provider identifier
+   */
+  extensionId: string;
+  /**
+   * Provider-local canvas identifier
+   */
+  canvasId: string;
+  /**
+   * Stable caller-supplied canvas instance identifier
+   */
+  instanceId: string;
+  /**
+   * Canvas open input
+   */
+  input?: JsonValue;
+  host?: CanvasHostContext;
+  session?: CanvasSessionContext;
+}
+/**
+ * Canvas open result returned by the provider.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CanvasProviderOpenResult".
+ */
+/** @experimental */
+export interface CanvasProviderOpenResult {
+  /**
+   * URL for web-rendered canvases
+   */
+  url?: string;
+  /**
+   * Provider-supplied title
+   */
+  title?: string;
+  /**
+   * Provider-supplied status text
+   */
+  status?: string;
+}
+/**
+ * Internal canvas provider registration parameters.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CanvasProviderRegisterRequest".
+ */
+/** @experimental */
+export interface CanvasProviderRegisterRequest {
+  /**
+   * Connection identifier for callback routing
+   */
+  connectionId: string;
+  /**
+   * Provider metadata supplied by the host
+   */
+  info: JsonValue;
+  /**
+   * Canvas contributions supplied by the provider
+   */
+  canvases: JsonValue[];
+}
+/**
+ * Internal canvas provider unregistration parameters.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CanvasProviderUnregisterRequest".
+ */
+/** @experimental */
+export interface CanvasProviderUnregisterRequest {
+  /**
+   * Connection identifier to unregister
+   */
+  connectionId: string;
+}
+/**
+ * Options scoped to the built-in CAPI (Copilot API) provider.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CapiSessionOptions".
+ */
+/** @experimental */
+export interface CapiSessionOptions {
+  /**
+   * Whether to use WebSocket transport for the CAPI Responses API. Enabled by default when the model advertises `ws:/responses` support; set to `false` to force the HTTP Responses transport in environments where WebSockets are blocked (e.g. behind a proxy). Setting this to `false` is equivalent to the `COPILOT_CLI_DISABLE_WEBSOCKET_RESPONSES` environment variable.
+   */
+  enableWebSocketResponses?: boolean;
+}
+/**
+ * Semantic digest of a strictly parsed and schema-validated JSON MCP card. Both URL-backed and embedded cards are canonicalised with RFC 8785 JSON Canonicalization Scheme, encoded as UTF-8, and hashed with SHA-256.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CardDigest".
+ */
+/** @experimental */
+export interface CardDigest {
+  algorithm: CardDigestAlgorithm;
+  value: CardDigestValue;
+}
+/**
+ * An inert AI skill catalog result. AI skills are discovery-only and cannot be represented as installable through this surface.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogAiSkillCandidate".
+ */
+/** @experimental */
+export interface CatalogAiSkillCandidate {
+  /**
+   * Opaque, runtime-instance scoped, TTL-bound, single-use handle for this candidate. Carries no readable information and is rejected when stale, replayed, or presented to a different runtime instance. Never logged.
+   */
+  handle: string;
+  /**
+   * ISO 8601 timestamp after which the handle is stale and will be rejected.
+   */
+  handleExpiresAt: string;
+  /**
+   * Discriminator: this candidate describes an AI skill
+   */
+  kind: "ai-skill";
+  /**
+   * Media type of the underlying AI skill card
+   */
+  mediaType: "application/ai-skill";
+  /**
+   * AI skills are discovery-only and cannot be installed through this surface
+   */
+  installability: "not-installable-kind";
+  /**
+   * Display name taken verbatim from the card. Inert untrusted text.
+   */
+  displayName: string;
+  /**
+   * Description taken verbatim from the card. Inert untrusted text.
+   */
+  description?: string;
+  /**
+   * Publisher taken verbatim from the card. Inert untrusted text.
+   */
+  publisher?: string;
+  source: CatalogCandidateSource;
+  provenance: CatalogAiSkillCandidateProvenance;
+}
+/**
+ * Candidate whose card is retrieved from a URL through the runtime's hardened fetch boundary.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogCandidateSourceUrl".
+ */
+/** @experimental */
+export interface CatalogCandidateSourceUrl {
+  /**
+   * Discriminator: the card is URL-backed, and carries no embedded data
+   */
+  kind: "url";
+  /**
+   * Card URL as advertised. Inert untrusted data: the runtime retrieves it only through its own hardened boundary, and it is never logged.
+   */
+  url: string;
+}
+/**
+ * Candidate whose card reference arrived inline. The document and its content-derived properties stay behind the runtime boundary.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogCandidateSourceEmbedded".
+ */
+/** @experimental */
+export interface CatalogCandidateSourceEmbedded {
+  /**
+   * Discriminator: the card is embedded, and carries no URL
+   */
+  kind: "embedded";
+}
+/**
+ * Where and when an AI skill catalog reference was observed. Discovery provenance deliberately carries no content digest because search does not establish the exact validated content a later plan will bind.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogAiSkillCandidateProvenance".
+ */
+/** @experimental */
+export interface CatalogAiSkillCandidateProvenance {
+  /**
+   * Host of the catalog authority that advertised the reference, without path, query, or credentials. Inert untrusted data.
+   */
+  authority: string;
+  /**
+   * ISO 8601 timestamp at which the runtime observed the catalog reference. This is not a retrieval or validation timestamp.
+   */
+  observedAt: string;
+  /**
+   * Media type advertised for the referenced AI skill card
+   */
+  mediaType: "application/ai-skill";
+}
+/**
+ * An optional catalog authentication exchange did not establish the caller's identity. Anonymous search remains supported; this refusal is reserved for an operation that cannot continue after the attempted exchange. It is distinct from `policy-rejected` and from a network failure, and the reason identifies the recovery action.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogAuthenticationRequiredError".
+ */
+/** @experimental */
+export interface CatalogAuthenticationRequiredError {
+  /**
+   * Discriminator: the caller is not authenticated
+   */
+  kind: "authentication-required";
+  reason: CatalogAuthenticationRequiredReason;
+  /**
+   * Human-readable explanation, safe to surface. Never contains a credential or token, nor a query, URL, handle, or secret.
+   */
+  message: string;
+}
+/**
+ * An inert MCP server catalog result. Every free-text field is untrusted external data and must never be treated as an instruction, and the handle is the only way to refer to the candidate in a later operation.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogMcpServerCandidate".
+ */
+/** @experimental */
+export interface CatalogMcpServerCandidate {
+  /**
+   * Opaque, runtime-instance scoped, TTL-bound, single-use handle for this candidate. Carries no readable information and is rejected when stale, replayed, or presented to a different runtime instance. Never logged.
+   */
+  handle: string;
+  /**
+   * ISO 8601 timestamp after which the handle is stale and will be rejected.
+   */
+  handleExpiresAt: string;
+  /**
+   * Discriminator: this candidate describes an MCP server
+   */
+  kind: "mcp-server";
+  mediaType: McpServerCardMediaType;
+  installability: CatalogMcpServerInstallability;
+  /**
+   * Display name taken verbatim from the card. Inert untrusted text.
+   */
+  displayName: string;
+  /**
+   * Description taken verbatim from the card. Inert untrusted text.
+   */
+  description?: string;
+  /**
+   * Publisher taken verbatim from the card. Inert untrusted text.
+   */
+  publisher?: string;
+  source: CatalogCandidateSource;
+  provenance: CatalogMcpServerCandidateProvenance;
+}
+/**
+ * Where and when an MCP server catalog reference was observed. Discovery provenance deliberately carries no content digest because search does not establish the exact validated content a later plan will bind.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogMcpServerCandidateProvenance".
+ */
+/** @experimental */
+export interface CatalogMcpServerCandidateProvenance {
+  /**
+   * Host of the catalog authority that advertised the reference, without path, query, or credentials. Inert untrusted data.
+   */
+  authority: string;
+  /**
+   * ISO 8601 timestamp at which the runtime observed the catalog reference. This is not a retrieval or validation timestamp.
+   */
+  observedAt: string;
+  mediaType: McpServerCardMediaType;
+}
+/**
+ * The protocol version and capability set a caller requires, supplied on every catalog request so negotiation cannot be skipped by omission.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogClientContract".
+ */
+/** @experimental */
+export interface CatalogClientContract {
+  /**
+   * SDK protocol version the caller was generated against. A caller below the runtime's minimum supported version is refused rather than served a partial result.
+   */
+  protocolVersion: number;
+  /**
+   * Wire features the caller requires the runtime to understand. Identifiers are bounded but extensible so a newer caller can negotiate with an older runtime. Requiring an unknown feature yields a typed refusal listing what is understood, never a partial grant. A grant does not promise that a deployment has enabled the operation; typed unavailable results report that separately.
+   *
+   * @maxItems 32
+   */
+  requiredCapabilities: CatalogCapabilityId[];
+}
+/**
+ * An upstream catalog response broke the wire contract. Most importantly, every result must carry exactly one of a URL or embedded data: a result carrying both, or neither, is refused here rather than being guessed at.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogContractViolationError".
+ */
+/** @experimental */
+export interface CatalogContractViolationError {
+  /**
+   * Discriminator: the upstream response broke the contract
+   */
+  kind: "contract-violation";
+  reason: CatalogContractViolationReason;
+  /**
+   * Human-readable explanation, safe to surface. Never echoes response content, nor a query, URL, handle, or secret.
+   */
+  message: string;
+}
+/**
+ * A presented handle was not accepted. Handles are runtime-instance scoped, TTL-bound, and single-use, so each way of failing is reported distinctly.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogHandleRejectedError".
+ */
+/** @experimental */
+export interface CatalogHandleRejectedError {
+  /**
+   * Discriminator: a handle was rejected
+   */
+  kind: "handle-rejected";
+  handleType: CatalogHandleType;
+  reason: CatalogHandleRejectionReason;
+  /**
+   * Human-readable explanation, safe to surface. Never contains the handle itself, nor a query, URL, or secret.
+   */
+  message: string;
+}
+/**
+ * The request was rejected before any work was done, because a bounded field fell outside its permitted range or a required field was unusable.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogInvalidRequestError".
+ */
+/** @experimental */
+export interface CatalogInvalidRequestError {
+  /**
+   * Discriminator: the request itself was invalid
+   */
+  kind: "invalid-request";
+  field: CatalogInvalidRequestField;
+  /**
+   * Human-readable explanation, safe to surface. Never echoes the offending value, nor a query, URL, handle, or secret.
+   */
+  message: string;
+}
+/**
+ * A card could not be parsed or did not satisfy its declared media type's schema.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogMalformedCardError".
+ */
+/** @experimental */
+export interface CatalogMalformedCardError {
+  /**
+   * Discriminator: the card was malformed
+   */
+  kind: "malformed-card";
+  reason: CatalogMalformedCardReason;
+  mediaType?: CatalogMediaType;
+  /**
+   * Human-readable explanation, safe to surface. Never echoes card content, nor a query, URL, handle, or secret.
+   */
+  message: string;
+}
+/**
+ * The protocol version and capability set the runtime actually honoured for a successful catalog operation.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogNegotiatedContract".
+ */
+/** @experimental */
+export interface CatalogNegotiatedContract {
+  /**
+   * Protocol version of the runtime that served the request.
+   */
+  runtimeProtocolVersion: number;
+  /**
+   * Wire features the runtime understood for this operation. Always a superset of the caller's required features, because any shortfall is a refusal instead. Operation availability remains a separate typed result.
+   */
+  grantedCapabilities: CatalogCapability[];
+}
+/**
+ * The caller's protocol version or required capabilities cannot be honoured. Returned instead of a partial or ambiguous success.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogNegotiationRefusedError".
+ */
+/** @experimental */
+export interface CatalogNegotiationRefusedError {
+  /**
+   * Discriminator: capability or protocol-version negotiation failed
+   */
+  kind: "negotiation-refused";
+  reason: CatalogNegotiationRefusedReason;
+  /**
+   * Protocol version of the runtime that refused the request.
+   */
+  runtimeProtocolVersion: number;
+  /**
+   * Lowest caller protocol version this runtime will serve.
+   */
+  minimumSupportedProtocolVersion: number;
+  /**
+   * Every wire feature this runtime understands, so the caller can retry within that contract. This list does not imply that every deployment has enabled every operation.
+   */
+  supportedCapabilities: CatalogCapability[];
+  /**
+   * The subset of the caller's bounded extensible capability identifiers this runtime cannot honour.
+   *
+   * @maxItems 32
+   */
+  unsupportedCapabilities: CatalogCapabilityId[];
+  /**
+   * Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.
+   */
+  message: string;
+}
+/**
+ * The runtime could not reach the catalog authority or retrieve a card. Covers being offline as well as transport-level failure.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogNetworkFailureError".
+ */
+/** @experimental */
+export interface CatalogNetworkFailureError {
+  /**
+   * Discriminator: the network operation failed
+   */
+  kind: "network-failure";
+  reason: CatalogNetworkFailureReason;
+  /**
+   * HTTP status code, when the failure was a rejected response.
+   */
+  statusCode?: number;
+  /**
+   * Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.
+   */
+  message: string;
+}
+/**
+ * The candidate is discoverable but cannot be installed. `application/ai-skill` resolves here, because it stays searchable while remaining typed non-installable.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogNotInstallableError".
+ */
+/** @experimental */
+export interface CatalogNotInstallableError {
+  /**
+   * Discriminator: the candidate cannot be installed
+   */
+  kind: "not-installable";
+  reason: CatalogNotInstallableReason;
+  /**
+   * Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.
+   */
+  message: string;
+}
+/**
+ * Registry or enterprise policy refused the operation.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogPolicyRejectedError".
+ */
+/** @experimental */
+export interface CatalogPolicyRejectedError {
+  /**
+   * Discriminator: policy refused the operation
+   */
+  kind: "policy-rejected";
+  source: McpPlanPolicySource;
+  /**
+   * Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.
+   */
+  message: string;
+}
+/**
+ * A bounded catalog search. Both the query length and the result count are capped by the schema so a caller cannot request an unbounded scan.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogSearchRequest".
+ */
+/** @experimental */
+export interface CatalogSearchRequest {
+  contract: CatalogClientContract;
+  /**
+   * Free-text search query. Never written to logs or telemetry.
+   */
+  query: string;
+  /**
+   * Maximum number of candidates to return. Defaults to 10 when omitted.
+   */
+  limit?: number;
+  /**
+   * Restrict results to these candidate kinds. When omitted, every kind the runtime supports is searched.
+   *
+   * @minItems 1
+   * @maxItems 2
+   */
+  kinds?: [CatalogCandidateKind] | [CatalogCandidateKind, CatalogCandidateKind];
+}
+/**
+ * A completed catalog search: inert candidate summaries, each carrying a single-use handle.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogSearchSucceeded".
+ */
+/** @experimental */
+export interface CatalogSearchSucceeded {
+  /**
+   * Discriminator: the search completed
    */
-  extensionId: string;
+  kind: "succeeded";
   /**
-   * Provider-local canvas identifier
+   * Pseudonymous identifier for this search, issued by the runtime or by the catalog authority it queried and never by the caller, so it cannot be forged or replayed to attribute an install to a search that never happened. Always present on a success, so a result set can be tied to the installs it leads to. It identifies a search rather than a person: it is derived from no user, account, device, or query data, and must never be joined with user identity to re-identify anyone.
    */
-  canvasId: string;
+  searchId: string;
   /**
-   * Stable caller-supplied canvas instance identifier
+   * Matching candidates, never more than the requested limit. All text is inert untrusted data.
+   *
+   * @maxItems 50
    */
-  instanceId: string;
+  candidates: CatalogCandidate[];
   /**
-   * Canvas open input
+   * Whether further matches existed beyond the requested limit.
    */
-  input?: JsonValue;
-  host?: CanvasHostContext;
-  session?: CanvasSessionContext;
+  truncated: boolean;
+  negotiated: CatalogNegotiatedContract;
 }
 /**
- * Canvas open result returned by the provider.
+ * The request asked for a candidate kind this runtime does not serve.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CanvasProviderOpenResult".
+ * via the `definition` "CatalogUnsupportedKindError".
  */
 /** @experimental */
-export interface CanvasProviderOpenResult {
+export interface CatalogUnsupportedKindError {
   /**
-   * URL for web-rendered canvases
+   * Discriminator: an unsupported candidate kind was requested
    */
-  url?: string;
+  kind: "unsupported-kind";
   /**
-   * Provider-supplied title
+   * The kinds from the request that are not supported.
    */
-  title?: string;
+  requestedKinds: CatalogCandidateKind[];
   /**
-   * Provider-supplied status text
+   * Every candidate kind this runtime can serve.
    */
-  status?: string;
+  supportedKinds: CatalogCandidateKind[];
+  /**
+   * Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.
+   */
+  message: string;
 }
 /**
- * Internal canvas provider registration parameters.
+ * Retrieval was refused by the runtime's hardened fetch boundary before any request left the process, or before a redirect was followed.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CanvasProviderRegisterRequest".
+ * via the `definition` "CatalogUnsafeRetrievalError".
  */
 /** @experimental */
-export interface CanvasProviderRegisterRequest {
-  /**
-   * Connection identifier for callback routing
-   */
-  connectionId: string;
+export interface CatalogUnsafeRetrievalError {
   /**
-   * Provider metadata supplied by the host
+   * Discriminator: retrieval was refused as unsafe
    */
-  info: JsonValue;
+  kind: "unsafe-retrieval";
+  reason: CatalogUnsafeRetrievalReason;
   /**
-   * Canvas contributions supplied by the provider
+   * Human-readable explanation, safe to surface. Never contains the refused URL, nor a query, handle, or secret.
    */
-  canvases: JsonValue[];
+  message: string;
 }
 /**
- * Internal canvas provider unregistration parameters.
+ * The operation is not available on this runtime. Distinct from a network failure: nothing was attempted.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CanvasProviderUnregisterRequest".
+ * via the `definition` "CatalogUnavailableError".
  */
 /** @experimental */
-export interface CanvasProviderUnregisterRequest {
+export interface CatalogUnavailableError {
   /**
-   * Connection identifier to unregister
+   * Discriminator: the operation is not available
    */
-  connectionId: string;
+  kind: "unavailable";
+  reason: CatalogUnavailableReason;
+  /**
+   * Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.
+   */
+  message: string;
 }
 /**
- * Options scoped to the built-in CAPI (Copilot API) provider.
+ * No transport this runtime can use is available for the requested server.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CapiSessionOptions".
+ * via the `definition` "CatalogUnavailableTransportError".
  */
 /** @experimental */
-export interface CapiSessionOptions {
+export interface CatalogUnavailableTransportError {
   /**
-   * Whether to use WebSocket transport for the CAPI Responses API. Enabled by default when the model advertises `ws:/responses` support; set to `false` to force the HTTP Responses transport in environments where WebSockets are blocked (e.g. behind a proxy). Setting this to `false` is equivalent to the `COPILOT_CLI_DISABLE_WEBSOCKET_RESPONSES` environment variable.
+   * Discriminator: no usable transport is available
    */
-  enableWebSocketResponses?: boolean;
+  kind: "unavailable-transport";
+  reason: CatalogUnavailableTransportReason;
+  /**
+   * Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.
+   */
+  message: string;
 }
 /**
  * Slash commands available in the session, after applying any include/exclude filters.
@@ -9123,192 +10157,486 @@ export interface McpDiscoverResult {
 /** @experimental */
 export interface McpEnableRequest {
   /**
-   * Name of the MCP server to enable
+   * Name of the MCP server to enable
+   */
+  serverName: string;
+}
+/**
+ * Identifiers and raw MCP CreateMessageRequest params used to run a sampling inference.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpExecuteSamplingParams".
+ */
+/** @experimental */
+export interface McpExecuteSamplingParams {
+  /**
+   * Caller-provided unique identifier for this sampling execution. Use this same ID with cancelSamplingExecution to cancel the in-flight call. Must be unique within the session for the lifetime of the call.
+   */
+  requestId: string;
+  /**
+   * Name of the MCP server that initiated the sampling request
+   */
+  serverName: string;
+  /**
+   * The original MCP JSON-RPC request ID (string or number). Used by the runtime to correlate the inference with the originating MCP request for telemetry; this is distinct from `requestId` (which is the schema-level cancellation handle).
+   */
+  mcpRequestId: JsonValue;
+  request: McpExecuteSamplingRequest;
+}
+/**
+ * Raw MCP CreateMessageRequest params, as received in the `sampling.requested` event. Treated as opaque at the schema layer; the runtime converts the embedded MCP messages into the OpenAI chat-completion shape internally.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpExecuteSamplingRequest".
+ */
+/** @experimental */
+export interface McpExecuteSamplingRequest {
+  [k: string]: unknown | undefined;
+}
+/**
+ * MCP CreateMessageResult payload (with optional 'tools' extension), present when action='success'. Treated as opaque at the schema layer; consumers should construct/consume it per the MCP CreateMessageResult shape.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpExecuteSamplingResult".
+ */
+/** @experimental */
+export interface McpExecuteSamplingResult {
+  [k: string]: unknown | undefined;
+}
+/**
+ * MCP server whose connection attempt failed.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpFailedServer".
+ */
+/** @experimental */
+export interface McpFailedServer {
+  /**
+   * The config key of the server that failed to connect.
+   */
+  name: string;
+  /**
+   * The captured connection failure detail.
+   */
+  error?: string;
+}
+/**
+ * MCP server filtered by policy, with name, reason, and optional redacted reason.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpFilteredServer".
+ */
+/** @experimental */
+export interface McpFilteredServer {
+  /**
+   * Filtered server name
+   */
+  name: string;
+  /**
+   * Human-readable filter reason
+   */
+  reason: string;
+  /**
+   * PII-free filter reason
+   */
+  redactedReason?: string;
+  /**
+   * @deprecated
+   * Deprecated. This field is no longer populated.
+   */
+  enterpriseName?: string;
+}
+/**
+ * MCP headers refresh request id and the host response.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpHeadersHandlePendingHeadersRefreshRequestRequest".
+ */
+/** @experimental */
+export interface McpHeadersHandlePendingHeadersRefreshRequestRequest {
+  /**
+   * Headers refresh request identifier from mcp.headers_refresh_required
+   */
+  requestId: string;
+  result: McpHeadersHandlePendingHeadersRefreshRequest;
+}
+/**
+ * Indicates whether the pending MCP headers refresh response was accepted.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpHeadersHandlePendingHeadersRefreshRequestResult".
+ */
+/** @experimental */
+export interface McpHeadersHandlePendingHeadersRefreshRequestResult {
+  /**
+   * Whether the response was accepted. False if the request was unknown, timed out, or already resolved.
+   */
+  success: boolean;
+}
+/**
+ * Host-level state, omitted when no MCP host is initialized.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpHostState".
+ */
+/** @experimental */
+export interface McpHostState {
+  /**
+   * Whether third-party MCP servers are policy-enabled for this session.
+   */
+  mcp3pEnabled: boolean;
+  /**
+   * Configured servers that are explicitly disabled.
+   */
+  disabledServers: string[];
+  /**
+   * Configured servers filtered out by MCP server policy.
+   */
+  filteredServers: string[];
+  /**
+   * Names of currently-connected MCP clients.
+   */
+  clients: string[];
+  /**
+   * Names of servers with in-flight connection attempts.
+   */
+  pendingConnections: string[];
+  /**
+   * Map of server name to recorded connection failure.
+   */
+  failedServers: {
+    [k: string]: McpServerFailureInfo | undefined;
+  };
+  /**
+   * Map of server name to recorded pending-auth state.
+   */
+  needsAuthServers: {
+    [k: string]: McpServerNeedsAuthInfo | undefined;
+  };
+}
+/**
+ * Recorded MCP server connection failure.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpServerFailureInfo".
+ */
+/** @experimental */
+export interface McpServerFailureInfo {
+  /**
+   * Failure message produced when the MCP server connection failed.
+   */
+  message: string;
+  /**
+   * epoch-ms timestamp at which the failure was recorded.
+   */
+  timestamp: number;
+}
+/**
+ * Recorded MCP server pending-auth state.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpServerNeedsAuthInfo".
+ */
+/** @experimental */
+export interface McpServerNeedsAuthInfo {
+  /**
+   * epoch-ms timestamp at which the server signalled it needs authentication.
+   */
+  timestamp: number;
+}
+/**
+ * A normalised, inert description of what installing an MCP server would involve. Carries no raw card, no install specification, and no secret value.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpInstallPlan".
+ */
+/** @experimental */
+export interface McpInstallPlan {
+  /**
+   * Opaque, runtime-instance scoped, TTL-bound, single-use handle for this plan. Rejected when stale, replayed, or presented to a different runtime instance. Never logged.
+   */
+  planHandle: string;
+  /**
+   * ISO 8601 timestamp after which the plan handle is stale and will be rejected. Abandoning a plan needs no call: an unused handle simply expires, so cancellation before commit is side-effect free.
+   */
+  planHandleExpiresAt: string;
+  identity: McpPlanResourceIdentity;
+  provenance: McpPlanProvenance;
+  /**
+   * Every eligible transport, so a host can present an explicit choice. A completed plan always has at least one; when none is eligible, planning returns `CatalogUnavailableTransportError` instead.
+   *
+   * @minItems 1
+   * @maxItems 50
+   */
+  transportChoices: [McpPlanTransportChoice, ...McpPlanTransportChoice[]];
+  /**
+   * Identifier of the choice the runtime would pick by default. Omitted when there is no eligible transport, or when the runtime expresses no preference.
+   */
+  recommendedTransportChoiceId?: string;
+  target: McpPlanTarget;
+  policy: McpPlanPolicyResult;
+  /**
+   * The configuration changes installing would make, described rather than serialised, so the mutable configuration payload stays behind the runtime boundary.
    */
-  serverName: string;
+  configurationChanges: McpPlanConfigurationChange[];
+  /**
+   * Whether applying this plan would require an MCP reload to take effect. Planning itself never reloads.
+   */
+  reloadRequired: boolean;
+  /**
+   * Whether the plan cannot be applied without further input, because a required value has no default or a secret must be supplied.
+   */
+  requiresInteractiveConfiguration: boolean;
 }
 /**
- * Identifiers and raw MCP CreateMessageRequest params used to run a sampling inference.
+ * Normalised identity of the MCP server a plan targets, independent of how the card spelled it.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "McpExecuteSamplingParams".
+ * via the `definition` "McpPlanResourceIdentity".
  */
 /** @experimental */
-export interface McpExecuteSamplingParams {
+export interface McpPlanResourceIdentity {
   /**
-   * Caller-provided unique identifier for this sampling execution. Use this same ID with cancelSamplingExecution to cancel the in-flight call. Must be unique within the session for the lifetime of the call.
+   * Canonical, normalised name of the server, for example `io.github.owner/server`.
    */
-  requestId: string;
+  canonicalName: string;
   /**
-   * Name of the MCP server that initiated the sampling request
+   * Local configuration key the server would be recorded under.
    */
   serverName: string;
   /**
-   * The original MCP JSON-RPC request ID (string or number). Used by the runtime to correlate the inference with the originating MCP request for telemetry; this is distinct from `requestId` (which is the schema-level cancellation handle).
+   * Version advertised by the card, when it declares one.
    */
-  mcpRequestId: JsonValue;
-  request: McpExecuteSamplingRequest;
-}
-/**
- * Raw MCP CreateMessageRequest params, as received in the `sampling.requested` event. Treated as opaque at the schema layer; the runtime converts the embedded MCP messages into the OpenAI chat-completion shape internally.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "McpExecuteSamplingRequest".
- */
-/** @experimental */
-export interface McpExecuteSamplingRequest {
-  [k: string]: unknown | undefined;
+  version?: string;
+  /**
+   * Registry identifier of the server, when it came from a registry.
+   */
+  registryId?: string;
 }
 /**
- * MCP CreateMessageResult payload (with optional 'tools' extension), present when action='success'. Treated as opaque at the schema layer; consumers should construct/consume it per the MCP CreateMessageResult shape.
+ * Provenance of the exact validated JSON MCP card content bound privately to a completed plan and its opaque handle.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "McpExecuteSamplingResult".
+ * via the `definition` "McpPlanProvenance".
  */
 /** @experimental */
-export interface McpExecuteSamplingResult {
-  [k: string]: unknown | undefined;
+export interface McpPlanProvenance {
+  /**
+   * Authority associated with the validated card, without path, query, or credentials. Inert untrusted data.
+   */
+  authority: string;
+  /**
+   * ISO 8601 timestamp at which the runtime completed strict parsing and schema validation of the card content.
+   */
+  validatedAt: string;
+  cardDigest: CardDigest;
+  mediaType: McpServerCardMediaType;
 }
 /**
- * MCP server whose connection attempt failed.
+ * An eligible local-package transport choice. Package identity is required and a remote endpoint cannot be represented.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "McpFailedServer".
+ * via the `definition` "McpPlanTransportChoicePackage".
  */
 /** @experimental */
-export interface McpFailedServer {
+export interface McpPlanTransportChoicePackage {
   /**
-   * The config key of the server that failed to connect.
+   * Stable identifier for this choice within the plan, used to select it when the plan is applied.
    */
-  name: string;
+  choiceId: string;
+  transport: McpPlanPackageTransport;
+  installMethod: McpPlanPackageInstallMethod;
   /**
-   * The captured connection failure detail.
+   * Packaging ecosystem, for example `oci` or `npm`.
    */
-  error?: string;
+  packageType: string;
+  /**
+   * Package identifier. Inert untrusted data.
+   */
+  packageIdentifier: string;
+  /**
+   * Typed values this choice requires, excluding secrets.
+   */
+  requiredValues: McpPlanRequiredValue[];
+  /**
+   * Secrets this choice requires, referenced by placeholder only.
+   */
+  secretPlaceholders: McpPlanSecretPlaceholder[];
 }
 /**
- * MCP server filtered by policy, with name, reason, and optional redacted reason.
+ * One non-secret scalar value a transport choice needs before it can be applied.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "McpFilteredServer".
+ * via the `definition` "McpPlanRequiredValueScalar".
  */
 /** @experimental */
-export interface McpFilteredServer {
+export interface McpPlanRequiredValueScalar {
+  kind: McpPlanRequiredValueScalarKind;
   /**
-   * Filtered server name
+   * Key the value is supplied under. Inert untrusted data.
    */
-  name: string;
+  key: string;
+  category: McpPlanValueCategory;
+  valueType: McpPlanScalarValueType;
   /**
-   * Human-readable filter reason
+   * Whether the value must be present for the plan to be applicable.
    */
-  reason: string;
+  required: boolean;
   /**
-   * PII-free filter reason
+   * Default supplied by the card, when the value can be resolved without input. Presence is the authoritative indication that a default exists. Inert untrusted data.
    */
-  redactedReason?: string;
+  defaultValue?: string;
   /**
-   * @deprecated
-   * Deprecated. This field is no longer populated.
+   * Human-readable label from the card. Inert untrusted text.
    */
-  enterpriseName?: string;
+  title?: string;
+  /**
+   * Human-readable explanation from the card. Inert untrusted text.
+   */
+  description?: string;
+  /**
+   * Whether the value may be supplied more than once.
+   */
+  isRepeated: boolean;
 }
 /**
- * MCP headers refresh request id and the host response.
+ * One enumerated non-secret value a transport choice needs before it can be applied. The permitted values are structurally required.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "McpHeadersHandlePendingHeadersRefreshRequestRequest".
+ * via the `definition` "McpPlanRequiredValueEnum".
  */
 /** @experimental */
-export interface McpHeadersHandlePendingHeadersRefreshRequestRequest {
+export interface McpPlanRequiredValueEnum {
+  kind: McpPlanRequiredValueEnumKind;
   /**
-   * Headers refresh request identifier from mcp.headers_refresh_required
+   * Key the value is supplied under. Inert untrusted data.
    */
-  requestId: string;
-  result: McpHeadersHandlePendingHeadersRefreshRequest;
+  key: string;
+  category: McpPlanValueCategory;
+  valueType: McpPlanEnumValueType;
+  /**
+   * Whether the value must be present for the plan to be applicable.
+   */
+  required: boolean;
+  /**
+   * Default supplied by the card, when the value can be resolved without input. Presence is the authoritative indication that a default exists. Inert untrusted data.
+   */
+  defaultValue?: string;
+  /**
+   * Human-readable label from the card. Inert untrusted text.
+   */
+  title?: string;
+  /**
+   * Human-readable explanation from the card. Inert untrusted text.
+   */
+  description?: string;
+  /**
+   * Non-empty permitted value set. Inert untrusted data.
+   *
+   * @minItems 1
+   */
+  enumValues: [string, ...string[]];
+  /**
+   * Whether the value may be supplied more than once.
+   */
+  isRepeated: boolean;
 }
 /**
- * Indicates whether the pending MCP headers refresh response was accepted.
+ * A secret a transport choice needs, referenced by placeholder. No secret value ever appears in a plan, and the placeholder resolves against the keychain only when a plan is applied.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "McpHeadersHandlePendingHeadersRefreshRequestResult".
+ * via the `definition` "McpPlanSecretPlaceholder".
  */
 /** @experimental */
-export interface McpHeadersHandlePendingHeadersRefreshRequestResult {
+export interface McpPlanSecretPlaceholder {
   /**
-   * Whether the response was accepted. False if the request was unknown, timed out, or already resolved.
+   * Key the secret is supplied under. Inert untrusted data.
    */
-  success: boolean;
+  key: string;
+  placeholder: McpPlanSecretReference;
+  /**
+   * Human-readable label from the card. Inert untrusted text.
+   */
+  title?: string;
 }
 /**
- * Host-level state, omitted when no MCP host is initialized.
+ * An eligible remote-endpoint transport choice. The endpoint is required and package identity cannot be represented.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "McpHostState".
+ * via the `definition` "McpPlanTransportChoiceRemote".
  */
 /** @experimental */
-export interface McpHostState {
-  /**
-   * Whether third-party MCP servers are policy-enabled for this session.
-   */
-  mcp3pEnabled: boolean;
-  /**
-   * Configured servers that are explicitly disabled.
-   */
-  disabledServers: string[];
-  /**
-   * Configured servers filtered out by MCP server policy.
-   */
-  filteredServers: string[];
+export interface McpPlanTransportChoiceRemote {
   /**
-   * Names of currently-connected MCP clients.
+   * Stable identifier for this choice within the plan, used to select it when the plan is applied.
    */
-  clients: string[];
+  choiceId: string;
+  transport: McpPlanRemoteTransport;
+  installMethod: McpPlanRemoteInstallMethod;
   /**
-   * Names of servers with in-flight connection attempts.
+   * Endpoint URL. Inert untrusted data.
    */
-  pendingConnections: string[];
+  endpoint: string;
   /**
-   * Map of server name to recorded connection failure.
+   * Typed values this choice requires, excluding secrets.
    */
-  failedServers: {
-    [k: string]: McpServerFailureInfo | undefined;
-  };
+  requiredValues: McpPlanRequiredValue[];
   /**
-   * Map of server name to recorded pending-auth state.
+   * Secrets this choice requires, referenced by placeholder only.
    */
-  needsAuthServers: {
-    [k: string]: McpServerNeedsAuthInfo | undefined;
-  };
+  secretPlaceholders: McpPlanSecretPlaceholder[];
 }
 /**
- * Recorded MCP server connection failure.
+ * Where a plan would be written.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "McpServerFailureInfo".
+ * via the `definition` "McpPlanTarget".
  */
 /** @experimental */
-export interface McpServerFailureInfo {
+export interface McpPlanTarget {
+  scope: McpPlanScope;
   /**
-   * Failure message produced when the MCP server connection failed.
+   * Configuration key the server would be recorded under within that scope.
    */
-  message: string;
+  configKey: string;
+}
+/**
+ * Outcome of evaluating the planned server against registry and enterprise policy. Evaluation is read-only.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanPolicyResult".
+ */
+/** @experimental */
+export interface McpPlanPolicyResult {
+  decision: McpPlanPolicyDecision;
+  source: McpPlanPolicySource;
   /**
-   * epoch-ms timestamp at which the failure was recorded.
+   * Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.
    */
-  timestamp: number;
+  reason?: string;
 }
 /**
- * Recorded MCP server pending-auth state.
+ * One change applying the plan would make, described rather than serialised so the configuration payload stays behind the runtime boundary.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "McpServerNeedsAuthInfo".
+ * via the `definition` "McpPlanConfigurationChange".
  */
 /** @experimental */
-export interface McpServerNeedsAuthInfo {
+export interface McpPlanConfigurationChange {
+  operation: McpPlanConfigurationOperation;
+  scope: McpPlanScope;
   /**
-   * epoch-ms timestamp at which the server signalled it needs authentication.
+   * Configuration key the change applies to.
    */
-  timestamp: number;
+  configKey: string;
+  /**
+   * Names of the configuration fields the change would set, without their values.
+   */
+  changedFields: string[];
+  /**
+   * Secret placeholders the written configuration would reference. The constrained placeholder type cannot carry a literal secret value.
+   */
+  secretReferences: McpPlanSecretReference[];
 }
 /**
  * Server name to check running status for.
@@ -9531,6 +10859,92 @@ export interface McpOauthRespondResult {
    */
   success: boolean;
 }
+/**
+ * A computed MCP install plan. Nothing has been applied: the plan describes what installing would change, and the plan handle is what a later apply operation would consume.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanInstallPlanned".
+ */
+/** @experimental */
+export interface McpPlanInstallPlanned {
+  /**
+   * Discriminator: a plan was computed and nothing was changed
+   */
+  kind: "planned";
+  plan: McpInstallPlan;
+  negotiated: CatalogNegotiatedContract;
+}
+/**
+ * A side-effect-free request for an MCP install plan. Computing a plan never writes configuration, stores a secret, or reloads MCP servers.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanInstallRequest".
+ */
+/** @experimental */
+export interface McpPlanInstallRequest {
+  contract: CatalogClientContract;
+  source: McpPlanInstallSource;
+  scope?: McpPlanScope;
+}
+/**
+ * Plan from a candidate returned by a previous catalog search.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanInstallSourceCandidate".
+ */
+/** @experimental */
+export interface McpPlanInstallSourceCandidate {
+  kind: McpPlanInstallSourceCandidateKind;
+  /**
+   * Single-use candidate handle. Consumed by this call, so a replay of the same handle is rejected.
+   */
+  candidateHandle: string;
+  /**
+   * The runtime- or authority-minted `searchId` returned with the search that produced this candidate. A search implementation binds it to private candidate-handle context; a planning implementation must verify that context before returning a plan. The unavailable planning implementation in this contract layer validates presence but does not claim the verification has occurred. It identifies a search rather than a person and must never be joined with user identity to re-identify anyone.
+   */
+  searchId: string;
+}
+/**
+ * Plan from a card supplied directly by the caller, without a preceding search.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpPlanInstallSourceCard".
+ */
+/** @experimental */
+export interface McpPlanInstallSourceCard {
+  kind: McpPlanInstallSourceCardKind;
+  card: McpServerCardReference;
+}
+/**
+ * An MCP server card to be retrieved from a URL through the runtime's hardened fetch boundary.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpServerCardUrl".
+ */
+/** @experimental */
+export interface McpServerCardUrl {
+  kind: McpServerCardUrlKind;
+  mediaType: McpServerCardMediaType;
+  /**
+   * Card URL. Retrieved only through the runtime's hardened boundary, with scheme, credential, address-range, redirect, timeout, and response-size controls applied. Never logged.
+   */
+  url: string;
+}
+/**
+ * An MCP server card supplied inline as an inert document.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpServerCardEmbedded".
+ */
+/** @experimental */
+export interface McpServerCardEmbedded {
+  kind: McpServerCardEmbeddedKind;
+  mediaType: McpServerCardMediaType;
+  /**
+   * The card document verbatim, treated as inert untrusted bytes. The runtime parses and validates it; the host is not expected to interpret it. Never logged.
+   */
+  data: string;
+}
 /**
  * Registration parameters for an external MCP client.
  *
@@ -11035,6 +12449,19 @@ export interface ModeSetResult {
    */
   armInteractiveContinuation?: boolean;
 }
+/**
+ * Result of moving in-flight MCP loading to the background.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "MoveMcpLoadingToBackgroundResult".
+ */
+/** @experimental */
+export interface MoveMcpLoadingToBackgroundResult {
+  /**
+   * Whether an in-flight MCP load was moved to the background, releasing turns that were waiting on it. False when no MCP load was in flight or the waiting turns had already been released.
+   */
+  movedToBackground: boolean;
+}
 /**
  * External SDK input for a named custom model provider. Ingested by the native protocol boundary before host dispatch.
  *
@@ -12435,10 +13862,20 @@ export interface PermissionsFolderTrustAddTrustedResult {
  * No parameters.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "PermissionsGetAllowAllRequest".
+ * via the `definition` "PermissionsGetModeRequest".
  */
 /** @experimental */
-export interface PermissionsGetAllowAllRequest {}
+export interface PermissionsGetModeRequest {}
+/**
+ * Current permission mode.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PermissionsGetModeResult".
+ */
+/** @experimental */
+export interface PermissionsGetModeResult {
+  mode: PermissionMode;
+}
 /**
  * Indicates whether the operation succeeded.
  *
@@ -12569,50 +14006,60 @@ export interface PermissionsResetSessionApprovalsResult {
   success: boolean;
 }
 /**
- * Allow-all mode to apply for the session.
+ * Allow-all toggle for tool permission requests, with an optional telemetry source.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "PermissionsSetAllowAllRequest".
+ * via the `definition` "PermissionsSetApproveAllRequest".
  */
 /** @experimental */
-export interface PermissionsSetAllowAllRequest {
-  mode?: PermissionsAllowAllMode;
+export interface PermissionsSetApproveAllRequest {
   /**
-   * Legacy full allow-all toggle. Prefer `mode`; when `mode` is omitted, `enabled: true` is treated as `mode: "on"` and any other value is treated as `mode: "off"`.
+   * Whether to auto-approve all tool permission requests
    */
-  enabled?: boolean;
+  enabled: boolean;
+  source?: PermissionsSetApproveAllSource;
+}
+/**
+ * Indicates whether the operation succeeded.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PermissionsSetApproveAllResult".
+ */
+/** @experimental */
+export interface PermissionsSetApproveAllResult {
   /**
-   * Optional model id for the `auto` mode auto-approval LLM judging. Only meaningful when `mode` is `auto`; ignored otherwise. When omitted, the session resolves a default judge model: `gpt-5.5` for CAPI sessions and the session's active model for BYOK sessions.
+   * Whether the operation succeeded
    */
-  model?: string;
-  source?: PermissionsSetAllowAllSource;
+  success: boolean;
 }
 /**
- * Allow-all toggle for tool permission requests, with an optional telemetry source.
+ * Permission mode to apply for the session.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "PermissionsSetApproveAllRequest".
+ * via the `definition` "PermissionsSetModeRequest".
  */
 /** @experimental */
-export interface PermissionsSetApproveAllRequest {
+export interface PermissionsSetModeRequest {
+  mode: PermissionMode;
   /**
-   * Whether to auto-approve all tool permission requests
+   * Optional judge model id for assisted mode. When omitted, the session resolves the provider default: `gpt-5.5` for CAPI sessions and the active session model for BYOK sessions.
    */
-  enabled: boolean;
-  source?: PermissionsSetApproveAllSource;
+  assistedApprovalModel?: string;
+  source?: PermissionModeSource;
 }
 /**
- * Indicates whether the operation succeeded.
+ * Indicates whether the requested permission mode was applied and reports the authoritative post-mutation mode.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "PermissionsSetApproveAllResult".
+ * via the `definition` "PermissionsSetModeResult".
  */
 /** @experimental */
-export interface PermissionsSetApproveAllResult {
+export interface PermissionsSetModeResult {
   /**
    * Whether the operation succeeded
    */
   success: boolean;
+  mode: PermissionMode;
 }
 /**
  * Toggles whether permission prompts should be bridged into session events for this client.
@@ -12758,6 +14205,10 @@ export interface PlanSqlTodosRow {
    * Todo status.
    */
   status?: string;
+  /**
+   * Todo creation time, as stored by the session SQL schema's `datetime('now')` default: `YYYY-MM-DD HH:MM:SS` in UTC. Lets clients attribute todos to the work item that created them (e.g. scoping a goal's progress to the todos it produced) rather than to the whole session.
+   */
+  createdAt?: string;
 }
 /**
  * Todo rows + dependency edges read from the session SQL database.
@@ -21130,6 +22581,15 @@ export function createServerRpc(connection: MessageConnection) {
              */
             discover: async (params: McpDiscoverRequest): Promise<McpDiscoverResult> =>
                 connection.sendRequest("mcp.discover", params),
+            /**
+             * Requests a side-effect-free MCP install plan from a catalog candidate handle or a caller-supplied card. This host-implemented server method is available through SDK/TUI hosts; standalone and C-ABI runtimes whose host does not implement server-method dispatch return JSON-RPC MethodNotFound. A runtime with planning available returns a normalised plan and opaque single-use plan handle; a runtime without it returns the typed planning-unavailable result. A completed plan reports resource identity, provenance, eligible transport choices, the user-scope target, required typed values and secret placeholders, the policy result, the configuration changes installing would make, and whether a reload would be needed. Planning never writes configuration, stores a secret, or reloads MCP servers, so abandoning a plan needs no call and leaves nothing behind.
+             *
+             * @param params A side-effect-free request for an MCP install plan. Computing a plan never writes configuration, stores a secret, or reloads MCP servers.
+             *
+             * @returns Outcome of an mcp.planInstall call: either a normalised plan, or one typed refusal. Nothing is written in either case.
+             */
+            planInstall: async (params: McpPlanInstallRequest): Promise<McpPlanInstallResult> =>
+                connection.sendRequest("mcp.planInstall", params),
         },
         /** @experimental */
         extensions: {
@@ -21163,6 +22623,18 @@ export function createServerRpc(connection: MessageConnection) {
         registerExtensionLaunchProvider: async (): Promise<void> =>
             connection.sendRequest("registerExtensionLaunchProvider", {}),
         /** @experimental */
+        catalog: {
+            /**
+             * Requests a bounded catalog search. This host-implemented server method is available through SDK/TUI hosts; standalone and C-ABI runtimes whose host does not implement server-method dispatch return JSON-RPC MethodNotFound. A runtime with search available returns inert candidate summaries, each with an opaque single-use handle scoped to this runtime instance; a runtime without it returns the typed search-unavailable result. Public authorities may be searched anonymously, while an authority that requires credentials yields the typed authentication-required result. All returned text, URLs, and package metadata are untrusted external data and can never trigger instructions, tools, or installation. Read-only: nothing is installed, configured, or persisted.
+             *
+             * @param params A bounded catalog search. Both the query length and the result count are capped by the schema so a caller cannot request an unbounded scan.
+             *
+             * @returns Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal. Never a partial success.
+             */
+            search: async (params: CatalogSearchRequest): Promise<CatalogSearchResult> =>
+                connection.sendRequest("catalog.search", params),
+        },
+        /** @experimental */
         plugins: {
             /**
              * Lists plugins installed in user/global state.
@@ -22526,6 +23998,13 @@ export function createSessionRpc(connection: MessageConnection, sessionId: strin
              */
             reload: async (): Promise<void> =>
                 connection.sendRequest("session.mcp.reload", { sessionId }),
+            /**
+             * Releases any turns waiting on an in-flight MCP load without cancelling the load, letting the agent proceed while MCP servers finish connecting in the background. No-op when no MCP load is in flight or waiting turns were already released.
+             *
+             * @returns Result of moving in-flight MCP loading to the background.
+             */
+            moveLoadingToBackground: async (): Promise<MoveMcpLoadingToBackgroundResult> =>
+                connection.sendRequest("session.mcp.moveLoadingToBackground", { sessionId }),
             /**
              * Runs an MCP sampling inference on behalf of an MCP server.
              *
@@ -23101,21 +24580,21 @@ export function createSessionRpc(connection: MessageConnection, sessionId: strin
             setApproveAll: async (params: PermissionsSetApproveAllRequest): Promise<PermissionsSetApproveAllResult> =>
                 connection.sendRequest("session.permissions.setApproveAll", { sessionId, ...params }),
             /**
-             * Sets the allow-all permission mode for the session. Used by attach-mode clients (e.g. LocalRpcSession's `/allow-all` forwarder) to flip the target session's permission state. The `on` mode swaps in unrestricted path and URL managers and emits `session.permissions_changed` on transition; the `auto` mode keeps normal prompt paths active while attaching LLM safety recommendations. The result returns the authoritative post-mutation state so callers can update their local mirrors without racing the `session.permissions_changed` notification on the same wire.
+             * Sets the permission mode for the session. `manual` follows the normal approval flow, `assisted` attaches LLM safety recommendations, and `allow-all` automatically approves permission requests. The result returns the authoritative post-mutation mode so callers can update local state without racing the `session.permissions_changed` notification.
              *
-             * @param params Allow-all mode to apply for the session.
+             * @param params Permission mode to apply for the session.
              *
-             * @returns Indicates whether the operation succeeded and reports the post-mutation state.
+             * @returns Indicates whether the requested permission mode was applied and reports the authoritative post-mutation mode.
              */
-            setAllowAll: async (params: PermissionsSetAllowAllRequest): Promise<AllowAllPermissionSetResult> =>
-                connection.sendRequest("session.permissions.setAllowAll", { sessionId, ...params }),
+            setMode: async (params: PermissionsSetModeRequest): Promise<PermissionsSetModeResult> =>
+                connection.sendRequest("session.permissions.setMode", { sessionId, ...params }),
             /**
-             * Returns the current allow-all permission mode for the session.
+             * Returns the current permission mode for the session.
              *
-             * @returns Current allow-all permission mode.
+             * @returns Current permission mode.
              */
-            getAllowAll: async (): Promise<AllowAllPermissionState> =>
-                connection.sendRequest("session.permissions.getAllowAll", { sessionId }),
+            getMode: async (): Promise<PermissionsGetModeResult> =>
+                connection.sendRequest("session.permissions.getMode", { sessionId }),
             /**
              * Adds or removes session-scoped or location-scoped permission rules.
              *
diff --git a/nodejs/src/generated/session-events.ts b/nodejs/src/generated/session-events.ts
index 4f9654e068..fdb82ab14e 100644
--- a/nodejs/src/generated/session-events.ts
+++ b/nodejs/src/generated/session-events.ts
@@ -229,16 +229,16 @@ export type SessionMode =
   /** The agent is working autonomously toward task completion. */
   | "autopilot";
 /**
- * Allow-all mode for the session.
+ * Permission mode for the session.
  */
 /** @experimental */
-export type PermissionAllowAllMode =
+export type PermissionMode =
   /** Permission requests follow the normal approval flow. */
-  | "off"
+  | "manual"
+  /** Permission requests include an LLM safety recommendation; clients may automatically approve requests judged acceptable. */
+  | "assisted"
   /** Tool, path, and URL permission requests are automatically approved. */
-  | "on"
-  /** Permission requests follow the normal approval flow with an LLM advisory recommendation attached; clients may choose to auto-approve requests the judge evaluated as acceptable. */
-  | "auto";
+  | "allow-all";
 /**
  * The type of operation performed on the plan file
  */
@@ -604,10 +604,10 @@ export type PermissionRequestMemoryAction =
   /** Vote on an existing memory. */
   | "vote";
 /**
- * Why the auto-approval judge produced no usable recommendation. Present only alongside an `error` recommendation, where the human-readable reason is a fixed string and therefore cannot distinguish these cases. Intended to make a judge failure reportable by a consumer that has no access to the host's logs.
+ * Why the assisted-approval judge produced no usable recommendation. Present only alongside an `error` recommendation, where the human-readable reason is a fixed string and therefore cannot distinguish these cases. Intended to make a judge failure reportable by a consumer that has no access to the host's logs.
  */
 /** @experimental */
-export type AutoApprovalJudgeFailureReason =
+export type AssistedApprovalJudgeFailureReason =
   /** The judge model call exceeded its deadline. */
   | "timeout"
   /** The judge model call was cancelled before it returned. */
@@ -619,15 +619,15 @@ export type AutoApprovalJudgeFailureReason =
   /** The judge model replied, but the reply carried no ALLOW/DENY verdict. */
   | "parse_error";
 /**
- * Outcome of the auto-approval safety judge for a permission request. Present only when auto mode is enabled; its absence means the judge did not evaluate the request (auto mode was off).
+ * Outcome of the assisted-approval safety judge for a permission request. Present only in assisted mode; its absence means the judge did not evaluate the request.
  */
 /** @experimental */
-export type AutoApprovalRecommendation =
+export type AssistedApprovalRecommendation =
   /** The judge evaluated the request and recommends automatically approving it. */
   | "approve"
-  /** The judge evaluated the request and does not recommend auto-approving it; explicit approval is required. Whether that means prompting, denying, or something else is the consumer's decision. */
+  /** The judge evaluated the request and does not recommend automatically approving it; explicit approval is required. Whether that means prompting, denying, or something else is the consumer's decision. */
   | "requireApproval"
-  /** Auto mode is enabled, but this request category is never auto-approvable (for example, sandbox-bypass requests), so the judge was not consulted. */
+  /** Assisted mode is enabled, but this request category is never automatically approvable (for example, sandbox-bypass requests), so the judge was not consulted. */
   | "excluded"
   /** The judge was consulted but did not return a usable recommendation, so the request requires explicit approval. */
   | "error";
@@ -846,12 +846,12 @@ export type ManagedSettingsEnforcedAction =
  * For a `bypass_permissions_blocked` action, which permission-escalation primitive was refused
  */
 export type ManagedSettingsEnforcedEscalation =
-  /** Full allow-all ("/allow-all on") permissions — auto-approving tools, paths, and URLs. */
+  /** Full allow-all permissions — automatically approving tools, paths, and URLs. */
   | "allow_all"
-  /** Auto-approval of all tool permission requests. */
+  /** Automatic approval of all tool permission requests. */
   | "approve_all"
-  /** Advisory auto-approval ("/allow-all auto") mode — keeps normal prompt paths and adds LLM-advised approval, distinct from full allow-all. */
-  | "auto_approval"
+  /** Assisted mode — keeps normal prompt paths and adds an LLM recommendation, distinct from allow-all. */
+  | "assisted_approval"
   /** Unrestricted filesystem access outside the session's allowed directories. */
   | "unrestricted_paths"
   /** Unrestricted URL fetch access. */
@@ -1821,8 +1821,9 @@ export interface SessionLimitsChangedData {
   sessionLimits: SessionLimitsConfig | null;
 }
 /**
- * Session event "session.permissions_changed". Permissions change details carrying the aggregate allow-all transition.
+ * Session event "session.permissions_changed". Permission-mode transition details.
  */
+/** @experimental */
 export interface PermissionsChangedEvent {
   /**
    * Sub-agent instance identifier. Absent for events from the root/main agent and session-level events.
@@ -1851,29 +1852,28 @@ export interface PermissionsChangedEvent {
   type: "session.permissions_changed";
 }
 /**
- * Permissions change details carrying the aggregate allow-all transition.
+ * Permission-mode transition details.
  */
+/** @experimental */
 export interface PermissionsChangedData {
   /**
-   * Allow-all mode after the change
+   * Explicit LLM judge model override used by assisted mode; omitted when the provider default applies
    *
    * @experimental
    */
-  allowAllPermissionMode?: PermissionAllowAllMode;
+  assistedApprovalModel?: string;
   /**
-   * Aggregate allow-all flag after the change
-   */
-  allowAllPermissions: boolean;
-  /**
-   * Allow-all mode before the change
+   * Permission mode after the change
    *
    * @experimental
    */
-  previousAllowAllPermissionMode?: PermissionAllowAllMode;
+  mode: PermissionMode;
   /**
-   * Aggregate allow-all flag before the change
+   * Permission mode before the change
+   *
+   * @experimental
    */
-  previousAllowAllPermissions: boolean;
+  previousMode: PermissionMode;
 }
 /**
  * Session event "session.plan_changed". Plan file operation details indicating what changed
@@ -6790,7 +6790,12 @@ export interface PermissionRequestUrl {
  */
 export interface PermissionRequestMemory {
   action?: PermissionRequestMemoryAction;
-  autoApproval?: PermissionAutoApproval;
+  /**
+   * Assisted-approval judge information for this request; present only in assisted mode.
+   *
+   * @experimental
+   */
+  assistedApproval?: PermissionAssistedApproval;
   /**
    * Source references for the stored fact (store only)
    */
@@ -6823,11 +6828,11 @@ export interface PermissionRequestMemory {
   toolCallId?: string;
 }
 /**
- * Auto-approval judge information attached to a permission request. Present (non-null) only when the session's allow-all mode is "auto"; its absence means auto mode was off and the judge did not evaluate the request. The `recommendation` conveys the judge's disposition for this request.
+ * Assisted-approval judge information attached to a permission request. Present only in assisted mode; its absence means the judge did not evaluate the request. The `recommendation` conveys the judge's disposition for this request.
  */
 /** @experimental */
-export interface PermissionAutoApproval {
-  failureReason?: AutoApprovalJudgeFailureReason;
+export interface PermissionAssistedApproval {
+  failureReason?: AssistedApprovalJudgeFailureReason;
   /**
    * Model id that produced the recommendation, when the judge was consulted and reported one. Absent for `excluded` (the judge was not consulted) and for failures that occurred before a model was selected.
    */
@@ -6836,7 +6841,7 @@ export interface PermissionAutoApproval {
    * Human-readable reason for the judge's recommendation, when available.
    */
   reason?: string;
-  recommendation: AutoApprovalRecommendation;
+  recommendation: AssistedApprovalRecommendation;
 }
 /**
  * Custom tool invocation permission request
@@ -7041,11 +7046,11 @@ export interface PermissionRequestExtensionEnvAccess {
  */
 export interface PermissionPromptRequestCommands {
   /**
-   * Auto-approval judge information for this request; present only when auto mode is enabled.
+   * Assisted-approval judge information for this request; present only in assisted mode.
    *
    * @experimental
    */
-  autoApproval?: PermissionAutoApproval;
+  assistedApproval?: PermissionAssistedApproval;
   /**
    * Whether the UI can offer session-wide approval for this command pattern
    */
@@ -7084,11 +7089,11 @@ export interface PermissionPromptRequestCommands {
  */
 export interface PermissionPromptRequestWrite {
   /**
-   * Auto-approval judge information for this request; present only when auto mode is enabled.
+   * Assisted-approval judge information for this request; present only in assisted mode.
    *
    * @experimental
    */
-  autoApproval?: PermissionAutoApproval;
+  assistedApproval?: PermissionAssistedApproval;
   /**
    * Whether the UI can offer session-wide approval for file write operations
    */
@@ -7127,11 +7132,11 @@ export interface PermissionPromptRequestWrite {
  */
 export interface PermissionPromptRequestRead {
   /**
-   * Auto-approval judge information for this request; present only when auto mode is enabled.
+   * Assisted-approval judge information for this request; present only in assisted mode.
    *
    * @experimental
    */
-  autoApproval?: PermissionAutoApproval;
+  assistedApproval?: PermissionAssistedApproval;
   /**
    * Human-readable description of why the file is being read
    */
@@ -7162,11 +7167,11 @@ export interface PermissionPromptRequestMcp {
    */
   args?: JsonValue;
   /**
-   * Auto-approval judge information for this request; present only when auto mode is enabled.
+   * Assisted-approval judge information for this request; present only in assisted mode.
    *
    * @experimental
    */
-  autoApproval?: PermissionAutoApproval;
+  assistedApproval?: PermissionAssistedApproval;
   /**
    * Prompt kind discriminator
    */
@@ -7199,11 +7204,11 @@ export interface PermissionPromptRequestMcp {
  */
 export interface PermissionPromptRequestUrl {
   /**
-   * Auto-approval judge information for this request; present only when auto mode is enabled.
+   * Assisted-approval judge information for this request; present only in assisted mode.
    *
    * @experimental
    */
-  autoApproval?: PermissionAutoApproval;
+  assistedApproval?: PermissionAssistedApproval;
   /**
    * Human-readable description of why the URL is being accessed
    */
@@ -7243,11 +7248,11 @@ export interface PermissionPromptRequestUrl {
 export interface PermissionPromptRequestMemory {
   action?: PermissionRequestMemoryAction;
   /**
-   * Auto-approval judge information for this request; present only when auto mode is enabled.
+   * Assisted-approval judge information for this request; present only in assisted mode.
    *
    * @experimental
    */
-  autoApproval?: PermissionAutoApproval;
+  assistedApproval?: PermissionAssistedApproval;
   /**
    * Source references for the stored fact (store only)
    */
@@ -7283,11 +7288,11 @@ export interface PermissionPromptRequestCustomTool {
    */
   args?: JsonValue;
   /**
-   * Auto-approval judge information for this request; present only when auto mode is enabled.
+   * Assisted-approval judge information for this request; present only in assisted mode.
    *
    * @experimental
    */
-  autoApproval?: PermissionAutoApproval;
+  assistedApproval?: PermissionAssistedApproval;
   /**
    * Prompt kind discriminator
    */
@@ -7311,11 +7316,11 @@ export interface PermissionPromptRequestCustomTool {
 export interface PermissionPromptRequestPath {
   accessKind: PermissionPromptRequestPathAccessKind;
   /**
-   * Auto-approval judge information for this request; present only when auto mode is enabled.
+   * Assisted-approval judge information for this request; present only in assisted mode.
    *
    * @experimental
    */
-  autoApproval?: PermissionAutoApproval;
+  assistedApproval?: PermissionAssistedApproval;
   /**
    * Prompt kind discriminator
    */
@@ -7334,11 +7339,11 @@ export interface PermissionPromptRequestPath {
  */
 export interface PermissionPromptRequestHook {
   /**
-   * Auto-approval judge information for this request; present only when auto mode is enabled.
+   * Assisted-approval judge information for this request; present only in assisted mode.
    *
    * @experimental
    */
-  autoApproval?: PermissionAutoApproval;
+  assistedApproval?: PermissionAssistedApproval;
   /**
    * Optional message from the hook explaining why confirmation is needed
    */
@@ -7365,11 +7370,11 @@ export interface PermissionPromptRequestHook {
  */
 export interface PermissionPromptRequestExtensionManagement {
   /**
-   * Auto-approval judge information for this request; present only when auto mode is enabled.
+   * Assisted-approval judge information for this request; present only in assisted mode.
    *
    * @experimental
    */
-  autoApproval?: PermissionAutoApproval;
+  assistedApproval?: PermissionAssistedApproval;
   /**
    * Name of the extension being managed
    */
@@ -7396,11 +7401,11 @@ export interface PermissionPromptRequestFactory {
    */
   approvalKey: string;
   /**
-   * Auto-approval judge information for this request; present only when auto mode is enabled.
+   * Assisted-approval judge information for this request; present only in assisted mode.
    *
    * @experimental
    */
-  autoApproval?: PermissionAutoApproval;
+  assistedApproval?: PermissionAssistedApproval;
   /**
    * Whether this factory is eligible for persistent approval
    */
@@ -7468,11 +7473,11 @@ export interface PermissionPromptRequestFactory {
  */
 export interface PermissionPromptRequestExtensionPermissionAccess {
   /**
-   * Auto-approval judge information for this request; present only when auto mode is enabled.
+   * Assisted-approval judge information for this request; present only in assisted mode.
    *
    * @experimental
    */
-  autoApproval?: PermissionAutoApproval;
+  assistedApproval?: PermissionAssistedApproval;
   /**
    * Capabilities the extension is requesting
    */
@@ -7495,11 +7500,11 @@ export interface PermissionPromptRequestExtensionPermissionAccess {
  */
 export interface PermissionPromptRequestExtensionEnvAccess {
   /**
-   * Auto-approval judge information for this request; present only when auto mode is enabled.
+   * Assisted-approval judge information for this request; present only in assisted mode.
    *
    * @experimental
    */
-  autoApproval?: PermissionAutoApproval;
+  assistedApproval?: PermissionAssistedApproval;
   /**
    * Names of the sensitive environment variables the extension is requesting. Values never appear here.
    *
diff --git a/nodejs/test/e2e/rpc_session_state_extras.e2e.test.ts b/nodejs/test/e2e/rpc_session_state_extras.e2e.test.ts
index 54f40fe12c..6111809914 100644
--- a/nodejs/test/e2e/rpc_session_state_extras.e2e.test.ts
+++ b/nodejs/test/e2e/rpc_session_state_extras.e2e.test.ts
@@ -203,21 +203,21 @@ describe("Session-scoped state extras RPC", async () => {
     it("should get and set allowall permissions", { timeout: 120_000 }, async () => {
         const session = await createSession();
         try {
-            const initial = await session.rpc.permissions.getAllowAll();
-            expect(initial.enabled).toBe(false);
+            const initial = await session.rpc.permissions.getMode();
+            expect(initial.mode).toBe("manual");
 
-            const enable = await session.rpc.permissions.setAllowAll({ enabled: true });
+            const enable = await session.rpc.permissions.setMode({ mode: "allow-all" });
             expect(enable.success).toBe(true);
-            expect(enable.enabled).toBe(true);
-            expect((await session.rpc.permissions.getAllowAll()).enabled).toBe(true);
+            expect(enable.mode).toBe("allow-all");
+            expect((await session.rpc.permissions.getMode()).mode).toBe("allow-all");
 
-            const disable = await session.rpc.permissions.setAllowAll({ enabled: false });
+            const disable = await session.rpc.permissions.setMode({ mode: "manual" });
             expect(disable.success).toBe(true);
-            expect(disable.enabled).toBe(false);
-            expect((await session.rpc.permissions.getAllowAll()).enabled).toBe(false);
+            expect(disable.mode).toBe("manual");
+            expect((await session.rpc.permissions.getMode()).mode).toBe("manual");
         } finally {
             try {
-                await session.rpc.permissions.setAllowAll({ enabled: false });
+                await session.rpc.permissions.setMode({ mode: "manual" });
             } catch {
                 // Best-effort reset.
             }
diff --git a/nodejs/test/e2e/rpc_ui_ephemeral_query.e2e.test.ts b/nodejs/test/e2e/rpc_ui_ephemeral_query.e2e.test.ts
index 537329094e..07bdc54199 100644
--- a/nodejs/test/e2e/rpc_ui_ephemeral_query.e2e.test.ts
+++ b/nodejs/test/e2e/rpc_ui_ephemeral_query.e2e.test.ts
@@ -9,9 +9,9 @@ import { createSdkTestContext } from "./harness/sdkTestContext.js";
 describe("UI ephemeral query RPC", async () => {
     const { copilotClient: client } = await createSdkTestContext();
 
-    // TODO(cli-1.0.81-2): CLI 1.0.81-2 fails session.ui.ephemeralQuery against the recorded
-    // snapshot ("Failed to get response from the AI model"). Re-enable once the runtime
-    // fix ships.
+    // TODO(cli-1.0.81-2): CLI 1.0.81-4 still fails session.ui.ephemeralQuery against the
+    // recorded snapshot ("Failed to get response from the AI model"). Re-enable once the
+    // runtime fix ships.
     it.skip("should answer ephemeral query", { timeout: 120_000 }, async () => {
         const session = await client.createSession({ onPermissionRequest: approveAll });
         try {
diff --git a/nodejs/vitest.config.ts b/nodejs/vitest.config.ts
index fb9795d9de..eec87f977e 100644
--- a/nodejs/vitest.config.ts
+++ b/nodejs/vitest.config.ts
@@ -5,13 +5,10 @@ const integrationTestTimeout = process.platform === "win32" ? 60000 : 30000;
 const isInProcessTransport =
     (process.env.COPILOT_SDK_DEFAULT_CONNECTION ?? "").toLowerCase() === "inprocess";
 
-// TODO(cli-1.0.81-2): under @github/copilot 1.0.81-2 every model-driven turn hangs when the
-// runtime is hosted in-process (FFI). The session never reaches idle, so each test fails on
-// its own timeout with no error surfaced by the runtime; suites that only exercise RPC
-// without a model turn still pass. The same suites pass on the default (stdio) cell on all
-// three OSes, and they all passed in-process on 1.0.76-5, so the lost coverage is limited to
-// the transport rather than the behavior. Delete this list once a @github/copilot build
-// carrying the fix is picked up.
+// TODO(cli-1.0.81-4): model-driven turns eventually stop completing when the runtime is
+// hosted in-process against CAPI. The shared runtime then poisons every later model-driven
+// test until the job times out. These suites still run over stdio on all three OSes, while
+// pure-RPC in-process coverage remains enabled.
 const inProcessBlockedE2E = [
     "**/test/e2e/abort.e2e.test.ts",
     "**/test/e2e/agent_and_compact_rpc.e2e.test.ts",
diff --git a/python/copilot/generated/rpc.py b/python/copilot/generated/rpc.py
index 8a5a38853c..d8915a626d 100644
--- a/python/copilot/generated/rpc.py
+++ b/python/copilot/generated/rpc.py
@@ -6,7 +6,7 @@
 
 from typing import ClassVar, TYPE_CHECKING
 
-from .session_events import AbortReason, Attachment, ContextTier, EmbeddedBlobResourceContents, EmbeddedTextResourceContents, McpOauthHttpResponse, McpOauthWWWAuthenticateParams, McpServerSource, McpServerStatus, ModelChangeSource, PermissionPromptRequest, PermissionRule, ReasoningSummary, SessionEvent, SessionLimitsConfig, SessionMode, ShutdownType, SkillSource, TaskCompletionOutcome, UserToolSessionApproval, Verbosity
+from .session_events import AbortReason, Attachment, ContextTier, EmbeddedBlobResourceContents, EmbeddedTextResourceContents, McpOauthHttpResponse, McpOauthWWWAuthenticateParams, McpServerSource, McpServerStatus, ModelChangeSource, PermissionMode, PermissionPromptRequest, PermissionRule, ReasoningSummary, SessionEvent, SessionLimitsConfig, SessionMode, ShutdownType, SkillSource, TaskCompletionOutcome, UserToolSessionApproval, Verbosity
 
 if TYPE_CHECKING:
     from .._jsonrpc import JsonRpcClient
@@ -708,21 +708,6 @@ def to_dict(self) -> dict:
             result["projectPaths"] = from_union([lambda x: from_list(from_str, x), from_none], self.project_paths)
         return result
 
-# Experimental: this type is part of an experimental API and may change or be removed.
-class PermissionsAllowAllMode(Enum):
-    """Authoritative allow-all mode after the mutation
-
-    Current or requested allow-all mode.
-
-    Current allow-all mode
-
-    Allow-all mode to apply. `on` enables full allow-all; `auto` enables advisory LLM
-    auto-approval; `off` disables both.
-    """
-    AUTO = "auto"
-    OFF = "off"
-    ON = "on"
-
 class APIKeyAuthInfoType(Enum):
     API_KEY = "api-key"
 
@@ -1081,6 +1066,418 @@ def to_dict(self) -> dict:
             result["enableWebSocketResponses"] = from_union([from_bool, from_none], self.enable_web_socket_responses)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CardDigestAlgorithm(Enum):
+    """Canonical digest algorithm for a validated MCP card"""
+
+    SHA256_RFC8785 = "sha256-rfc8785"
+
+class Installability(Enum):
+    NOT_INSTALLABLE_KIND = "not-installable-kind"
+
+class CatalogAISkillCandidateKind(Enum):
+    AI_SKILL = "ai-skill"
+
+class MediaType(Enum):
+    APPLICATION_AI_SKILL = "application/ai-skill"
+
+class CatalogCandidateSourceKind(Enum):
+    """Discriminator for a URL-backed MCP server card
+
+    Discriminator for an embedded MCP server card
+    """
+    EMBEDDED = "embedded"
+    URL = "url"
+
+class CatalogAuthenticationRequiredErrorKind(Enum):
+    AUTHENTICATION_REQUIRED = "authentication-required"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogAuthenticationRequiredReason(Enum):
+    """Why authentication failed. Only an expired credential justifies attempting a silent
+    refresh; an absent or rejected credential requires sign-in.
+
+    Why the catalog authority did not accept the caller's identity
+    """
+    CREDENTIAL_EXPIRED = "credential-expired"
+    CREDENTIAL_REJECTED = "credential-rejected"
+    NO_CREDENTIAL = "no-credential"
+
+class CatalogCandidateInstallability(Enum):
+    """Whether this MCP server can be planned for installation, and if policy prevents it.
+
+    Whether an MCP server candidate can be planned for installation
+    """
+    INSTALLABLE = "installable"
+    NOT_INSTALLABLE_KIND = "not-installable-kind"
+    NOT_INSTALLABLE_POLICY = "not-installable-policy"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogCandidateKind(Enum):
+    """What kind of resource a catalog candidate describes"""
+
+    AI_SKILL = "ai-skill"
+    MCP_SERVER = "mcp-server"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogMediaType(Enum):
+    """JSON MCP media type of the underlying card.
+
+    JSON MCP card media type accepted for install planning
+
+    JSON MCP media type advertised for the referenced card.
+
+    JSON MCP media type the validated card was interpreted as.
+
+    Media type the card is expected to conform to.
+
+    Media type the card was interpreted as, when it declared one this runtime recognises.
+
+    Media type a catalog card is interpreted as
+    """
+    APPLICATION_AI_SKILL = "application/ai-skill"
+    APPLICATION_MCP_SERVER_CARD_JSON = "application/mcp-server-card+json"
+    APPLICATION_MCP_SERVER_JSON = "application/mcp-server+json"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class MCPServerCardEmbeddedKind(Enum):
+    """Discriminator for an embedded MCP server card"""
+
+    EMBEDDED = "embedded"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class MCPServerCardURLKind(Enum):
+    """Discriminator for a URL-backed MCP server card"""
+
+    URL = "url"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogCapability(Enum):
+    """A wire feature a caller can require of the catalog surface, negotiated per request. A
+    grant means the runtime understands the feature's contract, not that the deployment has
+    enabled the operation; typed unavailable results report availability separately.
+    """
+    AI_SKILL_DISCOVERY = "ai-skill-discovery"
+    LEGACY_MCP_SERVER_CARD = "legacy-mcp-server-card"
+    MCP_INSTALL_PLANNING = "mcp-install-planning"
+    MCP_SERVER_CARD = "mcp-server-card"
+    MULTIPLE_TRANSPORT_CHOICE = "multiple-transport-choice"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogClientContract:
+    """The protocol version and capability set a caller requires, supplied on every catalog
+    request so negotiation cannot be skipped by omission.
+
+    Protocol version and capabilities the caller requires.
+    """
+    protocol_version: int
+    """SDK protocol version the caller was generated against. A caller below the runtime's
+    minimum supported version is refused rather than served a partial result.
+    """
+    required_capabilities: list[str]
+    """Wire features the caller requires the runtime to understand. Identifiers are bounded but
+    extensible so a newer caller can negotiate with an older runtime. Requiring an unknown
+    feature yields a typed refusal listing what is understood, never a partial grant. A grant
+    does not promise that a deployment has enabled the operation; typed unavailable results
+    report that separately.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogClientContract':
+        assert isinstance(obj, dict)
+        protocol_version = from_int(obj.get("protocolVersion"))
+        required_capabilities = from_list(from_str, obj.get("requiredCapabilities"))
+        return CatalogClientContract(protocol_version, required_capabilities)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["protocolVersion"] = from_int(self.protocol_version)
+        result["requiredCapabilities"] = from_list(from_str, self.required_capabilities)
+        return result
+
+class CatalogContractViolationErrorKind(Enum):
+    CONTRACT_VIOLATION = "contract-violation"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogContractViolationReason(Enum):
+    """Which rule the response broke.
+
+    Which wire-contract rule an upstream response broke
+    """
+    BOTH_URL_AND_DATA = "both-url-and-data"
+    DUPLICATE_IDENTITY = "duplicate-identity"
+    NEITHER_URL_NOR_DATA = "neither-url-nor-data"
+    UNKNOWN_MEDIA_TYPE = "unknown-media-type"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogHandleType(Enum):
+    """Which kind of handle was presented.
+
+    Which kind of opaque handle was presented
+    """
+    CANDIDATE = "candidate"
+    PLAN = "plan"
+
+class CatalogHandleRejectedErrorKind(Enum):
+    HANDLE_REJECTED = "handle-rejected"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogHandleRejectionReason(Enum):
+    """Why the handle was rejected.
+
+    Why a presented handle was rejected
+    """
+    FOREIGN = "foreign"
+    INVALID = "invalid"
+    REPLAYED = "replayed"
+    STALE = "stale"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogInvalidRequestField(Enum):
+    """Which request field was rejected.
+
+    Which request field was rejected before any work was done
+    """
+    CARD = "card"
+    CONTRACT = "contract"
+    KINDS = "kinds"
+    LIMIT = "limit"
+    QUERY = "query"
+    SCOPE = "scope"
+    SOURCE = "source"
+
+class CatalogInvalidRequestErrorKind(Enum):
+    INVALID_REQUEST = "invalid-request"
+
+class CatalogMalformedCardErrorKind(Enum):
+    MALFORMED_CARD = "malformed-card"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogMalformedCardReason(Enum):
+    """How the card failed validation.
+
+    How a card failed validation
+    """
+    INVALID_JSON = "invalid-json"
+    MISSING_REQUIRED_FIELD = "missing-required-field"
+    SCHEMA_VIOLATION = "schema-violation"
+    SIZE_LIMIT_EXCEEDED = "size-limit-exceeded"
+    UNSUPPORTED_MEDIA_TYPE = "unsupported-media-type"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogMCPServerInstallabilityEnum(Enum):
+    """Whether this MCP server can be planned for installation, and if policy prevents it.
+
+    Whether an MCP server candidate can be planned for installation
+    """
+    INSTALLABLE = "installable"
+    NOT_INSTALLABLE_POLICY = "not-installable-policy"
+
+class CatalogMCPServerCandidateKind(Enum):
+    MCP_SERVER = "mcp-server"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class MCPServerCardMediaType(Enum):
+    """JSON MCP media type of the underlying card.
+
+    JSON MCP card media type accepted for install planning
+
+    JSON MCP media type advertised for the referenced card.
+
+    JSON MCP media type the validated card was interpreted as.
+
+    Media type the card is expected to conform to.
+    """
+    APPLICATION_MCP_SERVER_CARD_JSON = "application/mcp-server-card+json"
+    APPLICATION_MCP_SERVER_JSON = "application/mcp-server+json"
+
+class CatalogNegotiationRefusedErrorKind(Enum):
+    NEGOTIATION_REFUSED = "negotiation-refused"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogNegotiationRefusedReason(Enum):
+    """Whether the version or the capability set was the problem.
+
+    Why capability and protocol-version negotiation refused a caller
+    """
+    UNSUPPORTED_CAPABILITY = "unsupported-capability"
+    UNSUPPORTED_PROTOCOL_VERSION = "unsupported-protocol-version"
+
+class CatalogNetworkFailureErrorKind(Enum):
+    NETWORK_FAILURE = "network-failure"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogNetworkFailureReason(Enum):
+    """Categorised failure, low cardinality so it can be aggregated without carrying a URL.
+
+    Categorised network failure, low cardinality so it can be aggregated without carrying a
+    URL
+    """
+    CONNECTION_REFUSED = "connection-refused"
+    DNS = "dns"
+    HTTP_STATUS = "http-status"
+    OFFLINE = "offline"
+    REDIRECT_REJECTED = "redirect-rejected"
+    RESPONSE_TOO_LARGE = "response-too-large"
+    TIMEOUT = "timeout"
+    TLS = "tls"
+
+class CatalogNotInstallableErrorKind(Enum):
+    NOT_INSTALLABLE = "not-installable"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogNotInstallableReason(Enum):
+    """Why the candidate cannot be installed.
+
+    Why a discoverable candidate cannot be installed
+    """
+    AI_SKILL_NOT_INSTALLABLE = "ai-skill-not-installable"
+    KIND_NOT_INSTALLABLE = "kind-not-installable"
+    POLICY_FORBIDS = "policy-forbids"
+
+class CatalogPolicyRejectedErrorKind(Enum):
+    POLICY_REJECTED = "policy-rejected"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class MCPPlanPolicySource(Enum):
+    """Which authority produced the decision.
+
+    Which authority produced a policy decision
+    """
+    ENTERPRISE_ALLOWLIST = "enterprise-allowlist"
+    LOCAL_TRUST = "local-trust"
+    NONE = "none"
+    REGISTRY_POLICY = "registry-policy"
+
+class CatalogSearchResultKind(Enum):
+    AUTHENTICATION_REQUIRED = "authentication-required"
+    CONTRACT_VIOLATION = "contract-violation"
+    INVALID_REQUEST = "invalid-request"
+    MALFORMED_CARD = "malformed-card"
+    NEGOTIATION_REFUSED = "negotiation-refused"
+    NETWORK_FAILURE = "network-failure"
+    POLICY_REJECTED = "policy-rejected"
+    SUCCEEDED = "succeeded"
+    UNAVAILABLE = "unavailable"
+    UNSAFE_RETRIEVAL = "unsafe-retrieval"
+    UNSUPPORTED_KIND = "unsupported-kind"
+
+class CatalogSearchResultReason(Enum):
+    """Whether the version or the capability set was the problem.
+
+    Why capability and protocol-version negotiation refused a caller
+
+    Why authentication failed. Only an expired credential justifies attempting a silent
+    refresh; an absent or rejected credential requires sign-in.
+
+    Why the catalog authority did not accept the caller's identity
+
+    Categorised failure, low cardinality so it can be aggregated without carrying a URL.
+
+    Categorised network failure, low cardinality so it can be aggregated without carrying a
+    URL
+
+    Which control refused the retrieval, low cardinality so it can be aggregated without
+    carrying a URL.
+
+    Which hardened-fetch control refused a retrieval
+
+    How the card failed validation.
+
+    How a card failed validation
+
+    Which rule the response broke.
+
+    Which wire-contract rule an upstream response broke
+
+    Why the operation is unavailable.
+
+    Why a catalog operation is not available on this runtime
+    """
+    AUTHORITY_NOT_CONFIGURED = "authority-not-configured"
+    BLOCKED_ADDRESS = "blocked-address"
+    BLOCKED_SCHEME = "blocked-scheme"
+    BOTH_URL_AND_DATA = "both-url-and-data"
+    CONNECTION_REFUSED = "connection-refused"
+    CREDENTIALS_IN_URL = "credentials-in-url"
+    CREDENTIAL_EXPIRED = "credential-expired"
+    CREDENTIAL_REJECTED = "credential-rejected"
+    DISABLED_BY_POLICY = "disabled-by-policy"
+    DNS = "dns"
+    DUPLICATE_IDENTITY = "duplicate-identity"
+    HOST_NOT_PERMITTED = "host-not-permitted"
+    HTTP_STATUS = "http-status"
+    INVALID_JSON = "invalid-json"
+    MISSING_REQUIRED_FIELD = "missing-required-field"
+    NEITHER_URL_NOR_DATA = "neither-url-nor-data"
+    NO_CREDENTIAL = "no-credential"
+    OFFLINE = "offline"
+    PLANNING_UNAVAILABLE = "planning-unavailable"
+    PROXY_REJECTED = "proxy-rejected"
+    REDIRECT_REJECTED = "redirect-rejected"
+    REDIRECT_TO_BLOCKED_ADDRESS = "redirect-to-blocked-address"
+    RESPONSE_TOO_LARGE = "response-too-large"
+    SCHEMA_VIOLATION = "schema-violation"
+    SEARCH_UNAVAILABLE = "search-unavailable"
+    SIZE_LIMIT_EXCEEDED = "size-limit-exceeded"
+    TIMEOUT = "timeout"
+    TLS = "tls"
+    UNKNOWN_MEDIA_TYPE = "unknown-media-type"
+    UNSUPPORTED_CAPABILITY = "unsupported-capability"
+    UNSUPPORTED_MEDIA_TYPE = "unsupported-media-type"
+    UNSUPPORTED_PROTOCOL_VERSION = "unsupported-protocol-version"
+
+class CatalogSearchSucceededKind(Enum):
+    SUCCEEDED = "succeeded"
+
+class CatalogUnavailableErrorKind(Enum):
+    UNAVAILABLE = "unavailable"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogUnavailableReason(Enum):
+    """Why the operation is unavailable.
+
+    Why a catalog operation is not available on this runtime
+    """
+    AUTHORITY_NOT_CONFIGURED = "authority-not-configured"
+    DISABLED_BY_POLICY = "disabled-by-policy"
+    PLANNING_UNAVAILABLE = "planning-unavailable"
+    SEARCH_UNAVAILABLE = "search-unavailable"
+
+class CatalogUnavailableTransportErrorKind(Enum):
+    UNAVAILABLE_TRANSPORT = "unavailable-transport"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogUnavailableTransportReason(Enum):
+    """Why no transport could be offered.
+
+    Why no usable transport could be offered
+    """
+    NO_ELIGIBLE_TRANSPORT = "no-eligible-transport"
+    REMOTE_ENUMERATION_UNAVAILABLE = "remote-enumeration-unavailable"
+    TRANSPORT_NOT_SUPPORTED = "transport-not-supported"
+
+class CatalogUnsafeRetrievalErrorKind(Enum):
+    UNSAFE_RETRIEVAL = "unsafe-retrieval"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CatalogUnsafeRetrievalReason(Enum):
+    """Which control refused the retrieval, low cardinality so it can be aggregated without
+    carrying a URL.
+
+    Which hardened-fetch control refused a retrieval
+    """
+    BLOCKED_ADDRESS = "blocked-address"
+    BLOCKED_SCHEME = "blocked-scheme"
+    CREDENTIALS_IN_URL = "credentials-in-url"
+    HOST_NOT_PERMITTED = "host-not-permitted"
+    PROXY_REJECTED = "proxy-rejected"
+    REDIRECT_TO_BLOCKED_ADDRESS = "redirect-to-blocked-address"
+
+class CatalogUnsupportedKindErrorKind(Enum):
+    UNSUPPORTED_KIND = "unsupported-kind"
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class SlashCommandInputChoice:
@@ -3603,20 +4000,17 @@ def to_dict(self) -> dict:
             result["output"] = self.output
         return result
 
-class PurpleSource(Enum):
+class InstalledPluginSourceURLSource(Enum):
     GITHUB = "github"
     LOCAL = "local"
     URL = "url"
 
-class FluffySource(Enum):
+class PurpleSource(Enum):
     GITHUB = "github"
 
-class TentacledSource(Enum):
+class FluffySource(Enum):
     LOCAL = "local"
 
-class StickySource(Enum):
-    URL = "url"
-
 # Experimental: this type is part of an experimental API and may change or be removed.
 class InstructionLocation(Enum):
     """Which tier this target belongs to
@@ -4825,6 +5219,164 @@ def to_dict(self) -> dict:
         result["timestamp"] = from_int(self.timestamp)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+class MCPPlanConfigurationOperation(Enum):
+    """Whether the change would create a new entry or modify an existing one.
+
+    Whether a planned configuration change would create or modify an entry
+    """
+    ADD = "add"
+    UPDATE = "update"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class MCPPlanScope(Enum):
+    """Scope the change would be written to.
+
+    Configuration scope an MCP install plan targets
+
+    Configuration scope the plan targets.
+
+    Configuration scope the plan targets. Defaults to user scope when omitted.
+    """
+    USER = "user"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class MCPPlanResourceIdentity:
+    """Normalised identity of the server the plan would install.
+
+    Normalised identity of the MCP server a plan targets, independent of how the card spelled
+    it.
+    """
+    canonical_name: str
+    """Canonical, normalised name of the server, for example `io.github.owner/server`."""
+
+    server_name: str
+    """Local configuration key the server would be recorded under."""
+
+    registry_id: str | None = None
+    """Registry identifier of the server, when it came from a registry."""
+
+    version: str | None = None
+    """Version advertised by the card, when it declares one."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'MCPPlanResourceIdentity':
+        assert isinstance(obj, dict)
+        canonical_name = from_str(obj.get("canonicalName"))
+        server_name = from_str(obj.get("serverName"))
+        registry_id = from_union([from_str, from_none], obj.get("registryId"))
+        version = from_union([from_str, from_none], obj.get("version"))
+        return MCPPlanResourceIdentity(canonical_name, server_name, registry_id, version)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["canonicalName"] = from_str(self.canonical_name)
+        result["serverName"] = from_str(self.server_name)
+        if self.registry_id is not None:
+            result["registryId"] = from_union([from_str, from_none], self.registry_id)
+        if self.version is not None:
+            result["version"] = from_union([from_str, from_none], self.version)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class MCPPlanPolicyDecision(Enum):
+    """What policy decided for this server.
+
+    What policy decided for a planned server
+    """
+    ALLOWED = "allowed"
+    BLOCKED = "blocked"
+    REQUIRES_APPROVAL = "requires-approval"
+
+class InstallMethod(Enum):
+    """Discriminator for a package-backed transport choice
+
+    Discriminator for a remote-endpoint transport choice
+    """
+    PACKAGE = "package"
+    REMOTE = "remote"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class MCPPlanValueCategory(Enum):
+    """Where the value is applied when the server is launched.
+
+    Where a required value is applied when the planned server is launched
+    """
+    ENVIRONMENT_VARIABLE = "environment-variable"
+    HEADER = "header"
+    PACKAGE_ARGUMENT = "package-argument"
+    RUNTIME_ARGUMENT = "runtime-argument"
+    URL_VARIABLE = "url-variable"
+
+class MCPPlanRequiredValueKind(Enum):
+    """Discriminator for a scalar required value
+
+    Discriminator for an enumerated required value
+    """
+    ENUM = "enum"
+    SCALAR = "scalar"
+
+class MCPPlanRequiredValueValueType(Enum):
+    """Scalar type the value must conform to.
+
+    Scalar type a required value must conform to
+
+    Discriminator for an enumerated required value
+    """
+    BOOLEAN = "boolean"
+    ENUM = "enum"
+    NUMBER = "number"
+    PATH = "path"
+    STRING = "string"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class MCPPlanSecretPlaceholder:
+    """A secret a transport choice needs, referenced by placeholder. No secret value ever
+    appears in a plan, and the placeholder resolves against the keychain only when a plan is
+    applied.
+    """
+    key: str
+    """Key the secret is supplied under. Inert untrusted data."""
+
+    placeholder: str
+    """The runtime-assigned `${secret:<id>}` placeholder written into configuration in place of
+    the value.
+    """
+    title: str | None = None
+    """Human-readable label from the card. Inert untrusted text."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'MCPPlanSecretPlaceholder':
+        assert isinstance(obj, dict)
+        key = from_str(obj.get("key"))
+        placeholder = from_str(obj.get("placeholder"))
+        title = from_union([from_str, from_none], obj.get("title"))
+        return MCPPlanSecretPlaceholder(key, placeholder, title)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["key"] = from_str(self.key)
+        result["placeholder"] = from_str(self.placeholder)
+        if self.title is not None:
+            result["title"] = from_union([from_str, from_none], self.title)
+        return result
+
+class MCPPlanETransport(Enum):
+    """Local process transport this package choice would use.
+
+    Transport exposed by a locally launched package
+
+    Endpoint transport this remote choice would use.
+
+    Transport exposed by a remote endpoint
+    """
+    HTTP = "http"
+    SSE = "sse"
+    STDIO = "stdio"
+    STREAMABLE_HTTP = "streamable-http"
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class MCPIsServerRunningRequest:
@@ -5066,6 +5618,184 @@ def to_dict(self) -> dict:
         result["success"] = from_bool(self.success)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+class MCPPlan(Enum):
+    """Discriminator for an enumerated required value"""
+
+    ENUM = "enum"
+
+class MCPPlanInstallPlannedKind(Enum):
+    PLANNED = "planned"
+
+class MCPPlanInstallSourceKind(Enum):
+    """Discriminator for a candidate-backed install-plan source
+
+    Discriminator for a caller-supplied-card install-plan source
+    """
+    CANDIDATE = "candidate"
+    CARD = "card"
+
+class MCPPlanInstallResultKind(Enum):
+    AUTHENTICATION_REQUIRED = "authentication-required"
+    CONTRACT_VIOLATION = "contract-violation"
+    HANDLE_REJECTED = "handle-rejected"
+    INVALID_REQUEST = "invalid-request"
+    MALFORMED_CARD = "malformed-card"
+    NEGOTIATION_REFUSED = "negotiation-refused"
+    NETWORK_FAILURE = "network-failure"
+    NOT_INSTALLABLE = "not-installable"
+    PLANNED = "planned"
+    POLICY_REJECTED = "policy-rejected"
+    UNAVAILABLE = "unavailable"
+    UNAVAILABLE_TRANSPORT = "unavailable-transport"
+    UNSAFE_RETRIEVAL = "unsafe-retrieval"
+
+class MCPPlanInstallResultReason(Enum):
+    """Whether the version or the capability set was the problem.
+
+    Why capability and protocol-version negotiation refused a caller
+
+    Why the handle was rejected.
+
+    Why a presented handle was rejected
+
+    Why authentication failed. Only an expired credential justifies attempting a silent
+    refresh; an absent or rejected credential requires sign-in.
+
+    Why the catalog authority did not accept the caller's identity
+
+    Categorised failure, low cardinality so it can be aggregated without carrying a URL.
+
+    Categorised network failure, low cardinality so it can be aggregated without carrying a
+    URL
+
+    Which control refused the retrieval, low cardinality so it can be aggregated without
+    carrying a URL.
+
+    Which hardened-fetch control refused a retrieval
+
+    How the card failed validation.
+
+    How a card failed validation
+
+    Which rule the response broke.
+
+    Which wire-contract rule an upstream response broke
+
+    Why no transport could be offered.
+
+    Why no usable transport could be offered
+
+    Why the candidate cannot be installed.
+
+    Why a discoverable candidate cannot be installed
+
+    Why the operation is unavailable.
+
+    Why a catalog operation is not available on this runtime
+    """
+    AI_SKILL_NOT_INSTALLABLE = "ai-skill-not-installable"
+    AUTHORITY_NOT_CONFIGURED = "authority-not-configured"
+    BLOCKED_ADDRESS = "blocked-address"
+    BLOCKED_SCHEME = "blocked-scheme"
+    BOTH_URL_AND_DATA = "both-url-and-data"
+    CONNECTION_REFUSED = "connection-refused"
+    CREDENTIALS_IN_URL = "credentials-in-url"
+    CREDENTIAL_EXPIRED = "credential-expired"
+    CREDENTIAL_REJECTED = "credential-rejected"
+    DISABLED_BY_POLICY = "disabled-by-policy"
+    DNS = "dns"
+    DUPLICATE_IDENTITY = "duplicate-identity"
+    FOREIGN = "foreign"
+    HOST_NOT_PERMITTED = "host-not-permitted"
+    HTTP_STATUS = "http-status"
+    INVALID = "invalid"
+    INVALID_JSON = "invalid-json"
+    KIND_NOT_INSTALLABLE = "kind-not-installable"
+    MISSING_REQUIRED_FIELD = "missing-required-field"
+    NEITHER_URL_NOR_DATA = "neither-url-nor-data"
+    NO_CREDENTIAL = "no-credential"
+    NO_ELIGIBLE_TRANSPORT = "no-eligible-transport"
+    OFFLINE = "offline"
+    PLANNING_UNAVAILABLE = "planning-unavailable"
+    POLICY_FORBIDS = "policy-forbids"
+    PROXY_REJECTED = "proxy-rejected"
+    REDIRECT_REJECTED = "redirect-rejected"
+    REDIRECT_TO_BLOCKED_ADDRESS = "redirect-to-blocked-address"
+    REMOTE_ENUMERATION_UNAVAILABLE = "remote-enumeration-unavailable"
+    REPLAYED = "replayed"
+    RESPONSE_TOO_LARGE = "response-too-large"
+    SCHEMA_VIOLATION = "schema-violation"
+    SEARCH_UNAVAILABLE = "search-unavailable"
+    SIZE_LIMIT_EXCEEDED = "size-limit-exceeded"
+    STALE = "stale"
+    TIMEOUT = "timeout"
+    TLS = "tls"
+    TRANSPORT_NOT_SUPPORTED = "transport-not-supported"
+    UNKNOWN_MEDIA_TYPE = "unknown-media-type"
+    UNSUPPORTED_CAPABILITY = "unsupported-capability"
+    UNSUPPORTED_MEDIA_TYPE = "unsupported-media-type"
+    UNSUPPORTED_PROTOCOL_VERSION = "unsupported-protocol-version"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class MCPPlanInstallSourceCandidateKind(Enum):
+    """Discriminator for a candidate-backed install-plan source"""
+
+    CANDIDATE = "candidate"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class MCPPlanInstallSourceCardKind(Enum):
+    """Discriminator for a caller-supplied-card install-plan source"""
+
+    CARD = "card"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class MCPPlanPackageInstallMethod(Enum):
+    """Discriminator for a package-backed transport choice"""
+
+    PACKAGE = "package"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class MCPPlanPackageTransport(Enum):
+    """Local process transport this package choice would use.
+
+    Transport exposed by a locally launched package
+    """
+    STDIO = "stdio"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class MCPPlanRemoteInstallMethod(Enum):
+    """Discriminator for a remote-endpoint transport choice"""
+
+    REMOTE = "remote"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class MCPPlanRemoteTransport(Enum):
+    """Endpoint transport this remote choice would use.
+
+    Transport exposed by a remote endpoint
+    """
+    HTTP = "http"
+    SSE = "sse"
+    STREAMABLE_HTTP = "streamable-http"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class MCPPlanRequiredValueScalarKind(Enum):
+    """Discriminator for a scalar required value"""
+
+    SCALAR = "scalar"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class MCPPlanScalarValueTypeEnum(Enum):
+    """Scalar type the value must conform to.
+
+    Scalar type a required value must conform to
+    """
+    BOOLEAN = "boolean"
+    NUMBER = "number"
+    PATH = "path"
+    STRING = "string"
+
 class MCPServerConfigType(Enum):
     """Local transport type. Defaults to stdio when omitted.
 
@@ -6084,6 +6814,28 @@ def to_dict(self) -> dict:
             result["selectionId"] = from_union([from_str, from_none], self.selection_id)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class MoveMCPLoadingToBackgroundResult:
+    """Result of moving in-flight MCP loading to the background."""
+
+    moved_to_background: bool
+    """Whether an in-flight MCP load was moved to the background, releasing turns that were
+    waiting on it. False when no MCP load was in flight or the waiting turns had already been
+    released.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'MoveMCPLoadingToBackgroundResult':
+        assert isinstance(obj, dict)
+        moved_to_background = from_bool(obj.get("movedToBackground"))
+        return MoveMCPLoadingToBackgroundResult(moved_to_background)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["movedToBackground"] = from_bool(self.moved_to_background)
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class NameGetResult:
@@ -6404,9 +7156,9 @@ class PermissionDecisionSource(Enum):
 
     Controlled reason or actor responsible for a permission response.
     """
+    ASSISTED_APPROVAL = "assisted_approval"
     HOST_POLICY = "host_policy"
     HUMAN_RESPONSE = "human_response"
-    JUDGE_RECOMMENDATION = "judge_recommendation"
     UNATTENDED_FALLBACK = "unattended_fallback"
 
 # Experimental: this type is part of an experimental API and may change or be removed.
@@ -6810,15 +7562,34 @@ def to_dict(self) -> dict:
 
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
-class PermissionsGetAllowAllRequest:
+class PermissionsGetModeRequest:
     """No parameters."""
     @staticmethod
-    def from_dict(obj: Any) -> 'PermissionsGetAllowAllRequest':
+    def from_dict(obj: Any) -> 'PermissionsGetModeRequest':
+        assert isinstance(obj, dict)
+        return PermissionsGetModeRequest()
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class PermissionsGetModeResult:
+    """Current permission mode."""
+
+    mode: PermissionMode
+    """Current permission mode"""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'PermissionsGetModeResult':
         assert isinstance(obj, dict)
-        return PermissionsGetAllowAllRequest()
+        mode = PermissionMode(obj.get("mode"))
+        return PermissionsGetModeResult(mode)
 
     def to_dict(self) -> dict:
         result: dict = {}
+        result["mode"] = to_enum(PermissionMode, self.mode)
         return result
 
 # Experimental: this type is part of an experimental API and may change or be removed.
@@ -7008,6 +7779,31 @@ def to_dict(self) -> dict:
         result["success"] = from_bool(self.success)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class PermissionsSetModeResult:
+    """Indicates whether the requested permission mode was applied and reports the authoritative
+    post-mutation mode.
+    """
+    mode: PermissionMode
+    """Authoritative permission mode after the mutation"""
+
+    success: bool
+    """Whether the operation succeeded"""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'PermissionsSetModeResult':
+        assert isinstance(obj, dict)
+        mode = PermissionMode(obj.get("mode"))
+        success = from_bool(obj.get("success"))
+        return PermissionsSetModeResult(mode, success)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["mode"] = to_enum(PermissionMode, self.mode)
+        result["success"] = from_bool(self.success)
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class PermissionsSetRequiredRequest:
@@ -7153,6 +7949,12 @@ class PlanSQLTodosRow:
     """A single todo row read from the session SQL `todos` table. All fields are optional
     because the SQL schema is best-effort and the agent may not have populated every column.
     """
+    created_at: str | None = None
+    """Todo creation time, as stored by the session SQL schema's `datetime('now')` default:
+    `YYYY-MM-DD HH:MM:SS` in UTC. Lets clients attribute todos to the work item that created
+    them (e.g. scoping a goal's progress to the todos it produced) rather than to the whole
+    session.
+    """
     description: str | None = None
     """Todo description."""
 
@@ -7168,14 +7970,17 @@ class PlanSQLTodosRow:
     @staticmethod
     def from_dict(obj: Any) -> 'PlanSQLTodosRow':
         assert isinstance(obj, dict)
+        created_at = from_union([from_str, from_none], obj.get("createdAt"))
         description = from_union([from_str, from_none], obj.get("description"))
         id = from_union([from_str, from_none], obj.get("id"))
         status = from_union([from_str, from_none], obj.get("status"))
         title = from_union([from_str, from_none], obj.get("title"))
-        return PlanSQLTodosRow(description, id, status, title)
+        return PlanSQLTodosRow(created_at, description, id, status, title)
 
     def to_dict(self) -> dict:
         result: dict = {}
+        if self.created_at is not None:
+            result["createdAt"] = from_union([from_str, from_none], self.created_at)
         if self.description is not None:
             result["description"] = from_union([from_str, from_none], self.description)
         if self.id is not None:
@@ -11173,9 +11978,6 @@ class SessionsOpenCreateKind(Enum):
 class SessionsOpenHandoffKind(Enum):
     HANDOFF = "handoff"
 
-class SessionsOpenRemoteKind(Enum):
-    REMOTE = "remote"
-
 class SessionsOpenResumeKind(Enum):
     RESUME = "resume"
 
@@ -13048,9 +13850,6 @@ def to_dict(self) -> dict:
         result["tokenCount"] = from_int(self.token_count)
         return result
 
-class UserAuthInfoType(Enum):
-    USER = "user"
-
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class UserSettingMetadata:
@@ -13769,61 +14568,6 @@ def to_dict(self) -> dict:
             result["field"] = from_union([lambda x: to_enum(AgentRegistrySpawnValidationErrorField, x), from_none], self.field)
         return result
 
-# Experimental: this type is part of an experimental API and may change or be removed.
-@dataclass
-class AllowAllPermissionSetResult:
-    """Indicates whether the operation succeeded and reports the post-mutation state."""
-
-    enabled: bool
-    """Authoritative full allow-all state after the mutation"""
-
-    success: bool
-    """Whether the operation succeeded"""
-
-    mode: PermissionsAllowAllMode | None = None
-    """Authoritative allow-all mode after the mutation"""
-
-    @staticmethod
-    def from_dict(obj: Any) -> 'AllowAllPermissionSetResult':
-        assert isinstance(obj, dict)
-        enabled = from_bool(obj.get("enabled"))
-        success = from_bool(obj.get("success"))
-        mode = from_union([PermissionsAllowAllMode, from_none], obj.get("mode"))
-        return AllowAllPermissionSetResult(enabled, success, mode)
-
-    def to_dict(self) -> dict:
-        result: dict = {}
-        result["enabled"] = from_bool(self.enabled)
-        result["success"] = from_bool(self.success)
-        if self.mode is not None:
-            result["mode"] = from_union([lambda x: to_enum(PermissionsAllowAllMode, x), from_none], self.mode)
-        return result
-
-# Experimental: this type is part of an experimental API and may change or be removed.
-@dataclass
-class AllowAllPermissionState:
-    """Current allow-all permission mode."""
-
-    enabled: bool
-    """Whether full allow-all permissions are currently active"""
-
-    mode: PermissionsAllowAllMode | None = None
-    """Current allow-all mode"""
-
-    @staticmethod
-    def from_dict(obj: Any) -> 'AllowAllPermissionState':
-        assert isinstance(obj, dict)
-        enabled = from_bool(obj.get("enabled"))
-        mode = from_union([PermissionsAllowAllMode, from_none], obj.get("mode"))
-        return AllowAllPermissionState(enabled, mode)
-
-    def to_dict(self) -> dict:
-        result: dict = {}
-        result["enabled"] = from_bool(self.enabled)
-        if self.mode is not None:
-            result["mode"] = from_union([lambda x: to_enum(PermissionsAllowAllMode, x), from_none], self.mode)
-        return result
-
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class BuiltInModelCatalog:
@@ -13892,6 +14636,734 @@ def to_dict(self) -> dict:
         result["type"] = to_enum(BuiltinToolInputSchemaType, self.type)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CardDigest:
+    """Semantic digest of a strictly parsed and schema-validated JSON MCP card. Both URL-backed
+    and embedded cards are canonicalised with RFC 8785 JSON Canonicalization Scheme, encoded
+    as UTF-8, and hashed with SHA-256.
+
+    Semantic digest of the exact validated JSON content bound to the plan handle.
+    """
+    algorithm: CardDigestAlgorithm
+    """Digest algorithm and canonical representation"""
+
+    value: str
+    """SHA-256 digest of the RFC 8785 canonical UTF-8 bytes, encoded as exactly 64 lowercase
+    hexadecimal characters.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CardDigest':
+        assert isinstance(obj, dict)
+        algorithm = CardDigestAlgorithm(obj.get("algorithm"))
+        value = from_str(obj.get("value"))
+        return CardDigest(algorithm, value)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["algorithm"] = to_enum(CardDigestAlgorithm, self.algorithm)
+        result["value"] = from_str(self.value)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogAuthenticationRequiredError:
+    """An optional catalog authentication exchange did not establish the caller's identity.
+    Anonymous search remains supported; this refusal is reserved for an operation that cannot
+    continue after the attempted exchange. It is distinct from `policy-rejected` and from a
+    network failure, and the reason identifies the recovery action.
+    """
+    kind: ClassVar[str] = "authentication-required"
+    """Discriminator: the caller is not authenticated"""
+
+    message: str
+    """Human-readable explanation, safe to surface. Never contains a credential or token, nor a
+    query, URL, handle, or secret.
+    """
+    reason: CatalogAuthenticationRequiredReason
+    """Why authentication failed. Only an expired credential justifies attempting a silent
+    refresh; an absent or rejected credential requires sign-in.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogAuthenticationRequiredError':
+        assert isinstance(obj, dict)
+        message = from_str(obj.get("message"))
+        reason = CatalogAuthenticationRequiredReason(obj.get("reason"))
+        return CatalogAuthenticationRequiredError(message, reason)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["kind"] = self.kind
+        result["message"] = from_str(self.message)
+        result["reason"] = to_enum(CatalogAuthenticationRequiredReason, self.reason)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogCandidateSourceEmbedded:
+    """Candidate whose card reference arrived inline. The document and its content-derived
+    properties stay behind the runtime boundary.
+    """
+    kind: ClassVar[str] = "embedded"
+    """Discriminator: the card is embedded, and carries no URL"""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogCandidateSourceEmbedded':
+        assert isinstance(obj, dict)
+        return CatalogCandidateSourceEmbedded()
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["kind"] = self.kind
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogCandidateSourceURL:
+    """Candidate whose card is retrieved from a URL through the runtime's hardened fetch
+    boundary.
+    """
+    kind: ClassVar[str] = "url"
+    """Discriminator: the card is URL-backed, and carries no embedded data"""
+
+    url: str
+    """Card URL as advertised. Inert untrusted data: the runtime retrieves it only through its
+    own hardened boundary, and it is never logged.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogCandidateSourceURL':
+        assert isinstance(obj, dict)
+        url = from_str(obj.get("url"))
+        return CatalogCandidateSourceURL(url)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["kind"] = self.kind
+        result["url"] = from_str(self.url)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class InstalledPluginSourceURL:
+    """Source descriptor for a direct URL plugin install, with URL, optional ref or full commit
+    SHA, and optional subpath.
+    """
+    source: MCPServerCardURLKind
+    """Constant value. Always "url"."""
+
+    url: str
+    """URL of the plugin source."""
+
+    path: str | None = None
+    """Optional source-relative path to the plugin."""
+
+    ref: str | None = None
+    """Optional Git ref to resolve."""
+
+    sha: str | None = None
+    """Optional full 40-character hexadecimal commit SHA."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'InstalledPluginSourceURL':
+        assert isinstance(obj, dict)
+        source = MCPServerCardURLKind(obj.get("source"))
+        url = from_str(obj.get("url"))
+        path = from_union([from_str, from_none], obj.get("path"))
+        ref = from_union([from_str, from_none], obj.get("ref"))
+        sha = from_union([from_str, from_none], obj.get("sha"))
+        return InstalledPluginSourceURL(source, url, path, ref, sha)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["source"] = to_enum(MCPServerCardURLKind, self.source)
+        result["url"] = from_str(self.url)
+        if self.path is not None:
+            result["path"] = from_union([from_str, from_none], self.path)
+        if self.ref is not None:
+            result["ref"] = from_union([from_str, from_none], self.ref)
+        if self.sha is not None:
+            result["sha"] = from_union([from_str, from_none], self.sha)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class SessionInstalledPluginSourceURL:
+    """Source descriptor for a direct URL plugin install, with URL, optional ref or full commit
+    SHA, and optional subpath.
+    """
+    source: MCPServerCardURLKind
+    """Constant value. Always "url"."""
+
+    url: str
+    """URL of the plugin source."""
+
+    path: str | None = None
+    """Optional source-relative path to the plugin."""
+
+    ref: str | None = None
+    """Optional Git ref to resolve."""
+
+    sha: str | None = None
+    """Optional full 40-character hexadecimal commit SHA."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'SessionInstalledPluginSourceURL':
+        assert isinstance(obj, dict)
+        source = MCPServerCardURLKind(obj.get("source"))
+        url = from_str(obj.get("url"))
+        path = from_union([from_str, from_none], obj.get("path"))
+        ref = from_union([from_str, from_none], obj.get("ref"))
+        sha = from_union([from_str, from_none], obj.get("sha"))
+        return SessionInstalledPluginSourceURL(source, url, path, ref, sha)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["source"] = to_enum(MCPServerCardURLKind, self.source)
+        result["url"] = from_str(self.url)
+        if self.path is not None:
+            result["path"] = from_union([from_str, from_none], self.path)
+        if self.ref is not None:
+            result["ref"] = from_union([from_str, from_none], self.ref)
+        if self.sha is not None:
+            result["sha"] = from_union([from_str, from_none], self.sha)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogNegotiatedContract:
+    """The protocol version and capability set the runtime actually honoured for a successful
+    catalog operation.
+
+    Protocol version and capabilities the runtime honoured.
+    """
+    granted_capabilities: list[CatalogCapability]
+    """Wire features the runtime understood for this operation. Always a superset of the
+    caller's required features, because any shortfall is a refusal instead. Operation
+    availability remains a separate typed result.
+    """
+    runtime_protocol_version: int
+    """Protocol version of the runtime that served the request."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogNegotiatedContract':
+        assert isinstance(obj, dict)
+        granted_capabilities = from_list(CatalogCapability, obj.get("grantedCapabilities"))
+        runtime_protocol_version = from_int(obj.get("runtimeProtocolVersion"))
+        return CatalogNegotiatedContract(granted_capabilities, runtime_protocol_version)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["grantedCapabilities"] = from_list(lambda x: to_enum(CatalogCapability, x), self.granted_capabilities)
+        result["runtimeProtocolVersion"] = from_int(self.runtime_protocol_version)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogSearchRequest:
+    """A bounded catalog search. Both the query length and the result count are capped by the
+    schema so a caller cannot request an unbounded scan.
+    """
+    contract: CatalogClientContract
+    """Protocol version and capabilities the caller requires."""
+
+    query: str
+    """Free-text search query. Never written to logs or telemetry."""
+
+    kinds: list[CatalogCandidateKind] | None = None
+    """Restrict results to these candidate kinds. When omitted, every kind the runtime supports
+    is searched.
+    """
+    limit: int | None = None
+    """Maximum number of candidates to return. Defaults to 10 when omitted."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogSearchRequest':
+        assert isinstance(obj, dict)
+        contract = CatalogClientContract.from_dict(obj.get("contract"))
+        query = from_str(obj.get("query"))
+        kinds = from_union([lambda x: from_list(CatalogCandidateKind, x), from_none], obj.get("kinds"))
+        limit = from_union([from_int, from_none], obj.get("limit"))
+        return CatalogSearchRequest(contract, query, kinds, limit)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["contract"] = to_class(CatalogClientContract, self.contract)
+        result["query"] = from_str(self.query)
+        if self.kinds is not None:
+            result["kinds"] = from_union([lambda x: from_list(lambda x: to_enum(CatalogCandidateKind, x), x), from_none], self.kinds)
+        if self.limit is not None:
+            result["limit"] = from_union([from_int, from_none], self.limit)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogContractViolationError:
+    """An upstream catalog response broke the wire contract. Most importantly, every result must
+    carry exactly one of a URL or embedded data: a result carrying both, or neither, is
+    refused here rather than being guessed at.
+    """
+    kind: ClassVar[str] = "contract-violation"
+    """Discriminator: the upstream response broke the contract"""
+
+    message: str
+    """Human-readable explanation, safe to surface. Never echoes response content, nor a query,
+    URL, handle, or secret.
+    """
+    reason: CatalogContractViolationReason
+    """Which rule the response broke."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogContractViolationError':
+        assert isinstance(obj, dict)
+        message = from_str(obj.get("message"))
+        reason = CatalogContractViolationReason(obj.get("reason"))
+        return CatalogContractViolationError(message, reason)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["kind"] = self.kind
+        result["message"] = from_str(self.message)
+        result["reason"] = to_enum(CatalogContractViolationReason, self.reason)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogHandleRejectedError:
+    """A presented handle was not accepted. Handles are runtime-instance scoped, TTL-bound, and
+    single-use, so each way of failing is reported distinctly.
+    """
+    handle_type: CatalogHandleType
+    """Which kind of handle was presented."""
+
+    kind: ClassVar[str] = "handle-rejected"
+    """Discriminator: a handle was rejected"""
+
+    message: str
+    """Human-readable explanation, safe to surface. Never contains the handle itself, nor a
+    query, URL, or secret.
+    """
+    reason: CatalogHandleRejectionReason
+    """Why the handle was rejected."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogHandleRejectedError':
+        assert isinstance(obj, dict)
+        handle_type = CatalogHandleType(obj.get("handleType"))
+        message = from_str(obj.get("message"))
+        reason = CatalogHandleRejectionReason(obj.get("reason"))
+        return CatalogHandleRejectedError(handle_type, message, reason)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["handleType"] = to_enum(CatalogHandleType, self.handle_type)
+        result["kind"] = self.kind
+        result["message"] = from_str(self.message)
+        result["reason"] = to_enum(CatalogHandleRejectionReason, self.reason)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogInvalidRequestError:
+    """The request was rejected before any work was done, because a bounded field fell outside
+    its permitted range or a required field was unusable.
+    """
+    field: CatalogInvalidRequestField
+    """Which request field was rejected."""
+
+    kind: ClassVar[str] = "invalid-request"
+    """Discriminator: the request itself was invalid"""
+
+    message: str
+    """Human-readable explanation, safe to surface. Never echoes the offending value, nor a
+    query, URL, handle, or secret.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogInvalidRequestError':
+        assert isinstance(obj, dict)
+        field = CatalogInvalidRequestField(obj.get("field"))
+        message = from_str(obj.get("message"))
+        return CatalogInvalidRequestError(field, message)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["field"] = to_enum(CatalogInvalidRequestField, self.field)
+        result["kind"] = self.kind
+        result["message"] = from_str(self.message)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogMalformedCardError:
+    """A card could not be parsed or did not satisfy its declared media type's schema."""
+
+    kind: ClassVar[str] = "malformed-card"
+    """Discriminator: the card was malformed"""
+
+    message: str
+    """Human-readable explanation, safe to surface. Never echoes card content, nor a query, URL,
+    handle, or secret.
+    """
+    reason: CatalogMalformedCardReason
+    """How the card failed validation."""
+
+    media_type: CatalogMediaType | None = None
+    """Media type the card was interpreted as, when it declared one this runtime recognises."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogMalformedCardError':
+        assert isinstance(obj, dict)
+        message = from_str(obj.get("message"))
+        reason = CatalogMalformedCardReason(obj.get("reason"))
+        media_type = from_union([CatalogMediaType, from_none], obj.get("mediaType"))
+        return CatalogMalformedCardError(message, reason, media_type)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["kind"] = self.kind
+        result["message"] = from_str(self.message)
+        result["reason"] = to_enum(CatalogMalformedCardReason, self.reason)
+        if self.media_type is not None:
+            result["mediaType"] = from_union([lambda x: to_enum(CatalogMediaType, x), from_none], self.media_type)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class MCPServerCardEmbedded:
+    """An MCP server card supplied inline as an inert document."""
+
+    data: str
+    """The card document verbatim, treated as inert untrusted bytes. The runtime parses and
+    validates it; the host is not expected to interpret it. Never logged.
+    """
+    kind: ClassVar[str] = "embedded"
+    """Discriminator: the card is embedded, and carries no URL"""
+
+    media_type: MCPServerCardMediaType
+    """Media type the card is expected to conform to."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'MCPServerCardEmbedded':
+        assert isinstance(obj, dict)
+        data = from_str(obj.get("data"))
+        media_type = MCPServerCardMediaType(obj.get("mediaType"))
+        return MCPServerCardEmbedded(data, media_type)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["data"] = from_str(self.data)
+        result["kind"] = self.kind
+        result["mediaType"] = to_enum(MCPServerCardMediaType, self.media_type)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class MCPServerCardURL:
+    """An MCP server card to be retrieved from a URL through the runtime's hardened fetch
+    boundary.
+    """
+    kind: ClassVar[str] = "url"
+    """Discriminator: the card is URL-backed, and carries no embedded data"""
+
+    media_type: MCPServerCardMediaType
+    """Media type the card is expected to conform to."""
+
+    url: str
+    """Card URL. Retrieved only through the runtime's hardened boundary, with scheme,
+    credential, address-range, redirect, timeout, and response-size controls applied. Never
+    logged.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'MCPServerCardURL':
+        assert isinstance(obj, dict)
+        media_type = MCPServerCardMediaType(obj.get("mediaType"))
+        url = from_str(obj.get("url"))
+        return MCPServerCardURL(media_type, url)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["kind"] = self.kind
+        result["mediaType"] = to_enum(MCPServerCardMediaType, self.media_type)
+        result["url"] = from_str(self.url)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogNegotiationRefusedError:
+    """The caller's protocol version or required capabilities cannot be honoured. Returned
+    instead of a partial or ambiguous success.
+    """
+    kind: ClassVar[str] = "negotiation-refused"
+    """Discriminator: capability or protocol-version negotiation failed"""
+
+    message: str
+    """Human-readable explanation, safe to surface. Never contains a query, URL, handle, or
+    secret.
+    """
+    minimum_supported_protocol_version: int
+    """Lowest caller protocol version this runtime will serve."""
+
+    reason: CatalogNegotiationRefusedReason
+    """Whether the version or the capability set was the problem."""
+
+    runtime_protocol_version: int
+    """Protocol version of the runtime that refused the request."""
+
+    supported_capabilities: list[CatalogCapability]
+    """Every wire feature this runtime understands, so the caller can retry within that
+    contract. This list does not imply that every deployment has enabled every operation.
+    """
+    unsupported_capabilities: list[str]
+    """The subset of the caller's bounded extensible capability identifiers this runtime cannot
+    honour.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogNegotiationRefusedError':
+        assert isinstance(obj, dict)
+        message = from_str(obj.get("message"))
+        minimum_supported_protocol_version = from_int(obj.get("minimumSupportedProtocolVersion"))
+        reason = CatalogNegotiationRefusedReason(obj.get("reason"))
+        runtime_protocol_version = from_int(obj.get("runtimeProtocolVersion"))
+        supported_capabilities = from_list(CatalogCapability, obj.get("supportedCapabilities"))
+        unsupported_capabilities = from_list(from_str, obj.get("unsupportedCapabilities"))
+        return CatalogNegotiationRefusedError(message, minimum_supported_protocol_version, reason, runtime_protocol_version, supported_capabilities, unsupported_capabilities)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["kind"] = self.kind
+        result["message"] = from_str(self.message)
+        result["minimumSupportedProtocolVersion"] = from_int(self.minimum_supported_protocol_version)
+        result["reason"] = to_enum(CatalogNegotiationRefusedReason, self.reason)
+        result["runtimeProtocolVersion"] = from_int(self.runtime_protocol_version)
+        result["supportedCapabilities"] = from_list(lambda x: to_enum(CatalogCapability, x), self.supported_capabilities)
+        result["unsupportedCapabilities"] = from_list(from_str, self.unsupported_capabilities)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogNetworkFailureError:
+    """The runtime could not reach the catalog authority or retrieve a card. Covers being
+    offline as well as transport-level failure.
+    """
+    kind: ClassVar[str] = "network-failure"
+    """Discriminator: the network operation failed"""
+
+    message: str
+    """Human-readable explanation, safe to surface. Never contains a query, URL, handle, or
+    secret.
+    """
+    reason: CatalogNetworkFailureReason
+    """Categorised failure, low cardinality so it can be aggregated without carrying a URL."""
+
+    status_code: int | None = None
+    """HTTP status code, when the failure was a rejected response."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogNetworkFailureError':
+        assert isinstance(obj, dict)
+        message = from_str(obj.get("message"))
+        reason = CatalogNetworkFailureReason(obj.get("reason"))
+        status_code = from_union([from_int, from_none], obj.get("statusCode"))
+        return CatalogNetworkFailureError(message, reason, status_code)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["kind"] = self.kind
+        result["message"] = from_str(self.message)
+        result["reason"] = to_enum(CatalogNetworkFailureReason, self.reason)
+        if self.status_code is not None:
+            result["statusCode"] = from_union([from_int, from_none], self.status_code)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogNotInstallableError:
+    """The candidate is discoverable but cannot be installed. `application/ai-skill` resolves
+    here, because it stays searchable while remaining typed non-installable.
+    """
+    kind: ClassVar[str] = "not-installable"
+    """Discriminator: the candidate cannot be installed"""
+
+    message: str
+    """Human-readable explanation, safe to surface. Never contains a query, URL, handle, or
+    secret.
+    """
+    reason: CatalogNotInstallableReason
+    """Why the candidate cannot be installed."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogNotInstallableError':
+        assert isinstance(obj, dict)
+        message = from_str(obj.get("message"))
+        reason = CatalogNotInstallableReason(obj.get("reason"))
+        return CatalogNotInstallableError(message, reason)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["kind"] = self.kind
+        result["message"] = from_str(self.message)
+        result["reason"] = to_enum(CatalogNotInstallableReason, self.reason)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogPolicyRejectedError:
+    """Registry or enterprise policy refused the operation."""
+
+    kind: ClassVar[str] = "policy-rejected"
+    """Discriminator: policy refused the operation"""
+
+    message: str
+    """Human-readable explanation, safe to surface. Never contains a query, URL, handle, or
+    secret.
+    """
+    source: MCPPlanPolicySource
+    """Which authority produced the decision."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogPolicyRejectedError':
+        assert isinstance(obj, dict)
+        message = from_str(obj.get("message"))
+        source = MCPPlanPolicySource(obj.get("source"))
+        return CatalogPolicyRejectedError(message, source)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["kind"] = self.kind
+        result["message"] = from_str(self.message)
+        result["source"] = to_enum(MCPPlanPolicySource, self.source)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogUnavailableError:
+    """The operation is not available on this runtime. Distinct from a network failure: nothing
+    was attempted.
+    """
+    kind: ClassVar[str] = "unavailable"
+    """Discriminator: the operation is not available"""
+
+    message: str
+    """Human-readable explanation, safe to surface. Never contains a query, URL, handle, or
+    secret.
+    """
+    reason: CatalogUnavailableReason
+    """Why the operation is unavailable."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogUnavailableError':
+        assert isinstance(obj, dict)
+        message = from_str(obj.get("message"))
+        reason = CatalogUnavailableReason(obj.get("reason"))
+        return CatalogUnavailableError(message, reason)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["kind"] = self.kind
+        result["message"] = from_str(self.message)
+        result["reason"] = to_enum(CatalogUnavailableReason, self.reason)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogUnavailableTransportError:
+    """No transport this runtime can use is available for the requested server."""
+
+    kind: ClassVar[str] = "unavailable-transport"
+    """Discriminator: no usable transport is available"""
+
+    message: str
+    """Human-readable explanation, safe to surface. Never contains a query, URL, handle, or
+    secret.
+    """
+    reason: CatalogUnavailableTransportReason
+    """Why no transport could be offered."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogUnavailableTransportError':
+        assert isinstance(obj, dict)
+        message = from_str(obj.get("message"))
+        reason = CatalogUnavailableTransportReason(obj.get("reason"))
+        return CatalogUnavailableTransportError(message, reason)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["kind"] = self.kind
+        result["message"] = from_str(self.message)
+        result["reason"] = to_enum(CatalogUnavailableTransportReason, self.reason)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogUnsafeRetrievalError:
+    """Retrieval was refused by the runtime's hardened fetch boundary before any request left
+    the process, or before a redirect was followed.
+    """
+    kind: ClassVar[str] = "unsafe-retrieval"
+    """Discriminator: retrieval was refused as unsafe"""
+
+    message: str
+    """Human-readable explanation, safe to surface. Never contains the refused URL, nor a query,
+    handle, or secret.
+    """
+    reason: CatalogUnsafeRetrievalReason
+    """Which control refused the retrieval, low cardinality so it can be aggregated without
+    carrying a URL.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogUnsafeRetrievalError':
+        assert isinstance(obj, dict)
+        message = from_str(obj.get("message"))
+        reason = CatalogUnsafeRetrievalReason(obj.get("reason"))
+        return CatalogUnsafeRetrievalError(message, reason)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["kind"] = self.kind
+        result["message"] = from_str(self.message)
+        result["reason"] = to_enum(CatalogUnsafeRetrievalReason, self.reason)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogUnsupportedKindError:
+    """The request asked for a candidate kind this runtime does not serve."""
+
+    kind: ClassVar[str] = "unsupported-kind"
+    """Discriminator: an unsupported candidate kind was requested"""
+
+    message: str
+    """Human-readable explanation, safe to surface. Never contains a query, URL, handle, or
+    secret.
+    """
+    requested_kinds: list[CatalogCandidateKind]
+    """The kinds from the request that are not supported."""
+
+    supported_kinds: list[CatalogCandidateKind]
+    """Every candidate kind this runtime can serve."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogUnsupportedKindError':
+        assert isinstance(obj, dict)
+        message = from_str(obj.get("message"))
+        requested_kinds = from_list(CatalogCandidateKind, obj.get("requestedKinds"))
+        supported_kinds = from_list(CatalogCandidateKind, obj.get("supportedKinds"))
+        return CatalogUnsupportedKindError(message, requested_kinds, supported_kinds)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["kind"] = self.kind
+        result["message"] = from_str(self.message)
+        result["requestedKinds"] = from_list(lambda x: to_enum(CatalogCandidateKind, x), self.requested_kinds)
+        result["supportedKinds"] = from_list(lambda x: to_enum(CatalogCandidateKind, x), self.supported_kinds)
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class SlashCommandInput:
@@ -14293,6 +15765,119 @@ def to_dict(self) -> dict:
             result["url"] = from_union([from_str, from_none], self.url)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogAISkillCandidateProvenance:
+    """Where the catalog reference was observed, without the card itself or any content digest.
+
+    Where and when an AI skill catalog reference was observed. Discovery provenance
+    deliberately carries no content digest because search does not establish the exact
+    validated content a later plan will bind.
+    """
+    authority: str
+    """Host of the catalog authority that advertised the reference, without path, query, or
+    credentials. Inert untrusted data.
+    """
+    media_type: MediaType
+    """Media type advertised for the referenced AI skill card"""
+
+    observed_at: str
+    """ISO 8601 timestamp at which the runtime observed the catalog reference. This is not a
+    retrieval or validation timestamp.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogAISkillCandidateProvenance':
+        assert isinstance(obj, dict)
+        authority = from_str(obj.get("authority"))
+        media_type = MediaType(obj.get("mediaType"))
+        observed_at = from_str(obj.get("observedAt"))
+        return CatalogAISkillCandidateProvenance(authority, media_type, observed_at)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["authority"] = from_str(self.authority)
+        result["mediaType"] = to_enum(MediaType, self.media_type)
+        result["observedAt"] = from_str(self.observed_at)
+        return result
+
+@dataclass
+class CatalogCandidateProvenance:
+    """Where the catalog reference was observed, without the card itself or any content digest.
+
+    Where and when an MCP server catalog reference was observed. Discovery provenance
+    deliberately carries no content digest because search does not establish the exact
+    validated content a later plan will bind.
+
+    Where and when an AI skill catalog reference was observed. Discovery provenance
+    deliberately carries no content digest because search does not establish the exact
+    validated content a later plan will bind.
+    """
+    authority: str
+    """Host of the catalog authority that advertised the reference, without path, query, or
+    credentials. Inert untrusted data.
+    """
+    media_type: CatalogMediaType
+    """JSON MCP media type advertised for the referenced card.
+
+    Media type advertised for the referenced AI skill card
+    """
+    observed_at: str
+    """ISO 8601 timestamp at which the runtime observed the catalog reference. This is not a
+    retrieval or validation timestamp.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogCandidateProvenance':
+        assert isinstance(obj, dict)
+        authority = from_str(obj.get("authority"))
+        media_type = CatalogMediaType(obj.get("mediaType"))
+        observed_at = from_str(obj.get("observedAt"))
+        return CatalogCandidateProvenance(authority, media_type, observed_at)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["authority"] = from_str(self.authority)
+        result["mediaType"] = to_enum(CatalogMediaType, self.media_type)
+        result["observedAt"] = from_str(self.observed_at)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogMCPServerCandidateProvenance:
+    """Where the catalog reference was observed, without the card itself or any content digest.
+
+    Where and when an MCP server catalog reference was observed. Discovery provenance
+    deliberately carries no content digest because search does not establish the exact
+    validated content a later plan will bind.
+    """
+    authority: str
+    """Host of the catalog authority that advertised the reference, without path, query, or
+    credentials. Inert untrusted data.
+    """
+    media_type: MCPServerCardMediaType
+    """JSON MCP media type advertised for the referenced card."""
+
+    observed_at: str
+    """ISO 8601 timestamp at which the runtime observed the catalog reference. This is not a
+    retrieval or validation timestamp.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogMCPServerCandidateProvenance':
+        assert isinstance(obj, dict)
+        authority = from_str(obj.get("authority"))
+        media_type = MCPServerCardMediaType(obj.get("mediaType"))
+        observed_at = from_str(obj.get("observedAt"))
+        return CatalogMCPServerCandidateProvenance(authority, media_type, observed_at)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["authority"] = from_str(self.authority)
+        result["mediaType"] = to_enum(MCPServerCardMediaType, self.media_type)
+        result["observedAt"] = from_str(self.observed_at)
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class CompletionsRequestResult:
@@ -15607,7 +17192,7 @@ class InstalledPluginSource:
 
     Source descriptor for a direct local plugin install, with a local filesystem path.
     """
-    source: PurpleSource
+    source: InstalledPluginSourceURLSource
     """Constant value. Always "github".
 
     Constant value. Always "url".
@@ -15636,7 +17221,7 @@ class InstalledPluginSource:
     @staticmethod
     def from_dict(obj: Any) -> 'InstalledPluginSource':
         assert isinstance(obj, dict)
-        source = PurpleSource(obj.get("source"))
+        source = InstalledPluginSourceURLSource(obj.get("source"))
         path = from_union([from_str, from_none], obj.get("path"))
         ref = from_union([from_str, from_none], obj.get("ref"))
         repo = from_union([from_str, from_none], obj.get("repo"))
@@ -15646,7 +17231,7 @@ def from_dict(obj: Any) -> 'InstalledPluginSource':
 
     def to_dict(self) -> dict:
         result: dict = {}
-        result["source"] = to_enum(PurpleSource, self.source)
+        result["source"] = to_enum(InstalledPluginSourceURLSource, self.source)
         if self.path is not None:
             result["path"] = from_union([from_str, from_none], self.path)
         if self.ref is not None:
@@ -15670,7 +17255,7 @@ class SessionInstalledPluginSource:
 
     Source descriptor for a direct local plugin install, with a local filesystem path.
     """
-    source: PurpleSource
+    source: InstalledPluginSourceURLSource
     """Constant value. Always "github".
 
     Constant value. Always "url".
@@ -15699,7 +17284,7 @@ class SessionInstalledPluginSource:
     @staticmethod
     def from_dict(obj: Any) -> 'SessionInstalledPluginSource':
         assert isinstance(obj, dict)
-        source = PurpleSource(obj.get("source"))
+        source = InstalledPluginSourceURLSource(obj.get("source"))
         path = from_union([from_str, from_none], obj.get("path"))
         ref = from_union([from_str, from_none], obj.get("ref"))
         repo = from_union([from_str, from_none], obj.get("repo"))
@@ -15709,7 +17294,7 @@ def from_dict(obj: Any) -> 'SessionInstalledPluginSource':
 
     def to_dict(self) -> dict:
         result: dict = {}
-        result["source"] = to_enum(PurpleSource, self.source)
+        result["source"] = to_enum(InstalledPluginSourceURLSource, self.source)
         if self.path is not None:
             result["path"] = from_union([from_str, from_none], self.path)
         if self.ref is not None:
@@ -15731,7 +17316,7 @@ class InstalledPluginSourceGitHub:
     repo: str
     """GitHub repository in `owner/repo` form."""
 
-    source: FluffySource
+    source: PurpleSource
     """Constant value. Always "github"."""
 
     path: str | None = None
@@ -15747,7 +17332,7 @@ class InstalledPluginSourceGitHub:
     def from_dict(obj: Any) -> 'InstalledPluginSourceGitHub':
         assert isinstance(obj, dict)
         repo = from_str(obj.get("repo"))
-        source = FluffySource(obj.get("source"))
+        source = PurpleSource(obj.get("source"))
         path = from_union([from_str, from_none], obj.get("path"))
         ref = from_union([from_str, from_none], obj.get("ref"))
         sha = from_union([from_str, from_none], obj.get("sha"))
@@ -15756,7 +17341,7 @@ def from_dict(obj: Any) -> 'InstalledPluginSourceGitHub':
     def to_dict(self) -> dict:
         result: dict = {}
         result["repo"] = from_str(self.repo)
-        result["source"] = to_enum(FluffySource, self.source)
+        result["source"] = to_enum(PurpleSource, self.source)
         if self.path is not None:
             result["path"] = from_union([from_str, from_none], self.path)
         if self.ref is not None:
@@ -15774,7 +17359,7 @@ class SessionInstalledPluginSourceGitHub:
     repo: str
     """GitHub repository in `owner/repo` form."""
 
-    source: FluffySource
+    source: PurpleSource
     """Constant value. Always "github"."""
 
     path: str | None = None
@@ -15790,7 +17375,7 @@ class SessionInstalledPluginSourceGitHub:
     def from_dict(obj: Any) -> 'SessionInstalledPluginSourceGitHub':
         assert isinstance(obj, dict)
         repo = from_str(obj.get("repo"))
-        source = FluffySource(obj.get("source"))
+        source = PurpleSource(obj.get("source"))
         path = from_union([from_str, from_none], obj.get("path"))
         ref = from_union([from_str, from_none], obj.get("ref"))
         sha = from_union([from_str, from_none], obj.get("sha"))
@@ -15799,7 +17384,7 @@ def from_dict(obj: Any) -> 'SessionInstalledPluginSourceGitHub':
     def to_dict(self) -> dict:
         result: dict = {}
         result["repo"] = from_str(self.repo)
-        result["source"] = to_enum(FluffySource, self.source)
+        result["source"] = to_enum(PurpleSource, self.source)
         if self.path is not None:
             result["path"] = from_union([from_str, from_none], self.path)
         if self.ref is not None:
@@ -15816,20 +17401,20 @@ class InstalledPluginSourceLocal:
     path: str
     """Local filesystem path to the plugin."""
 
-    source: TentacledSource
+    source: FluffySource
     """Constant value. Always "local"."""
 
     @staticmethod
     def from_dict(obj: Any) -> 'InstalledPluginSourceLocal':
         assert isinstance(obj, dict)
         path = from_str(obj.get("path"))
-        source = TentacledSource(obj.get("source"))
+        source = FluffySource(obj.get("source"))
         return InstalledPluginSourceLocal(path, source)
 
     def to_dict(self) -> dict:
         result: dict = {}
         result["path"] = from_str(self.path)
-        result["source"] = to_enum(TentacledSource, self.source)
+        result["source"] = to_enum(FluffySource, self.source)
         return result
 
 # Experimental: this type is part of an experimental API and may change or be removed.
@@ -15840,106 +17425,20 @@ class SessionInstalledPluginSourceLocal:
     path: str
     """Local filesystem path to the plugin."""
 
-    source: TentacledSource
+    source: FluffySource
     """Constant value. Always "local"."""
 
     @staticmethod
     def from_dict(obj: Any) -> 'SessionInstalledPluginSourceLocal':
         assert isinstance(obj, dict)
         path = from_str(obj.get("path"))
-        source = TentacledSource(obj.get("source"))
+        source = FluffySource(obj.get("source"))
         return SessionInstalledPluginSourceLocal(path, source)
 
     def to_dict(self) -> dict:
         result: dict = {}
         result["path"] = from_str(self.path)
-        result["source"] = to_enum(TentacledSource, self.source)
-        return result
-
-# Experimental: this type is part of an experimental API and may change or be removed.
-@dataclass
-class InstalledPluginSourceURL:
-    """Source descriptor for a direct URL plugin install, with URL, optional ref or full commit
-    SHA, and optional subpath.
-    """
-    source: StickySource
-    """Constant value. Always "url"."""
-
-    url: str
-    """URL of the plugin source."""
-
-    path: str | None = None
-    """Optional source-relative path to the plugin."""
-
-    ref: str | None = None
-    """Optional Git ref to resolve."""
-
-    sha: str | None = None
-    """Optional full 40-character hexadecimal commit SHA."""
-
-    @staticmethod
-    def from_dict(obj: Any) -> 'InstalledPluginSourceURL':
-        assert isinstance(obj, dict)
-        source = StickySource(obj.get("source"))
-        url = from_str(obj.get("url"))
-        path = from_union([from_str, from_none], obj.get("path"))
-        ref = from_union([from_str, from_none], obj.get("ref"))
-        sha = from_union([from_str, from_none], obj.get("sha"))
-        return InstalledPluginSourceURL(source, url, path, ref, sha)
-
-    def to_dict(self) -> dict:
-        result: dict = {}
-        result["source"] = to_enum(StickySource, self.source)
-        result["url"] = from_str(self.url)
-        if self.path is not None:
-            result["path"] = from_union([from_str, from_none], self.path)
-        if self.ref is not None:
-            result["ref"] = from_union([from_str, from_none], self.ref)
-        if self.sha is not None:
-            result["sha"] = from_union([from_str, from_none], self.sha)
-        return result
-
-# Experimental: this type is part of an experimental API and may change or be removed.
-@dataclass
-class SessionInstalledPluginSourceURL:
-    """Source descriptor for a direct URL plugin install, with URL, optional ref or full commit
-    SHA, and optional subpath.
-    """
-    source: StickySource
-    """Constant value. Always "url"."""
-
-    url: str
-    """URL of the plugin source."""
-
-    path: str | None = None
-    """Optional source-relative path to the plugin."""
-
-    ref: str | None = None
-    """Optional Git ref to resolve."""
-
-    sha: str | None = None
-    """Optional full 40-character hexadecimal commit SHA."""
-
-    @staticmethod
-    def from_dict(obj: Any) -> 'SessionInstalledPluginSourceURL':
-        assert isinstance(obj, dict)
-        source = StickySource(obj.get("source"))
-        url = from_str(obj.get("url"))
-        path = from_union([from_str, from_none], obj.get("path"))
-        ref = from_union([from_str, from_none], obj.get("ref"))
-        sha = from_union([from_str, from_none], obj.get("sha"))
-        return SessionInstalledPluginSourceURL(source, url, path, ref, sha)
-
-    def to_dict(self) -> dict:
-        result: dict = {}
-        result["source"] = to_enum(StickySource, self.source)
-        result["url"] = from_str(self.url)
-        if self.path is not None:
-            result["path"] = from_union([from_str, from_none], self.path)
-        if self.ref is not None:
-            result["ref"] = from_union([from_str, from_none], self.ref)
-        if self.sha is not None:
-            result["sha"] = from_union([from_str, from_none], self.sha)
+        result["source"] = to_enum(FluffySource, self.source)
         return result
 
 # Experimental: this type is part of an experimental API and may change or be removed.
@@ -16812,6 +18311,141 @@ def to_dict(self) -> dict:
         result["pendingConnections"] = from_list(from_str, self.pending_connections)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class MCPPlanConfigurationChange:
+    """One change applying the plan would make, described rather than serialised so the
+    configuration payload stays behind the runtime boundary.
+    """
+    changed_fields: list[str]
+    """Names of the configuration fields the change would set, without their values."""
+
+    config_key: str
+    """Configuration key the change applies to."""
+
+    operation: MCPPlanConfigurationOperation
+    """Whether the change would create a new entry or modify an existing one."""
+
+    scope: MCPPlanScope
+    """Scope the change would be written to."""
+
+    secret_references: list[str]
+    """Secret placeholders the written configuration would reference. The constrained
+    placeholder type cannot carry a literal secret value.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'MCPPlanConfigurationChange':
+        assert isinstance(obj, dict)
+        changed_fields = from_list(from_str, obj.get("changedFields"))
+        config_key = from_str(obj.get("configKey"))
+        operation = MCPPlanConfigurationOperation(obj.get("operation"))
+        scope = MCPPlanScope(obj.get("scope"))
+        secret_references = from_list(from_str, obj.get("secretReferences"))
+        return MCPPlanConfigurationChange(changed_fields, config_key, operation, scope, secret_references)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["changedFields"] = from_list(from_str, self.changed_fields)
+        result["configKey"] = from_str(self.config_key)
+        result["operation"] = to_enum(MCPPlanConfigurationOperation, self.operation)
+        result["scope"] = to_enum(MCPPlanScope, self.scope)
+        result["secretReferences"] = from_list(from_str, self.secret_references)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class MCPPlanTarget:
+    """Configuration scope and key the plan would write to.
+
+    Where a plan would be written.
+    """
+    config_key: str
+    """Configuration key the server would be recorded under within that scope."""
+
+    scope: MCPPlanScope
+    """Configuration scope the plan targets."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'MCPPlanTarget':
+        assert isinstance(obj, dict)
+        config_key = from_str(obj.get("configKey"))
+        scope = MCPPlanScope(obj.get("scope"))
+        return MCPPlanTarget(config_key, scope)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["configKey"] = from_str(self.config_key)
+        result["scope"] = to_enum(MCPPlanScope, self.scope)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class MCPPlanInstallRequest:
+    """A side-effect-free request for an MCP install plan. Computing a plan never writes
+    configuration, stores a secret, or reloads MCP servers.
+    """
+    contract: CatalogClientContract
+    """Protocol version and capabilities the caller requires."""
+
+    source: MCPPlanInstallSource
+    """What to plan: either a candidate handle from a previous search, or a card supplied
+    directly.
+    """
+    scope: MCPPlanScope | None = None
+    """Configuration scope the plan targets. Defaults to user scope when omitted."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'MCPPlanInstallRequest':
+        assert isinstance(obj, dict)
+        contract = CatalogClientContract.from_dict(obj.get("contract"))
+        source = _load_MCPPlanInstallSource(obj.get("source"))
+        scope = from_union([MCPPlanScope, from_none], obj.get("scope"))
+        return MCPPlanInstallRequest(contract, source, scope)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["contract"] = to_class(CatalogClientContract, self.contract)
+        result["source"] = (self.source).to_dict()
+        if self.scope is not None:
+            result["scope"] = from_union([lambda x: to_enum(MCPPlanScope, x), from_none], self.scope)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class MCPPlanPolicyResult:
+    """Outcome of evaluating the server against registry and enterprise policy.
+
+    Outcome of evaluating the planned server against registry and enterprise policy.
+    Evaluation is read-only.
+    """
+    decision: MCPPlanPolicyDecision
+    """What policy decided for this server."""
+
+    source: MCPPlanPolicySource
+    """Which authority produced the decision."""
+
+    reason: str | None = None
+    """Human-readable explanation, safe to surface. Never contains a query, URL, handle, or
+    secret.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'MCPPlanPolicyResult':
+        assert isinstance(obj, dict)
+        decision = MCPPlanPolicyDecision(obj.get("decision"))
+        source = MCPPlanPolicySource(obj.get("source"))
+        reason = from_union([from_str, from_none], obj.get("reason"))
+        return MCPPlanPolicyResult(decision, source, reason)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["decision"] = to_enum(MCPPlanPolicyDecision, self.decision)
+        result["source"] = to_enum(MCPPlanPolicySource, self.source)
+        if self.reason is not None:
+            result["reason"] = from_union([from_str, from_none], self.reason)
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class MCPOauthPendingRequestResponse:
@@ -16849,6 +18483,291 @@ def to_dict(self) -> dict:
             result["tokenType"] = from_union([from_str, from_none], self.token_type)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class MCPPlanRequiredValueEnum:
+    """One enumerated non-secret value a transport choice needs before it can be applied. The
+    permitted values are structurally required.
+    """
+    category: MCPPlanValueCategory
+    """Where the value is applied when the server is launched."""
+
+    enum_values: list[str]
+    """Non-empty permitted value set. Inert untrusted data."""
+
+    is_repeated: bool
+    """Whether the value may be supplied more than once."""
+
+    key: str
+    """Key the value is supplied under. Inert untrusted data."""
+
+    kind: ClassVar[str] = "enum"
+    """Discriminator: this required value uses a fixed enumeration."""
+
+    required: bool
+    """Whether the value must be present for the plan to be applicable."""
+
+    value_type: MCPPlan
+    """Discriminator: the value must be one of `enumValues`."""
+
+    default_value: str | None = None
+    """Default supplied by the card, when the value can be resolved without input. Presence is
+    the authoritative indication that a default exists. Inert untrusted data.
+    """
+    description: str | None = None
+    """Human-readable explanation from the card. Inert untrusted text."""
+
+    title: str | None = None
+    """Human-readable label from the card. Inert untrusted text."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'MCPPlanRequiredValueEnum':
+        assert isinstance(obj, dict)
+        category = MCPPlanValueCategory(obj.get("category"))
+        enum_values = from_list(from_str, obj.get("enumValues"))
+        is_repeated = from_bool(obj.get("isRepeated"))
+        key = from_str(obj.get("key"))
+        required = from_bool(obj.get("required"))
+        value_type = MCPPlan(obj.get("valueType"))
+        default_value = from_union([from_str, from_none], obj.get("defaultValue"))
+        description = from_union([from_str, from_none], obj.get("description"))
+        title = from_union([from_str, from_none], obj.get("title"))
+        return MCPPlanRequiredValueEnum(category, enum_values, is_repeated, key, required, value_type, default_value, description, title)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["category"] = to_enum(MCPPlanValueCategory, self.category)
+        result["enumValues"] = from_list(from_str, self.enum_values)
+        result["isRepeated"] = from_bool(self.is_repeated)
+        result["key"] = from_str(self.key)
+        result["kind"] = self.kind
+        result["required"] = from_bool(self.required)
+        result["valueType"] = to_enum(MCPPlan, self.value_type)
+        if self.default_value is not None:
+            result["defaultValue"] = from_union([from_str, from_none], self.default_value)
+        if self.description is not None:
+            result["description"] = from_union([from_str, from_none], self.description)
+        if self.title is not None:
+            result["title"] = from_union([from_str, from_none], self.title)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class MCPPlanInstallSourceCandidate:
+    """Plan from a candidate returned by a previous catalog search."""
+
+    candidate_handle: str
+    """Single-use candidate handle. Consumed by this call, so a replay of the same handle is
+    rejected.
+    """
+    kind: ClassVar[str] = "candidate"
+    """Discriminator: plan from a previously returned candidate"""
+
+    search_id: str
+    """The runtime- or authority-minted `searchId` returned with the search that produced this
+    candidate. A search implementation binds it to private candidate-handle context; a
+    planning implementation must verify that context before returning a plan. The unavailable
+    planning implementation in this contract layer validates presence but does not claim the
+    verification has occurred. It identifies a search rather than a person and must never be
+    joined with user identity to re-identify anyone.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'MCPPlanInstallSourceCandidate':
+        assert isinstance(obj, dict)
+        candidate_handle = from_str(obj.get("candidateHandle"))
+        search_id = from_str(obj.get("searchId"))
+        return MCPPlanInstallSourceCandidate(candidate_handle, search_id)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["candidateHandle"] = from_str(self.candidate_handle)
+        result["kind"] = self.kind
+        result["searchId"] = from_str(self.search_id)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class MCPPlanInstallSourceCard:
+    """Plan from a card supplied directly by the caller, without a preceding search."""
+
+    card: MCPServerCardReference
+    """The card to plan from: exactly one of a URL or embedded data."""
+
+    kind: ClassVar[str] = "card"
+    """Discriminator: plan from a caller-supplied card"""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'MCPPlanInstallSourceCard':
+        assert isinstance(obj, dict)
+        card = _load_MCPServerCardReference(obj.get("card"))
+        return MCPPlanInstallSourceCard(card)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["card"] = (self.card).to_dict()
+        result["kind"] = self.kind
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class MCPPlanTransportChoicePackage:
+    """An eligible local-package transport choice. Package identity is required and a remote
+    endpoint cannot be represented.
+    """
+    choice_id: str
+    """Stable identifier for this choice within the plan, used to select it when the plan is
+    applied.
+    """
+    install_method: MCPPlanPackageInstallMethod
+    """Discriminator: this choice runs a local package"""
+
+    package_identifier: str
+    """Package identifier. Inert untrusted data."""
+
+    package_type: str
+    """Packaging ecosystem, for example `oci` or `npm`."""
+
+    required_values: list[MCPPlanRequiredValue]
+    """Typed values this choice requires, excluding secrets."""
+
+    secret_placeholders: list[MCPPlanSecretPlaceholder]
+    """Secrets this choice requires, referenced by placeholder only."""
+
+    transport: MCPPlanPackageTransport
+    """Local process transport this package choice would use."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'MCPPlanTransportChoicePackage':
+        assert isinstance(obj, dict)
+        choice_id = from_str(obj.get("choiceId"))
+        install_method = MCPPlanPackageInstallMethod(obj.get("installMethod"))
+        package_identifier = from_str(obj.get("packageIdentifier"))
+        package_type = from_str(obj.get("packageType"))
+        required_values = from_list(_load_MCPPlanRequiredValue, obj.get("requiredValues"))
+        secret_placeholders = from_list(MCPPlanSecretPlaceholder.from_dict, obj.get("secretPlaceholders"))
+        transport = MCPPlanPackageTransport(obj.get("transport"))
+        return MCPPlanTransportChoicePackage(choice_id, install_method, package_identifier, package_type, required_values, secret_placeholders, transport)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["choiceId"] = from_str(self.choice_id)
+        result["installMethod"] = to_enum(MCPPlanPackageInstallMethod, self.install_method)
+        result["packageIdentifier"] = from_str(self.package_identifier)
+        result["packageType"] = from_str(self.package_type)
+        result["requiredValues"] = from_list(lambda x: (x).to_dict(), self.required_values)
+        result["secretPlaceholders"] = from_list(lambda x: to_class(MCPPlanSecretPlaceholder, x), self.secret_placeholders)
+        result["transport"] = to_enum(MCPPlanPackageTransport, self.transport)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class MCPPlanTransportChoiceRemote:
+    """An eligible remote-endpoint transport choice. The endpoint is required and package
+    identity cannot be represented.
+    """
+    choice_id: str
+    """Stable identifier for this choice within the plan, used to select it when the plan is
+    applied.
+    """
+    endpoint: str
+    """Endpoint URL. Inert untrusted data."""
+
+    install_method: MCPPlanRemoteInstallMethod
+    """Discriminator: this choice connects to a remote endpoint"""
+
+    required_values: list[MCPPlanRequiredValue]
+    """Typed values this choice requires, excluding secrets."""
+
+    secret_placeholders: list[MCPPlanSecretPlaceholder]
+    """Secrets this choice requires, referenced by placeholder only."""
+
+    transport: MCPPlanRemoteTransport
+    """Endpoint transport this remote choice would use."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'MCPPlanTransportChoiceRemote':
+        assert isinstance(obj, dict)
+        choice_id = from_str(obj.get("choiceId"))
+        endpoint = from_str(obj.get("endpoint"))
+        install_method = MCPPlanRemoteInstallMethod(obj.get("installMethod"))
+        required_values = from_list(_load_MCPPlanRequiredValue, obj.get("requiredValues"))
+        secret_placeholders = from_list(MCPPlanSecretPlaceholder.from_dict, obj.get("secretPlaceholders"))
+        transport = MCPPlanRemoteTransport(obj.get("transport"))
+        return MCPPlanTransportChoiceRemote(choice_id, endpoint, install_method, required_values, secret_placeholders, transport)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["choiceId"] = from_str(self.choice_id)
+        result["endpoint"] = from_str(self.endpoint)
+        result["installMethod"] = to_enum(MCPPlanRemoteInstallMethod, self.install_method)
+        result["requiredValues"] = from_list(lambda x: (x).to_dict(), self.required_values)
+        result["secretPlaceholders"] = from_list(lambda x: to_class(MCPPlanSecretPlaceholder, x), self.secret_placeholders)
+        result["transport"] = to_enum(MCPPlanRemoteTransport, self.transport)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class MCPPlanRequiredValueScalar:
+    """One non-secret scalar value a transport choice needs before it can be applied."""
+
+    category: MCPPlanValueCategory
+    """Where the value is applied when the server is launched."""
+
+    is_repeated: bool
+    """Whether the value may be supplied more than once."""
+
+    key: str
+    """Key the value is supplied under. Inert untrusted data."""
+
+    kind: ClassVar[str] = "scalar"
+    """Discriminator: this required value uses a scalar type."""
+
+    required: bool
+    """Whether the value must be present for the plan to be applicable."""
+
+    value_type: MCPPlanScalarValueTypeEnum
+    """Scalar type the value must conform to."""
+
+    default_value: str | None = None
+    """Default supplied by the card, when the value can be resolved without input. Presence is
+    the authoritative indication that a default exists. Inert untrusted data.
+    """
+    description: str | None = None
+    """Human-readable explanation from the card. Inert untrusted text."""
+
+    title: str | None = None
+    """Human-readable label from the card. Inert untrusted text."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'MCPPlanRequiredValueScalar':
+        assert isinstance(obj, dict)
+        category = MCPPlanValueCategory(obj.get("category"))
+        is_repeated = from_bool(obj.get("isRepeated"))
+        key = from_str(obj.get("key"))
+        required = from_bool(obj.get("required"))
+        value_type = MCPPlanScalarValueTypeEnum(obj.get("valueType"))
+        default_value = from_union([from_str, from_none], obj.get("defaultValue"))
+        description = from_union([from_str, from_none], obj.get("description"))
+        title = from_union([from_str, from_none], obj.get("title"))
+        return MCPPlanRequiredValueScalar(category, is_repeated, key, required, value_type, default_value, description, title)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["category"] = to_enum(MCPPlanValueCategory, self.category)
+        result["isRepeated"] = from_bool(self.is_repeated)
+        result["key"] = from_str(self.key)
+        result["kind"] = self.kind
+        result["required"] = from_bool(self.required)
+        result["valueType"] = to_enum(MCPPlanScalarValueTypeEnum, self.value_type)
+        if self.default_value is not None:
+            result["defaultValue"] = from_union([from_str, from_none], self.default_value)
+        if self.description is not None:
+            result["description"] = from_union([from_str, from_none], self.description)
+        if self.title is not None:
+            result["title"] = from_union([from_str, from_none], self.title)
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class MCPResourcesReadResult:
@@ -22729,6 +24648,47 @@ def to_dict(self) -> dict:
             result["logCapture"] = from_union([lambda x: to_class(AgentRegistryLogCapture, x), from_none], self.log_capture)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class MCPPlanProvenance:
+    """Origin and semantic digest of the exact validated JSON MCP card content bound to this
+    plan.
+
+    Provenance of the exact validated JSON MCP card content bound privately to a completed
+    plan and its opaque handle.
+    """
+    authority: str
+    """Authority associated with the validated card, without path, query, or credentials. Inert
+    untrusted data.
+    """
+    card_digest: CardDigest
+    """Semantic digest of the exact validated JSON content bound to the plan handle."""
+
+    media_type: MCPServerCardMediaType
+    """JSON MCP media type the validated card was interpreted as."""
+
+    validated_at: str
+    """ISO 8601 timestamp at which the runtime completed strict parsing and schema validation of
+    the card content.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'MCPPlanProvenance':
+        assert isinstance(obj, dict)
+        authority = from_str(obj.get("authority"))
+        card_digest = CardDigest.from_dict(obj.get("cardDigest"))
+        media_type = MCPServerCardMediaType(obj.get("mediaType"))
+        validated_at = from_str(obj.get("validatedAt"))
+        return MCPPlanProvenance(authority, card_digest, media_type, validated_at)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["authority"] = from_str(self.authority)
+        result["cardDigest"] = to_class(CardDigest, self.card_digest)
+        result["mediaType"] = to_enum(MCPServerCardMediaType, self.media_type)
+        result["validatedAt"] = from_str(self.validated_at)
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class SlashCommandInfo:
@@ -22874,6 +24834,230 @@ def to_dict(self) -> dict:
         result["openCanvases"] = from_list(lambda x: to_class(OpenCanvasInstance, x), self.open_canvases)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogAISkillCandidate:
+    """An inert AI skill catalog result. AI skills are discovery-only and cannot be represented
+    as installable through this surface.
+    """
+    display_name: str
+    """Display name taken verbatim from the card. Inert untrusted text."""
+
+    handle: str
+    """Opaque, runtime-instance scoped, TTL-bound, single-use handle for this candidate. Carries
+    no readable information and is rejected when stale, replayed, or presented to a different
+    runtime instance. Never logged.
+    """
+    handle_expires_at: str
+    """ISO 8601 timestamp after which the handle is stale and will be rejected."""
+
+    installability: Installability
+    """AI skills are discovery-only and cannot be installed through this surface"""
+
+    kind: CatalogAISkillCandidateKind
+    """Discriminator: this candidate describes an AI skill"""
+
+    media_type: MediaType
+    """Media type of the underlying AI skill card"""
+
+    provenance: CatalogAISkillCandidateProvenance
+    """Where the catalog reference was observed, without the card itself or any content digest."""
+
+    source: CatalogCandidateSource
+    """Where the card came from: exactly one of a URL or embedded data, encoded as a tagged
+    union so neither both nor neither can be represented.
+    """
+    description: str | None = None
+    """Description taken verbatim from the card. Inert untrusted text."""
+
+    publisher: str | None = None
+    """Publisher taken verbatim from the card. Inert untrusted text."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogAISkillCandidate':
+        assert isinstance(obj, dict)
+        display_name = from_str(obj.get("displayName"))
+        handle = from_str(obj.get("handle"))
+        handle_expires_at = from_str(obj.get("handleExpiresAt"))
+        installability = Installability(obj.get("installability"))
+        kind = CatalogAISkillCandidateKind(obj.get("kind"))
+        media_type = MediaType(obj.get("mediaType"))
+        provenance = CatalogAISkillCandidateProvenance.from_dict(obj.get("provenance"))
+        source = _load_CatalogCandidateSource(obj.get("source"))
+        description = from_union([from_str, from_none], obj.get("description"))
+        publisher = from_union([from_str, from_none], obj.get("publisher"))
+        return CatalogAISkillCandidate(display_name, handle, handle_expires_at, installability, kind, media_type, provenance, source, description, publisher)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["displayName"] = from_str(self.display_name)
+        result["handle"] = from_str(self.handle)
+        result["handleExpiresAt"] = from_str(self.handle_expires_at)
+        result["installability"] = to_enum(Installability, self.installability)
+        result["kind"] = to_enum(CatalogAISkillCandidateKind, self.kind)
+        result["mediaType"] = to_enum(MediaType, self.media_type)
+        result["provenance"] = to_class(CatalogAISkillCandidateProvenance, self.provenance)
+        result["source"] = (self.source).to_dict()
+        if self.description is not None:
+            result["description"] = from_union([from_str, from_none], self.description)
+        if self.publisher is not None:
+            result["publisher"] = from_union([from_str, from_none], self.publisher)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogCandidate:
+    """One inert catalog result, represented as an MCP server or discovery-only AI skill variant
+    so kind, media type, provenance, and installability cannot contradict each other.
+
+    An inert MCP server catalog result. Every free-text field is untrusted external data and
+    must never be treated as an instruction, and the handle is the only way to refer to the
+    candidate in a later operation.
+
+    An inert AI skill catalog result. AI skills are discovery-only and cannot be represented
+    as installable through this surface.
+    """
+    display_name: str
+    """Display name taken verbatim from the card. Inert untrusted text."""
+
+    handle: str
+    """Opaque, runtime-instance scoped, TTL-bound, single-use handle for this candidate. Carries
+    no readable information and is rejected when stale, replayed, or presented to a different
+    runtime instance. Never logged.
+    """
+    handle_expires_at: str
+    """ISO 8601 timestamp after which the handle is stale and will be rejected."""
+
+    installability: CatalogCandidateInstallability
+    """Whether this MCP server can be planned for installation, and if policy prevents it.
+
+    AI skills are discovery-only and cannot be installed through this surface
+    """
+    kind: CatalogCandidateKind
+    """Discriminator: this candidate describes an MCP server
+
+    Discriminator: this candidate describes an AI skill
+    """
+    media_type: CatalogMediaType
+    """JSON MCP media type of the underlying card.
+
+    Media type of the underlying AI skill card
+    """
+    provenance: CatalogCandidateProvenance
+    """Where the catalog reference was observed, without the card itself or any content digest."""
+
+    source: CatalogCandidateSource
+    """Where the card came from: exactly one of a URL or embedded data, encoded as a tagged
+    union so neither both nor neither can be represented.
+    """
+    description: str | None = None
+    """Description taken verbatim from the card. Inert untrusted text."""
+
+    publisher: str | None = None
+    """Publisher taken verbatim from the card. Inert untrusted text."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogCandidate':
+        assert isinstance(obj, dict)
+        display_name = from_str(obj.get("displayName"))
+        handle = from_str(obj.get("handle"))
+        handle_expires_at = from_str(obj.get("handleExpiresAt"))
+        installability = CatalogCandidateInstallability(obj.get("installability"))
+        kind = CatalogCandidateKind(obj.get("kind"))
+        media_type = CatalogMediaType(obj.get("mediaType"))
+        provenance = CatalogCandidateProvenance.from_dict(obj.get("provenance"))
+        source = _load_CatalogCandidateSource(obj.get("source"))
+        description = from_union([from_str, from_none], obj.get("description"))
+        publisher = from_union([from_str, from_none], obj.get("publisher"))
+        return CatalogCandidate(display_name, handle, handle_expires_at, installability, kind, media_type, provenance, source, description, publisher)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["displayName"] = from_str(self.display_name)
+        result["handle"] = from_str(self.handle)
+        result["handleExpiresAt"] = from_str(self.handle_expires_at)
+        result["installability"] = to_enum(CatalogCandidateInstallability, self.installability)
+        result["kind"] = to_enum(CatalogCandidateKind, self.kind)
+        result["mediaType"] = to_enum(CatalogMediaType, self.media_type)
+        result["provenance"] = to_class(CatalogCandidateProvenance, self.provenance)
+        result["source"] = (self.source).to_dict()
+        if self.description is not None:
+            result["description"] = from_union([from_str, from_none], self.description)
+        if self.publisher is not None:
+            result["publisher"] = from_union([from_str, from_none], self.publisher)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogMCPServerCandidate:
+    """An inert MCP server catalog result. Every free-text field is untrusted external data and
+    must never be treated as an instruction, and the handle is the only way to refer to the
+    candidate in a later operation.
+    """
+    display_name: str
+    """Display name taken verbatim from the card. Inert untrusted text."""
+
+    handle: str
+    """Opaque, runtime-instance scoped, TTL-bound, single-use handle for this candidate. Carries
+    no readable information and is rejected when stale, replayed, or presented to a different
+    runtime instance. Never logged.
+    """
+    handle_expires_at: str
+    """ISO 8601 timestamp after which the handle is stale and will be rejected."""
+
+    installability: CatalogMCPServerInstallabilityEnum
+    """Whether this MCP server can be planned for installation, and if policy prevents it."""
+
+    kind: CatalogMCPServerCandidateKind
+    """Discriminator: this candidate describes an MCP server"""
+
+    media_type: MCPServerCardMediaType
+    """JSON MCP media type of the underlying card."""
+
+    provenance: CatalogMCPServerCandidateProvenance
+    """Where the catalog reference was observed, without the card itself or any content digest."""
+
+    source: CatalogCandidateSource
+    """Where the card came from: exactly one of a URL or embedded data, encoded as a tagged
+    union so neither both nor neither can be represented.
+    """
+    description: str | None = None
+    """Description taken verbatim from the card. Inert untrusted text."""
+
+    publisher: str | None = None
+    """Publisher taken verbatim from the card. Inert untrusted text."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogMCPServerCandidate':
+        assert isinstance(obj, dict)
+        display_name = from_str(obj.get("displayName"))
+        handle = from_str(obj.get("handle"))
+        handle_expires_at = from_str(obj.get("handleExpiresAt"))
+        installability = CatalogMCPServerInstallabilityEnum(obj.get("installability"))
+        kind = CatalogMCPServerCandidateKind(obj.get("kind"))
+        media_type = MCPServerCardMediaType(obj.get("mediaType"))
+        provenance = CatalogMCPServerCandidateProvenance.from_dict(obj.get("provenance"))
+        source = _load_CatalogCandidateSource(obj.get("source"))
+        description = from_union([from_str, from_none], obj.get("description"))
+        publisher = from_union([from_str, from_none], obj.get("publisher"))
+        return CatalogMCPServerCandidate(display_name, handle, handle_expires_at, installability, kind, media_type, provenance, source, description, publisher)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["displayName"] = from_str(self.display_name)
+        result["handle"] = from_str(self.handle)
+        result["handleExpiresAt"] = from_str(self.handle_expires_at)
+        result["installability"] = to_enum(CatalogMCPServerInstallabilityEnum, self.installability)
+        result["kind"] = to_enum(CatalogMCPServerCandidateKind, self.kind)
+        result["mediaType"] = to_enum(MCPServerCardMediaType, self.media_type)
+        result["provenance"] = to_class(CatalogMCPServerCandidateProvenance, self.provenance)
+        result["source"] = (self.source).to_dict()
+        if self.description is not None:
+            result["description"] = from_union([from_str, from_none], self.description)
+        if self.publisher is not None:
+            result["publisher"] = from_union([from_str, from_none], self.publisher)
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class DebugCollectLogsResult:
@@ -26602,6 +28786,90 @@ def to_dict(self) -> dict:
             result["unavailableReason"] = from_union([lambda x: to_enum(HistoryRewindUnavailableReason, x), from_none], self.unavailable_reason)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class MCPInstallPlan:
+    """A normalised, inert description of what installing an MCP server would involve. Carries
+    no raw card, no install specification, and no secret value.
+
+    The normalised plan.
+    """
+    configuration_changes: list[MCPPlanConfigurationChange]
+    """The configuration changes installing would make, described rather than serialised, so the
+    mutable configuration payload stays behind the runtime boundary.
+    """
+    identity: MCPPlanResourceIdentity
+    """Normalised identity of the server the plan would install."""
+
+    plan_handle: str
+    """Opaque, runtime-instance scoped, TTL-bound, single-use handle for this plan. Rejected
+    when stale, replayed, or presented to a different runtime instance. Never logged.
+    """
+    plan_handle_expires_at: str
+    """ISO 8601 timestamp after which the plan handle is stale and will be rejected. Abandoning
+    a plan needs no call: an unused handle simply expires, so cancellation before commit is
+    side-effect free.
+    """
+    policy: MCPPlanPolicyResult
+    """Outcome of evaluating the server against registry and enterprise policy."""
+
+    provenance: MCPPlanProvenance
+    """Origin and semantic digest of the exact validated JSON MCP card content bound to this
+    plan.
+    """
+    reload_required: bool
+    """Whether applying this plan would require an MCP reload to take effect. Planning itself
+    never reloads.
+    """
+    requires_interactive_configuration: bool
+    """Whether the plan cannot be applied without further input, because a required value has no
+    default or a secret must be supplied.
+    """
+    target: MCPPlanTarget
+    """Configuration scope and key the plan would write to."""
+
+    transport_choices: list[MCPPlanTransportChoice]
+    """Every eligible transport, so a host can present an explicit choice. A completed plan
+    always has at least one; when none is eligible, planning returns
+    `CatalogUnavailableTransportError` instead.
+    """
+    recommended_transport_choice_id: str | None = None
+    """Identifier of the choice the runtime would pick by default. Omitted when there is no
+    eligible transport, or when the runtime expresses no preference.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'MCPInstallPlan':
+        assert isinstance(obj, dict)
+        configuration_changes = from_list(MCPPlanConfigurationChange.from_dict, obj.get("configurationChanges"))
+        identity = MCPPlanResourceIdentity.from_dict(obj.get("identity"))
+        plan_handle = from_str(obj.get("planHandle"))
+        plan_handle_expires_at = from_str(obj.get("planHandleExpiresAt"))
+        policy = MCPPlanPolicyResult.from_dict(obj.get("policy"))
+        provenance = MCPPlanProvenance.from_dict(obj.get("provenance"))
+        reload_required = from_bool(obj.get("reloadRequired"))
+        requires_interactive_configuration = from_bool(obj.get("requiresInteractiveConfiguration"))
+        target = MCPPlanTarget.from_dict(obj.get("target"))
+        transport_choices = from_list(_load_MCPPlanTransportChoice, obj.get("transportChoices"))
+        recommended_transport_choice_id = from_union([from_str, from_none], obj.get("recommendedTransportChoiceId"))
+        return MCPInstallPlan(configuration_changes, identity, plan_handle, plan_handle_expires_at, policy, provenance, reload_required, requires_interactive_configuration, target, transport_choices, recommended_transport_choice_id)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["configurationChanges"] = from_list(lambda x: to_class(MCPPlanConfigurationChange, x), self.configuration_changes)
+        result["identity"] = to_class(MCPPlanResourceIdentity, self.identity)
+        result["planHandle"] = from_str(self.plan_handle)
+        result["planHandleExpiresAt"] = from_str(self.plan_handle_expires_at)
+        result["policy"] = to_class(MCPPlanPolicyResult, self.policy)
+        result["provenance"] = to_class(MCPPlanProvenance, self.provenance)
+        result["reloadRequired"] = from_bool(self.reload_required)
+        result["requiresInteractiveConfiguration"] = from_bool(self.requires_interactive_configuration)
+        result["target"] = to_class(MCPPlanTarget, self.target)
+        result["transportChoices"] = from_list(lambda x: (x).to_dict(), self.transport_choices)
+        if self.recommended_transport_choice_id is not None:
+            result["recommendedTransportChoiceId"] = from_union([from_str, from_none], self.recommended_transport_choice_id)
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class CommandList:
@@ -26776,6 +29044,50 @@ def to_dict(self) -> dict:
             result["session"] = from_union([lambda x: to_class(CanvasSessionContext, x), from_none], self.session)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class CatalogSearchSucceeded:
+    """A completed catalog search: inert candidate summaries, each carrying a single-use handle."""
+
+    candidates: list[CatalogCandidate]
+    """Matching candidates, never more than the requested limit. All text is inert untrusted
+    data.
+    """
+    kind: ClassVar[str] = "succeeded"
+    """Discriminator: the search completed"""
+
+    negotiated: CatalogNegotiatedContract
+    """Protocol version and capabilities the runtime honoured."""
+
+    search_id: str
+    """Pseudonymous identifier for this search, issued by the runtime or by the catalog
+    authority it queried and never by the caller, so it cannot be forged or replayed to
+    attribute an install to a search that never happened. Always present on a success, so a
+    result set can be tied to the installs it leads to. It identifies a search rather than a
+    person: it is derived from no user, account, device, or query data, and must never be
+    joined with user identity to re-identify anyone.
+    """
+    truncated: bool
+    """Whether further matches existed beyond the requested limit."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'CatalogSearchSucceeded':
+        assert isinstance(obj, dict)
+        candidates = from_list(CatalogCandidate.from_dict, obj.get("candidates"))
+        negotiated = CatalogNegotiatedContract.from_dict(obj.get("negotiated"))
+        search_id = from_str(obj.get("searchId"))
+        truncated = from_bool(obj.get("truncated"))
+        return CatalogSearchSucceeded(candidates, negotiated, search_id, truncated)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["candidates"] = from_list(lambda x: to_class(CatalogCandidate, x), self.candidates)
+        result["kind"] = self.kind
+        result["negotiated"] = to_class(CatalogNegotiatedContract, self.negotiated)
+        result["searchId"] = from_str(self.search_id)
+        result["truncated"] = from_bool(self.truncated)
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class HandlePendingToolCallRequest:
@@ -27901,6 +30213,35 @@ def to_dict(self) -> dict:
             result["totalNanoAiu"] = from_union([to_float, from_none], self.total_nano_aiu)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class MCPPlanInstallPlanned:
+    """A computed MCP install plan. Nothing has been applied: the plan describes what installing
+    would change, and the plan handle is what a later apply operation would consume.
+    """
+    kind: ClassVar[str] = "planned"
+    """Discriminator: a plan was computed and nothing was changed"""
+
+    negotiated: CatalogNegotiatedContract
+    """Protocol version and capabilities the runtime honoured."""
+
+    plan: MCPInstallPlan
+    """The normalised plan."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'MCPPlanInstallPlanned':
+        assert isinstance(obj, dict)
+        negotiated = CatalogNegotiatedContract.from_dict(obj.get("negotiated"))
+        plan = MCPInstallPlan.from_dict(obj.get("plan"))
+        return MCPPlanInstallPlanned(negotiated, plan)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["kind"] = self.kind
+        result["negotiated"] = to_class(CatalogNegotiatedContract, self.negotiated)
+        result["plan"] = to_class(MCPInstallPlan, self.plan)
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class FactoryListRunsResult:
@@ -31249,9 +33590,12 @@ def to_dict(self) -> dict:
         return result
 
 # Experimental: this type is part of an experimental API and may change or be removed.
-class PermissionsSetAAllSource(Enum):
-    """Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers."""
+class PermissionSource(Enum):
+    """Optional source for permission-mode telemetry. Defaults to `rpc` when omitted for SDK
+    callers.
 
+    Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers.
+    """
     AUTOPILOT_CONFIRMATION = "autopilot_confirmation"
     CLI_FLAG = "cli_flag"
     RPC = "rpc"
@@ -31259,69 +33603,62 @@ class PermissionsSetAAllSource(Enum):
 
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
-class PermissionsSetAllowAllRequest:
-    """Allow-all mode to apply for the session."""
+class PermissionsSetApproveAllRequest:
+    """Allow-all toggle for tool permission requests, with an optional telemetry source."""
 
-    enabled: bool | None = None
-    """Legacy full allow-all toggle. Prefer `mode`; when `mode` is omitted, `enabled: true` is
-    treated as `mode: "on"` and any other value is treated as `mode: "off"`.
-    """
-    mode: PermissionsAllowAllMode | None = None
-    """Allow-all mode to apply. `on` enables full allow-all; `auto` enables advisory LLM
-    auto-approval; `off` disables both.
-    """
-    model: str | None = None
-    """Optional model id for the `auto` mode auto-approval LLM judging. Only meaningful when
-    `mode` is `auto`; ignored otherwise. When omitted, the session resolves a default judge
-    model: `gpt-5.5` for CAPI sessions and the session's active model for BYOK sessions.
-    """
-    source: PermissionsSetAAllSource | None = None
+    enabled: bool
+    """Whether to auto-approve all tool permission requests"""
+
+    source: PermissionSource | None = None
     """Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers."""
 
     @staticmethod
-    def from_dict(obj: Any) -> 'PermissionsSetAllowAllRequest':
+    def from_dict(obj: Any) -> 'PermissionsSetApproveAllRequest':
         assert isinstance(obj, dict)
-        enabled = from_union([from_bool, from_none], obj.get("enabled"))
-        mode = from_union([PermissionsAllowAllMode, from_none], obj.get("mode"))
-        model = from_union([from_str, from_none], obj.get("model"))
-        source = from_union([PermissionsSetAAllSource, from_none], obj.get("source"))
-        return PermissionsSetAllowAllRequest(enabled, mode, model, source)
+        enabled = from_bool(obj.get("enabled"))
+        source = from_union([PermissionSource, from_none], obj.get("source"))
+        return PermissionsSetApproveAllRequest(enabled, source)
 
     def to_dict(self) -> dict:
         result: dict = {}
-        if self.enabled is not None:
-            result["enabled"] = from_union([from_bool, from_none], self.enabled)
-        if self.mode is not None:
-            result["mode"] = from_union([lambda x: to_enum(PermissionsAllowAllMode, x), from_none], self.mode)
-        if self.model is not None:
-            result["model"] = from_union([from_str, from_none], self.model)
+        result["enabled"] = from_bool(self.enabled)
         if self.source is not None:
-            result["source"] = from_union([lambda x: to_enum(PermissionsSetAAllSource, x), from_none], self.source)
+            result["source"] = from_union([lambda x: to_enum(PermissionSource, x), from_none], self.source)
         return result
 
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
-class PermissionsSetApproveAllRequest:
-    """Allow-all toggle for tool permission requests, with an optional telemetry source."""
+class PermissionsSetModeRequest:
+    """Permission mode to apply for the session."""
 
-    enabled: bool
-    """Whether to auto-approve all tool permission requests"""
+    mode: PermissionMode
+    """Permission mode to apply"""
 
-    source: PermissionsSetAAllSource | None = None
-    """Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers."""
+    assisted_approval_model: str | None = None
+    """Optional judge model id for assisted mode. When omitted, the session resolves the
+    provider default: `gpt-5.5` for CAPI sessions and the active session model for BYOK
+    sessions.
+    """
+    source: PermissionSource | None = None
+    """Optional source for permission-mode telemetry. Defaults to `rpc` when omitted for SDK
+    callers.
+    """
 
     @staticmethod
-    def from_dict(obj: Any) -> 'PermissionsSetApproveAllRequest':
+    def from_dict(obj: Any) -> 'PermissionsSetModeRequest':
         assert isinstance(obj, dict)
-        enabled = from_bool(obj.get("enabled"))
-        source = from_union([PermissionsSetAAllSource, from_none], obj.get("source"))
-        return PermissionsSetApproveAllRequest(enabled, source)
+        mode = PermissionMode(obj.get("mode"))
+        assisted_approval_model = from_union([from_str, from_none], obj.get("assistedApprovalModel"))
+        source = from_union([PermissionSource, from_none], obj.get("source"))
+        return PermissionsSetModeRequest(mode, assisted_approval_model, source)
 
     def to_dict(self) -> dict:
         result: dict = {}
-        result["enabled"] = from_bool(self.enabled)
+        result["mode"] = to_enum(PermissionMode, self.mode)
+        if self.assisted_approval_model is not None:
+            result["assistedApprovalModel"] = from_union([from_str, from_none], self.assisted_approval_model)
         if self.source is not None:
-            result["source"] = from_union([lambda x: to_enum(PermissionsSetAAllSource, x), from_none], self.source)
+            result["source"] = from_union([lambda x: to_enum(PermissionSource, x), from_none], self.source)
         return result
 
 # Experimental: this type is part of an experimental API and may change or be removed.
@@ -32203,8 +34540,6 @@ class RPC:
     agent_select_result: AgentSelectResult
     agent_set_prompt_request: AgentSetPromptRequest
     agents_get_discovery_paths_request: AgentsGetDiscoveryPathsRequest
-    allow_all_permission_set_result: AllowAllPermissionSetResult
-    allow_all_permission_state: AllowAllPermissionState
     api_key_auth_info: APIKeyAuthInfo
     auth_identity: AuthIdentity
     auth_info: AuthInfo
@@ -32239,6 +34574,52 @@ class RPC:
     canvas_provider_unregister_request: CanvasProviderUnregisterRequest
     canvas_session_context: CanvasSessionContext
     capi_session_options: CapiSessionOptions
+    card_digest: CardDigest
+    card_digest_algorithm: CardDigestAlgorithm
+    card_digest_value: str
+    catalog_ai_skill_candidate: CatalogAISkillCandidate
+    catalog_ai_skill_candidate_provenance: CatalogAISkillCandidateProvenance
+    catalog_authentication_required_error: CatalogAuthenticationRequiredError
+    catalog_authentication_required_reason: CatalogAuthenticationRequiredReason
+    catalog_candidate: CatalogCandidate
+    catalog_candidate_kind: CatalogCandidateKind
+    catalog_candidate_source: CatalogCandidateSource
+    catalog_candidate_source_embedded: CatalogCandidateSourceEmbedded
+    catalog_candidate_source_url: CatalogCandidateSourceURL
+    catalog_capability: CatalogCapability
+    catalog_capability_id: str
+    catalog_client_contract: CatalogClientContract
+    catalog_contract_violation_error: CatalogContractViolationError
+    catalog_contract_violation_reason: CatalogContractViolationReason
+    catalog_handle_rejected_error: CatalogHandleRejectedError
+    catalog_handle_rejection_reason: CatalogHandleRejectionReason
+    catalog_handle_type: CatalogHandleType
+    catalog_invalid_request_error: CatalogInvalidRequestError
+    catalog_invalid_request_field: CatalogInvalidRequestField
+    catalog_malformed_card_error: CatalogMalformedCardError
+    catalog_malformed_card_reason: CatalogMalformedCardReason
+    catalog_mcp_server_candidate: CatalogMCPServerCandidate
+    catalog_mcp_server_candidate_provenance: CatalogMCPServerCandidateProvenance
+    catalog_mcp_server_installability: CatalogMCPServerInstallabilityEnum
+    catalog_media_type: CatalogMediaType
+    catalog_negotiated_contract: CatalogNegotiatedContract
+    catalog_negotiation_refused_error: CatalogNegotiationRefusedError
+    catalog_negotiation_refused_reason: CatalogNegotiationRefusedReason
+    catalog_network_failure_error: CatalogNetworkFailureError
+    catalog_network_failure_reason: CatalogNetworkFailureReason
+    catalog_not_installable_error: CatalogNotInstallableError
+    catalog_not_installable_reason: CatalogNotInstallableReason
+    catalog_policy_rejected_error: CatalogPolicyRejectedError
+    catalog_search_request: CatalogSearchRequest
+    catalog_search_result: CatalogSearchResult
+    catalog_search_succeeded: CatalogSearchSucceeded
+    catalog_unavailable_error: CatalogUnavailableError
+    catalog_unavailable_reason: CatalogUnavailableReason
+    catalog_unavailable_transport_error: CatalogUnavailableTransportError
+    catalog_unavailable_transport_reason: CatalogUnavailableTransportReason
+    catalog_unsafe_retrieval_error: CatalogUnsafeRetrievalError
+    catalog_unsafe_retrieval_reason: CatalogUnsafeRetrievalReason
+    catalog_unsupported_kind_error: CatalogUnsupportedKindError
     command_list: CommandList
     commands_finalize_invocation_effect_request: CommandsFinalizeInvocationEffectRequest
     commands_finalize_invocation_effect_result: CommandsFinalizeInvocationEffectResult
@@ -32501,6 +34882,7 @@ class RPC:
     mcp_headers_handle_pending_headers_refresh_request_request: MCPHeadersHandlePendingHeadersRefreshRequestRequest
     mcp_headers_handle_pending_headers_refresh_request_result: MCPHeadersHandlePendingHeadersRefreshRequestResult
     mcp_host_state: MCPHostState
+    mcp_install_plan: MCPInstallPlan
     mcp_is_server_running_request: MCPIsServerRunningRequest
     mcp_is_server_running_result: MCPIsServerRunningResult
     mcp_list_tools_request: MCPListToolsRequest
@@ -32517,6 +34899,40 @@ class RPC:
     mcp_oauth_probe_result: MCPOauthProbeResult
     mcp_oauth_respond_request: MCPOauthRespondRequest
     mcp_oauth_respond_result: MCPOauthRespondResult
+    mcp_plan_configuration_change: MCPPlanConfigurationChange
+    mcp_plan_configuration_operation: MCPPlanConfigurationOperation
+    mcp_plan_enum_value_type: MCPPlan
+    mcp_plan_install_planned: MCPPlanInstallPlanned
+    mcp_plan_install_request: MCPPlanInstallRequest
+    mcp_plan_install_result: MCPPlanInstallResult
+    mcp_plan_install_source: MCPPlanInstallSource
+    mcp_plan_install_source_candidate: MCPPlanInstallSourceCandidate
+    mcp_plan_install_source_candidate_kind: MCPPlanInstallSourceCandidateKind
+    mcp_plan_install_source_card: MCPPlanInstallSourceCard
+    mcp_plan_install_source_card_kind: MCPPlanInstallSourceCardKind
+    mcp_plan_package_install_method: MCPPlanPackageInstallMethod
+    mcp_plan_package_transport: MCPPlanPackageTransport
+    mcp_plan_policy_decision: MCPPlanPolicyDecision
+    mcp_plan_policy_result: MCPPlanPolicyResult
+    mcp_plan_policy_source: MCPPlanPolicySource
+    mcp_plan_provenance: MCPPlanProvenance
+    mcp_plan_remote_install_method: MCPPlanRemoteInstallMethod
+    mcp_plan_remote_transport: MCPPlanRemoteTransport
+    mcp_plan_required_value: MCPPlanRequiredValue
+    mcp_plan_required_value_enum: MCPPlanRequiredValueEnum
+    mcp_plan_required_value_enum_kind: MCPPlan
+    mcp_plan_required_value_scalar: MCPPlanRequiredValueScalar
+    mcp_plan_required_value_scalar_kind: MCPPlanRequiredValueScalarKind
+    mcp_plan_resource_identity: MCPPlanResourceIdentity
+    mcp_plan_scalar_value_type: MCPPlanScalarValueTypeEnum
+    mcp_plan_scope: MCPPlanScope
+    mcp_plan_secret_placeholder: MCPPlanSecretPlaceholder
+    mcp_plan_secret_reference: str
+    mcp_plan_target: MCPPlanTarget
+    mcp_plan_transport_choice: MCPPlanTransportChoice
+    mcp_plan_transport_choice_package: MCPPlanTransportChoicePackage
+    mcp_plan_transport_choice_remote: MCPPlanTransportChoiceRemote
+    mcp_plan_value_category: MCPPlanValueCategory
     mcp_register_external_client_request: MCPRegisterExternalClientRequest
     mcp_reload_config: MCPReloadConfig
     mcp_reload_with_config_request: MCPReloadWithConfigRequest
@@ -32541,6 +34957,12 @@ class RPC:
     mcp_server: MCPServer
     mcp_server_auth_config: bool | MCPServerAuthConfigRedirectPort
     mcp_server_auth_config_redirect_port: MCPServerAuthConfigRedirectPort
+    mcp_server_card_embedded: MCPServerCardEmbedded
+    mcp_server_card_embedded_kind: MCPServerCardEmbeddedKind
+    mcp_server_card_media_type: MCPServerCardMediaType
+    mcp_server_card_reference: MCPServerCardReference
+    mcp_server_card_url: MCPServerCardURL
+    mcp_server_card_url_kind: MCPServerCardURLKind
     mcp_server_config: MCPServerConfig
     mcp_server_config_defer_tools: MCPServerConfigDeferTools
     mcp_server_config_http: MCPServerConfigHTTP
@@ -32611,6 +35033,7 @@ class RPC:
     model_switch_to_result: ModelSwitchToResult
     mode_set_request: ModeSetRequest
     mode_set_result: ModeSetResult
+    move_mcp_loading_to_background_result: MoveMCPLoadingToBackgroundResult
     named_provider_config: NamedProviderConfig
     name_get_result: NameGetResult
     name_set_auto_request: NameSetAutoRequest
@@ -32678,6 +35101,7 @@ class RPC:
     permission_location_resolve_params: PermissionLocationResolveParams
     permission_location_resolve_result: PermissionLocationResolveResult
     permission_location_type: PermissionLocationType
+    permission_mode_source: PermissionSource
     permission_paths_add_params: PermissionPathsAddParams
     permission_paths_allowed_check_params: PermissionPathsAllowedCheckParams
     permission_paths_allowed_check_result: PermissionPathsAllowedCheckResult
@@ -32689,7 +35113,6 @@ class RPC:
     permission_prompt_shown_notification: PermissionPromptShownNotification
     permission_request_result: PermissionRequestResult
     permission_rules_set: PermissionRulesSet
-    permissions_allow_all_mode: PermissionsAllowAllMode
     permissions_configure_additional_content_exclusion_policy: PermissionsConfigureAdditionalContentExclusionPolicy
     permissions_configure_additional_content_exclusion_policy_rule: PermissionsConfigureAdditionalContentExclusionPolicyRule
     permissions_configure_additional_content_exclusion_policy_rule_source: PermissionsConfigureAdditionalContentExclusionPolicyRuleSource
@@ -32697,7 +35120,8 @@ class RPC:
     permissions_configure_params: PermissionsConfigureParams
     permissions_configure_result: PermissionsConfigureResult
     permissions_folder_trust_add_trusted_result: PermissionsFolderTrustAddTrustedResult
-    permissions_get_allow_all_request: PermissionsGetAllowAllRequest
+    permissions_get_mode_request: PermissionsGetModeRequest
+    permissions_get_mode_result: PermissionsGetModeResult
     permissions_locations_add_tool_approval_details: PermissionsLocationsAddToolApprovalDetails
     permissions_locations_add_tool_approval_details_commands: PermissionsLocationsAddToolApprovalDetailsCommands
     permissions_locations_add_tool_approval_details_custom_tool: PermissionsLocationsAddToolApprovalDetailsCustomTool
@@ -32721,11 +35145,11 @@ class RPC:
     permissions_pending_requests_request: PermissionsPendingRequestsRequest
     permissions_reset_session_approvals_request: PermissionsResetSessionApprovalsRequest
     permissions_reset_session_approvals_result: PermissionsResetSessionApprovalsResult
-    permissions_set_allow_all_request: PermissionsSetAllowAllRequest
-    permissions_set_allow_all_source: PermissionsSetAAllSource
     permissions_set_approve_all_request: PermissionsSetApproveAllRequest
     permissions_set_approve_all_result: PermissionsSetApproveAllResult
-    permissions_set_approve_all_source: PermissionsSetAAllSource
+    permissions_set_approve_all_source: PermissionSource
+    permissions_set_mode_request: PermissionsSetModeRequest
+    permissions_set_mode_result: PermissionsSetModeResult
     permissions_set_required_request: PermissionsSetRequiredRequest
     permissions_set_required_result: PermissionsSetRequiredResult
     permissions_urls_set_unrestricted_mode_result: PermissionsUrlsSetUnrestrictedModeResult
@@ -33286,8 +35710,6 @@ def from_dict(obj: Any) -> 'RPC':
         agent_select_result = AgentSelectResult.from_dict(obj.get("AgentSelectResult"))
         agent_set_prompt_request = AgentSetPromptRequest.from_dict(obj.get("AgentSetPromptRequest"))
         agents_get_discovery_paths_request = AgentsGetDiscoveryPathsRequest.from_dict(obj.get("AgentsGetDiscoveryPathsRequest"))
-        allow_all_permission_set_result = AllowAllPermissionSetResult.from_dict(obj.get("AllowAllPermissionSetResult"))
-        allow_all_permission_state = AllowAllPermissionState.from_dict(obj.get("AllowAllPermissionState"))
         api_key_auth_info = APIKeyAuthInfo.from_dict(obj.get("ApiKeyAuthInfo"))
         auth_identity = AuthIdentity.from_dict(obj.get("AuthIdentity"))
         auth_info = _load_AuthInfo(obj.get("AuthInfo"))
@@ -33322,6 +35744,52 @@ def from_dict(obj: Any) -> 'RPC':
         canvas_provider_unregister_request = CanvasProviderUnregisterRequest.from_dict(obj.get("CanvasProviderUnregisterRequest"))
         canvas_session_context = CanvasSessionContext.from_dict(obj.get("CanvasSessionContext"))
         capi_session_options = CapiSessionOptions.from_dict(obj.get("CapiSessionOptions"))
+        card_digest = CardDigest.from_dict(obj.get("CardDigest"))
+        card_digest_algorithm = CardDigestAlgorithm(obj.get("CardDigestAlgorithm"))
+        card_digest_value = from_str(obj.get("CardDigestValue"))
+        catalog_ai_skill_candidate = CatalogAISkillCandidate.from_dict(obj.get("CatalogAiSkillCandidate"))
+        catalog_ai_skill_candidate_provenance = CatalogAISkillCandidateProvenance.from_dict(obj.get("CatalogAiSkillCandidateProvenance"))
+        catalog_authentication_required_error = CatalogAuthenticationRequiredError.from_dict(obj.get("CatalogAuthenticationRequiredError"))
+        catalog_authentication_required_reason = CatalogAuthenticationRequiredReason(obj.get("CatalogAuthenticationRequiredReason"))
+        catalog_candidate = CatalogCandidate.from_dict(obj.get("CatalogCandidate"))
+        catalog_candidate_kind = CatalogCandidateKind(obj.get("CatalogCandidateKind"))
+        catalog_candidate_source = _load_CatalogCandidateSource(obj.get("CatalogCandidateSource"))
+        catalog_candidate_source_embedded = CatalogCandidateSourceEmbedded.from_dict(obj.get("CatalogCandidateSourceEmbedded"))
+        catalog_candidate_source_url = CatalogCandidateSourceURL.from_dict(obj.get("CatalogCandidateSourceUrl"))
+        catalog_capability = CatalogCapability(obj.get("CatalogCapability"))
+        catalog_capability_id = from_str(obj.get("CatalogCapabilityId"))
+        catalog_client_contract = CatalogClientContract.from_dict(obj.get("CatalogClientContract"))
+        catalog_contract_violation_error = CatalogContractViolationError.from_dict(obj.get("CatalogContractViolationError"))
+        catalog_contract_violation_reason = CatalogContractViolationReason(obj.get("CatalogContractViolationReason"))
+        catalog_handle_rejected_error = CatalogHandleRejectedError.from_dict(obj.get("CatalogHandleRejectedError"))
+        catalog_handle_rejection_reason = CatalogHandleRejectionReason(obj.get("CatalogHandleRejectionReason"))
+        catalog_handle_type = CatalogHandleType(obj.get("CatalogHandleType"))
+        catalog_invalid_request_error = CatalogInvalidRequestError.from_dict(obj.get("CatalogInvalidRequestError"))
+        catalog_invalid_request_field = CatalogInvalidRequestField(obj.get("CatalogInvalidRequestField"))
+        catalog_malformed_card_error = CatalogMalformedCardError.from_dict(obj.get("CatalogMalformedCardError"))
+        catalog_malformed_card_reason = CatalogMalformedCardReason(obj.get("CatalogMalformedCardReason"))
+        catalog_mcp_server_candidate = CatalogMCPServerCandidate.from_dict(obj.get("CatalogMcpServerCandidate"))
+        catalog_mcp_server_candidate_provenance = CatalogMCPServerCandidateProvenance.from_dict(obj.get("CatalogMcpServerCandidateProvenance"))
+        catalog_mcp_server_installability = CatalogMCPServerInstallabilityEnum(obj.get("CatalogMcpServerInstallability"))
+        catalog_media_type = CatalogMediaType(obj.get("CatalogMediaType"))
+        catalog_negotiated_contract = CatalogNegotiatedContract.from_dict(obj.get("CatalogNegotiatedContract"))
+        catalog_negotiation_refused_error = CatalogNegotiationRefusedError.from_dict(obj.get("CatalogNegotiationRefusedError"))
+        catalog_negotiation_refused_reason = CatalogNegotiationRefusedReason(obj.get("CatalogNegotiationRefusedReason"))
+        catalog_network_failure_error = CatalogNetworkFailureError.from_dict(obj.get("CatalogNetworkFailureError"))
+        catalog_network_failure_reason = CatalogNetworkFailureReason(obj.get("CatalogNetworkFailureReason"))
+        catalog_not_installable_error = CatalogNotInstallableError.from_dict(obj.get("CatalogNotInstallableError"))
+        catalog_not_installable_reason = CatalogNotInstallableReason(obj.get("CatalogNotInstallableReason"))
+        catalog_policy_rejected_error = CatalogPolicyRejectedError.from_dict(obj.get("CatalogPolicyRejectedError"))
+        catalog_search_request = CatalogSearchRequest.from_dict(obj.get("CatalogSearchRequest"))
+        catalog_search_result = _load_CatalogSearchResult(obj.get("CatalogSearchResult"))
+        catalog_search_succeeded = CatalogSearchSucceeded.from_dict(obj.get("CatalogSearchSucceeded"))
+        catalog_unavailable_error = CatalogUnavailableError.from_dict(obj.get("CatalogUnavailableError"))
+        catalog_unavailable_reason = CatalogUnavailableReason(obj.get("CatalogUnavailableReason"))
+        catalog_unavailable_transport_error = CatalogUnavailableTransportError.from_dict(obj.get("CatalogUnavailableTransportError"))
+        catalog_unavailable_transport_reason = CatalogUnavailableTransportReason(obj.get("CatalogUnavailableTransportReason"))
+        catalog_unsafe_retrieval_error = CatalogUnsafeRetrievalError.from_dict(obj.get("CatalogUnsafeRetrievalError"))
+        catalog_unsafe_retrieval_reason = CatalogUnsafeRetrievalReason(obj.get("CatalogUnsafeRetrievalReason"))
+        catalog_unsupported_kind_error = CatalogUnsupportedKindError.from_dict(obj.get("CatalogUnsupportedKindError"))
         command_list = CommandList.from_dict(obj.get("CommandList"))
         commands_finalize_invocation_effect_request = CommandsFinalizeInvocationEffectRequest.from_dict(obj.get("CommandsFinalizeInvocationEffectRequest"))
         commands_finalize_invocation_effect_result = CommandsFinalizeInvocationEffectResult.from_dict(obj.get("CommandsFinalizeInvocationEffectResult"))
@@ -33584,6 +36052,7 @@ def from_dict(obj: Any) -> 'RPC':
         mcp_headers_handle_pending_headers_refresh_request_request = MCPHeadersHandlePendingHeadersRefreshRequestRequest.from_dict(obj.get("McpHeadersHandlePendingHeadersRefreshRequestRequest"))
         mcp_headers_handle_pending_headers_refresh_request_result = MCPHeadersHandlePendingHeadersRefreshRequestResult.from_dict(obj.get("McpHeadersHandlePendingHeadersRefreshRequestResult"))
         mcp_host_state = MCPHostState.from_dict(obj.get("McpHostState"))
+        mcp_install_plan = MCPInstallPlan.from_dict(obj.get("McpInstallPlan"))
         mcp_is_server_running_request = MCPIsServerRunningRequest.from_dict(obj.get("McpIsServerRunningRequest"))
         mcp_is_server_running_result = MCPIsServerRunningResult.from_dict(obj.get("McpIsServerRunningResult"))
         mcp_list_tools_request = MCPListToolsRequest.from_dict(obj.get("McpListToolsRequest"))
@@ -33600,6 +36069,40 @@ def from_dict(obj: Any) -> 'RPC':
         mcp_oauth_probe_result = MCPOauthProbeResult.from_dict(obj.get("McpOauthProbeResult"))
         mcp_oauth_respond_request = MCPOauthRespondRequest.from_dict(obj.get("McpOauthRespondRequest"))
         mcp_oauth_respond_result = MCPOauthRespondResult.from_dict(obj.get("McpOauthRespondResult"))
+        mcp_plan_configuration_change = MCPPlanConfigurationChange.from_dict(obj.get("McpPlanConfigurationChange"))
+        mcp_plan_configuration_operation = MCPPlanConfigurationOperation(obj.get("McpPlanConfigurationOperation"))
+        mcp_plan_enum_value_type = MCPPlan(obj.get("McpPlanEnumValueType"))
+        mcp_plan_install_planned = MCPPlanInstallPlanned.from_dict(obj.get("McpPlanInstallPlanned"))
+        mcp_plan_install_request = MCPPlanInstallRequest.from_dict(obj.get("McpPlanInstallRequest"))
+        mcp_plan_install_result = _load_MCPPlanInstallResult(obj.get("McpPlanInstallResult"))
+        mcp_plan_install_source = _load_MCPPlanInstallSource(obj.get("McpPlanInstallSource"))
+        mcp_plan_install_source_candidate = MCPPlanInstallSourceCandidate.from_dict(obj.get("McpPlanInstallSourceCandidate"))
+        mcp_plan_install_source_candidate_kind = MCPPlanInstallSourceCandidateKind(obj.get("McpPlanInstallSourceCandidateKind"))
+        mcp_plan_install_source_card = MCPPlanInstallSourceCard.from_dict(obj.get("McpPlanInstallSourceCard"))
+        mcp_plan_install_source_card_kind = MCPPlanInstallSourceCardKind(obj.get("McpPlanInstallSourceCardKind"))
+        mcp_plan_package_install_method = MCPPlanPackageInstallMethod(obj.get("McpPlanPackageInstallMethod"))
+        mcp_plan_package_transport = MCPPlanPackageTransport(obj.get("McpPlanPackageTransport"))
+        mcp_plan_policy_decision = MCPPlanPolicyDecision(obj.get("McpPlanPolicyDecision"))
+        mcp_plan_policy_result = MCPPlanPolicyResult.from_dict(obj.get("McpPlanPolicyResult"))
+        mcp_plan_policy_source = MCPPlanPolicySource(obj.get("McpPlanPolicySource"))
+        mcp_plan_provenance = MCPPlanProvenance.from_dict(obj.get("McpPlanProvenance"))
+        mcp_plan_remote_install_method = MCPPlanRemoteInstallMethod(obj.get("McpPlanRemoteInstallMethod"))
+        mcp_plan_remote_transport = MCPPlanRemoteTransport(obj.get("McpPlanRemoteTransport"))
+        mcp_plan_required_value = _load_MCPPlanRequiredValue(obj.get("McpPlanRequiredValue"))
+        mcp_plan_required_value_enum = MCPPlanRequiredValueEnum.from_dict(obj.get("McpPlanRequiredValueEnum"))
+        mcp_plan_required_value_enum_kind = MCPPlan(obj.get("McpPlanRequiredValueEnumKind"))
+        mcp_plan_required_value_scalar = MCPPlanRequiredValueScalar.from_dict(obj.get("McpPlanRequiredValueScalar"))
+        mcp_plan_required_value_scalar_kind = MCPPlanRequiredValueScalarKind(obj.get("McpPlanRequiredValueScalarKind"))
+        mcp_plan_resource_identity = MCPPlanResourceIdentity.from_dict(obj.get("McpPlanResourceIdentity"))
+        mcp_plan_scalar_value_type = MCPPlanScalarValueTypeEnum(obj.get("McpPlanScalarValueType"))
+        mcp_plan_scope = MCPPlanScope(obj.get("McpPlanScope"))
+        mcp_plan_secret_placeholder = MCPPlanSecretPlaceholder.from_dict(obj.get("McpPlanSecretPlaceholder"))
+        mcp_plan_secret_reference = from_str(obj.get("McpPlanSecretReference"))
+        mcp_plan_target = MCPPlanTarget.from_dict(obj.get("McpPlanTarget"))
+        mcp_plan_transport_choice = _load_MCPPlanTransportChoice(obj.get("McpPlanTransportChoice"))
+        mcp_plan_transport_choice_package = MCPPlanTransportChoicePackage.from_dict(obj.get("McpPlanTransportChoicePackage"))
+        mcp_plan_transport_choice_remote = MCPPlanTransportChoiceRemote.from_dict(obj.get("McpPlanTransportChoiceRemote"))
+        mcp_plan_value_category = MCPPlanValueCategory(obj.get("McpPlanValueCategory"))
         mcp_register_external_client_request = MCPRegisterExternalClientRequest.from_dict(obj.get("McpRegisterExternalClientRequest"))
         mcp_reload_config = MCPReloadConfig.from_dict(obj.get("McpReloadConfig"))
         mcp_reload_with_config_request = MCPReloadWithConfigRequest.from_dict(obj.get("McpReloadWithConfigRequest"))
@@ -33624,6 +36127,12 @@ def from_dict(obj: Any) -> 'RPC':
         mcp_server = MCPServer.from_dict(obj.get("McpServer"))
         mcp_server_auth_config = from_union([from_bool, MCPServerAuthConfigRedirectPort.from_dict], obj.get("McpServerAuthConfig"))
         mcp_server_auth_config_redirect_port = MCPServerAuthConfigRedirectPort.from_dict(obj.get("McpServerAuthConfigRedirectPort"))
+        mcp_server_card_embedded = MCPServerCardEmbedded.from_dict(obj.get("McpServerCardEmbedded"))
+        mcp_server_card_embedded_kind = MCPServerCardEmbeddedKind(obj.get("McpServerCardEmbeddedKind"))
+        mcp_server_card_media_type = MCPServerCardMediaType(obj.get("McpServerCardMediaType"))
+        mcp_server_card_reference = _load_MCPServerCardReference(obj.get("McpServerCardReference"))
+        mcp_server_card_url = MCPServerCardURL.from_dict(obj.get("McpServerCardUrl"))
+        mcp_server_card_url_kind = MCPServerCardURLKind(obj.get("McpServerCardUrlKind"))
         mcp_server_config = MCPServerConfig.from_dict(obj.get("McpServerConfig"))
         mcp_server_config_defer_tools = MCPServerConfigDeferTools(obj.get("McpServerConfigDeferTools"))
         mcp_server_config_http = MCPServerConfigHTTP.from_dict(obj.get("McpServerConfigHttp"))
@@ -33694,6 +36203,7 @@ def from_dict(obj: Any) -> 'RPC':
         model_switch_to_result = ModelSwitchToResult.from_dict(obj.get("ModelSwitchToResult"))
         mode_set_request = ModeSetRequest.from_dict(obj.get("ModeSetRequest"))
         mode_set_result = ModeSetResult.from_dict(obj.get("ModeSetResult"))
+        move_mcp_loading_to_background_result = MoveMCPLoadingToBackgroundResult.from_dict(obj.get("MoveMcpLoadingToBackgroundResult"))
         named_provider_config = NamedProviderConfig.from_dict(obj.get("NamedProviderConfig"))
         name_get_result = NameGetResult.from_dict(obj.get("NameGetResult"))
         name_set_auto_request = NameSetAutoRequest.from_dict(obj.get("NameSetAutoRequest"))
@@ -33761,6 +36271,7 @@ def from_dict(obj: Any) -> 'RPC':
         permission_location_resolve_params = PermissionLocationResolveParams.from_dict(obj.get("PermissionLocationResolveParams"))
         permission_location_resolve_result = PermissionLocationResolveResult.from_dict(obj.get("PermissionLocationResolveResult"))
         permission_location_type = PermissionLocationType(obj.get("PermissionLocationType"))
+        permission_mode_source = PermissionSource(obj.get("PermissionModeSource"))
         permission_paths_add_params = PermissionPathsAddParams.from_dict(obj.get("PermissionPathsAddParams"))
         permission_paths_allowed_check_params = PermissionPathsAllowedCheckParams.from_dict(obj.get("PermissionPathsAllowedCheckParams"))
         permission_paths_allowed_check_result = PermissionPathsAllowedCheckResult.from_dict(obj.get("PermissionPathsAllowedCheckResult"))
@@ -33772,7 +36283,6 @@ def from_dict(obj: Any) -> 'RPC':
         permission_prompt_shown_notification = PermissionPromptShownNotification.from_dict(obj.get("PermissionPromptShownNotification"))
         permission_request_result = PermissionRequestResult.from_dict(obj.get("PermissionRequestResult"))
         permission_rules_set = PermissionRulesSet.from_dict(obj.get("PermissionRulesSet"))
-        permissions_allow_all_mode = PermissionsAllowAllMode(obj.get("PermissionsAllowAllMode"))
         permissions_configure_additional_content_exclusion_policy = PermissionsConfigureAdditionalContentExclusionPolicy.from_dict(obj.get("PermissionsConfigureAdditionalContentExclusionPolicy"))
         permissions_configure_additional_content_exclusion_policy_rule = PermissionsConfigureAdditionalContentExclusionPolicyRule.from_dict(obj.get("PermissionsConfigureAdditionalContentExclusionPolicyRule"))
         permissions_configure_additional_content_exclusion_policy_rule_source = PermissionsConfigureAdditionalContentExclusionPolicyRuleSource.from_dict(obj.get("PermissionsConfigureAdditionalContentExclusionPolicyRuleSource"))
@@ -33780,7 +36290,8 @@ def from_dict(obj: Any) -> 'RPC':
         permissions_configure_params = PermissionsConfigureParams.from_dict(obj.get("PermissionsConfigureParams"))
         permissions_configure_result = PermissionsConfigureResult.from_dict(obj.get("PermissionsConfigureResult"))
         permissions_folder_trust_add_trusted_result = PermissionsFolderTrustAddTrustedResult.from_dict(obj.get("PermissionsFolderTrustAddTrustedResult"))
-        permissions_get_allow_all_request = PermissionsGetAllowAllRequest.from_dict(obj.get("PermissionsGetAllowAllRequest"))
+        permissions_get_mode_request = PermissionsGetModeRequest.from_dict(obj.get("PermissionsGetModeRequest"))
+        permissions_get_mode_result = PermissionsGetModeResult.from_dict(obj.get("PermissionsGetModeResult"))
         permissions_locations_add_tool_approval_details = _load_PermissionsLocationsAddToolApprovalDetails(obj.get("PermissionsLocationsAddToolApprovalDetails"))
         permissions_locations_add_tool_approval_details_commands = PermissionsLocationsAddToolApprovalDetailsCommands.from_dict(obj.get("PermissionsLocationsAddToolApprovalDetailsCommands"))
         permissions_locations_add_tool_approval_details_custom_tool = PermissionsLocationsAddToolApprovalDetailsCustomTool.from_dict(obj.get("PermissionsLocationsAddToolApprovalDetailsCustomTool"))
@@ -33804,11 +36315,11 @@ def from_dict(obj: Any) -> 'RPC':
         permissions_pending_requests_request = PermissionsPendingRequestsRequest.from_dict(obj.get("PermissionsPendingRequestsRequest"))
         permissions_reset_session_approvals_request = PermissionsResetSessionApprovalsRequest.from_dict(obj.get("PermissionsResetSessionApprovalsRequest"))
         permissions_reset_session_approvals_result = PermissionsResetSessionApprovalsResult.from_dict(obj.get("PermissionsResetSessionApprovalsResult"))
-        permissions_set_allow_all_request = PermissionsSetAllowAllRequest.from_dict(obj.get("PermissionsSetAllowAllRequest"))
-        permissions_set_allow_all_source = PermissionsSetAAllSource(obj.get("PermissionsSetAllowAllSource"))
         permissions_set_approve_all_request = PermissionsSetApproveAllRequest.from_dict(obj.get("PermissionsSetApproveAllRequest"))
         permissions_set_approve_all_result = PermissionsSetApproveAllResult.from_dict(obj.get("PermissionsSetApproveAllResult"))
-        permissions_set_approve_all_source = PermissionsSetAAllSource(obj.get("PermissionsSetApproveAllSource"))
+        permissions_set_approve_all_source = PermissionSource(obj.get("PermissionsSetApproveAllSource"))
+        permissions_set_mode_request = PermissionsSetModeRequest.from_dict(obj.get("PermissionsSetModeRequest"))
+        permissions_set_mode_result = PermissionsSetModeResult.from_dict(obj.get("PermissionsSetModeResult"))
         permissions_set_required_request = PermissionsSetRequiredRequest.from_dict(obj.get("PermissionsSetRequiredRequest"))
         permissions_set_required_result = PermissionsSetRequiredResult.from_dict(obj.get("PermissionsSetRequiredResult"))
         permissions_urls_set_unrestricted_mode_result = PermissionsUrlsSetUnrestrictedModeResult.from_dict(obj.get("PermissionsUrlsSetUnrestrictedModeResult"))
@@ -34322,7 +36833,7 @@ def from_dict(obj: Any) -> 'RPC':
         subagent_settings = from_union([SubagentSettings.from_dict, from_none], obj.get("SubagentSettings"))
         task_progress = from_union([TaskProgress.from_dict, from_none], obj.get("TaskProgress"))
         workspace_summary = from_union([WorkspaceSummary.from_dict, from_none], obj.get("WorkspaceSummary"))
-        return RPC(abort_request, abort_result, account_all_users, account_get_all_users_result, account_get_current_auth_result, account_get_quota_request, account_get_quota_result, account_login_request, account_login_result, account_logout_request, account_logout_result, account_quota_snapshot, adaptive_thinking_support, agent_discovery_path, agent_discovery_path_list, agent_discovery_path_scope, agent_get_current_result, agent_info, agent_info_source, agent_list, agent_list_request, agent_registry_live_target_entry, agent_registry_live_target_entry_attention_kind, agent_registry_live_target_entry_kind, agent_registry_live_target_entry_last_terminal_event, agent_registry_live_target_entry_status, agent_registry_log_capture, agent_registry_log_capture_open_error_reason, agent_registry_spawn_error, agent_registry_spawn_permission_mode, agent_registry_spawn_registry_timeout, agent_registry_spawn_request, agent_registry_spawn_result, agent_registry_spawn_spawned, agent_registry_spawn_validation_error, agent_registry_spawn_validation_error_field, agent_registry_spawn_validation_error_reason, agent_reload_result, agents_discover_request, agent_select_request, agent_select_result, agent_set_prompt_request, agents_get_discovery_paths_request, allow_all_permission_set_result, allow_all_permission_state, api_key_auth_info, auth_identity, auth_info, auth_info_type, auth_validation_error, auth_validation_errors, built_in_model_catalog, built_in_model_catalog_entry, builtin_tool_descriptor, builtin_tool_format, builtin_tool_format_type, builtin_tool_input_schema, builtin_tool_input_schema_type, builtin_tool_safe_for_telemetry, builtin_tool_safe_telemetry_fields, cancel_user_requested_shell_command_result, canvas_action, canvas_action_invoke_request, canvas_action_invoke_result, canvas_close_request, canvas_host_context, canvas_host_context_capabilities, canvas_json_schema, canvas_list, canvas_list_open_result, canvas_open_request, canvas_provider_close_request, canvas_provider_invoke_action_request, canvas_provider_open_request, canvas_provider_open_result, canvas_provider_register_request, canvas_provider_unregister_request, canvas_session_context, capi_session_options, command_list, commands_finalize_invocation_effect_request, commands_finalize_invocation_effect_result, commands_handle_pending_command_request, commands_handle_pending_command_result, commands_invocation_effect_outcome, commands_invocation_origin, commands_invoke_request, commands_list_request, commands_respond_to_queued_command_request, commands_respond_to_queued_command_result, completions_get_trigger_characters_result, completions_request_request, completions_request_result, configure_session_extensions_params, connected_remote_session_metadata, connected_remote_session_metadata_kind, connected_remote_session_metadata_repository, connect_remote_session_params, connect_request, connect_result, content_exclusion_check_paths_request, content_exclusion_check_paths_result, content_exclusion_path_check, content_filter_mode, context_heaviest_message, copilot_api_token_auth_info, copilot_user_response, copilot_user_response_endpoints, copilot_user_response_quota_snapshots, copilot_user_response_quota_snapshots_chat, copilot_user_response_quota_snapshots_completions, copilot_user_response_quota_snapshots_premium_interactions, current_model, current_tool_metadata, debug_collect_logs_collected_entry, debug_collect_logs_destination, debug_collect_logs_entry, debug_collect_logs_entry_kind, debug_collect_logs_include, debug_collect_logs_redaction, debug_collect_logs_request, debug_collect_logs_result, debug_collect_logs_result_kind, debug_collect_logs_skipped_entry, debug_collect_logs_source, disable_bypass_permissions_mode, discovered_canvas, discovered_extension, discovered_extension_mode, discovered_extension_plugin, discovered_extensions, discovered_extensions_disable_request, discovered_extensions_enable_request, discovered_extension_source, discovered_mcp_server, discovered_mcp_server_type, enqueue_command_params, enqueue_command_result, env_auth_info, event_log_read_request, event_log_release_interest_result, event_log_tail_result, event_log_types, events_agent_scope, events_cursor_status, events_read_direction, events_read_result, execute_command_params, execute_command_result, extension, extension_context_push_input, extension_launch_profile, extension_launch_provider_resolve_request, extension_launch_provider_resolve_result, extension_list, extensions_disable_request, extensions_enable_request, extension_source, extension_status, external_tool_result, external_tool_text_result_for_llm, external_tool_text_result_for_llm_binary_results_for_llm, external_tool_text_result_for_llm_binary_results_for_llm_type, external_tool_text_result_for_llm_content, external_tool_text_result_for_llm_content_audio, external_tool_text_result_for_llm_content_image, external_tool_text_result_for_llm_content_resource, external_tool_text_result_for_llm_content_resource_details, external_tool_text_result_for_llm_content_resource_link, external_tool_text_result_for_llm_content_resource_link_icon, external_tool_text_result_for_llm_content_resource_link_icon_theme, external_tool_text_result_for_llm_content_shell_exit, external_tool_text_result_for_llm_content_terminal, external_tool_text_result_for_llm_content_text, factory_abort_request, factory_ack_result, factory_agent_options, factory_agent_request, factory_agent_result, factory_agent_summary, factory_cancel_request, factory_current_phase, factory_declared_limits, factory_durable_operation, factory_execute_request, factory_execute_result, factory_get_run_progress_request, factory_get_run_request, factory_journal_get_request, factory_journal_get_result, factory_journal_put_request, factory_list_runs_request, factory_list_runs_result, factory_log_line, factory_log_line_kind, factory_log_request, factory_phase_observation, factory_phase_status, factory_progress_line, factory_progress_page, factory_resume_request, factory_resume_result, factory_run_consumed, factory_run_detail, factory_run_failure, factory_run_failure_kind, factory_run_limits, factory_run_request, factory_run_result, factory_run_status, factory_run_summary, factory_run_terminal, filter_mapping, fleet_start_request, fleet_start_result, folder_trust_add_params, folder_trust_check_params, folder_trust_check_result, gh_cli_auth_info, git_hub_telemetry_client_info, git_hub_telemetry_event, git_hub_telemetry_notification, handle_pending_tool_call_request, handle_pending_tool_call_result, history_abort_manual_compaction_result, history_cancel_background_compaction_result, history_clear_context_request, history_clear_context_result, history_compact_context_window, history_compact_request, history_compact_result, history_file_restore_skip_reason, history_list_rewind_points_result, history_preview_rewind_request, history_preview_rewind_result, history_rewind_change_type, history_rewind_file_preview, history_rewind_mode, history_rewind_outcome, history_rewind_point, history_rewind_request, history_rewind_result, history_rewind_unavailable_reason, history_skipped_file_restore, history_summarize_for_handoff_result, history_truncate_request, history_truncate_result, hmac_auth_info, hook_invoke_request, hook_invoke_response, hook_type, installed_plugin, installed_plugin_info, installed_plugin_source, installed_plugin_source_git_hub, installed_plugin_source_local, installed_plugin_source_url, instruction_discovery_path, instruction_discovery_path_kind, instruction_discovery_path_list, instruction_discovery_path_location, instructions_discover_request, instructions_get_discovery_paths_request, instructions_get_sources_result, instruction_source, instruction_source_location, instruction_source_type, interrupt_main_turn_request, interrupt_main_turn_result, llm_inference_headers, llm_inference_http_request_chunk_request, llm_inference_http_request_chunk_result, llm_inference_http_request_start_request, llm_inference_http_request_start_result, llm_inference_http_request_start_transport, llm_inference_http_response_chunk_error, llm_inference_http_response_chunk_request, llm_inference_http_response_chunk_result, llm_inference_http_response_start_request, llm_inference_http_response_start_result, llm_inference_set_provider_result, local_session_metadata_value, log_request, log_result, lsp_initialize_request, managed_settings_read_result, marketplace_add_result, marketplace_browse_result, marketplace_info, marketplace_list_result, marketplace_plugin_info, marketplace_refresh_entry, marketplace_refresh_result, marketplace_remove_result, mcp_allowed_server, mcp_apps_call_tool_request, mcp_apps_diagnose_capability, mcp_apps_diagnose_request, mcp_apps_diagnose_result, mcp_apps_diagnose_server, mcp_apps_host_context, mcp_apps_host_context_details, mcp_apps_host_context_details_available_display_mode, mcp_apps_host_context_details_display_mode, mcp_apps_host_context_details_platform, mcp_apps_host_context_details_theme, mcp_apps_list_tools_request, mcp_apps_list_tools_result, mcp_apps_read_resource_request, mcp_apps_read_resource_result, mcp_apps_resource_content, mcp_apps_set_host_context_details, mcp_apps_set_host_context_details_available_display_mode, mcp_apps_set_host_context_details_display_mode, mcp_apps_set_host_context_details_platform, mcp_apps_set_host_context_details_theme, mcp_apps_set_host_context_request, mcp_cancel_sampling_execution_params, mcp_cancel_sampling_execution_result, mcp_config_add_request, mcp_config_disable_request, mcp_config_enable_request, mcp_config_list, mcp_config_remove_request, mcp_config_update_request, mcp_configure_git_hub_request, mcp_configure_git_hub_result, mcp_disable_request, mcp_discover_request, mcp_discover_result, mcp_elicitation_form_mode, mcp_enable_request, mcp_execute_sampling_params, mcp_execute_sampling_request, mcp_execute_sampling_result, mcp_failed_server, mcp_filtered_server, mcp_headers_handle_pending_headers_refresh_request, mcp_headers_handle_pending_headers_refresh_request_request, mcp_headers_handle_pending_headers_refresh_request_result, mcp_host_state, mcp_is_server_running_request, mcp_is_server_running_result, mcp_list_tools_request, mcp_list_tools_result, mcp_oauth_authentication_state_changed_request, mcp_oauth_handle_pending_request, mcp_oauth_handle_pending_result, mcp_oauth_login_grant_type, mcp_oauth_login_request, mcp_oauth_login_result, mcp_oauth_pending_request_response, mcp_oauth_probe_needs_auth_reason, mcp_oauth_probe_request, mcp_oauth_probe_result, mcp_oauth_respond_request, mcp_oauth_respond_result, mcp_register_external_client_request, mcp_reload_config, mcp_reload_with_config_request, mcp_remove_git_hub_result, mcp_resource, mcp_resource_annotations, mcp_resource_content, mcp_resource_icon, mcp_resources_list_request, mcp_resources_list_result, mcp_resources_list_templates_request, mcp_resources_list_templates_result, mcp_resources_read_request, mcp_resources_read_result, mcp_resource_template, mcp_restart_server_request, mcp_safe_for_telemetry, mcp_safe_for_telemetry_fields, mcp_sampling_execution_action, mcp_sampling_execution_result, mcp_serializable_server_config, mcp_server, mcp_server_auth_config, mcp_server_auth_config_redirect_port, mcp_server_config, mcp_server_config_defer_tools, mcp_server_config_http, mcp_server_config_http_oauth_grant_type, mcp_server_config_http_type, mcp_server_config_memory, mcp_server_config_memory_type, mcp_server_config_stdio, mcp_server_config_stdio_type, mcp_server_failure_info, mcp_server_list, mcp_server_needs_auth_info, mcp_set_env_value_mode_details, mcp_set_env_value_mode_params, mcp_set_env_value_mode_result, mcp_start_server_request, mcp_start_servers_result, mcp_stop_server_request, mcp_task_metadata, mcp_tools, mcp_tool_ui, mcp_tool_ui_visibility, mcp_unregister_external_client_request, memory_configuration, metadata_context_attribution_result, metadata_context_heaviest_messages_request, metadata_context_heaviest_messages_result, metadata_context_info_request, metadata_context_info_result, metadata_is_processing_result, metadata_recompute_context_tokens_request, metadata_recompute_context_tokens_result, metadata_record_context_change_request, metadata_record_context_change_result, metadata_set_working_directory_request, metadata_set_working_directory_result, metadata_snapshot_current_mode, metadata_snapshot_remote_metadata, metadata_snapshot_remote_metadata_repository, metadata_snapshot_remote_metadata_task_type, model, model_apply_startup_overlay_request, model_billing, model_billing_promo, model_billing_token_prices, model_billing_token_prices_long_context, model_capabilities, model_capabilities_limits, model_capabilities_limits_vision, model_capabilities_override, model_capabilities_override_limits, model_capabilities_override_limits_vision, model_capabilities_override_supports, model_capabilities_supports, model_list, model_list_request, model_picker_category, model_picker_persistence_request, model_picker_price_category, model_picker_settings_context, model_policy, model_policy_state, model_set_reasoning_effort_request, model_set_reasoning_effort_result, models_list_request, model_switch_confirmation, model_switch_to_request, model_switch_to_result, mode_set_request, mode_set_result, named_provider_config, name_get_result, name_set_auto_request, name_set_auto_result, name_set_request, open_canvas_instance, options_update_additional_content_exclusion_policy, options_update_additional_content_exclusion_policy_rule, options_update_additional_content_exclusion_policy_rule_source, options_update_additional_content_exclusion_policy_scope, options_update_context_tier, options_update_env_value_mode, options_update_reasoning_summary, options_update_tool_filter_precedence, pending_permission_request, pending_permission_request_list, permission_decision, permission_decision_approved, permission_decision_approved_for_location, permission_decision_approved_for_session, permission_decision_approve_for_location, permission_decision_approve_for_location_approval, permission_decision_approve_for_location_approval_commands, permission_decision_approve_for_location_approval_custom_tool, permission_decision_approve_for_location_approval_extension_env_access, permission_decision_approve_for_location_approval_extension_management, permission_decision_approve_for_location_approval_extension_permission_access, permission_decision_approve_for_location_approval_factory, permission_decision_approve_for_location_approval_mcp, permission_decision_approve_for_location_approval_mcp_sampling, permission_decision_approve_for_location_approval_memory, permission_decision_approve_for_location_approval_read, permission_decision_approve_for_location_approval_write, permission_decision_approve_for_session, permission_decision_approve_for_session_approval, permission_decision_approve_for_session_approval_commands, permission_decision_approve_for_session_approval_custom_tool, permission_decision_approve_for_session_approval_extension_env_access, permission_decision_approve_for_session_approval_extension_management, permission_decision_approve_for_session_approval_extension_permission_access, permission_decision_approve_for_session_approval_factory, permission_decision_approve_for_session_approval_mcp, permission_decision_approve_for_session_approval_mcp_sampling, permission_decision_approve_for_session_approval_memory, permission_decision_approve_for_session_approval_read, permission_decision_approve_for_session_approval_write, permission_decision_approve_once, permission_decision_approve_permanently, permission_decision_cancelled, permission_decision_context, permission_decision_denied_by_content_exclusion_policy, permission_decision_denied_by_permission_request_hook, permission_decision_denied_by_rules, permission_decision_denied_interactively_by_user, permission_decision_denied_no_approval_rule_and_could_not_request_from_user, permission_decision_outcome, permission_decision_reject, permission_decision_request, permission_decision_source, permission_decision_surface, permission_decision_user_not_available, permission_location_add_tool_approval_params, permission_location_apply_params, permission_location_apply_result, permission_location_resolve_params, permission_location_resolve_result, permission_location_type, permission_paths_add_params, permission_paths_allowed_check_params, permission_paths_allowed_check_result, permission_paths_config, permission_paths_list, permission_paths_update_primary_params, permission_paths_workspace_check_params, permission_paths_workspace_check_result, permission_prompt_shown_notification, permission_request_result, permission_rules_set, permissions_allow_all_mode, permissions_configure_additional_content_exclusion_policy, permissions_configure_additional_content_exclusion_policy_rule, permissions_configure_additional_content_exclusion_policy_rule_source, permissions_configure_additional_content_exclusion_policy_scope, permissions_configure_params, permissions_configure_result, permissions_folder_trust_add_trusted_result, permissions_get_allow_all_request, permissions_locations_add_tool_approval_details, permissions_locations_add_tool_approval_details_commands, permissions_locations_add_tool_approval_details_custom_tool, permissions_locations_add_tool_approval_details_extension_env_access, permissions_locations_add_tool_approval_details_extension_management, permissions_locations_add_tool_approval_details_extension_permission_access, permissions_locations_add_tool_approval_details_factory, permissions_locations_add_tool_approval_details_mcp, permissions_locations_add_tool_approval_details_mcp_sampling, permissions_locations_add_tool_approval_details_memory, permissions_locations_add_tool_approval_details_read, permissions_locations_add_tool_approval_details_write, permissions_locations_add_tool_approval_result, permissions_modify_rules_params, permissions_modify_rules_result, permissions_modify_rules_scope, permissions_notify_prompt_shown_result, permissions_paths_add_result, permissions_paths_list_request, permissions_paths_update_primary_result, permissions_pending_requests_request, permissions_reset_session_approvals_request, permissions_reset_session_approvals_result, permissions_set_allow_all_request, permissions_set_allow_all_source, permissions_set_approve_all_request, permissions_set_approve_all_result, permissions_set_approve_all_source, permissions_set_required_request, permissions_set_required_result, permissions_urls_set_unrestricted_mode_result, permission_urls_config, permission_urls_set_unrestricted_mode_params, ping_request, ping_result, plan_read_result, plan_read_sql_todos_result, plan_read_sql_todos_with_dependencies_result, plan_sql_todo_dependency, plan_sql_todos_row, plan_update_request, plugin, plugin_install_result, plugin_list, plugin_list_result, plugins_builtin_set_request, plugins_disable_request, plugins_enable_request, plugins_install_request, plugins_marketplaces_add_request, plugins_marketplaces_browse_request, plugins_marketplaces_refresh_request, plugins_marketplaces_remove_request, plugins_reload_request, plugins_uninstall_request, plugins_update_request, plugin_update_all_entry, plugin_update_all_result, plugin_update_result, protocol_external_tool_defer, protocol_external_tool_definition, provider_add_request, provider_add_result, provider_config, provider_config_azure, provider_config_transport, provider_config_type, provider_config_wire_api, provider_endpoint, provider_endpoint_transport, provider_endpoint_type, provider_endpoint_wire_api, provider_get_endpoint_request, provider_model_config, provider_session_token, provider_token_acquire_request, provider_token_acquire_result, push_attachment, push_attachment_blob, push_attachment_directory, push_attachment_file, push_attachment_file_line_range, push_attachment_git_hub_actions_job, push_attachment_git_hub_commit, push_attachment_git_hub_file, push_attachment_git_hub_file_diff, push_attachment_git_hub_file_diff_side, push_attachment_git_hub_reference, push_attachment_git_hub_reference_type, push_attachment_git_hub_release, push_attachment_git_hub_repository, push_attachment_git_hub_snippet, push_attachment_git_hub_tree_comparison, push_attachment_git_hub_tree_comparison_side, push_attachment_git_hub_url, push_attachment_selection, push_attachment_selection_details, push_attachment_selection_details_end, push_attachment_selection_details_start, push_git_hub_repo_ref, queue_begin_deferred_idle_drain_request, queue_begin_deferred_idle_drain_result, queue_consume_system_notifications_request, queued_command_handled, queued_command_not_handled, queued_command_result, queue_defer_session_idle_request, queue_duplicate_at_request, queue_duplicate_at_result, queue_enqueue_resume_pending_result, queue_finish_deferred_idle_drain_request, queue_finish_deferred_idle_drain_result, queue_has_pending_result, queue_insert_at_request, queue_insert_at_result, queue_insert_message, queue_move_item_request, queue_move_item_result, queue_pending_items, queue_pending_items_kind, queue_pending_items_result, queue_remove_at_request, queue_remove_at_result, queue_remove_most_recent_result, queue_send_now_request, queue_send_now_result, queue_set_drain_paused_request, queue_snapshot_result, queue_update_text_request, queue_update_text_result, register_event_interest_params, register_event_interest_result, register_extension_tools_params, register_extension_tools_result, release_event_interest_params, remote_control_config, remote_control_config_existing_mc_session, remote_control_status, remote_control_status_active, remote_control_status_connecting, remote_control_status_error, remote_control_status_off, remote_control_status_result, remote_control_stop_result, remote_control_transfer_result, remote_enable_request, remote_enable_result, remote_notify_steerable_changed_request, remote_notify_steerable_changed_result, remote_session_connection_result, remote_session_host_status, remote_session_metadata_repository, remote_session_metadata_task_type, remote_session_metadata_value, remote_session_mode, remote_session_repository, run_options, sandbox_config, sandbox_config_auth, sandbox_config_user_policy, sandbox_config_user_policy_experimental, sandbox_config_user_policy_experimental_seatbelt, sandbox_config_user_policy_filesystem, sandbox_config_user_policy_network, sandbox_config_user_policy_network_proxy, sandbox_config_user_policy_seatbelt, schedule_add_at_request, schedule_add_cron_request, schedule_add_request, schedule_add_result, schedule_add_self_paced_request, schedule_entry, schedule_has_self_paced_result, schedule_list, schedule_rearm_self_paced_request, schedule_stop_request, schedule_stop_result, secrets_add_filter_values_request, secrets_add_filter_values_result, send_agent_mode, send_attachments_to_message_params, send_message_item, send_messages_request, send_messages_result, send_mode, send_request, send_result, send_system_notification_request, server_agent_list, server_instruction_source_list, server_skill, server_skill_list, session_activity, session_agent_list_request, session_auth_login_request, session_auth_logout_user_request, session_auth_status, session_auth_switch_request, session_bulk_delete_result, session_cancel_all_background_agents_result, session_capability, session_commands_list_request, session_completion_item, session_context, session_context_host_type, session_enrich_metadata_result, session_fs_append_file_request, session_fs_error, session_fs_error_code, session_fs_exists_request, session_fs_exists_result, session_fs_mkdir_request, session_fs_readdir_request, session_fs_readdir_result, session_fs_readdir_with_types_entry, session_fs_readdir_with_types_entry_type, session_fs_readdir_with_types_request, session_fs_readdir_with_types_result, session_fs_read_file_request, session_fs_read_file_result, session_fs_rename_request, session_fs_rm_request, session_fs_set_provider_capabilities, session_fs_set_provider_conventions, session_fs_set_provider_request, session_fs_set_provider_result, session_fs_sqlite_exists_request, session_fs_sqlite_exists_result, session_fs_sqlite_query_request, session_fs_sqlite_query_result, session_fs_sqlite_query_type, session_fs_sqlite_transaction_error, session_fs_sqlite_transaction_error_class, session_fs_sqlite_transaction_request, session_fs_sqlite_transaction_result, session_fs_sqlite_transaction_statement, session_fs_stat_request, session_fs_stat_result, session_fs_write_file_request, session_git_hub_auth_get_all_auth_available_result, session_git_hub_auth_logout_result, session_git_hub_auth_logout_user_result, session_history_compact_request, session_installed_plugin, session_installed_plugin_source, session_installed_plugin_source_git_hub, session_installed_plugin_source_local, session_installed_plugin_source_url, session_limit_prediction_baseline_data, session_limit_prediction_client_type, session_limit_prediction_details, session_limit_prediction_predict_request, session_limit_prediction_request, session_limit_prediction_result, session_limit_prediction_source, session_limit_prediction_tier, session_limit_prediction_tier_option, session_limit_prediction_unavailable_reason, session_list, session_list_entry, session_list_filter, session_load_deferred_repo_hooks_result, session_log_level, session_managed_permissions, session_managed_settings, session_mcp_apps_call_tool_result, session_metadata_snapshot, session_mode, session_model_list, session_model_list_request, session_model_price_category, session_open_options, session_open_options_additional_content_exclusion_policy, session_open_options_additional_content_exclusion_policy_rule, session_open_options_additional_content_exclusion_policy_rule_source, session_open_options_additional_content_exclusion_policy_scope, session_open_options_env_value_mode, session_open_options_reasoning_summary, session_open_params, session_open_result, session_plugins_reload_request, session_provider_get_endpoint_request, session_prune_result, sessions_bulk_delete_request, sessions_check_in_use_request, sessions_check_in_use_result, sessions_close_request, sessions_close_result, sessions_delete_request, sessions_enrich_metadata_request, session_set_credentials_params, session_set_credentials_result, session_settings_built_in_tool_availability_snapshot, session_settings_evaluate_predicate_request, session_settings_evaluate_predicate_result, session_settings_job_snapshot, session_settings_model_snapshot, session_settings_online_evaluation_snapshot, session_settings_predicate_name, session_settings_repo_snapshot, session_settings_snapshot, session_settings_validation_snapshot, sessions_find_by_prefix_request, sessions_find_by_prefix_result, sessions_find_by_task_id_request, sessions_find_by_task_id_result, sessions_fork_request, sessions_fork_result, sessions_get_board_entry_count_request, sessions_get_board_entry_count_result, sessions_get_event_file_path_request, sessions_get_event_file_path_result, sessions_get_last_for_context_request, sessions_get_last_for_context_result, sessions_get_metadata_request, sessions_get_metadata_result, sessions_get_persisted_remote_steerable_request, sessions_get_persisted_remote_steerable_result, session_sizes, sessions_list_non_empty_session_ids_request, sessions_list_non_empty_session_ids_result, sessions_list_request, sessions_load_deferred_repo_hooks_request, sessions_open_attach, sessions_open_cloud, sessions_open_create, sessions_open_handoff, sessions_open_handoff_task_type, sessions_open_progress, sessions_open_progress_status, sessions_open_progress_step, sessions_open_remote, sessions_open_resume, sessions_open_resume_last, sessions_open_status, session_source, sessions_prune_old_request, sessions_register_extension_tools_on_session_options, sessions_release_lock_request, sessions_release_lock_result, sessions_reload_plugin_hooks_request, sessions_reload_plugin_hooks_result, sessions_save_request, sessions_save_result, sessions_set_additional_plugins_request, sessions_set_additional_plugins_result, sessions_set_remote_control_steering_request, sessions_start_remote_control_request, sessions_stop_remote_control_request, sessions_transfer_remote_control_request, session_telemetry_engagement, session_update_options_params, session_update_options_result, session_visibility_status, session_working_directory_context, session_working_directory_context_host_type, shell_cancel_user_requested_request, shell_credentials, shell_exec_request, shell_exec_result, shell_execute_user_requested_request, shell_init_profile, shell_init_script, shell_init_script_shell, shell_kill_request, shell_kill_result, shell_kill_signal, shell_options, shutdown_request, skill, skill_discovery_path, skill_discovery_path_list, skill_discovery_scope, skill_list, skills_config_set_disabled_skills_request, skills_config_set_skill_disabled_request, skills_disable_request, skills_discover_request, skills_enable_request, skills_get_discovery_paths_request, skills_get_invoked_result, skills_invoked_skill, skills_load_diagnostics, slash_command_add_timeline_entry_result, slash_command_agent_prompt_result, slash_command_completed_result, slash_command_info, slash_command_input, slash_command_input_choice, slash_command_input_completion, slash_command_invocation_result, slash_command_kind, slash_command_model_picker_dialog, slash_command_select_subcommand_option, slash_command_select_subcommand_result, slash_command_set_model_result, slash_command_set_plan_model_result, slash_command_show_dialog_result, slash_command_text_result, slash_command_timeline_entry, subagent_settings_entry, subagent_settings_entry_context_tier, task_agent_info, task_agent_progress, task_complete_data, task_completion_decision, task_execution_mode, task_info, task_list, task_progress_line, tasks_cancel_request, tasks_cancel_result, tasks_get_current_promotable_result, tasks_get_progress_request, tasks_get_progress_result, task_shell_info, task_shell_info_attachment_mode, task_shell_progress, tasks_promote_current_to_background_result, tasks_promote_to_background_request, tasks_promote_to_background_result, tasks_refresh_result, tasks_remove_request, tasks_remove_result, tasks_send_message_request, tasks_send_message_result, tasks_start_agent_request, tasks_start_agent_result, task_status, tasks_wait_for_pending_result, telemetry_set_feature_overrides_request, token_auth_info, tool, tool_list, tool_result, tool_result_expanded, tool_result_new_message, tool_result_type, tools_execute_request, tools_get_builtin_descriptors_request, tools_get_builtin_descriptors_result, tools_get_current_metadata_result, tools_initialize_and_validate_result, tools_list_request, tools_set_request, tools_set_result, tools_shell_descriptor_config, tools_task_complete_event_data_request, tools_update_subagent_settings_result, ui_auto_mode_switch_response, ui_elicitation_array_any_of_field, ui_elicitation_array_any_of_field_items, ui_elicitation_array_any_of_field_items_any_of, ui_elicitation_array_enum_field, ui_elicitation_array_enum_field_items, ui_elicitation_field_value, ui_elicitation_request, ui_elicitation_response, ui_elicitation_response_action, ui_elicitation_response_content, ui_elicitation_result, ui_elicitation_schema, ui_elicitation_schema_property, ui_elicitation_schema_property_boolean, ui_elicitation_schema_property_number, ui_elicitation_schema_property_number_type, ui_elicitation_schema_property_string, ui_elicitation_schema_property_string_format, ui_elicitation_string_enum_field, ui_elicitation_string_one_of_field, ui_elicitation_string_one_of_field_one_of, ui_ephemeral_query_request, ui_ephemeral_query_result, ui_exit_plan_mode_action, ui_exit_plan_mode_response, ui_handle_pending_auto_mode_switch_request, ui_handle_pending_elicitation_request, ui_handle_pending_exit_plan_mode_request, ui_handle_pending_result, ui_handle_pending_sampling_request, ui_handle_pending_sampling_response, ui_handle_pending_session_limits_exhausted_request, ui_handle_pending_user_input_request, ui_register_direct_auto_mode_switch_handler_result, ui_session_limits_exhausted_response, ui_session_limits_exhausted_response_action, ui_unregister_direct_auto_mode_switch_handler_request, ui_unregister_direct_auto_mode_switch_handler_result, ui_user_input_response, update_subagent_settings_request, usage_get_metrics_result, usage_metrics_agent_metric, usage_metrics_code_changes, usage_metrics_model_metric, usage_metrics_model_metric_requests, usage_metrics_model_metric_token_detail, usage_metrics_model_metric_usage, usage_metrics_token_detail, user_auth_info, user_requested_shell_command_result, user_setting_metadata, user_settings_get_result, user_settings_set_request, user_settings_set_result, visibility_get_result, visibility_set_request, visibility_set_result, workspace_diff_file_change, workspace_diff_file_change_type, workspace_diff_mode, workspace_diff_result, workspaces_add_summary_request, workspaces_add_summary_result, workspaces_autopilot_objective_exists_result, workspaces_checkpoints, workspaces_create_file_request, workspaces_delete_autopilot_objective_result, workspaces_diff_request, workspaces_ensure_request, workspaces_get_workspace_result, workspaces_list_checkpoints_result, workspaces_list_files_result, workspaces_read_autopilot_objective_result, workspaces_read_checkpoint_request, workspaces_read_checkpoint_result, workspaces_read_file_request, workspaces_read_file_result, workspaces_save_large_paste_request, workspaces_save_large_paste_result, workspaces_truncate_summaries_request, workspace_summary_host_type, workspaces_update_metadata_request, workspaces_workspace_details_host_type, workspaces_write_autopilot_objective_request, workspaces_write_autopilot_objective_result, session_auth_info_result, session_context_attribution, session_context_info, subagent_settings, task_progress, workspace_summary)
+        return RPC(abort_request, abort_result, account_all_users, account_get_all_users_result, account_get_current_auth_result, account_get_quota_request, account_get_quota_result, account_login_request, account_login_result, account_logout_request, account_logout_result, account_quota_snapshot, adaptive_thinking_support, agent_discovery_path, agent_discovery_path_list, agent_discovery_path_scope, agent_get_current_result, agent_info, agent_info_source, agent_list, agent_list_request, agent_registry_live_target_entry, agent_registry_live_target_entry_attention_kind, agent_registry_live_target_entry_kind, agent_registry_live_target_entry_last_terminal_event, agent_registry_live_target_entry_status, agent_registry_log_capture, agent_registry_log_capture_open_error_reason, agent_registry_spawn_error, agent_registry_spawn_permission_mode, agent_registry_spawn_registry_timeout, agent_registry_spawn_request, agent_registry_spawn_result, agent_registry_spawn_spawned, agent_registry_spawn_validation_error, agent_registry_spawn_validation_error_field, agent_registry_spawn_validation_error_reason, agent_reload_result, agents_discover_request, agent_select_request, agent_select_result, agent_set_prompt_request, agents_get_discovery_paths_request, api_key_auth_info, auth_identity, auth_info, auth_info_type, auth_validation_error, auth_validation_errors, built_in_model_catalog, built_in_model_catalog_entry, builtin_tool_descriptor, builtin_tool_format, builtin_tool_format_type, builtin_tool_input_schema, builtin_tool_input_schema_type, builtin_tool_safe_for_telemetry, builtin_tool_safe_telemetry_fields, cancel_user_requested_shell_command_result, canvas_action, canvas_action_invoke_request, canvas_action_invoke_result, canvas_close_request, canvas_host_context, canvas_host_context_capabilities, canvas_json_schema, canvas_list, canvas_list_open_result, canvas_open_request, canvas_provider_close_request, canvas_provider_invoke_action_request, canvas_provider_open_request, canvas_provider_open_result, canvas_provider_register_request, canvas_provider_unregister_request, canvas_session_context, capi_session_options, card_digest, card_digest_algorithm, card_digest_value, catalog_ai_skill_candidate, catalog_ai_skill_candidate_provenance, catalog_authentication_required_error, catalog_authentication_required_reason, catalog_candidate, catalog_candidate_kind, catalog_candidate_source, catalog_candidate_source_embedded, catalog_candidate_source_url, catalog_capability, catalog_capability_id, catalog_client_contract, catalog_contract_violation_error, catalog_contract_violation_reason, catalog_handle_rejected_error, catalog_handle_rejection_reason, catalog_handle_type, catalog_invalid_request_error, catalog_invalid_request_field, catalog_malformed_card_error, catalog_malformed_card_reason, catalog_mcp_server_candidate, catalog_mcp_server_candidate_provenance, catalog_mcp_server_installability, catalog_media_type, catalog_negotiated_contract, catalog_negotiation_refused_error, catalog_negotiation_refused_reason, catalog_network_failure_error, catalog_network_failure_reason, catalog_not_installable_error, catalog_not_installable_reason, catalog_policy_rejected_error, catalog_search_request, catalog_search_result, catalog_search_succeeded, catalog_unavailable_error, catalog_unavailable_reason, catalog_unavailable_transport_error, catalog_unavailable_transport_reason, catalog_unsafe_retrieval_error, catalog_unsafe_retrieval_reason, catalog_unsupported_kind_error, command_list, commands_finalize_invocation_effect_request, commands_finalize_invocation_effect_result, commands_handle_pending_command_request, commands_handle_pending_command_result, commands_invocation_effect_outcome, commands_invocation_origin, commands_invoke_request, commands_list_request, commands_respond_to_queued_command_request, commands_respond_to_queued_command_result, completions_get_trigger_characters_result, completions_request_request, completions_request_result, configure_session_extensions_params, connected_remote_session_metadata, connected_remote_session_metadata_kind, connected_remote_session_metadata_repository, connect_remote_session_params, connect_request, connect_result, content_exclusion_check_paths_request, content_exclusion_check_paths_result, content_exclusion_path_check, content_filter_mode, context_heaviest_message, copilot_api_token_auth_info, copilot_user_response, copilot_user_response_endpoints, copilot_user_response_quota_snapshots, copilot_user_response_quota_snapshots_chat, copilot_user_response_quota_snapshots_completions, copilot_user_response_quota_snapshots_premium_interactions, current_model, current_tool_metadata, debug_collect_logs_collected_entry, debug_collect_logs_destination, debug_collect_logs_entry, debug_collect_logs_entry_kind, debug_collect_logs_include, debug_collect_logs_redaction, debug_collect_logs_request, debug_collect_logs_result, debug_collect_logs_result_kind, debug_collect_logs_skipped_entry, debug_collect_logs_source, disable_bypass_permissions_mode, discovered_canvas, discovered_extension, discovered_extension_mode, discovered_extension_plugin, discovered_extensions, discovered_extensions_disable_request, discovered_extensions_enable_request, discovered_extension_source, discovered_mcp_server, discovered_mcp_server_type, enqueue_command_params, enqueue_command_result, env_auth_info, event_log_read_request, event_log_release_interest_result, event_log_tail_result, event_log_types, events_agent_scope, events_cursor_status, events_read_direction, events_read_result, execute_command_params, execute_command_result, extension, extension_context_push_input, extension_launch_profile, extension_launch_provider_resolve_request, extension_launch_provider_resolve_result, extension_list, extensions_disable_request, extensions_enable_request, extension_source, extension_status, external_tool_result, external_tool_text_result_for_llm, external_tool_text_result_for_llm_binary_results_for_llm, external_tool_text_result_for_llm_binary_results_for_llm_type, external_tool_text_result_for_llm_content, external_tool_text_result_for_llm_content_audio, external_tool_text_result_for_llm_content_image, external_tool_text_result_for_llm_content_resource, external_tool_text_result_for_llm_content_resource_details, external_tool_text_result_for_llm_content_resource_link, external_tool_text_result_for_llm_content_resource_link_icon, external_tool_text_result_for_llm_content_resource_link_icon_theme, external_tool_text_result_for_llm_content_shell_exit, external_tool_text_result_for_llm_content_terminal, external_tool_text_result_for_llm_content_text, factory_abort_request, factory_ack_result, factory_agent_options, factory_agent_request, factory_agent_result, factory_agent_summary, factory_cancel_request, factory_current_phase, factory_declared_limits, factory_durable_operation, factory_execute_request, factory_execute_result, factory_get_run_progress_request, factory_get_run_request, factory_journal_get_request, factory_journal_get_result, factory_journal_put_request, factory_list_runs_request, factory_list_runs_result, factory_log_line, factory_log_line_kind, factory_log_request, factory_phase_observation, factory_phase_status, factory_progress_line, factory_progress_page, factory_resume_request, factory_resume_result, factory_run_consumed, factory_run_detail, factory_run_failure, factory_run_failure_kind, factory_run_limits, factory_run_request, factory_run_result, factory_run_status, factory_run_summary, factory_run_terminal, filter_mapping, fleet_start_request, fleet_start_result, folder_trust_add_params, folder_trust_check_params, folder_trust_check_result, gh_cli_auth_info, git_hub_telemetry_client_info, git_hub_telemetry_event, git_hub_telemetry_notification, handle_pending_tool_call_request, handle_pending_tool_call_result, history_abort_manual_compaction_result, history_cancel_background_compaction_result, history_clear_context_request, history_clear_context_result, history_compact_context_window, history_compact_request, history_compact_result, history_file_restore_skip_reason, history_list_rewind_points_result, history_preview_rewind_request, history_preview_rewind_result, history_rewind_change_type, history_rewind_file_preview, history_rewind_mode, history_rewind_outcome, history_rewind_point, history_rewind_request, history_rewind_result, history_rewind_unavailable_reason, history_skipped_file_restore, history_summarize_for_handoff_result, history_truncate_request, history_truncate_result, hmac_auth_info, hook_invoke_request, hook_invoke_response, hook_type, installed_plugin, installed_plugin_info, installed_plugin_source, installed_plugin_source_git_hub, installed_plugin_source_local, installed_plugin_source_url, instruction_discovery_path, instruction_discovery_path_kind, instruction_discovery_path_list, instruction_discovery_path_location, instructions_discover_request, instructions_get_discovery_paths_request, instructions_get_sources_result, instruction_source, instruction_source_location, instruction_source_type, interrupt_main_turn_request, interrupt_main_turn_result, llm_inference_headers, llm_inference_http_request_chunk_request, llm_inference_http_request_chunk_result, llm_inference_http_request_start_request, llm_inference_http_request_start_result, llm_inference_http_request_start_transport, llm_inference_http_response_chunk_error, llm_inference_http_response_chunk_request, llm_inference_http_response_chunk_result, llm_inference_http_response_start_request, llm_inference_http_response_start_result, llm_inference_set_provider_result, local_session_metadata_value, log_request, log_result, lsp_initialize_request, managed_settings_read_result, marketplace_add_result, marketplace_browse_result, marketplace_info, marketplace_list_result, marketplace_plugin_info, marketplace_refresh_entry, marketplace_refresh_result, marketplace_remove_result, mcp_allowed_server, mcp_apps_call_tool_request, mcp_apps_diagnose_capability, mcp_apps_diagnose_request, mcp_apps_diagnose_result, mcp_apps_diagnose_server, mcp_apps_host_context, mcp_apps_host_context_details, mcp_apps_host_context_details_available_display_mode, mcp_apps_host_context_details_display_mode, mcp_apps_host_context_details_platform, mcp_apps_host_context_details_theme, mcp_apps_list_tools_request, mcp_apps_list_tools_result, mcp_apps_read_resource_request, mcp_apps_read_resource_result, mcp_apps_resource_content, mcp_apps_set_host_context_details, mcp_apps_set_host_context_details_available_display_mode, mcp_apps_set_host_context_details_display_mode, mcp_apps_set_host_context_details_platform, mcp_apps_set_host_context_details_theme, mcp_apps_set_host_context_request, mcp_cancel_sampling_execution_params, mcp_cancel_sampling_execution_result, mcp_config_add_request, mcp_config_disable_request, mcp_config_enable_request, mcp_config_list, mcp_config_remove_request, mcp_config_update_request, mcp_configure_git_hub_request, mcp_configure_git_hub_result, mcp_disable_request, mcp_discover_request, mcp_discover_result, mcp_elicitation_form_mode, mcp_enable_request, mcp_execute_sampling_params, mcp_execute_sampling_request, mcp_execute_sampling_result, mcp_failed_server, mcp_filtered_server, mcp_headers_handle_pending_headers_refresh_request, mcp_headers_handle_pending_headers_refresh_request_request, mcp_headers_handle_pending_headers_refresh_request_result, mcp_host_state, mcp_install_plan, mcp_is_server_running_request, mcp_is_server_running_result, mcp_list_tools_request, mcp_list_tools_result, mcp_oauth_authentication_state_changed_request, mcp_oauth_handle_pending_request, mcp_oauth_handle_pending_result, mcp_oauth_login_grant_type, mcp_oauth_login_request, mcp_oauth_login_result, mcp_oauth_pending_request_response, mcp_oauth_probe_needs_auth_reason, mcp_oauth_probe_request, mcp_oauth_probe_result, mcp_oauth_respond_request, mcp_oauth_respond_result, mcp_plan_configuration_change, mcp_plan_configuration_operation, mcp_plan_enum_value_type, mcp_plan_install_planned, mcp_plan_install_request, mcp_plan_install_result, mcp_plan_install_source, mcp_plan_install_source_candidate, mcp_plan_install_source_candidate_kind, mcp_plan_install_source_card, mcp_plan_install_source_card_kind, mcp_plan_package_install_method, mcp_plan_package_transport, mcp_plan_policy_decision, mcp_plan_policy_result, mcp_plan_policy_source, mcp_plan_provenance, mcp_plan_remote_install_method, mcp_plan_remote_transport, mcp_plan_required_value, mcp_plan_required_value_enum, mcp_plan_required_value_enum_kind, mcp_plan_required_value_scalar, mcp_plan_required_value_scalar_kind, mcp_plan_resource_identity, mcp_plan_scalar_value_type, mcp_plan_scope, mcp_plan_secret_placeholder, mcp_plan_secret_reference, mcp_plan_target, mcp_plan_transport_choice, mcp_plan_transport_choice_package, mcp_plan_transport_choice_remote, mcp_plan_value_category, mcp_register_external_client_request, mcp_reload_config, mcp_reload_with_config_request, mcp_remove_git_hub_result, mcp_resource, mcp_resource_annotations, mcp_resource_content, mcp_resource_icon, mcp_resources_list_request, mcp_resources_list_result, mcp_resources_list_templates_request, mcp_resources_list_templates_result, mcp_resources_read_request, mcp_resources_read_result, mcp_resource_template, mcp_restart_server_request, mcp_safe_for_telemetry, mcp_safe_for_telemetry_fields, mcp_sampling_execution_action, mcp_sampling_execution_result, mcp_serializable_server_config, mcp_server, mcp_server_auth_config, mcp_server_auth_config_redirect_port, mcp_server_card_embedded, mcp_server_card_embedded_kind, mcp_server_card_media_type, mcp_server_card_reference, mcp_server_card_url, mcp_server_card_url_kind, mcp_server_config, mcp_server_config_defer_tools, mcp_server_config_http, mcp_server_config_http_oauth_grant_type, mcp_server_config_http_type, mcp_server_config_memory, mcp_server_config_memory_type, mcp_server_config_stdio, mcp_server_config_stdio_type, mcp_server_failure_info, mcp_server_list, mcp_server_needs_auth_info, mcp_set_env_value_mode_details, mcp_set_env_value_mode_params, mcp_set_env_value_mode_result, mcp_start_server_request, mcp_start_servers_result, mcp_stop_server_request, mcp_task_metadata, mcp_tools, mcp_tool_ui, mcp_tool_ui_visibility, mcp_unregister_external_client_request, memory_configuration, metadata_context_attribution_result, metadata_context_heaviest_messages_request, metadata_context_heaviest_messages_result, metadata_context_info_request, metadata_context_info_result, metadata_is_processing_result, metadata_recompute_context_tokens_request, metadata_recompute_context_tokens_result, metadata_record_context_change_request, metadata_record_context_change_result, metadata_set_working_directory_request, metadata_set_working_directory_result, metadata_snapshot_current_mode, metadata_snapshot_remote_metadata, metadata_snapshot_remote_metadata_repository, metadata_snapshot_remote_metadata_task_type, model, model_apply_startup_overlay_request, model_billing, model_billing_promo, model_billing_token_prices, model_billing_token_prices_long_context, model_capabilities, model_capabilities_limits, model_capabilities_limits_vision, model_capabilities_override, model_capabilities_override_limits, model_capabilities_override_limits_vision, model_capabilities_override_supports, model_capabilities_supports, model_list, model_list_request, model_picker_category, model_picker_persistence_request, model_picker_price_category, model_picker_settings_context, model_policy, model_policy_state, model_set_reasoning_effort_request, model_set_reasoning_effort_result, models_list_request, model_switch_confirmation, model_switch_to_request, model_switch_to_result, mode_set_request, mode_set_result, move_mcp_loading_to_background_result, named_provider_config, name_get_result, name_set_auto_request, name_set_auto_result, name_set_request, open_canvas_instance, options_update_additional_content_exclusion_policy, options_update_additional_content_exclusion_policy_rule, options_update_additional_content_exclusion_policy_rule_source, options_update_additional_content_exclusion_policy_scope, options_update_context_tier, options_update_env_value_mode, options_update_reasoning_summary, options_update_tool_filter_precedence, pending_permission_request, pending_permission_request_list, permission_decision, permission_decision_approved, permission_decision_approved_for_location, permission_decision_approved_for_session, permission_decision_approve_for_location, permission_decision_approve_for_location_approval, permission_decision_approve_for_location_approval_commands, permission_decision_approve_for_location_approval_custom_tool, permission_decision_approve_for_location_approval_extension_env_access, permission_decision_approve_for_location_approval_extension_management, permission_decision_approve_for_location_approval_extension_permission_access, permission_decision_approve_for_location_approval_factory, permission_decision_approve_for_location_approval_mcp, permission_decision_approve_for_location_approval_mcp_sampling, permission_decision_approve_for_location_approval_memory, permission_decision_approve_for_location_approval_read, permission_decision_approve_for_location_approval_write, permission_decision_approve_for_session, permission_decision_approve_for_session_approval, permission_decision_approve_for_session_approval_commands, permission_decision_approve_for_session_approval_custom_tool, permission_decision_approve_for_session_approval_extension_env_access, permission_decision_approve_for_session_approval_extension_management, permission_decision_approve_for_session_approval_extension_permission_access, permission_decision_approve_for_session_approval_factory, permission_decision_approve_for_session_approval_mcp, permission_decision_approve_for_session_approval_mcp_sampling, permission_decision_approve_for_session_approval_memory, permission_decision_approve_for_session_approval_read, permission_decision_approve_for_session_approval_write, permission_decision_approve_once, permission_decision_approve_permanently, permission_decision_cancelled, permission_decision_context, permission_decision_denied_by_content_exclusion_policy, permission_decision_denied_by_permission_request_hook, permission_decision_denied_by_rules, permission_decision_denied_interactively_by_user, permission_decision_denied_no_approval_rule_and_could_not_request_from_user, permission_decision_outcome, permission_decision_reject, permission_decision_request, permission_decision_source, permission_decision_surface, permission_decision_user_not_available, permission_location_add_tool_approval_params, permission_location_apply_params, permission_location_apply_result, permission_location_resolve_params, permission_location_resolve_result, permission_location_type, permission_mode_source, permission_paths_add_params, permission_paths_allowed_check_params, permission_paths_allowed_check_result, permission_paths_config, permission_paths_list, permission_paths_update_primary_params, permission_paths_workspace_check_params, permission_paths_workspace_check_result, permission_prompt_shown_notification, permission_request_result, permission_rules_set, permissions_configure_additional_content_exclusion_policy, permissions_configure_additional_content_exclusion_policy_rule, permissions_configure_additional_content_exclusion_policy_rule_source, permissions_configure_additional_content_exclusion_policy_scope, permissions_configure_params, permissions_configure_result, permissions_folder_trust_add_trusted_result, permissions_get_mode_request, permissions_get_mode_result, permissions_locations_add_tool_approval_details, permissions_locations_add_tool_approval_details_commands, permissions_locations_add_tool_approval_details_custom_tool, permissions_locations_add_tool_approval_details_extension_env_access, permissions_locations_add_tool_approval_details_extension_management, permissions_locations_add_tool_approval_details_extension_permission_access, permissions_locations_add_tool_approval_details_factory, permissions_locations_add_tool_approval_details_mcp, permissions_locations_add_tool_approval_details_mcp_sampling, permissions_locations_add_tool_approval_details_memory, permissions_locations_add_tool_approval_details_read, permissions_locations_add_tool_approval_details_write, permissions_locations_add_tool_approval_result, permissions_modify_rules_params, permissions_modify_rules_result, permissions_modify_rules_scope, permissions_notify_prompt_shown_result, permissions_paths_add_result, permissions_paths_list_request, permissions_paths_update_primary_result, permissions_pending_requests_request, permissions_reset_session_approvals_request, permissions_reset_session_approvals_result, permissions_set_approve_all_request, permissions_set_approve_all_result, permissions_set_approve_all_source, permissions_set_mode_request, permissions_set_mode_result, permissions_set_required_request, permissions_set_required_result, permissions_urls_set_unrestricted_mode_result, permission_urls_config, permission_urls_set_unrestricted_mode_params, ping_request, ping_result, plan_read_result, plan_read_sql_todos_result, plan_read_sql_todos_with_dependencies_result, plan_sql_todo_dependency, plan_sql_todos_row, plan_update_request, plugin, plugin_install_result, plugin_list, plugin_list_result, plugins_builtin_set_request, plugins_disable_request, plugins_enable_request, plugins_install_request, plugins_marketplaces_add_request, plugins_marketplaces_browse_request, plugins_marketplaces_refresh_request, plugins_marketplaces_remove_request, plugins_reload_request, plugins_uninstall_request, plugins_update_request, plugin_update_all_entry, plugin_update_all_result, plugin_update_result, protocol_external_tool_defer, protocol_external_tool_definition, provider_add_request, provider_add_result, provider_config, provider_config_azure, provider_config_transport, provider_config_type, provider_config_wire_api, provider_endpoint, provider_endpoint_transport, provider_endpoint_type, provider_endpoint_wire_api, provider_get_endpoint_request, provider_model_config, provider_session_token, provider_token_acquire_request, provider_token_acquire_result, push_attachment, push_attachment_blob, push_attachment_directory, push_attachment_file, push_attachment_file_line_range, push_attachment_git_hub_actions_job, push_attachment_git_hub_commit, push_attachment_git_hub_file, push_attachment_git_hub_file_diff, push_attachment_git_hub_file_diff_side, push_attachment_git_hub_reference, push_attachment_git_hub_reference_type, push_attachment_git_hub_release, push_attachment_git_hub_repository, push_attachment_git_hub_snippet, push_attachment_git_hub_tree_comparison, push_attachment_git_hub_tree_comparison_side, push_attachment_git_hub_url, push_attachment_selection, push_attachment_selection_details, push_attachment_selection_details_end, push_attachment_selection_details_start, push_git_hub_repo_ref, queue_begin_deferred_idle_drain_request, queue_begin_deferred_idle_drain_result, queue_consume_system_notifications_request, queued_command_handled, queued_command_not_handled, queued_command_result, queue_defer_session_idle_request, queue_duplicate_at_request, queue_duplicate_at_result, queue_enqueue_resume_pending_result, queue_finish_deferred_idle_drain_request, queue_finish_deferred_idle_drain_result, queue_has_pending_result, queue_insert_at_request, queue_insert_at_result, queue_insert_message, queue_move_item_request, queue_move_item_result, queue_pending_items, queue_pending_items_kind, queue_pending_items_result, queue_remove_at_request, queue_remove_at_result, queue_remove_most_recent_result, queue_send_now_request, queue_send_now_result, queue_set_drain_paused_request, queue_snapshot_result, queue_update_text_request, queue_update_text_result, register_event_interest_params, register_event_interest_result, register_extension_tools_params, register_extension_tools_result, release_event_interest_params, remote_control_config, remote_control_config_existing_mc_session, remote_control_status, remote_control_status_active, remote_control_status_connecting, remote_control_status_error, remote_control_status_off, remote_control_status_result, remote_control_stop_result, remote_control_transfer_result, remote_enable_request, remote_enable_result, remote_notify_steerable_changed_request, remote_notify_steerable_changed_result, remote_session_connection_result, remote_session_host_status, remote_session_metadata_repository, remote_session_metadata_task_type, remote_session_metadata_value, remote_session_mode, remote_session_repository, run_options, sandbox_config, sandbox_config_auth, sandbox_config_user_policy, sandbox_config_user_policy_experimental, sandbox_config_user_policy_experimental_seatbelt, sandbox_config_user_policy_filesystem, sandbox_config_user_policy_network, sandbox_config_user_policy_network_proxy, sandbox_config_user_policy_seatbelt, schedule_add_at_request, schedule_add_cron_request, schedule_add_request, schedule_add_result, schedule_add_self_paced_request, schedule_entry, schedule_has_self_paced_result, schedule_list, schedule_rearm_self_paced_request, schedule_stop_request, schedule_stop_result, secrets_add_filter_values_request, secrets_add_filter_values_result, send_agent_mode, send_attachments_to_message_params, send_message_item, send_messages_request, send_messages_result, send_mode, send_request, send_result, send_system_notification_request, server_agent_list, server_instruction_source_list, server_skill, server_skill_list, session_activity, session_agent_list_request, session_auth_login_request, session_auth_logout_user_request, session_auth_status, session_auth_switch_request, session_bulk_delete_result, session_cancel_all_background_agents_result, session_capability, session_commands_list_request, session_completion_item, session_context, session_context_host_type, session_enrich_metadata_result, session_fs_append_file_request, session_fs_error, session_fs_error_code, session_fs_exists_request, session_fs_exists_result, session_fs_mkdir_request, session_fs_readdir_request, session_fs_readdir_result, session_fs_readdir_with_types_entry, session_fs_readdir_with_types_entry_type, session_fs_readdir_with_types_request, session_fs_readdir_with_types_result, session_fs_read_file_request, session_fs_read_file_result, session_fs_rename_request, session_fs_rm_request, session_fs_set_provider_capabilities, session_fs_set_provider_conventions, session_fs_set_provider_request, session_fs_set_provider_result, session_fs_sqlite_exists_request, session_fs_sqlite_exists_result, session_fs_sqlite_query_request, session_fs_sqlite_query_result, session_fs_sqlite_query_type, session_fs_sqlite_transaction_error, session_fs_sqlite_transaction_error_class, session_fs_sqlite_transaction_request, session_fs_sqlite_transaction_result, session_fs_sqlite_transaction_statement, session_fs_stat_request, session_fs_stat_result, session_fs_write_file_request, session_git_hub_auth_get_all_auth_available_result, session_git_hub_auth_logout_result, session_git_hub_auth_logout_user_result, session_history_compact_request, session_installed_plugin, session_installed_plugin_source, session_installed_plugin_source_git_hub, session_installed_plugin_source_local, session_installed_plugin_source_url, session_limit_prediction_baseline_data, session_limit_prediction_client_type, session_limit_prediction_details, session_limit_prediction_predict_request, session_limit_prediction_request, session_limit_prediction_result, session_limit_prediction_source, session_limit_prediction_tier, session_limit_prediction_tier_option, session_limit_prediction_unavailable_reason, session_list, session_list_entry, session_list_filter, session_load_deferred_repo_hooks_result, session_log_level, session_managed_permissions, session_managed_settings, session_mcp_apps_call_tool_result, session_metadata_snapshot, session_mode, session_model_list, session_model_list_request, session_model_price_category, session_open_options, session_open_options_additional_content_exclusion_policy, session_open_options_additional_content_exclusion_policy_rule, session_open_options_additional_content_exclusion_policy_rule_source, session_open_options_additional_content_exclusion_policy_scope, session_open_options_env_value_mode, session_open_options_reasoning_summary, session_open_params, session_open_result, session_plugins_reload_request, session_provider_get_endpoint_request, session_prune_result, sessions_bulk_delete_request, sessions_check_in_use_request, sessions_check_in_use_result, sessions_close_request, sessions_close_result, sessions_delete_request, sessions_enrich_metadata_request, session_set_credentials_params, session_set_credentials_result, session_settings_built_in_tool_availability_snapshot, session_settings_evaluate_predicate_request, session_settings_evaluate_predicate_result, session_settings_job_snapshot, session_settings_model_snapshot, session_settings_online_evaluation_snapshot, session_settings_predicate_name, session_settings_repo_snapshot, session_settings_snapshot, session_settings_validation_snapshot, sessions_find_by_prefix_request, sessions_find_by_prefix_result, sessions_find_by_task_id_request, sessions_find_by_task_id_result, sessions_fork_request, sessions_fork_result, sessions_get_board_entry_count_request, sessions_get_board_entry_count_result, sessions_get_event_file_path_request, sessions_get_event_file_path_result, sessions_get_last_for_context_request, sessions_get_last_for_context_result, sessions_get_metadata_request, sessions_get_metadata_result, sessions_get_persisted_remote_steerable_request, sessions_get_persisted_remote_steerable_result, session_sizes, sessions_list_non_empty_session_ids_request, sessions_list_non_empty_session_ids_result, sessions_list_request, sessions_load_deferred_repo_hooks_request, sessions_open_attach, sessions_open_cloud, sessions_open_create, sessions_open_handoff, sessions_open_handoff_task_type, sessions_open_progress, sessions_open_progress_status, sessions_open_progress_step, sessions_open_remote, sessions_open_resume, sessions_open_resume_last, sessions_open_status, session_source, sessions_prune_old_request, sessions_register_extension_tools_on_session_options, sessions_release_lock_request, sessions_release_lock_result, sessions_reload_plugin_hooks_request, sessions_reload_plugin_hooks_result, sessions_save_request, sessions_save_result, sessions_set_additional_plugins_request, sessions_set_additional_plugins_result, sessions_set_remote_control_steering_request, sessions_start_remote_control_request, sessions_stop_remote_control_request, sessions_transfer_remote_control_request, session_telemetry_engagement, session_update_options_params, session_update_options_result, session_visibility_status, session_working_directory_context, session_working_directory_context_host_type, shell_cancel_user_requested_request, shell_credentials, shell_exec_request, shell_exec_result, shell_execute_user_requested_request, shell_init_profile, shell_init_script, shell_init_script_shell, shell_kill_request, shell_kill_result, shell_kill_signal, shell_options, shutdown_request, skill, skill_discovery_path, skill_discovery_path_list, skill_discovery_scope, skill_list, skills_config_set_disabled_skills_request, skills_config_set_skill_disabled_request, skills_disable_request, skills_discover_request, skills_enable_request, skills_get_discovery_paths_request, skills_get_invoked_result, skills_invoked_skill, skills_load_diagnostics, slash_command_add_timeline_entry_result, slash_command_agent_prompt_result, slash_command_completed_result, slash_command_info, slash_command_input, slash_command_input_choice, slash_command_input_completion, slash_command_invocation_result, slash_command_kind, slash_command_model_picker_dialog, slash_command_select_subcommand_option, slash_command_select_subcommand_result, slash_command_set_model_result, slash_command_set_plan_model_result, slash_command_show_dialog_result, slash_command_text_result, slash_command_timeline_entry, subagent_settings_entry, subagent_settings_entry_context_tier, task_agent_info, task_agent_progress, task_complete_data, task_completion_decision, task_execution_mode, task_info, task_list, task_progress_line, tasks_cancel_request, tasks_cancel_result, tasks_get_current_promotable_result, tasks_get_progress_request, tasks_get_progress_result, task_shell_info, task_shell_info_attachment_mode, task_shell_progress, tasks_promote_current_to_background_result, tasks_promote_to_background_request, tasks_promote_to_background_result, tasks_refresh_result, tasks_remove_request, tasks_remove_result, tasks_send_message_request, tasks_send_message_result, tasks_start_agent_request, tasks_start_agent_result, task_status, tasks_wait_for_pending_result, telemetry_set_feature_overrides_request, token_auth_info, tool, tool_list, tool_result, tool_result_expanded, tool_result_new_message, tool_result_type, tools_execute_request, tools_get_builtin_descriptors_request, tools_get_builtin_descriptors_result, tools_get_current_metadata_result, tools_initialize_and_validate_result, tools_list_request, tools_set_request, tools_set_result, tools_shell_descriptor_config, tools_task_complete_event_data_request, tools_update_subagent_settings_result, ui_auto_mode_switch_response, ui_elicitation_array_any_of_field, ui_elicitation_array_any_of_field_items, ui_elicitation_array_any_of_field_items_any_of, ui_elicitation_array_enum_field, ui_elicitation_array_enum_field_items, ui_elicitation_field_value, ui_elicitation_request, ui_elicitation_response, ui_elicitation_response_action, ui_elicitation_response_content, ui_elicitation_result, ui_elicitation_schema, ui_elicitation_schema_property, ui_elicitation_schema_property_boolean, ui_elicitation_schema_property_number, ui_elicitation_schema_property_number_type, ui_elicitation_schema_property_string, ui_elicitation_schema_property_string_format, ui_elicitation_string_enum_field, ui_elicitation_string_one_of_field, ui_elicitation_string_one_of_field_one_of, ui_ephemeral_query_request, ui_ephemeral_query_result, ui_exit_plan_mode_action, ui_exit_plan_mode_response, ui_handle_pending_auto_mode_switch_request, ui_handle_pending_elicitation_request, ui_handle_pending_exit_plan_mode_request, ui_handle_pending_result, ui_handle_pending_sampling_request, ui_handle_pending_sampling_response, ui_handle_pending_session_limits_exhausted_request, ui_handle_pending_user_input_request, ui_register_direct_auto_mode_switch_handler_result, ui_session_limits_exhausted_response, ui_session_limits_exhausted_response_action, ui_unregister_direct_auto_mode_switch_handler_request, ui_unregister_direct_auto_mode_switch_handler_result, ui_user_input_response, update_subagent_settings_request, usage_get_metrics_result, usage_metrics_agent_metric, usage_metrics_code_changes, usage_metrics_model_metric, usage_metrics_model_metric_requests, usage_metrics_model_metric_token_detail, usage_metrics_model_metric_usage, usage_metrics_token_detail, user_auth_info, user_requested_shell_command_result, user_setting_metadata, user_settings_get_result, user_settings_set_request, user_settings_set_result, visibility_get_result, visibility_set_request, visibility_set_result, workspace_diff_file_change, workspace_diff_file_change_type, workspace_diff_mode, workspace_diff_result, workspaces_add_summary_request, workspaces_add_summary_result, workspaces_autopilot_objective_exists_result, workspaces_checkpoints, workspaces_create_file_request, workspaces_delete_autopilot_objective_result, workspaces_diff_request, workspaces_ensure_request, workspaces_get_workspace_result, workspaces_list_checkpoints_result, workspaces_list_files_result, workspaces_read_autopilot_objective_result, workspaces_read_checkpoint_request, workspaces_read_checkpoint_result, workspaces_read_file_request, workspaces_read_file_result, workspaces_save_large_paste_request, workspaces_save_large_paste_result, workspaces_truncate_summaries_request, workspace_summary_host_type, workspaces_update_metadata_request, workspaces_workspace_details_host_type, workspaces_write_autopilot_objective_request, workspaces_write_autopilot_objective_result, session_auth_info_result, session_context_attribution, session_context_info, subagent_settings, task_progress, workspace_summary)
 
     def to_dict(self) -> dict:
         result: dict = {}
@@ -34369,8 +36880,6 @@ def to_dict(self) -> dict:
         result["AgentSelectResult"] = to_class(AgentSelectResult, self.agent_select_result)
         result["AgentSetPromptRequest"] = to_class(AgentSetPromptRequest, self.agent_set_prompt_request)
         result["AgentsGetDiscoveryPathsRequest"] = to_class(AgentsGetDiscoveryPathsRequest, self.agents_get_discovery_paths_request)
-        result["AllowAllPermissionSetResult"] = to_class(AllowAllPermissionSetResult, self.allow_all_permission_set_result)
-        result["AllowAllPermissionState"] = to_class(AllowAllPermissionState, self.allow_all_permission_state)
         result["ApiKeyAuthInfo"] = to_class(APIKeyAuthInfo, self.api_key_auth_info)
         result["AuthIdentity"] = to_class(AuthIdentity, self.auth_identity)
         result["AuthInfo"] = (self.auth_info).to_dict()
@@ -34405,6 +36914,52 @@ def to_dict(self) -> dict:
         result["CanvasProviderUnregisterRequest"] = to_class(CanvasProviderUnregisterRequest, self.canvas_provider_unregister_request)
         result["CanvasSessionContext"] = to_class(CanvasSessionContext, self.canvas_session_context)
         result["CapiSessionOptions"] = to_class(CapiSessionOptions, self.capi_session_options)
+        result["CardDigest"] = to_class(CardDigest, self.card_digest)
+        result["CardDigestAlgorithm"] = to_enum(CardDigestAlgorithm, self.card_digest_algorithm)
+        result["CardDigestValue"] = from_str(self.card_digest_value)
+        result["CatalogAiSkillCandidate"] = to_class(CatalogAISkillCandidate, self.catalog_ai_skill_candidate)
+        result["CatalogAiSkillCandidateProvenance"] = to_class(CatalogAISkillCandidateProvenance, self.catalog_ai_skill_candidate_provenance)
+        result["CatalogAuthenticationRequiredError"] = to_class(CatalogAuthenticationRequiredError, self.catalog_authentication_required_error)
+        result["CatalogAuthenticationRequiredReason"] = to_enum(CatalogAuthenticationRequiredReason, self.catalog_authentication_required_reason)
+        result["CatalogCandidate"] = to_class(CatalogCandidate, self.catalog_candidate)
+        result["CatalogCandidateKind"] = to_enum(CatalogCandidateKind, self.catalog_candidate_kind)
+        result["CatalogCandidateSource"] = (self.catalog_candidate_source).to_dict()
+        result["CatalogCandidateSourceEmbedded"] = to_class(CatalogCandidateSourceEmbedded, self.catalog_candidate_source_embedded)
+        result["CatalogCandidateSourceUrl"] = to_class(CatalogCandidateSourceURL, self.catalog_candidate_source_url)
+        result["CatalogCapability"] = to_enum(CatalogCapability, self.catalog_capability)
+        result["CatalogCapabilityId"] = from_str(self.catalog_capability_id)
+        result["CatalogClientContract"] = to_class(CatalogClientContract, self.catalog_client_contract)
+        result["CatalogContractViolationError"] = to_class(CatalogContractViolationError, self.catalog_contract_violation_error)
+        result["CatalogContractViolationReason"] = to_enum(CatalogContractViolationReason, self.catalog_contract_violation_reason)
+        result["CatalogHandleRejectedError"] = to_class(CatalogHandleRejectedError, self.catalog_handle_rejected_error)
+        result["CatalogHandleRejectionReason"] = to_enum(CatalogHandleRejectionReason, self.catalog_handle_rejection_reason)
+        result["CatalogHandleType"] = to_enum(CatalogHandleType, self.catalog_handle_type)
+        result["CatalogInvalidRequestError"] = to_class(CatalogInvalidRequestError, self.catalog_invalid_request_error)
+        result["CatalogInvalidRequestField"] = to_enum(CatalogInvalidRequestField, self.catalog_invalid_request_field)
+        result["CatalogMalformedCardError"] = to_class(CatalogMalformedCardError, self.catalog_malformed_card_error)
+        result["CatalogMalformedCardReason"] = to_enum(CatalogMalformedCardReason, self.catalog_malformed_card_reason)
+        result["CatalogMcpServerCandidate"] = to_class(CatalogMCPServerCandidate, self.catalog_mcp_server_candidate)
+        result["CatalogMcpServerCandidateProvenance"] = to_class(CatalogMCPServerCandidateProvenance, self.catalog_mcp_server_candidate_provenance)
+        result["CatalogMcpServerInstallability"] = to_enum(CatalogMCPServerInstallabilityEnum, self.catalog_mcp_server_installability)
+        result["CatalogMediaType"] = to_enum(CatalogMediaType, self.catalog_media_type)
+        result["CatalogNegotiatedContract"] = to_class(CatalogNegotiatedContract, self.catalog_negotiated_contract)
+        result["CatalogNegotiationRefusedError"] = to_class(CatalogNegotiationRefusedError, self.catalog_negotiation_refused_error)
+        result["CatalogNegotiationRefusedReason"] = to_enum(CatalogNegotiationRefusedReason, self.catalog_negotiation_refused_reason)
+        result["CatalogNetworkFailureError"] = to_class(CatalogNetworkFailureError, self.catalog_network_failure_error)
+        result["CatalogNetworkFailureReason"] = to_enum(CatalogNetworkFailureReason, self.catalog_network_failure_reason)
+        result["CatalogNotInstallableError"] = to_class(CatalogNotInstallableError, self.catalog_not_installable_error)
+        result["CatalogNotInstallableReason"] = to_enum(CatalogNotInstallableReason, self.catalog_not_installable_reason)
+        result["CatalogPolicyRejectedError"] = to_class(CatalogPolicyRejectedError, self.catalog_policy_rejected_error)
+        result["CatalogSearchRequest"] = to_class(CatalogSearchRequest, self.catalog_search_request)
+        result["CatalogSearchResult"] = (self.catalog_search_result).to_dict()
+        result["CatalogSearchSucceeded"] = to_class(CatalogSearchSucceeded, self.catalog_search_succeeded)
+        result["CatalogUnavailableError"] = to_class(CatalogUnavailableError, self.catalog_unavailable_error)
+        result["CatalogUnavailableReason"] = to_enum(CatalogUnavailableReason, self.catalog_unavailable_reason)
+        result["CatalogUnavailableTransportError"] = to_class(CatalogUnavailableTransportError, self.catalog_unavailable_transport_error)
+        result["CatalogUnavailableTransportReason"] = to_enum(CatalogUnavailableTransportReason, self.catalog_unavailable_transport_reason)
+        result["CatalogUnsafeRetrievalError"] = to_class(CatalogUnsafeRetrievalError, self.catalog_unsafe_retrieval_error)
+        result["CatalogUnsafeRetrievalReason"] = to_enum(CatalogUnsafeRetrievalReason, self.catalog_unsafe_retrieval_reason)
+        result["CatalogUnsupportedKindError"] = to_class(CatalogUnsupportedKindError, self.catalog_unsupported_kind_error)
         result["CommandList"] = to_class(CommandList, self.command_list)
         result["CommandsFinalizeInvocationEffectRequest"] = to_class(CommandsFinalizeInvocationEffectRequest, self.commands_finalize_invocation_effect_request)
         result["CommandsFinalizeInvocationEffectResult"] = to_class(CommandsFinalizeInvocationEffectResult, self.commands_finalize_invocation_effect_result)
@@ -34667,6 +37222,7 @@ def to_dict(self) -> dict:
         result["McpHeadersHandlePendingHeadersRefreshRequestRequest"] = to_class(MCPHeadersHandlePendingHeadersRefreshRequestRequest, self.mcp_headers_handle_pending_headers_refresh_request_request)
         result["McpHeadersHandlePendingHeadersRefreshRequestResult"] = to_class(MCPHeadersHandlePendingHeadersRefreshRequestResult, self.mcp_headers_handle_pending_headers_refresh_request_result)
         result["McpHostState"] = to_class(MCPHostState, self.mcp_host_state)
+        result["McpInstallPlan"] = to_class(MCPInstallPlan, self.mcp_install_plan)
         result["McpIsServerRunningRequest"] = to_class(MCPIsServerRunningRequest, self.mcp_is_server_running_request)
         result["McpIsServerRunningResult"] = to_class(MCPIsServerRunningResult, self.mcp_is_server_running_result)
         result["McpListToolsRequest"] = to_class(MCPListToolsRequest, self.mcp_list_tools_request)
@@ -34683,6 +37239,40 @@ def to_dict(self) -> dict:
         result["McpOauthProbeResult"] = to_class(MCPOauthProbeResult, self.mcp_oauth_probe_result)
         result["McpOauthRespondRequest"] = to_class(MCPOauthRespondRequest, self.mcp_oauth_respond_request)
         result["McpOauthRespondResult"] = to_class(MCPOauthRespondResult, self.mcp_oauth_respond_result)
+        result["McpPlanConfigurationChange"] = to_class(MCPPlanConfigurationChange, self.mcp_plan_configuration_change)
+        result["McpPlanConfigurationOperation"] = to_enum(MCPPlanConfigurationOperation, self.mcp_plan_configuration_operation)
+        result["McpPlanEnumValueType"] = to_enum(MCPPlan, self.mcp_plan_enum_value_type)
+        result["McpPlanInstallPlanned"] = to_class(MCPPlanInstallPlanned, self.mcp_plan_install_planned)
+        result["McpPlanInstallRequest"] = to_class(MCPPlanInstallRequest, self.mcp_plan_install_request)
+        result["McpPlanInstallResult"] = (self.mcp_plan_install_result).to_dict()
+        result["McpPlanInstallSource"] = (self.mcp_plan_install_source).to_dict()
+        result["McpPlanInstallSourceCandidate"] = to_class(MCPPlanInstallSourceCandidate, self.mcp_plan_install_source_candidate)
+        result["McpPlanInstallSourceCandidateKind"] = to_enum(MCPPlanInstallSourceCandidateKind, self.mcp_plan_install_source_candidate_kind)
+        result["McpPlanInstallSourceCard"] = to_class(MCPPlanInstallSourceCard, self.mcp_plan_install_source_card)
+        result["McpPlanInstallSourceCardKind"] = to_enum(MCPPlanInstallSourceCardKind, self.mcp_plan_install_source_card_kind)
+        result["McpPlanPackageInstallMethod"] = to_enum(MCPPlanPackageInstallMethod, self.mcp_plan_package_install_method)
+        result["McpPlanPackageTransport"] = to_enum(MCPPlanPackageTransport, self.mcp_plan_package_transport)
+        result["McpPlanPolicyDecision"] = to_enum(MCPPlanPolicyDecision, self.mcp_plan_policy_decision)
+        result["McpPlanPolicyResult"] = to_class(MCPPlanPolicyResult, self.mcp_plan_policy_result)
+        result["McpPlanPolicySource"] = to_enum(MCPPlanPolicySource, self.mcp_plan_policy_source)
+        result["McpPlanProvenance"] = to_class(MCPPlanProvenance, self.mcp_plan_provenance)
+        result["McpPlanRemoteInstallMethod"] = to_enum(MCPPlanRemoteInstallMethod, self.mcp_plan_remote_install_method)
+        result["McpPlanRemoteTransport"] = to_enum(MCPPlanRemoteTransport, self.mcp_plan_remote_transport)
+        result["McpPlanRequiredValue"] = (self.mcp_plan_required_value).to_dict()
+        result["McpPlanRequiredValueEnum"] = to_class(MCPPlanRequiredValueEnum, self.mcp_plan_required_value_enum)
+        result["McpPlanRequiredValueEnumKind"] = to_enum(MCPPlan, self.mcp_plan_required_value_enum_kind)
+        result["McpPlanRequiredValueScalar"] = to_class(MCPPlanRequiredValueScalar, self.mcp_plan_required_value_scalar)
+        result["McpPlanRequiredValueScalarKind"] = to_enum(MCPPlanRequiredValueScalarKind, self.mcp_plan_required_value_scalar_kind)
+        result["McpPlanResourceIdentity"] = to_class(MCPPlanResourceIdentity, self.mcp_plan_resource_identity)
+        result["McpPlanScalarValueType"] = to_enum(MCPPlanScalarValueTypeEnum, self.mcp_plan_scalar_value_type)
+        result["McpPlanScope"] = to_enum(MCPPlanScope, self.mcp_plan_scope)
+        result["McpPlanSecretPlaceholder"] = to_class(MCPPlanSecretPlaceholder, self.mcp_plan_secret_placeholder)
+        result["McpPlanSecretReference"] = from_str(self.mcp_plan_secret_reference)
+        result["McpPlanTarget"] = to_class(MCPPlanTarget, self.mcp_plan_target)
+        result["McpPlanTransportChoice"] = (self.mcp_plan_transport_choice).to_dict()
+        result["McpPlanTransportChoicePackage"] = to_class(MCPPlanTransportChoicePackage, self.mcp_plan_transport_choice_package)
+        result["McpPlanTransportChoiceRemote"] = to_class(MCPPlanTransportChoiceRemote, self.mcp_plan_transport_choice_remote)
+        result["McpPlanValueCategory"] = to_enum(MCPPlanValueCategory, self.mcp_plan_value_category)
         result["McpRegisterExternalClientRequest"] = to_class(MCPRegisterExternalClientRequest, self.mcp_register_external_client_request)
         result["McpReloadConfig"] = to_class(MCPReloadConfig, self.mcp_reload_config)
         result["McpReloadWithConfigRequest"] = to_class(MCPReloadWithConfigRequest, self.mcp_reload_with_config_request)
@@ -34707,6 +37297,12 @@ def to_dict(self) -> dict:
         result["McpServer"] = to_class(MCPServer, self.mcp_server)
         result["McpServerAuthConfig"] = from_union([from_bool, lambda x: to_class(MCPServerAuthConfigRedirectPort, x)], self.mcp_server_auth_config)
         result["McpServerAuthConfigRedirectPort"] = to_class(MCPServerAuthConfigRedirectPort, self.mcp_server_auth_config_redirect_port)
+        result["McpServerCardEmbedded"] = to_class(MCPServerCardEmbedded, self.mcp_server_card_embedded)
+        result["McpServerCardEmbeddedKind"] = to_enum(MCPServerCardEmbeddedKind, self.mcp_server_card_embedded_kind)
+        result["McpServerCardMediaType"] = to_enum(MCPServerCardMediaType, self.mcp_server_card_media_type)
+        result["McpServerCardReference"] = (self.mcp_server_card_reference).to_dict()
+        result["McpServerCardUrl"] = to_class(MCPServerCardURL, self.mcp_server_card_url)
+        result["McpServerCardUrlKind"] = to_enum(MCPServerCardURLKind, self.mcp_server_card_url_kind)
         result["McpServerConfig"] = to_class(MCPServerConfig, self.mcp_server_config)
         result["McpServerConfigDeferTools"] = to_enum(MCPServerConfigDeferTools, self.mcp_server_config_defer_tools)
         result["McpServerConfigHttp"] = to_class(MCPServerConfigHTTP, self.mcp_server_config_http)
@@ -34777,6 +37373,7 @@ def to_dict(self) -> dict:
         result["ModelSwitchToResult"] = to_class(ModelSwitchToResult, self.model_switch_to_result)
         result["ModeSetRequest"] = to_class(ModeSetRequest, self.mode_set_request)
         result["ModeSetResult"] = to_class(ModeSetResult, self.mode_set_result)
+        result["MoveMcpLoadingToBackgroundResult"] = to_class(MoveMCPLoadingToBackgroundResult, self.move_mcp_loading_to_background_result)
         result["NamedProviderConfig"] = to_class(NamedProviderConfig, self.named_provider_config)
         result["NameGetResult"] = to_class(NameGetResult, self.name_get_result)
         result["NameSetAutoRequest"] = to_class(NameSetAutoRequest, self.name_set_auto_request)
@@ -34844,6 +37441,7 @@ def to_dict(self) -> dict:
         result["PermissionLocationResolveParams"] = to_class(PermissionLocationResolveParams, self.permission_location_resolve_params)
         result["PermissionLocationResolveResult"] = to_class(PermissionLocationResolveResult, self.permission_location_resolve_result)
         result["PermissionLocationType"] = to_enum(PermissionLocationType, self.permission_location_type)
+        result["PermissionModeSource"] = to_enum(PermissionSource, self.permission_mode_source)
         result["PermissionPathsAddParams"] = to_class(PermissionPathsAddParams, self.permission_paths_add_params)
         result["PermissionPathsAllowedCheckParams"] = to_class(PermissionPathsAllowedCheckParams, self.permission_paths_allowed_check_params)
         result["PermissionPathsAllowedCheckResult"] = to_class(PermissionPathsAllowedCheckResult, self.permission_paths_allowed_check_result)
@@ -34855,7 +37453,6 @@ def to_dict(self) -> dict:
         result["PermissionPromptShownNotification"] = to_class(PermissionPromptShownNotification, self.permission_prompt_shown_notification)
         result["PermissionRequestResult"] = to_class(PermissionRequestResult, self.permission_request_result)
         result["PermissionRulesSet"] = to_class(PermissionRulesSet, self.permission_rules_set)
-        result["PermissionsAllowAllMode"] = to_enum(PermissionsAllowAllMode, self.permissions_allow_all_mode)
         result["PermissionsConfigureAdditionalContentExclusionPolicy"] = to_class(PermissionsConfigureAdditionalContentExclusionPolicy, self.permissions_configure_additional_content_exclusion_policy)
         result["PermissionsConfigureAdditionalContentExclusionPolicyRule"] = to_class(PermissionsConfigureAdditionalContentExclusionPolicyRule, self.permissions_configure_additional_content_exclusion_policy_rule)
         result["PermissionsConfigureAdditionalContentExclusionPolicyRuleSource"] = to_class(PermissionsConfigureAdditionalContentExclusionPolicyRuleSource, self.permissions_configure_additional_content_exclusion_policy_rule_source)
@@ -34863,7 +37460,8 @@ def to_dict(self) -> dict:
         result["PermissionsConfigureParams"] = to_class(PermissionsConfigureParams, self.permissions_configure_params)
         result["PermissionsConfigureResult"] = to_class(PermissionsConfigureResult, self.permissions_configure_result)
         result["PermissionsFolderTrustAddTrustedResult"] = to_class(PermissionsFolderTrustAddTrustedResult, self.permissions_folder_trust_add_trusted_result)
-        result["PermissionsGetAllowAllRequest"] = to_class(PermissionsGetAllowAllRequest, self.permissions_get_allow_all_request)
+        result["PermissionsGetModeRequest"] = to_class(PermissionsGetModeRequest, self.permissions_get_mode_request)
+        result["PermissionsGetModeResult"] = to_class(PermissionsGetModeResult, self.permissions_get_mode_result)
         result["PermissionsLocationsAddToolApprovalDetails"] = (self.permissions_locations_add_tool_approval_details).to_dict()
         result["PermissionsLocationsAddToolApprovalDetailsCommands"] = to_class(PermissionsLocationsAddToolApprovalDetailsCommands, self.permissions_locations_add_tool_approval_details_commands)
         result["PermissionsLocationsAddToolApprovalDetailsCustomTool"] = to_class(PermissionsLocationsAddToolApprovalDetailsCustomTool, self.permissions_locations_add_tool_approval_details_custom_tool)
@@ -34887,11 +37485,11 @@ def to_dict(self) -> dict:
         result["PermissionsPendingRequestsRequest"] = to_class(PermissionsPendingRequestsRequest, self.permissions_pending_requests_request)
         result["PermissionsResetSessionApprovalsRequest"] = to_class(PermissionsResetSessionApprovalsRequest, self.permissions_reset_session_approvals_request)
         result["PermissionsResetSessionApprovalsResult"] = to_class(PermissionsResetSessionApprovalsResult, self.permissions_reset_session_approvals_result)
-        result["PermissionsSetAllowAllRequest"] = to_class(PermissionsSetAllowAllRequest, self.permissions_set_allow_all_request)
-        result["PermissionsSetAllowAllSource"] = to_enum(PermissionsSetAAllSource, self.permissions_set_allow_all_source)
         result["PermissionsSetApproveAllRequest"] = to_class(PermissionsSetApproveAllRequest, self.permissions_set_approve_all_request)
         result["PermissionsSetApproveAllResult"] = to_class(PermissionsSetApproveAllResult, self.permissions_set_approve_all_result)
-        result["PermissionsSetApproveAllSource"] = to_enum(PermissionsSetAAllSource, self.permissions_set_approve_all_source)
+        result["PermissionsSetApproveAllSource"] = to_enum(PermissionSource, self.permissions_set_approve_all_source)
+        result["PermissionsSetModeRequest"] = to_class(PermissionsSetModeRequest, self.permissions_set_mode_request)
+        result["PermissionsSetModeResult"] = to_class(PermissionsSetModeResult, self.permissions_set_mode_result)
         result["PermissionsSetRequiredRequest"] = to_class(PermissionsSetRequiredRequest, self.permissions_set_required_request)
         result["PermissionsSetRequiredResult"] = to_class(PermissionsSetRequiredResult, self.permissions_set_required_result)
         result["PermissionsUrlsSetUnrestrictedModeResult"] = to_class(PermissionsUrlsSetUnrestrictedModeResult, self.permissions_urls_set_unrestricted_mode_result)
@@ -35442,6 +38040,37 @@ def _load_AuthInfo(obj: Any) -> "AuthInfo":
         case "api-key": return APIKeyAuthInfo.from_dict(obj)
         case _: raise ValueError(f"Unknown AuthInfo type: {kind!r}")
 
+# Where a candidate's card came from. Exactly one of a URL or embedded data: the union has no variant carrying both, and no variant carrying neither, so the rule holds structurally rather than by validation.
+CatalogCandidateSource = CatalogCandidateSourceURL | CatalogCandidateSourceEmbedded
+
+def _load_CatalogCandidateSource(obj: Any) -> "CatalogCandidateSource":
+    assert isinstance(obj, dict)
+    kind = obj.get("kind")
+    match kind:
+        case "url": return CatalogCandidateSourceURL.from_dict(obj)
+        case "embedded": return CatalogCandidateSourceEmbedded.from_dict(obj)
+        case _: raise ValueError(f"Unknown CatalogCandidateSource kind: {kind!r}")
+
+# Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal. Never a partial success.
+CatalogSearchResult = CatalogSearchSucceeded | CatalogNegotiationRefusedError | CatalogUnsupportedKindError | CatalogInvalidRequestError | CatalogAuthenticationRequiredError | CatalogPolicyRejectedError | CatalogNetworkFailureError | CatalogUnsafeRetrievalError | CatalogMalformedCardError | CatalogContractViolationError | CatalogUnavailableError
+
+def _load_CatalogSearchResult(obj: Any) -> "CatalogSearchResult":
+    assert isinstance(obj, dict)
+    kind = obj.get("kind")
+    match kind:
+        case "succeeded": return CatalogSearchSucceeded.from_dict(obj)
+        case "negotiation-refused": return CatalogNegotiationRefusedError.from_dict(obj)
+        case "unsupported-kind": return CatalogUnsupportedKindError.from_dict(obj)
+        case "invalid-request": return CatalogInvalidRequestError.from_dict(obj)
+        case "authentication-required": return CatalogAuthenticationRequiredError.from_dict(obj)
+        case "policy-rejected": return CatalogPolicyRejectedError.from_dict(obj)
+        case "network-failure": return CatalogNetworkFailureError.from_dict(obj)
+        case "unsafe-retrieval": return CatalogUnsafeRetrievalError.from_dict(obj)
+        case "malformed-card": return CatalogMalformedCardError.from_dict(obj)
+        case "contract-violation": return CatalogContractViolationError.from_dict(obj)
+        case "unavailable": return CatalogUnavailableError.from_dict(obj)
+        case _: raise ValueError(f"Unknown CatalogSearchResult kind: {kind!r}")
+
 # A content block within a tool result, which may be text, terminal output, image, audio, or a resource
 ExternalToolTextResultForLlmContent = ExternalToolTextResultForLlmContentText | ExternalToolTextResultForLlmContentTerminal | ExternalToolTextResultForLlmContentShellExit | ExternalToolTextResultForLlmContentImage | ExternalToolTextResultForLlmContentAudio | ExternalToolTextResultForLlmContentResourceLink | ExternalToolTextResultForLlmContentResource
 
@@ -35458,6 +38087,72 @@ def _load_ExternalToolTextResultForLlmContent(obj: Any) -> "ExternalToolTextResu
         case "resource": return ExternalToolTextResultForLlmContentResource.from_dict(obj)
         case _: raise ValueError(f"Unknown ExternalToolTextResultForLlmContent type: {kind!r}")
 
+# Outcome of an mcp.planInstall call: either a normalised plan, or one typed refusal. Nothing is written in either case.
+MCPPlanInstallResult = MCPPlanInstallPlanned | CatalogNegotiationRefusedError | CatalogHandleRejectedError | CatalogInvalidRequestError | CatalogAuthenticationRequiredError | CatalogPolicyRejectedError | CatalogNetworkFailureError | CatalogUnsafeRetrievalError | CatalogMalformedCardError | CatalogContractViolationError | CatalogUnavailableTransportError | CatalogNotInstallableError | CatalogUnavailableError
+
+def _load_MCPPlanInstallResult(obj: Any) -> "MCPPlanInstallResult":
+    assert isinstance(obj, dict)
+    kind = obj.get("kind")
+    match kind:
+        case "planned": return MCPPlanInstallPlanned.from_dict(obj)
+        case "negotiation-refused": return CatalogNegotiationRefusedError.from_dict(obj)
+        case "handle-rejected": return CatalogHandleRejectedError.from_dict(obj)
+        case "invalid-request": return CatalogInvalidRequestError.from_dict(obj)
+        case "authentication-required": return CatalogAuthenticationRequiredError.from_dict(obj)
+        case "policy-rejected": return CatalogPolicyRejectedError.from_dict(obj)
+        case "network-failure": return CatalogNetworkFailureError.from_dict(obj)
+        case "unsafe-retrieval": return CatalogUnsafeRetrievalError.from_dict(obj)
+        case "malformed-card": return CatalogMalformedCardError.from_dict(obj)
+        case "contract-violation": return CatalogContractViolationError.from_dict(obj)
+        case "unavailable-transport": return CatalogUnavailableTransportError.from_dict(obj)
+        case "not-installable": return CatalogNotInstallableError.from_dict(obj)
+        case "unavailable": return CatalogUnavailableError.from_dict(obj)
+        case _: raise ValueError(f"Unknown MCPPlanInstallResult kind: {kind!r}")
+
+# What an install plan is computed from: a candidate handle from a previous search, or a card supplied directly.
+MCPPlanInstallSource = MCPPlanInstallSourceCandidate | MCPPlanInstallSourceCard
+
+def _load_MCPPlanInstallSource(obj: Any) -> "MCPPlanInstallSource":
+    assert isinstance(obj, dict)
+    kind = obj.get("kind")
+    match kind:
+        case "candidate": return MCPPlanInstallSourceCandidate.from_dict(obj)
+        case "card": return MCPPlanInstallSourceCard.from_dict(obj)
+        case _: raise ValueError(f"Unknown MCPPlanInstallSource kind: {kind!r}")
+
+# One non-secret value a transport choice needs, represented as a scalar or enumerated variant so enum values cannot be missing or attached to another type.
+MCPPlanRequiredValue = MCPPlanRequiredValueScalar | MCPPlanRequiredValueEnum
+
+def _load_MCPPlanRequiredValue(obj: Any) -> "MCPPlanRequiredValue":
+    assert isinstance(obj, dict)
+    kind = obj.get("kind")
+    match kind:
+        case "scalar": return MCPPlanRequiredValueScalar.from_dict(obj)
+        case "enum": return MCPPlanRequiredValueEnum.from_dict(obj)
+        case _: raise ValueError(f"Unknown MCPPlanRequiredValue kind: {kind!r}")
+
+# One eligible way to run the server, represented as a tagged package or remote variant so package identity and endpoint states cannot contradict the install method.
+MCPPlanTransportChoice = MCPPlanTransportChoicePackage | MCPPlanTransportChoiceRemote
+
+def _load_MCPPlanTransportChoice(obj: Any) -> "MCPPlanTransportChoice":
+    assert isinstance(obj, dict)
+    kind = obj.get("installMethod")
+    match kind:
+        case "package": return MCPPlanTransportChoicePackage.from_dict(obj)
+        case "remote": return MCPPlanTransportChoiceRemote.from_dict(obj)
+        case _: raise ValueError(f"Unknown MCPPlanTransportChoice installMethod: {kind!r}")
+
+# A card supplied directly by the caller. Exactly one of a URL or embedded data, encoded structurally so neither both nor neither can be expressed.
+MCPServerCardReference = MCPServerCardURL | MCPServerCardEmbedded
+
+def _load_MCPServerCardReference(obj: Any) -> "MCPServerCardReference":
+    assert isinstance(obj, dict)
+    kind = obj.get("kind")
+    match kind:
+        case "url": return MCPServerCardURL.from_dict(obj)
+        case "embedded": return MCPServerCardEmbedded.from_dict(obj)
+        case _: raise ValueError(f"Unknown MCPServerCardReference kind: {kind!r}")
+
 # The client's response to the pending permission prompt
 PermissionDecision = PermissionDecisionApproveOnce | PermissionDecisionApproveForSession | PermissionDecisionApproveForLocation | PermissionDecisionApprovePermanently | PermissionDecisionReject | PermissionDecisionUserNotAvailable | PermissionDecisionApproved | PermissionDecisionApprovedForSession | PermissionDecisionApprovedForLocation | PermissionDecisionCancelled | PermissionDecisionDeniedByRules | PermissionDecisionDeniedNoApprovalRuleAndCouldNotRequestFromUser | PermissionDecisionDeniedInteractivelyByUser | PermissionDecisionDeniedByContentExclusionPolicy | PermissionDecisionDeniedByPermissionRequestHook
 
@@ -35652,6 +38347,9 @@ def _load_TaskInfo(obj: Any) -> "TaskInfo":
 BuiltinToolSafeForTelemetry = bool
 CanvasActionInvokeResult = Any
 CanvasJsonSchema = Any
+CardDigestValue = str
+CatalogCapabilityId = str
+CatalogMcpServerInstallability = CatalogMCPServerInstallabilityEnum
 CommandsListRequest = Any
 ExternalToolResult = ExternalToolTextResultForLlm
 ExternalToolTextResultForLlmContentResourceLinkIconTheme = Theme
@@ -35671,17 +38369,26 @@ def _load_TaskInfo(obj: Any) -> "TaskInfo":
 McpExecuteSamplingRequest = dict
 McpExecuteSamplingResult = dict
 McpOauthLoginGrantType = MCPGrantType
+McpPlanEnumValueType = MCPPlan
+McpPlanInstallResult = MCPPlanInstallResult
+McpPlanInstallSource = MCPPlanInstallSource
+McpPlanRequiredValue = MCPPlanRequiredValue
+McpPlanRequiredValueEnumKind = MCPPlan
+McpPlanScalarValueType = MCPPlanScalarValueTypeEnum
+McpPlanSecretReference = str
+McpPlanTransportChoice = MCPPlanTransportChoice
 McpSafeForTelemetry = bool
 McpServerAuthConfig = bool
+McpServerCardReference = MCPServerCardReference
 McpServerConfigHttpOauthGrantType = MCPGrantType
 MetadataSnapshotRemoteMetadataTaskType = TaskType
 ModelListRequest = Any
 OptionsUpdateAdditionalContentExclusionPolicyScope = AdditionalContentExclusionPolicyScope
 OptionsUpdateEnvValueMode = MCPSetEnvValueModeDetails
 OptionsUpdateReasoningSummary = ReasoningSummary
+PermissionModeSource = PermissionSource
 PermissionsConfigureAdditionalContentExclusionPolicyScope = AdditionalContentExclusionPolicyScope
-PermissionsSetAllowAllSource = PermissionsSetAAllSource
-PermissionsSetApproveAllSource = PermissionsSetAAllSource
+PermissionsSetApproveAllSource = PermissionSource
 PluginsReloadRequest = Any
 ProtocolExternalToolDefer = MCPServerConfigDeferTools
 ProviderConfigTransport = ProviderTransport
@@ -35856,6 +38563,11 @@ async def discover(self, params: MCPDiscoverRequest, *, timeout: float | None =
         params_dict = {k: v for k, v in params.to_dict().items() if v is not None}
         return MCPDiscoverResult.from_dict(await self._client.request("mcp.discover", params_dict, **_timeout_kwargs(timeout)))
 
+    async def plan_install(self, params: MCPPlanInstallRequest, *, timeout: float | None = None) -> MCPPlanInstallResult:
+        "Requests a side-effect-free MCP install plan from a catalog candidate handle or a caller-supplied card. This host-implemented server method is available through SDK/TUI hosts; standalone and C-ABI runtimes whose host does not implement server-method dispatch return JSON-RPC MethodNotFound. A runtime with planning available returns a normalised plan and opaque single-use plan handle; a runtime without it returns the typed planning-unavailable result. A completed plan reports resource identity, provenance, eligible transport choices, the user-scope target, required typed values and secret placeholders, the policy result, the configuration changes installing would make, and whether a reload would be needed. Planning never writes configuration, stores a secret, or reloads MCP servers, so abandoning a plan needs no call and leaves nothing behind.\n\nArgs:\n    params: A side-effect-free request for an MCP install plan. Computing a plan never writes configuration, stores a secret, or reloads MCP servers.\n\nReturns:\n    Outcome of an mcp.planInstall call: either a normalised plan, or one typed refusal. Nothing is written in either case."
+        params_dict = {k: v for k, v in params.to_dict().items() if v is not None}
+        return _load_MCPPlanInstallResult(await self._client.request("mcp.planInstall", params_dict, **_timeout_kwargs(timeout)))
+
 
 # Experimental: this API group is experimental and may change or be removed.
 class ServerExtensionsApi:
@@ -35877,6 +38589,17 @@ async def disable(self, params: DiscoveredExtensionsDisableRequest, *, timeout:
         await self._client.request("extensions.disable", params_dict, **_timeout_kwargs(timeout))
 
 
+# Experimental: this API group is experimental and may change or be removed.
+class ServerCatalogApi:
+    def __init__(self, client: "JsonRpcClient"):
+        self._client = client
+
+    async def search(self, params: CatalogSearchRequest, *, timeout: float | None = None) -> CatalogSearchResult:
+        "Requests a bounded catalog search. This host-implemented server method is available through SDK/TUI hosts; standalone and C-ABI runtimes whose host does not implement server-method dispatch return JSON-RPC MethodNotFound. A runtime with search available returns inert candidate summaries, each with an opaque single-use handle scoped to this runtime instance; a runtime without it returns the typed search-unavailable result. Public authorities may be searched anonymously, while an authority that requires credentials yields the typed authentication-required result. All returned text, URLs, and package metadata are untrusted external data and can never trigger instructions, tools, or installation. Read-only: nothing is installed, configured, or persisted.\n\nArgs:\n    params: A bounded catalog search. Both the query length and the result count are capped by the schema so a caller cannot request an unbounded scan.\n\nReturns:\n    Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal. Never a partial success."
+        params_dict = {k: v for k, v in params.to_dict().items() if v is not None}
+        return _load_CatalogSearchResult(await self._client.request("catalog.search", params_dict, **_timeout_kwargs(timeout)))
+
+
 # Experimental: this API group is experimental and may change or be removed.
 class ServerPluginsBuiltinApi:
     def __init__(self, client: "JsonRpcClient"):
@@ -36251,6 +38974,7 @@ def __init__(self, client: "JsonRpcClient"):
         self.secrets = ServerSecretsApi(client)
         self.mcp = ServerMcpApi(client)
         self.extensions = ServerExtensionsApi(client)
+        self.catalog = ServerCatalogApi(client)
         self.plugins = ServerPluginsApi(client)
         self.skills = ServerSkillsApi(client)
         self.agents = ServerAgentsApi(client)
@@ -37001,6 +39725,10 @@ async def reload(self, *, timeout: float | None = None) -> None:
         "Reloads MCP server connections for the session."
         await self._client.request("session.mcp.reload", {"sessionId": self._session_id}, **_timeout_kwargs(timeout))
 
+    async def move_loading_to_background(self, *, timeout: float | None = None) -> MoveMCPLoadingToBackgroundResult:
+        "Releases any turns waiting on an in-flight MCP load without cancelling the load, letting the agent proceed while MCP servers finish connecting in the background. No-op when no MCP load is in flight or waiting turns were already released.\n\nReturns:\n    Result of moving in-flight MCP loading to the background."
+        return MoveMCPLoadingToBackgroundResult.from_dict(await self._client.request("session.mcp.moveLoadingToBackground", {"sessionId": self._session_id}, **_timeout_kwargs(timeout)))
+
     async def execute_sampling(self, params: MCPExecuteSamplingParams, *, timeout: float | None = None) -> MCPSamplingExecutionResult:
         "Runs an MCP sampling inference on behalf of an MCP server.\n\nArgs:\n    params: Identifiers and raw MCP CreateMessageRequest params used to run a sampling inference.\n\nReturns:\n    Outcome of an MCP sampling execution: success result, failure error, or cancellation."
         params_dict: dict[str, Any] = {k: v for k, v in params.to_dict().items() if v is not None}
@@ -37443,15 +40171,15 @@ async def set_approve_all(self, params: PermissionsSetApproveAllRequest, *, time
         params_dict["sessionId"] = self._session_id
         return PermissionsSetApproveAllResult.from_dict(await self._client.request("session.permissions.setApproveAll", params_dict, **_timeout_kwargs(timeout)))
 
-    async def set_allow_all(self, params: PermissionsSetAllowAllRequest, *, timeout: float | None = None) -> AllowAllPermissionSetResult:
-        "Sets the allow-all permission mode for the session. Used by attach-mode clients (e.g. LocalRpcSession's `/allow-all` forwarder) to flip the target session's permission state. The `on` mode swaps in unrestricted path and URL managers and emits `session.permissions_changed` on transition; the `auto` mode keeps normal prompt paths active while attaching LLM safety recommendations. The result returns the authoritative post-mutation state so callers can update their local mirrors without racing the `session.permissions_changed` notification on the same wire.\n\nArgs:\n    params: Allow-all mode to apply for the session.\n\nReturns:\n    Indicates whether the operation succeeded and reports the post-mutation state."
+    async def set_mode(self, params: PermissionsSetModeRequest, *, timeout: float | None = None) -> PermissionsSetModeResult:
+        "Sets the permission mode for the session. `manual` follows the normal approval flow, `assisted` attaches LLM safety recommendations, and `allow-all` automatically approves permission requests. The result returns the authoritative post-mutation mode so callers can update local state without racing the `session.permissions_changed` notification.\n\nArgs:\n    params: Permission mode to apply for the session.\n\nReturns:\n    Indicates whether the requested permission mode was applied and reports the authoritative post-mutation mode."
         params_dict: dict[str, Any] = {k: v for k, v in params.to_dict().items() if v is not None}
         params_dict["sessionId"] = self._session_id
-        return AllowAllPermissionSetResult.from_dict(await self._client.request("session.permissions.setAllowAll", params_dict, **_timeout_kwargs(timeout)))
+        return PermissionsSetModeResult.from_dict(await self._client.request("session.permissions.setMode", params_dict, **_timeout_kwargs(timeout)))
 
-    async def get_allow_all(self, *, timeout: float | None = None) -> AllowAllPermissionState:
-        "Returns the current allow-all permission mode for the session.\n\nReturns:\n    Current allow-all permission mode."
-        return AllowAllPermissionState.from_dict(await self._client.request("session.permissions.getAllowAll", {"sessionId": self._session_id}, **_timeout_kwargs(timeout)))
+    async def get_mode(self, *, timeout: float | None = None) -> PermissionsGetModeResult:
+        "Returns the current permission mode for the session.\n\nReturns:\n    Current permission mode."
+        return PermissionsGetModeResult.from_dict(await self._client.request("session.permissions.getMode", {"sessionId": self._session_id}, **_timeout_kwargs(timeout)))
 
     async def modify_rules(self, params: PermissionsModifyRulesParams, *, timeout: float | None = None) -> PermissionsModifyRulesResult:
         "Adds or removes session-scoped or location-scoped permission rules.\n\nArgs:\n    params: Scope and add/remove instructions for modifying session- or location-scoped permission rules.\n\nReturns:\n    Indicates whether the operation succeeded."
@@ -38496,8 +41224,6 @@ async def handle_git_hub_telemetry_event(params: dict) -> None:
     "AgentSetPromptRequest",
     "AgentsDiscoverRequest",
     "AgentsGetDiscoveryPathsRequest",
-    "AllowAllPermissionSetResult",
-    "AllowAllPermissionState",
     "ApprovalKind",
     "AuthIdentity",
     "AuthInfo",
@@ -38535,6 +41261,74 @@ async def handle_git_hub_telemetry_event(params: dict) -> None:
     "CanvasProviderUnregisterRequest",
     "CanvasSessionContext",
     "CapiSessionOptions",
+    "CardDigest",
+    "CardDigestAlgorithm",
+    "CardDigestValue",
+    "CatalogAISkillCandidate",
+    "CatalogAISkillCandidateKind",
+    "CatalogAISkillCandidateProvenance",
+    "CatalogAuthenticationRequiredError",
+    "CatalogAuthenticationRequiredErrorKind",
+    "CatalogAuthenticationRequiredReason",
+    "CatalogCandidate",
+    "CatalogCandidateInstallability",
+    "CatalogCandidateKind",
+    "CatalogCandidateProvenance",
+    "CatalogCandidateSource",
+    "CatalogCandidateSourceEmbedded",
+    "CatalogCandidateSourceKind",
+    "CatalogCandidateSourceURL",
+    "CatalogCapability",
+    "CatalogCapabilityId",
+    "CatalogClientContract",
+    "CatalogContractViolationError",
+    "CatalogContractViolationErrorKind",
+    "CatalogContractViolationReason",
+    "CatalogHandleRejectedError",
+    "CatalogHandleRejectedErrorKind",
+    "CatalogHandleRejectionReason",
+    "CatalogHandleType",
+    "CatalogInvalidRequestError",
+    "CatalogInvalidRequestErrorKind",
+    "CatalogInvalidRequestField",
+    "CatalogMCPServerCandidate",
+    "CatalogMCPServerCandidateKind",
+    "CatalogMCPServerCandidateProvenance",
+    "CatalogMCPServerInstallabilityEnum",
+    "CatalogMalformedCardError",
+    "CatalogMalformedCardErrorKind",
+    "CatalogMalformedCardReason",
+    "CatalogMcpServerInstallability",
+    "CatalogMediaType",
+    "CatalogNegotiatedContract",
+    "CatalogNegotiationRefusedError",
+    "CatalogNegotiationRefusedErrorKind",
+    "CatalogNegotiationRefusedReason",
+    "CatalogNetworkFailureError",
+    "CatalogNetworkFailureErrorKind",
+    "CatalogNetworkFailureReason",
+    "CatalogNotInstallableError",
+    "CatalogNotInstallableErrorKind",
+    "CatalogNotInstallableReason",
+    "CatalogPolicyRejectedError",
+    "CatalogPolicyRejectedErrorKind",
+    "CatalogSearchRequest",
+    "CatalogSearchResult",
+    "CatalogSearchResultKind",
+    "CatalogSearchResultReason",
+    "CatalogSearchSucceeded",
+    "CatalogSearchSucceededKind",
+    "CatalogUnavailableError",
+    "CatalogUnavailableErrorKind",
+    "CatalogUnavailableReason",
+    "CatalogUnavailableTransportError",
+    "CatalogUnavailableTransportErrorKind",
+    "CatalogUnavailableTransportReason",
+    "CatalogUnsafeRetrievalError",
+    "CatalogUnsafeRetrievalErrorKind",
+    "CatalogUnsafeRetrievalReason",
+    "CatalogUnsupportedKindError",
+    "CatalogUnsupportedKindErrorKind",
     "Categories",
     "ClientGlobalApiHandlers",
     "ClientSessionApiHandlers",
@@ -38738,12 +41532,15 @@ async def handle_git_hub_telemetry_event(params: dict) -> None:
     "HooksHandler",
     "Host",
     "HostType",
+    "InstallMethod",
+    "Installability",
     "InstalledPlugin",
     "InstalledPluginInfo",
     "InstalledPluginSource",
     "InstalledPluginSourceGitHub",
     "InstalledPluginSourceLocal",
     "InstalledPluginSourceURL",
+    "InstalledPluginSourceURLSource",
     "InstructionDiscoveryPath",
     "InstructionDiscoveryPathKind",
     "InstructionDiscoveryPathList",
@@ -38819,6 +41616,7 @@ async def handle_git_hub_telemetry_event(params: dict) -> None:
     "MCPHeadersHandlePendingHeadersRefreshRequestRequest",
     "MCPHeadersHandlePendingHeadersRefreshRequestResult",
     "MCPHostState",
+    "MCPInstallPlan",
     "MCPIsServerRunningRequest",
     "MCPIsServerRunningResult",
     "MCPListToolsRequest",
@@ -38835,6 +41633,45 @@ async def handle_git_hub_telemetry_event(params: dict) -> None:
     "MCPOauthProbeResult",
     "MCPOauthRespondRequest",
     "MCPOauthRespondResult",
+    "MCPPlan",
+    "MCPPlanConfigurationChange",
+    "MCPPlanConfigurationOperation",
+    "MCPPlanETransport",
+    "MCPPlanInstallPlanned",
+    "MCPPlanInstallPlannedKind",
+    "MCPPlanInstallRequest",
+    "MCPPlanInstallResult",
+    "MCPPlanInstallResultKind",
+    "MCPPlanInstallResultReason",
+    "MCPPlanInstallSource",
+    "MCPPlanInstallSourceCandidate",
+    "MCPPlanInstallSourceCandidateKind",
+    "MCPPlanInstallSourceCard",
+    "MCPPlanInstallSourceCardKind",
+    "MCPPlanInstallSourceKind",
+    "MCPPlanPackageInstallMethod",
+    "MCPPlanPackageTransport",
+    "MCPPlanPolicyDecision",
+    "MCPPlanPolicyResult",
+    "MCPPlanPolicySource",
+    "MCPPlanProvenance",
+    "MCPPlanRemoteInstallMethod",
+    "MCPPlanRemoteTransport",
+    "MCPPlanRequiredValue",
+    "MCPPlanRequiredValueEnum",
+    "MCPPlanRequiredValueKind",
+    "MCPPlanRequiredValueScalar",
+    "MCPPlanRequiredValueScalarKind",
+    "MCPPlanRequiredValueValueType",
+    "MCPPlanResourceIdentity",
+    "MCPPlanScalarValueTypeEnum",
+    "MCPPlanScope",
+    "MCPPlanSecretPlaceholder",
+    "MCPPlanTarget",
+    "MCPPlanTransportChoice",
+    "MCPPlanTransportChoicePackage",
+    "MCPPlanTransportChoiceRemote",
+    "MCPPlanValueCategory",
     "MCPRegisterExternalClientRequest",
     "MCPReloadConfig",
     "MCPReloadWithConfigRequest",
@@ -38858,6 +41695,12 @@ async def handle_git_hub_telemetry_event(params: dict) -> None:
     "MCPSerializableServerConfigType",
     "MCPServer",
     "MCPServerAuthConfigRedirectPort",
+    "MCPServerCardEmbedded",
+    "MCPServerCardEmbeddedKind",
+    "MCPServerCardMediaType",
+    "MCPServerCardReference",
+    "MCPServerCardURL",
+    "MCPServerCardURLKind",
     "MCPServerConfig",
     "MCPServerConfigDeferTools",
     "MCPServerConfigHTTP",
@@ -38904,10 +41747,20 @@ async def handle_git_hub_telemetry_event(params: dict) -> None:
     "McpHeadersApi",
     "McpOauthApi",
     "McpOauthLoginGrantType",
+    "McpPlanEnumValueType",
+    "McpPlanInstallResult",
+    "McpPlanInstallSource",
+    "McpPlanRequiredValue",
+    "McpPlanRequiredValueEnumKind",
+    "McpPlanScalarValueType",
+    "McpPlanSecretReference",
+    "McpPlanTransportChoice",
     "McpResourcesApi",
     "McpSafeForTelemetry",
     "McpServerAuthConfig",
+    "McpServerCardReference",
     "McpServerConfigHttpOauthGrantType",
+    "MediaType",
     "MemoryConfiguration",
     "MetadataApi",
     "MetadataContextAttributionResult",
@@ -38958,6 +41811,7 @@ async def handle_git_hub_telemetry_event(params: dict) -> None:
     "ModelSwitchToRequest",
     "ModelSwitchToResult",
     "ModelsListRequest",
+    "MoveMCPLoadingToBackgroundResult",
     "NameApi",
     "NameGetResult",
     "NameSetAutoRequest",
@@ -39053,6 +41907,7 @@ async def handle_git_hub_telemetry_event(params: dict) -> None:
     "PermissionLocationResolveParams",
     "PermissionLocationResolveResult",
     "PermissionLocationType",
+    "PermissionModeSource",
     "PermissionPathsAddParams",
     "PermissionPathsAllowedCheckParams",
     "PermissionPathsAllowedCheckResult",
@@ -39064,9 +41919,9 @@ async def handle_git_hub_telemetry_event(params: dict) -> None:
     "PermissionPromptShownNotification",
     "PermissionRequestResult",
     "PermissionRulesSet",
+    "PermissionSource",
     "PermissionUrlsConfig",
     "PermissionUrlsSetUnrestrictedModeParams",
-    "PermissionsAllowAllMode",
     "PermissionsApi",
     "PermissionsConfigureAdditionalContentExclusionPolicy",
     "PermissionsConfigureAdditionalContentExclusionPolicyRule",
@@ -39076,7 +41931,8 @@ async def handle_git_hub_telemetry_event(params: dict) -> None:
     "PermissionsConfigureResult",
     "PermissionsFolderTrustAddTrustedResult",
     "PermissionsFolderTrustApi",
-    "PermissionsGetAllowAllRequest",
+    "PermissionsGetModeRequest",
+    "PermissionsGetModeResult",
     "PermissionsLocationsAddToolApprovalDetails",
     "PermissionsLocationsAddToolApprovalDetailsCommands",
     "PermissionsLocationsAddToolApprovalDetailsCustomTool",
@@ -39102,12 +41958,11 @@ async def handle_git_hub_telemetry_event(params: dict) -> None:
     "PermissionsPendingRequestsRequest",
     "PermissionsResetSessionApprovalsRequest",
     "PermissionsResetSessionApprovalsResult",
-    "PermissionsSetAAllSource",
-    "PermissionsSetAllowAllRequest",
-    "PermissionsSetAllowAllSource",
     "PermissionsSetApproveAllRequest",
     "PermissionsSetApproveAllResult",
     "PermissionsSetApproveAllSource",
+    "PermissionsSetModeRequest",
+    "PermissionsSetModeResult",
     "PermissionsSetRequiredRequest",
     "PermissionsSetRequiredResult",
     "PermissionsUrlsApi",
@@ -39301,6 +42156,7 @@ async def handle_git_hub_telemetry_event(params: dict) -> None:
     "ServerAgentList",
     "ServerAgentRegistryApi",
     "ServerAgentsApi",
+    "ServerCatalogApi",
     "ServerCommandsApi",
     "ServerExtensionsApi",
     "ServerInstructionSourceList",
@@ -39482,7 +42338,6 @@ async def handle_git_hub_telemetry_event(params: dict) -> None:
     "SessionsOpenProgressStatus",
     "SessionsOpenProgressStep",
     "SessionsOpenRemote",
-    "SessionsOpenRemoteKind",
     "SessionsOpenResume",
     "SessionsOpenResumeKind",
     "SessionsOpenResumeLast",
@@ -39558,7 +42413,6 @@ async def handle_git_hub_telemetry_event(params: dict) -> None:
     "SlashCommandTextResult",
     "SlashCommandTimelineEntry",
     "Status",
-    "StickySource",
     "SubagentSettings",
     "SubagentSettingsEntry",
     "SubagentSettingsEntryContextTier",
@@ -39600,7 +42454,6 @@ async def handle_git_hub_telemetry_event(params: dict) -> None:
     "TasksWaitForPendingResult",
     "TelemetryApi",
     "TelemetrySetFeatureOverridesRequest",
-    "TentacledSource",
     "Theme",
     "TokenAuthInfo",
     "TokenAuthInfoType",
@@ -39677,7 +42530,6 @@ async def handle_git_hub_telemetry_event(params: dict) -> None:
     "UsageMetricsModelMetricUsage",
     "UsageMetricsTokenDetail",
     "UserAuthInfo",
-    "UserAuthInfoType",
     "UserRequestedShellCommandResult",
     "UserSettingMetadata",
     "UserSettingsGetResult",
diff --git a/python/copilot/generated/session_events.py b/python/copilot/generated/session_events.py
index 25b79428a4..68117bdc01 100644
--- a/python/copilot/generated/session_events.py
+++ b/python/copilot/generated/session_events.py
@@ -138,6 +138,7 @@ class SessionEventType(Enum):
     SESSION_MODEL_CHANGE = "session.model_change"
     SESSION_MODE_CHANGED = "session.mode_changed"
     SESSION_SESSION_LIMITS_CHANGED = "session.session_limits_changed"
+    # Experimental: this event is part of an experimental API and may change or be removed.
     SESSION_PERMISSIONS_CHANGED = "session.permissions_changed"
     SESSION_PLAN_CHANGED = "session.plan_changed"
     SESSION_TODOS_CHANGED = "session.todos_changed"
@@ -924,21 +925,21 @@ def to_dict(self) -> dict:
 
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
-class PermissionAutoApproval:
-    "Auto-approval judge information attached to a permission request. Present (non-null) only when the session's allow-all mode is \"auto\"; its absence means auto mode was off and the judge did not evaluate the request. The `recommendation` conveys the judge's disposition for this request."
-    recommendation: AutoApprovalRecommendation
-    failure_reason: AutoApprovalJudgeFailureReason | None = None
+class PermissionAssistedApproval:
+    "Assisted-approval judge information attached to a permission request. Present only in assisted mode; its absence means the judge did not evaluate the request. The `recommendation` conveys the judge's disposition for this request."
+    recommendation: AssistedApprovalRecommendation
+    failure_reason: AssistedApprovalJudgeFailureReason | None = None
     model: str | None = None
     reason: str | None = None
 
     @staticmethod
-    def from_dict(obj: Any) -> "PermissionAutoApproval":
+    def from_dict(obj: Any) -> "PermissionAssistedApproval":
         assert isinstance(obj, dict)
-        recommendation = parse_enum(AutoApprovalRecommendation, obj.get("recommendation"))
-        failure_reason = from_union([from_none, lambda x: parse_enum(AutoApprovalJudgeFailureReason, x)], obj.get("failureReason"))
+        recommendation = parse_enum(AssistedApprovalRecommendation, obj.get("recommendation"))
+        failure_reason = from_union([from_none, lambda x: parse_enum(AssistedApprovalJudgeFailureReason, x)], obj.get("failureReason"))
         model = from_union([from_none, from_str], obj.get("model"))
         reason = from_union([from_none, from_str], obj.get("reason"))
-        return PermissionAutoApproval(
+        return PermissionAssistedApproval(
             recommendation=recommendation,
             failure_reason=failure_reason,
             model=model,
@@ -947,9 +948,9 @@ def from_dict(obj: Any) -> "PermissionAutoApproval":
 
     def to_dict(self) -> dict:
         result: dict = {}
-        result["recommendation"] = to_enum(AutoApprovalRecommendation, self.recommendation)
+        result["recommendation"] = to_enum(AssistedApprovalRecommendation, self.recommendation)
         if self.failure_reason is not None:
-            result["failureReason"] = from_union([from_none, lambda x: to_enum(AutoApprovalJudgeFailureReason, x)], self.failure_reason)
+            result["failureReason"] = from_union([from_none, lambda x: to_enum(AssistedApprovalJudgeFailureReason, x)], self.failure_reason)
         if self.model is not None:
             result["model"] = from_union([from_none, from_str], self.model)
         if self.reason is not None:
@@ -1339,6 +1340,38 @@ def to_dict(self) -> dict:
         return result
 
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class SessionPermissionsChangedData:
+    "Permission-mode transition details."
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    mode: PermissionMode
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    previous_mode: PermissionMode
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    assisted_approval_model: str | None = None
+
+    @staticmethod
+    def from_dict(obj: Any) -> "SessionPermissionsChangedData":
+        assert isinstance(obj, dict)
+        mode = parse_enum(PermissionMode, obj.get("mode"))
+        previous_mode = parse_enum(PermissionMode, obj.get("previousMode"))
+        assisted_approval_model = from_union([from_none, from_str], obj.get("assistedApprovalModel"))
+        return SessionPermissionsChangedData(
+            mode=mode,
+            previous_mode=previous_mode,
+            assisted_approval_model=assisted_approval_model,
+        )
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["mode"] = to_enum(PermissionMode, self.mode)
+        result["previousMode"] = to_enum(PermissionMode, self.previous_mode)
+        if self.assisted_approval_model is not None:
+            result["assistedApprovalModel"] = from_union([from_none, from_str], self.assisted_approval_model)
+        return result
+
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class UiEphemeralQueryData:
@@ -4876,7 +4909,7 @@ class PermissionPromptRequestCommands:
     intention: str
     kind: ClassVar[str] = "commands"
     # Experimental: this field is part of an experimental API and may change or be removed.
-    auto_approval: PermissionAutoApproval | None = None
+    assisted_approval: PermissionAssistedApproval | None = None
     managed_approval_required: bool | None = None
     tool_call_id: str | None = None
     warning: str | None = None
@@ -4888,7 +4921,7 @@ def from_dict(obj: Any) -> "PermissionPromptRequestCommands":
         command_identifiers = from_list(from_str, obj.get("commandIdentifiers"))
         full_command_text = from_str(obj.get("fullCommandText"))
         intention = from_str(obj.get("intention"))
-        auto_approval = from_union([from_none, PermissionAutoApproval.from_dict], obj.get("autoApproval"))
+        assisted_approval = from_union([from_none, PermissionAssistedApproval.from_dict], obj.get("assistedApproval"))
         managed_approval_required = from_union([from_none, from_bool], obj.get("managedApprovalRequired"))
         tool_call_id = from_union([from_none, from_str], obj.get("toolCallId"))
         warning = from_union([from_none, from_str], obj.get("warning"))
@@ -4897,7 +4930,7 @@ def from_dict(obj: Any) -> "PermissionPromptRequestCommands":
             command_identifiers=command_identifiers,
             full_command_text=full_command_text,
             intention=intention,
-            auto_approval=auto_approval,
+            assisted_approval=assisted_approval,
             managed_approval_required=managed_approval_required,
             tool_call_id=tool_call_id,
             warning=warning,
@@ -4910,8 +4943,8 @@ def to_dict(self) -> dict:
         result["fullCommandText"] = from_str(self.full_command_text)
         result["intention"] = from_str(self.intention)
         result["kind"] = self.kind
-        if self.auto_approval is not None:
-            result["autoApproval"] = from_union([from_none, lambda x: to_class(PermissionAutoApproval, x)], self.auto_approval)
+        if self.assisted_approval is not None:
+            result["assistedApproval"] = from_union([from_none, lambda x: to_class(PermissionAssistedApproval, x)], self.assisted_approval)
         if self.managed_approval_required is not None:
             result["managedApprovalRequired"] = from_union([from_none, from_bool], self.managed_approval_required)
         if self.tool_call_id is not None:
@@ -4929,7 +4962,7 @@ class PermissionPromptRequestCustomTool:
     tool_name: str
     args: Any = None
     # Experimental: this field is part of an experimental API and may change or be removed.
-    auto_approval: PermissionAutoApproval | None = None
+    assisted_approval: PermissionAssistedApproval | None = None
     tool_call_id: str | None = None
 
     @staticmethod
@@ -4938,13 +4971,13 @@ def from_dict(obj: Any) -> "PermissionPromptRequestCustomTool":
         tool_description = from_str(obj.get("toolDescription"))
         tool_name = from_str(obj.get("toolName"))
         args = obj.get("args")
-        auto_approval = from_union([from_none, PermissionAutoApproval.from_dict], obj.get("autoApproval"))
+        assisted_approval = from_union([from_none, PermissionAssistedApproval.from_dict], obj.get("assistedApproval"))
         tool_call_id = from_union([from_none, from_str], obj.get("toolCallId"))
         return PermissionPromptRequestCustomTool(
             tool_description=tool_description,
             tool_name=tool_name,
             args=args,
-            auto_approval=auto_approval,
+            assisted_approval=assisted_approval,
             tool_call_id=tool_call_id,
         )
 
@@ -4955,8 +4988,8 @@ def to_dict(self) -> dict:
         result["toolName"] = from_str(self.tool_name)
         if self.args is not None:
             result["args"] = self.args
-        if self.auto_approval is not None:
-            result["autoApproval"] = from_union([from_none, lambda x: to_class(PermissionAutoApproval, x)], self.auto_approval)
+        if self.assisted_approval is not None:
+            result["assistedApproval"] = from_union([from_none, lambda x: to_class(PermissionAssistedApproval, x)], self.assisted_approval)
         if self.tool_call_id is not None:
             result["toolCallId"] = from_union([from_none, from_str], self.tool_call_id)
         return result
@@ -4969,7 +5002,7 @@ class PermissionPromptRequestExtensionEnvAccess:
     extension_name: str
     kind: ClassVar[str] = "extension-env-access"
     # Experimental: this field is part of an experimental API and may change or be removed.
-    auto_approval: PermissionAutoApproval | None = None
+    assisted_approval: PermissionAssistedApproval | None = None
     tool_call_id: str | None = None
 
     @staticmethod
@@ -4977,12 +5010,12 @@ def from_dict(obj: Any) -> "PermissionPromptRequestExtensionEnvAccess":
         assert isinstance(obj, dict)
         environment_variables = from_list(from_str, obj.get("environmentVariables"))
         extension_name = from_str(obj.get("extensionName"))
-        auto_approval = from_union([from_none, PermissionAutoApproval.from_dict], obj.get("autoApproval"))
+        assisted_approval = from_union([from_none, PermissionAssistedApproval.from_dict], obj.get("assistedApproval"))
         tool_call_id = from_union([from_none, from_str], obj.get("toolCallId"))
         return PermissionPromptRequestExtensionEnvAccess(
             environment_variables=environment_variables,
             extension_name=extension_name,
-            auto_approval=auto_approval,
+            assisted_approval=assisted_approval,
             tool_call_id=tool_call_id,
         )
 
@@ -4991,8 +5024,8 @@ def to_dict(self) -> dict:
         result["environmentVariables"] = from_list(from_str, self.environment_variables)
         result["extensionName"] = from_str(self.extension_name)
         result["kind"] = self.kind
-        if self.auto_approval is not None:
-            result["autoApproval"] = from_union([from_none, lambda x: to_class(PermissionAutoApproval, x)], self.auto_approval)
+        if self.assisted_approval is not None:
+            result["assistedApproval"] = from_union([from_none, lambda x: to_class(PermissionAssistedApproval, x)], self.assisted_approval)
         if self.tool_call_id is not None:
             result["toolCallId"] = from_union([from_none, from_str], self.tool_call_id)
         return result
@@ -5004,7 +5037,7 @@ class PermissionPromptRequestExtensionManagement:
     kind: ClassVar[str] = "extension-management"
     operation: str
     # Experimental: this field is part of an experimental API and may change or be removed.
-    auto_approval: PermissionAutoApproval | None = None
+    assisted_approval: PermissionAssistedApproval | None = None
     extension_name: str | None = None
     tool_call_id: str | None = None
 
@@ -5012,12 +5045,12 @@ class PermissionPromptRequestExtensionManagement:
     def from_dict(obj: Any) -> "PermissionPromptRequestExtensionManagement":
         assert isinstance(obj, dict)
         operation = from_str(obj.get("operation"))
-        auto_approval = from_union([from_none, PermissionAutoApproval.from_dict], obj.get("autoApproval"))
+        assisted_approval = from_union([from_none, PermissionAssistedApproval.from_dict], obj.get("assistedApproval"))
         extension_name = from_union([from_none, from_str], obj.get("extensionName"))
         tool_call_id = from_union([from_none, from_str], obj.get("toolCallId"))
         return PermissionPromptRequestExtensionManagement(
             operation=operation,
-            auto_approval=auto_approval,
+            assisted_approval=assisted_approval,
             extension_name=extension_name,
             tool_call_id=tool_call_id,
         )
@@ -5026,8 +5059,8 @@ def to_dict(self) -> dict:
         result: dict = {}
         result["kind"] = self.kind
         result["operation"] = from_str(self.operation)
-        if self.auto_approval is not None:
-            result["autoApproval"] = from_union([from_none, lambda x: to_class(PermissionAutoApproval, x)], self.auto_approval)
+        if self.assisted_approval is not None:
+            result["assistedApproval"] = from_union([from_none, lambda x: to_class(PermissionAssistedApproval, x)], self.assisted_approval)
         if self.extension_name is not None:
             result["extensionName"] = from_union([from_none, from_str], self.extension_name)
         if self.tool_call_id is not None:
@@ -5042,7 +5075,7 @@ class PermissionPromptRequestExtensionPermissionAccess:
     extension_name: str
     kind: ClassVar[str] = "extension-permission-access"
     # Experimental: this field is part of an experimental API and may change or be removed.
-    auto_approval: PermissionAutoApproval | None = None
+    assisted_approval: PermissionAssistedApproval | None = None
     tool_call_id: str | None = None
 
     @staticmethod
@@ -5050,12 +5083,12 @@ def from_dict(obj: Any) -> "PermissionPromptRequestExtensionPermissionAccess":
         assert isinstance(obj, dict)
         capabilities = from_list(from_str, obj.get("capabilities"))
         extension_name = from_str(obj.get("extensionName"))
-        auto_approval = from_union([from_none, PermissionAutoApproval.from_dict], obj.get("autoApproval"))
+        assisted_approval = from_union([from_none, PermissionAssistedApproval.from_dict], obj.get("assistedApproval"))
         tool_call_id = from_union([from_none, from_str], obj.get("toolCallId"))
         return PermissionPromptRequestExtensionPermissionAccess(
             capabilities=capabilities,
             extension_name=extension_name,
-            auto_approval=auto_approval,
+            assisted_approval=assisted_approval,
             tool_call_id=tool_call_id,
         )
 
@@ -5064,8 +5097,8 @@ def to_dict(self) -> dict:
         result["capabilities"] = from_list(from_str, self.capabilities)
         result["extensionName"] = from_str(self.extension_name)
         result["kind"] = self.kind
-        if self.auto_approval is not None:
-            result["autoApproval"] = from_union([from_none, lambda x: to_class(PermissionAutoApproval, x)], self.auto_approval)
+        if self.assisted_approval is not None:
+            result["assistedApproval"] = from_union([from_none, lambda x: to_class(PermissionAssistedApproval, x)], self.assisted_approval)
         if self.tool_call_id is not None:
             result["toolCallId"] = from_union([from_none, from_str], self.tool_call_id)
         return result
@@ -5082,7 +5115,7 @@ class PermissionPromptRequestFactory:
     operation: FactoryPermissionOperation
     phases: list[FactoryPermissionPhase]
     # Experimental: this field is part of an experimental API and may change or be removed.
-    auto_approval: PermissionAutoApproval | None = None
+    assisted_approval: PermissionAssistedApproval | None = None
     declared_max_ai_credits: float | None = None
     declared_max_concurrent_subagents: int | None = None
     declared_max_total_subagents: int | None = None
@@ -5103,7 +5136,7 @@ def from_dict(obj: Any) -> "PermissionPromptRequestFactory":
         name = from_str(obj.get("name"))
         operation = parse_enum(FactoryPermissionOperation, obj.get("operation"))
         phases = from_list(FactoryPermissionPhase.from_dict, obj.get("phases"))
-        auto_approval = from_union([from_none, PermissionAutoApproval.from_dict], obj.get("autoApproval"))
+        assisted_approval = from_union([from_none, PermissionAssistedApproval.from_dict], obj.get("assistedApproval"))
         declared_max_ai_credits = from_union([from_none, from_float], obj.get("declaredMaxAiCredits"))
         declared_max_concurrent_subagents = from_union([from_none, from_int], obj.get("declaredMaxConcurrentSubagents"))
         declared_max_total_subagents = from_union([from_none, from_int], obj.get("declaredMaxTotalSubagents"))
@@ -5121,7 +5154,7 @@ def from_dict(obj: Any) -> "PermissionPromptRequestFactory":
             name=name,
             operation=operation,
             phases=phases,
-            auto_approval=auto_approval,
+            assisted_approval=assisted_approval,
             declared_max_ai_credits=declared_max_ai_credits,
             declared_max_concurrent_subagents=declared_max_concurrent_subagents,
             declared_max_total_subagents=declared_max_total_subagents,
@@ -5143,8 +5176,8 @@ def to_dict(self) -> dict:
         result["name"] = from_str(self.name)
         result["operation"] = to_enum(FactoryPermissionOperation, self.operation)
         result["phases"] = from_list(lambda x: to_class(FactoryPermissionPhase, x), self.phases)
-        if self.auto_approval is not None:
-            result["autoApproval"] = from_union([from_none, lambda x: to_class(PermissionAutoApproval, x)], self.auto_approval)
+        if self.assisted_approval is not None:
+            result["assistedApproval"] = from_union([from_none, lambda x: to_class(PermissionAssistedApproval, x)], self.assisted_approval)
         if self.declared_max_ai_credits is not None:
             result["declaredMaxAiCredits"] = from_union([from_none, to_float], self.declared_max_ai_credits)
         if self.declared_max_concurrent_subagents is not None:
@@ -5174,7 +5207,7 @@ class PermissionPromptRequestHook:
     kind: ClassVar[str] = "hook"
     tool_name: str
     # Experimental: this field is part of an experimental API and may change or be removed.
-    auto_approval: PermissionAutoApproval | None = None
+    assisted_approval: PermissionAssistedApproval | None = None
     hook_message: str | None = None
     tool_args: Any = None
     tool_call_id: str | None = None
@@ -5183,13 +5216,13 @@ class PermissionPromptRequestHook:
     def from_dict(obj: Any) -> "PermissionPromptRequestHook":
         assert isinstance(obj, dict)
         tool_name = from_str(obj.get("toolName"))
-        auto_approval = from_union([from_none, PermissionAutoApproval.from_dict], obj.get("autoApproval"))
+        assisted_approval = from_union([from_none, PermissionAssistedApproval.from_dict], obj.get("assistedApproval"))
         hook_message = from_union([from_none, from_str], obj.get("hookMessage"))
         tool_args = obj.get("toolArgs")
         tool_call_id = from_union([from_none, from_str], obj.get("toolCallId"))
         return PermissionPromptRequestHook(
             tool_name=tool_name,
-            auto_approval=auto_approval,
+            assisted_approval=assisted_approval,
             hook_message=hook_message,
             tool_args=tool_args,
             tool_call_id=tool_call_id,
@@ -5199,8 +5232,8 @@ def to_dict(self) -> dict:
         result: dict = {}
         result["kind"] = self.kind
         result["toolName"] = from_str(self.tool_name)
-        if self.auto_approval is not None:
-            result["autoApproval"] = from_union([from_none, lambda x: to_class(PermissionAutoApproval, x)], self.auto_approval)
+        if self.assisted_approval is not None:
+            result["assistedApproval"] = from_union([from_none, lambda x: to_class(PermissionAssistedApproval, x)], self.assisted_approval)
         if self.hook_message is not None:
             result["hookMessage"] = from_union([from_none, from_str], self.hook_message)
         if self.tool_args is not None:
@@ -5219,7 +5252,7 @@ class PermissionPromptRequestMcp:
     tool_title: str
     args: Any = None
     # Experimental: this field is part of an experimental API and may change or be removed.
-    auto_approval: PermissionAutoApproval | None = None
+    assisted_approval: PermissionAssistedApproval | None = None
     # Experimental: this field is part of an experimental API and may change or be removed.
     permission_recommendation: PermissionRecommendation | None = None
     tool_call_id: str | None = None
@@ -5231,7 +5264,7 @@ def from_dict(obj: Any) -> "PermissionPromptRequestMcp":
         tool_name = from_str(obj.get("toolName"))
         tool_title = from_str(obj.get("toolTitle"))
         args = obj.get("args")
-        auto_approval = from_union([from_none, PermissionAutoApproval.from_dict], obj.get("autoApproval"))
+        assisted_approval = from_union([from_none, PermissionAssistedApproval.from_dict], obj.get("assistedApproval"))
         permission_recommendation = from_union([from_none, lambda x: parse_enum(PermissionRecommendation, x)], obj.get("permissionRecommendation"))
         tool_call_id = from_union([from_none, from_str], obj.get("toolCallId"))
         return PermissionPromptRequestMcp(
@@ -5239,7 +5272,7 @@ def from_dict(obj: Any) -> "PermissionPromptRequestMcp":
             tool_name=tool_name,
             tool_title=tool_title,
             args=args,
-            auto_approval=auto_approval,
+            assisted_approval=assisted_approval,
             permission_recommendation=permission_recommendation,
             tool_call_id=tool_call_id,
         )
@@ -5252,8 +5285,8 @@ def to_dict(self) -> dict:
         result["toolTitle"] = from_str(self.tool_title)
         if self.args is not None:
             result["args"] = self.args
-        if self.auto_approval is not None:
-            result["autoApproval"] = from_union([from_none, lambda x: to_class(PermissionAutoApproval, x)], self.auto_approval)
+        if self.assisted_approval is not None:
+            result["assistedApproval"] = from_union([from_none, lambda x: to_class(PermissionAssistedApproval, x)], self.assisted_approval)
         if self.permission_recommendation is not None:
             result["permissionRecommendation"] = from_union([from_none, lambda x: to_enum(PermissionRecommendation, x)], self.permission_recommendation)
         if self.tool_call_id is not None:
@@ -5268,7 +5301,7 @@ class PermissionPromptRequestMemory:
     kind: ClassVar[str] = "memory"
     action: PermissionRequestMemoryAction | None = None
     # Experimental: this field is part of an experimental API and may change or be removed.
-    auto_approval: PermissionAutoApproval | None = None
+    assisted_approval: PermissionAssistedApproval | None = None
     citations: str | None = None
     direction: PermissionRequestMemoryDirection | None = None
     reason: str | None = None
@@ -5280,7 +5313,7 @@ def from_dict(obj: Any) -> "PermissionPromptRequestMemory":
         assert isinstance(obj, dict)
         fact = from_str(obj.get("fact"))
         action = from_union([from_none, lambda x: parse_enum(PermissionRequestMemoryAction, x)], obj.get("action"))
-        auto_approval = from_union([from_none, PermissionAutoApproval.from_dict], obj.get("autoApproval"))
+        assisted_approval = from_union([from_none, PermissionAssistedApproval.from_dict], obj.get("assistedApproval"))
         citations = from_union([from_none, from_str], obj.get("citations"))
         direction = from_union([from_none, lambda x: parse_enum(PermissionRequestMemoryDirection, x)], obj.get("direction"))
         reason = from_union([from_none, from_str], obj.get("reason"))
@@ -5289,7 +5322,7 @@ def from_dict(obj: Any) -> "PermissionPromptRequestMemory":
         return PermissionPromptRequestMemory(
             fact=fact,
             action=action,
-            auto_approval=auto_approval,
+            assisted_approval=assisted_approval,
             citations=citations,
             direction=direction,
             reason=reason,
@@ -5303,8 +5336,8 @@ def to_dict(self) -> dict:
         result["kind"] = self.kind
         if self.action is not None:
             result["action"] = from_union([from_none, lambda x: to_enum(PermissionRequestMemoryAction, x)], self.action)
-        if self.auto_approval is not None:
-            result["autoApproval"] = from_union([from_none, lambda x: to_class(PermissionAutoApproval, x)], self.auto_approval)
+        if self.assisted_approval is not None:
+            result["assistedApproval"] = from_union([from_none, lambda x: to_class(PermissionAssistedApproval, x)], self.assisted_approval)
         if self.citations is not None:
             result["citations"] = from_union([from_none, from_str], self.citations)
         if self.direction is not None:
@@ -5325,7 +5358,7 @@ class PermissionPromptRequestPath:
     kind: ClassVar[str] = "path"
     paths: list[str]
     # Experimental: this field is part of an experimental API and may change or be removed.
-    auto_approval: PermissionAutoApproval | None = None
+    assisted_approval: PermissionAssistedApproval | None = None
     tool_call_id: str | None = None
 
     @staticmethod
@@ -5333,12 +5366,12 @@ def from_dict(obj: Any) -> "PermissionPromptRequestPath":
         assert isinstance(obj, dict)
         access_kind = parse_enum(PermissionPromptRequestPathAccessKind, obj.get("accessKind"))
         paths = from_list(from_str, obj.get("paths"))
-        auto_approval = from_union([from_none, PermissionAutoApproval.from_dict], obj.get("autoApproval"))
+        assisted_approval = from_union([from_none, PermissionAssistedApproval.from_dict], obj.get("assistedApproval"))
         tool_call_id = from_union([from_none, from_str], obj.get("toolCallId"))
         return PermissionPromptRequestPath(
             access_kind=access_kind,
             paths=paths,
-            auto_approval=auto_approval,
+            assisted_approval=assisted_approval,
             tool_call_id=tool_call_id,
         )
 
@@ -5347,8 +5380,8 @@ def to_dict(self) -> dict:
         result["accessKind"] = to_enum(PermissionPromptRequestPathAccessKind, self.access_kind)
         result["kind"] = self.kind
         result["paths"] = from_list(from_str, self.paths)
-        if self.auto_approval is not None:
-            result["autoApproval"] = from_union([from_none, lambda x: to_class(PermissionAutoApproval, x)], self.auto_approval)
+        if self.assisted_approval is not None:
+            result["assistedApproval"] = from_union([from_none, lambda x: to_class(PermissionAssistedApproval, x)], self.assisted_approval)
         if self.tool_call_id is not None:
             result["toolCallId"] = from_union([from_none, from_str], self.tool_call_id)
         return result
@@ -5361,7 +5394,7 @@ class PermissionPromptRequestRead:
     kind: ClassVar[str] = "read"
     path: str
     # Experimental: this field is part of an experimental API and may change or be removed.
-    auto_approval: PermissionAutoApproval | None = None
+    assisted_approval: PermissionAssistedApproval | None = None
     managed_approval_required: bool | None = None
     tool_call_id: str | None = None
 
@@ -5370,13 +5403,13 @@ def from_dict(obj: Any) -> "PermissionPromptRequestRead":
         assert isinstance(obj, dict)
         intention = from_str(obj.get("intention"))
         path = from_str(obj.get("path"))
-        auto_approval = from_union([from_none, PermissionAutoApproval.from_dict], obj.get("autoApproval"))
+        assisted_approval = from_union([from_none, PermissionAssistedApproval.from_dict], obj.get("assistedApproval"))
         managed_approval_required = from_union([from_none, from_bool], obj.get("managedApprovalRequired"))
         tool_call_id = from_union([from_none, from_str], obj.get("toolCallId"))
         return PermissionPromptRequestRead(
             intention=intention,
             path=path,
-            auto_approval=auto_approval,
+            assisted_approval=assisted_approval,
             managed_approval_required=managed_approval_required,
             tool_call_id=tool_call_id,
         )
@@ -5386,8 +5419,8 @@ def to_dict(self) -> dict:
         result["intention"] = from_str(self.intention)
         result["kind"] = self.kind
         result["path"] = from_str(self.path)
-        if self.auto_approval is not None:
-            result["autoApproval"] = from_union([from_none, lambda x: to_class(PermissionAutoApproval, x)], self.auto_approval)
+        if self.assisted_approval is not None:
+            result["assistedApproval"] = from_union([from_none, lambda x: to_class(PermissionAssistedApproval, x)], self.assisted_approval)
         if self.managed_approval_required is not None:
             result["managedApprovalRequired"] = from_union([from_none, from_bool], self.managed_approval_required)
         if self.tool_call_id is not None:
@@ -5402,7 +5435,7 @@ class PermissionPromptRequestUrl:
     kind: ClassVar[str] = "url"
     url: str
     # Experimental: this field is part of an experimental API and may change or be removed.
-    auto_approval: PermissionAutoApproval | None = None
+    assisted_approval: PermissionAssistedApproval | None = None
     managed_approval_required: bool | None = None
     redirected_from: str | None = None
     request_sandbox_bypass: bool | None = None
@@ -5414,7 +5447,7 @@ def from_dict(obj: Any) -> "PermissionPromptRequestUrl":
         assert isinstance(obj, dict)
         intention = from_str(obj.get("intention"))
         url = from_str(obj.get("url"))
-        auto_approval = from_union([from_none, PermissionAutoApproval.from_dict], obj.get("autoApproval"))
+        assisted_approval = from_union([from_none, PermissionAssistedApproval.from_dict], obj.get("assistedApproval"))
         managed_approval_required = from_union([from_none, from_bool], obj.get("managedApprovalRequired"))
         redirected_from = from_union([from_none, from_str], obj.get("redirectedFrom"))
         request_sandbox_bypass = from_union([from_none, from_bool], obj.get("requestSandboxBypass"))
@@ -5423,7 +5456,7 @@ def from_dict(obj: Any) -> "PermissionPromptRequestUrl":
         return PermissionPromptRequestUrl(
             intention=intention,
             url=url,
-            auto_approval=auto_approval,
+            assisted_approval=assisted_approval,
             managed_approval_required=managed_approval_required,
             redirected_from=redirected_from,
             request_sandbox_bypass=request_sandbox_bypass,
@@ -5436,8 +5469,8 @@ def to_dict(self) -> dict:
         result["intention"] = from_str(self.intention)
         result["kind"] = self.kind
         result["url"] = from_str(self.url)
-        if self.auto_approval is not None:
-            result["autoApproval"] = from_union([from_none, lambda x: to_class(PermissionAutoApproval, x)], self.auto_approval)
+        if self.assisted_approval is not None:
+            result["assistedApproval"] = from_union([from_none, lambda x: to_class(PermissionAssistedApproval, x)], self.assisted_approval)
         if self.managed_approval_required is not None:
             result["managedApprovalRequired"] = from_union([from_none, from_bool], self.managed_approval_required)
         if self.redirected_from is not None:
@@ -5460,7 +5493,7 @@ class PermissionPromptRequestWrite:
     intention: str
     kind: ClassVar[str] = "write"
     # Experimental: this field is part of an experimental API and may change or be removed.
-    auto_approval: PermissionAutoApproval | None = None
+    assisted_approval: PermissionAssistedApproval | None = None
     managed_approval_required: bool | None = None
     new_file_contents: str | None = None
     tool_call_id: str | None = None
@@ -5472,7 +5505,7 @@ def from_dict(obj: Any) -> "PermissionPromptRequestWrite":
         diff = from_str(obj.get("diff"))
         file_name = from_str(obj.get("fileName"))
         intention = from_str(obj.get("intention"))
-        auto_approval = from_union([from_none, PermissionAutoApproval.from_dict], obj.get("autoApproval"))
+        assisted_approval = from_union([from_none, PermissionAssistedApproval.from_dict], obj.get("assistedApproval"))
         managed_approval_required = from_union([from_none, from_bool], obj.get("managedApprovalRequired"))
         new_file_contents = from_union([from_none, from_str], obj.get("newFileContents"))
         tool_call_id = from_union([from_none, from_str], obj.get("toolCallId"))
@@ -5481,7 +5514,7 @@ def from_dict(obj: Any) -> "PermissionPromptRequestWrite":
             diff=diff,
             file_name=file_name,
             intention=intention,
-            auto_approval=auto_approval,
+            assisted_approval=assisted_approval,
             managed_approval_required=managed_approval_required,
             new_file_contents=new_file_contents,
             tool_call_id=tool_call_id,
@@ -5494,8 +5527,8 @@ def to_dict(self) -> dict:
         result["fileName"] = from_str(self.file_name)
         result["intention"] = from_str(self.intention)
         result["kind"] = self.kind
-        if self.auto_approval is not None:
-            result["autoApproval"] = from_union([from_none, lambda x: to_class(PermissionAutoApproval, x)], self.auto_approval)
+        if self.assisted_approval is not None:
+            result["assistedApproval"] = from_union([from_none, lambda x: to_class(PermissionAssistedApproval, x)], self.assisted_approval)
         if self.managed_approval_required is not None:
             result["managedApprovalRequired"] = from_union([from_none, from_bool], self.managed_approval_required)
         if self.new_file_contents is not None:
@@ -5848,7 +5881,8 @@ class PermissionRequestMemory:
     fact: str
     kind: ClassVar[str] = "memory"
     action: PermissionRequestMemoryAction | None = None
-    auto_approval: PermissionAutoApproval | None = None
+    # Experimental: this field is part of an experimental API and may change or be removed.
+    assisted_approval: PermissionAssistedApproval | None = None
     citations: str | None = None
     direction: PermissionRequestMemoryDirection | None = None
     reason: str | None = None
@@ -5863,7 +5897,7 @@ def from_dict(obj: Any) -> "PermissionRequestMemory":
         assert isinstance(obj, dict)
         fact = from_str(obj.get("fact"))
         action = from_union([from_none, lambda x: parse_enum(PermissionRequestMemoryAction, x)], obj.get("action"))
-        auto_approval = from_union([from_none, PermissionAutoApproval.from_dict], obj.get("autoApproval"))
+        assisted_approval = from_union([from_none, PermissionAssistedApproval.from_dict], obj.get("assistedApproval"))
         citations = from_union([from_none, from_str], obj.get("citations"))
         direction = from_union([from_none, lambda x: parse_enum(PermissionRequestMemoryDirection, x)], obj.get("direction"))
         reason = from_union([from_none, from_str], obj.get("reason"))
@@ -5875,7 +5909,7 @@ def from_dict(obj: Any) -> "PermissionRequestMemory":
         return PermissionRequestMemory(
             fact=fact,
             action=action,
-            auto_approval=auto_approval,
+            assisted_approval=assisted_approval,
             citations=citations,
             direction=direction,
             reason=reason,
@@ -5892,8 +5926,8 @@ def to_dict(self) -> dict:
         result["kind"] = self.kind
         if self.action is not None:
             result["action"] = from_union([from_none, lambda x: to_enum(PermissionRequestMemoryAction, x)], self.action)
-        if self.auto_approval is not None:
-            result["autoApproval"] = from_union([from_none, lambda x: to_class(PermissionAutoApproval, x)], self.auto_approval)
+        if self.assisted_approval is not None:
+            result["assistedApproval"] = from_union([from_none, lambda x: to_class(PermissionAssistedApproval, x)], self.assisted_approval)
         if self.citations is not None:
             result["citations"] = from_union([from_none, from_str], self.citations)
         if self.direction is not None:
@@ -7335,41 +7369,6 @@ def to_dict(self) -> dict:
         return result
 
 
-@dataclass
-class SessionPermissionsChangedData:
-    "Permissions change details carrying the aggregate allow-all transition."
-    allow_all_permissions: bool
-    previous_allow_all_permissions: bool
-    # Experimental: this field is part of an experimental API and may change or be removed.
-    allow_all_permission_mode: PermissionAllowAllMode | None = None
-    # Experimental: this field is part of an experimental API and may change or be removed.
-    previous_allow_all_permission_mode: PermissionAllowAllMode | None = None
-
-    @staticmethod
-    def from_dict(obj: Any) -> "SessionPermissionsChangedData":
-        assert isinstance(obj, dict)
-        allow_all_permissions = from_bool(obj.get("allowAllPermissions"))
-        previous_allow_all_permissions = from_bool(obj.get("previousAllowAllPermissions"))
-        allow_all_permission_mode = from_union([from_none, lambda x: parse_enum(PermissionAllowAllMode, x)], obj.get("allowAllPermissionMode"))
-        previous_allow_all_permission_mode = from_union([from_none, lambda x: parse_enum(PermissionAllowAllMode, x)], obj.get("previousAllowAllPermissionMode"))
-        return SessionPermissionsChangedData(
-            allow_all_permissions=allow_all_permissions,
-            previous_allow_all_permissions=previous_allow_all_permissions,
-            allow_all_permission_mode=allow_all_permission_mode,
-            previous_allow_all_permission_mode=previous_allow_all_permission_mode,
-        )
-
-    def to_dict(self) -> dict:
-        result: dict = {}
-        result["allowAllPermissions"] = from_bool(self.allow_all_permissions)
-        result["previousAllowAllPermissions"] = from_bool(self.previous_allow_all_permissions)
-        if self.allow_all_permission_mode is not None:
-            result["allowAllPermissionMode"] = from_union([from_none, lambda x: to_enum(PermissionAllowAllMode, x)], self.allow_all_permission_mode)
-        if self.previous_allow_all_permission_mode is not None:
-            result["previousAllowAllPermissionMode"] = from_union([from_none, lambda x: to_enum(PermissionAllowAllMode, x)], self.previous_allow_all_permission_mode)
-        return result
-
-
 @dataclass
 class SessionPlanChangedData:
     "Plan file operation details indicating what changed"
@@ -10527,8 +10526,8 @@ def _load_UserToolSessionApproval(obj: Any) -> "UserToolSessionApproval":
 
 
 # Experimental: this enum is part of an experimental API and may change or be removed.
-class AutoApprovalJudgeFailureReason(Enum):
-    "Why the auto-approval judge produced no usable recommendation. Present only alongside an `error` recommendation, where the human-readable reason is a fixed string and therefore cannot distinguish these cases. Intended to make a judge failure reportable by a consumer that has no access to the host's logs."
+class AssistedApprovalJudgeFailureReason(Enum):
+    "Why the assisted-approval judge produced no usable recommendation. Present only alongside an `error` recommendation, where the human-readable reason is a fixed string and therefore cannot distinguish these cases. Intended to make a judge failure reportable by a consumer that has no access to the host's logs."
     # The judge model call exceeded its deadline.
     TIMEOUT = "timeout"
     # The judge model call was cancelled before it returned.
@@ -10542,13 +10541,13 @@ class AutoApprovalJudgeFailureReason(Enum):
 
 
 # Experimental: this enum is part of an experimental API and may change or be removed.
-class AutoApprovalRecommendation(Enum):
-    "Outcome of the auto-approval safety judge for a permission request. Present only when auto mode is enabled; its absence means the judge did not evaluate the request (auto mode was off)."
+class AssistedApprovalRecommendation(Enum):
+    "Outcome of the assisted-approval safety judge for a permission request. Present only in assisted mode; its absence means the judge did not evaluate the request."
     # The judge evaluated the request and recommends automatically approving it.
     APPROVE = "approve"
-    # The judge evaluated the request and does not recommend auto-approving it; explicit approval is required. Whether that means prompting, denying, or something else is the consumer's decision.
+    # The judge evaluated the request and does not recommend automatically approving it; explicit approval is required. Whether that means prompting, denying, or something else is the consumer's decision.
     REQUIRE_APPROVAL = "requireApproval"
-    # Auto mode is enabled, but this request category is never auto-approvable (for example, sandbox-bypass requests), so the judge was not consulted.
+    # Assisted mode is enabled, but this request category is never automatically approvable (for example, sandbox-bypass requests), so the judge was not consulted.
     EXCLUDED = "excluded"
     # The judge was consulted but did not return a usable recommendation, so the request requires explicit approval.
     ERROR = "error"
@@ -10566,14 +10565,14 @@ class CitationProvider(Enum):
 
 
 # Experimental: this enum is part of an experimental API and may change or be removed.
-class PermissionAllowAllMode(Enum):
-    "Allow-all mode for the session."
+class PermissionMode(Enum):
+    "Permission mode for the session."
     # Permission requests follow the normal approval flow.
-    OFF = "off"
+    MANUAL = "manual"
+    # Permission requests include an LLM safety recommendation; clients may automatically approve requests judged acceptable.
+    ASSISTED = "assisted"
     # Tool, path, and URL permission requests are automatically approved.
-    ON = "on"
-    # Permission requests follow the normal approval flow with an LLM advisory recommendation attached; clients may choose to auto-approve requests the judge evaluated as acceptable.
-    AUTO = "auto"
+    ALLOW_ALL = "allow-all"
 
 
 # Experimental: this enum is part of an experimental API and may change or be removed.
@@ -10838,12 +10837,12 @@ class ManagedSettingsEnforcedAction(Enum):
 
 class ManagedSettingsEnforcedEscalation(Enum):
     "For a `bypass_permissions_blocked` action, which permission-escalation primitive was refused"
-    # Full allow-all ("/allow-all on") permissions — auto-approving tools, paths, and URLs.
+    # Full allow-all permissions — automatically approving tools, paths, and URLs.
     ALLOW_ALL = "allow_all"
-    # Auto-approval of all tool permission requests.
+    # Automatic approval of all tool permission requests.
     APPROVE_ALL = "approve_all"
-    # Advisory auto-approval ("/allow-all auto") mode — keeps normal prompt paths and adds LLM-advised approval, distinct from full allow-all.
-    AUTO_APPROVAL = "auto_approval"
+    # Assisted mode — keeps normal prompt paths and adds an LLM recommendation, distinct from allow-all.
+    ASSISTED_APPROVAL = "assisted_approval"
     # Unrestricted filesystem access outside the session's allowed directories.
     UNRESTRICTED_PATHS = "unrestricted_paths"
     # Unrestricted URL fetch access.
@@ -11467,6 +11466,8 @@ def session_event_to_dict(x: SessionEvent) -> Any:
     "AssistantUsageCopilotUsageTokenDetail",
     "AssistantUsageData",
     "AssistantUsageTransport",
+    "AssistedApprovalJudgeFailureReason",
+    "AssistedApprovalRecommendation",
     "Attachment",
     "AttachmentBlob",
     "AttachmentDirectory",
@@ -11490,8 +11491,6 @@ def session_event_to_dict(x: SessionEvent) -> Any:
     "AttachmentSelectionDetails",
     "AttachmentSelectionDetailsEnd",
     "AttachmentSelectionDetailsStart",
-    "AutoApprovalJudgeFailureReason",
-    "AutoApprovalRecommendation",
     "AutoModeResolvedReasoningBucket",
     "AutoModeSwitchCompletedData",
     "AutoModeSwitchRequestedData",
@@ -11593,11 +11592,10 @@ def session_event_to_dict(x: SessionEvent) -> Any:
     "OmittedBinaryResult",
     "OmittedBinaryType",
     "PendingMessagesModifiedData",
-    "PermissionAllowAllMode",
     "PermissionApproved",
     "PermissionApprovedForLocation",
     "PermissionApprovedForSession",
-    "PermissionAutoApproval",
+    "PermissionAssistedApproval",
     "PermissionCancelled",
     "PermissionCompletedData",
     "PermissionDeniedByContentExclusionPolicy",
@@ -11605,6 +11603,7 @@ def session_event_to_dict(x: SessionEvent) -> Any:
     "PermissionDeniedByRules",
     "PermissionDeniedInteractivelyByUser",
     "PermissionDeniedNoApprovalRuleAndCouldNotRequestFromUser",
+    "PermissionMode",
     "PermissionPromptRequest",
     "PermissionPromptRequestCommands",
     "PermissionPromptRequestCustomTool",
diff --git a/python/e2e/test_rpc_session_state_extras_e2e.py b/python/e2e/test_rpc_session_state_extras_e2e.py
index 5d0d881a00..7523059c7b 100644
--- a/python/e2e/test_rpc_session_state_extras_e2e.py
+++ b/python/e2e/test_rpc_session_state_extras_e2e.py
@@ -19,7 +19,7 @@
     MetadataContextHeaviestMessagesRequest,
     ModelSwitchToRequest,
     NamedProviderConfig,
-    PermissionsSetAllowAllRequest,
+    PermissionsSetModeRequest,
     ProviderAddRequest,
     ProviderModelConfig,
     ProviderType,
@@ -32,6 +32,7 @@
     VisibilitySetRequest,
 )
 from copilot.session import PermissionHandler
+from copilot.session_events import PermissionMode
 
 from .testharness import E2ETestContext
 
@@ -185,26 +186,26 @@ async def test_should_get_and_set_allowall_permissions(self, ctx: E2ETestContext
             on_permission_request=PermissionHandler.approve_all,
         ) as session:
             try:
-                initial = await session.rpc.permissions.get_allow_all()
-                assert initial.enabled is False
+                initial = await session.rpc.permissions.get_mode()
+                assert initial.mode is PermissionMode.MANUAL
 
-                enable = await session.rpc.permissions.set_allow_all(
-                    PermissionsSetAllowAllRequest(enabled=True)
+                enable = await session.rpc.permissions.set_mode(
+                    PermissionsSetModeRequest(mode=PermissionMode.ALLOW_ALL)
                 )
                 assert enable.success is True
-                assert enable.enabled is True
-                assert (await session.rpc.permissions.get_allow_all()).enabled is True
+                assert enable.mode is PermissionMode.ALLOW_ALL
+                assert (await session.rpc.permissions.get_mode()).mode is PermissionMode.ALLOW_ALL
 
-                disable = await session.rpc.permissions.set_allow_all(
-                    PermissionsSetAllowAllRequest(enabled=False)
+                disable = await session.rpc.permissions.set_mode(
+                    PermissionsSetModeRequest(mode=PermissionMode.MANUAL)
                 )
                 assert disable.success is True
-                assert disable.enabled is False
-                assert (await session.rpc.permissions.get_allow_all()).enabled is False
+                assert disable.mode is PermissionMode.MANUAL
+                assert (await session.rpc.permissions.get_mode()).mode is PermissionMode.MANUAL
             finally:
                 with contextlib.suppress(Exception):
-                    await session.rpc.permissions.set_allow_all(
-                        PermissionsSetAllowAllRequest(enabled=False)
+                    await session.rpc.permissions.set_mode(
+                        PermissionsSetModeRequest(mode=PermissionMode.MANUAL)
                     )
 
     async def test_should_get_context_attribution_and_heaviest_messages_after_turn(
diff --git a/python/e2e/test_rpc_ui_ephemeral_query_e2e.py b/python/e2e/test_rpc_ui_ephemeral_query_e2e.py
index 46fa853974..34cce42620 100644
--- a/python/e2e/test_rpc_ui_ephemeral_query_e2e.py
+++ b/python/e2e/test_rpc_ui_ephemeral_query_e2e.py
@@ -18,10 +18,10 @@
 
 
 class TestRpcUiEphemeralQuery:
-    # TODO(cli-1.0.81-2): CLI 1.0.81-2 fails session.ui.ephemeralQuery against the recorded
-    # snapshot ("Failed to get response from the AI model"). Re-enable once the runtime
-    # fix ships.
-    @pytest.mark.skip(reason="blocked on CLI 1.0.81-2 session.ui.ephemeralQuery regression")
+    # TODO(cli-1.0.81-2): CLI 1.0.81-4 still fails session.ui.ephemeralQuery against the
+    # recorded snapshot ("Failed to get response from the AI model"). Re-enable once the
+    # runtime fix ships.
+    @pytest.mark.skip(reason="blocked on CLI 1.0.81-4 session.ui.ephemeralQuery regression")
     async def test_should_answer_ephemeral_query(self, ctx: E2ETestContext):
         async with await ctx.client.create_session(
             on_permission_request=PermissionHandler.approve_all,
diff --git a/python/e2e/test_session_e2e.py b/python/e2e/test_session_e2e.py
index b6f173f759..08413f228f 100644
--- a/python/e2e/test_session_e2e.py
+++ b/python/e2e/test_session_e2e.py
@@ -16,6 +16,7 @@
     E2ETestContext,
     get_final_assistant_message,
     get_next_event_of_type,
+    wait_for_condition,
 )
 
 pytestmark = pytest.mark.asyncio(loop_scope="module")
@@ -396,19 +397,26 @@ async def test_should_delete_session(self, ctx: E2ETestContext):
             )
 
     async def test_should_get_session_metadata(self, ctx: E2ETestContext):
-        import asyncio
-
         # Create a session and send a message to persist it
         session = await ctx.client.create_session(
             on_permission_request=PermissionHandler.approve_all
         )
         await session.send_and_wait("Say hello")
 
-        # Small delay to ensure session file is written to disk
-        await asyncio.sleep(0.2)
+        metadata = None
+
+        async def metadata_is_available() -> bool:
+            nonlocal metadata
+            metadata = await ctx.client.get_session_metadata(session.session_id)
+            return metadata is not None
+
+        await wait_for_condition(
+            metadata_is_available,
+            timeout=10.0,
+            timeout_message="Timed out waiting for session metadata to persist.",
+        )
 
         # Get metadata for the session we just created
-        metadata = await ctx.client.get_session_metadata(session.session_id)
         assert metadata is not None
         assert metadata.session_id == session.session_id
         assert isinstance(metadata.start_time, datetime)
diff --git a/rust/src/generated/api_types.rs b/rust/src/generated/api_types.rs
index 4aebb49edd..2041fa8f2e 100644
--- a/rust/src/generated/api_types.rs
+++ b/rust/src/generated/api_types.rs
@@ -11,9 +11,9 @@ use serde::{Deserialize, Serialize};
 
 use super::session_events::{
     AbortReason, ContextTier, McpOauthHttpResponse, McpOauthWWWAuthenticateParams, McpServerSource,
-    McpServerStatus, ModelChangeSource, OmittedBinaryOmittedReason, PermissionPromptRequest,
-    PermissionRule, ReasoningSummary, SessionLimitsConfig, SessionMode, ShutdownType, SkillSource,
-    TaskCompletionOutcome, UserToolSessionApproval, Verbosity,
+    McpServerStatus, ModelChangeSource, OmittedBinaryOmittedReason, PermissionMode,
+    PermissionPromptRequest, PermissionRule, ReasoningSummary, SessionLimitsConfig, SessionMode,
+    ShutdownType, SkillSource, TaskCompletionOutcome, UserToolSessionApproval, Verbosity,
 };
 use crate::types::{RequestId, SessionEvent, SessionId};
 
@@ -57,6 +57,8 @@ pub mod rpc_methods {
     pub const MCP_CONFIG_RELOAD: &str = "mcp.config.reload";
     /// `mcp.discover`
     pub const MCP_DISCOVER: &str = "mcp.discover";
+    /// `mcp.planInstall`
+    pub const MCP_PLANINSTALL: &str = "mcp.planInstall";
     /// `extensions.discover`
     pub const EXTENSIONS_DISCOVER: &str = "extensions.discover";
     /// `extensions.enable`
@@ -65,6 +67,8 @@ pub mod rpc_methods {
     pub const EXTENSIONS_DISABLE: &str = "extensions.disable";
     /// `registerExtensionLaunchProvider`
     pub const REGISTEREXTENSIONLAUNCHPROVIDER: &str = "registerExtensionLaunchProvider";
+    /// `catalog.search`
+    pub const CATALOG_SEARCH: &str = "catalog.search";
     /// `plugins.list`
     pub const PLUGINS_LIST: &str = "plugins.list";
     /// `plugins.install`
@@ -400,6 +404,8 @@ pub mod rpc_methods {
     pub const SESSION_MCP_DISABLE: &str = "session.mcp.disable";
     /// `session.mcp.reload`
     pub const SESSION_MCP_RELOAD: &str = "session.mcp.reload";
+    /// `session.mcp.moveLoadingToBackground`
+    pub const SESSION_MCP_MOVELOADINGTOBACKGROUND: &str = "session.mcp.moveLoadingToBackground";
     /// `session.mcp.reloadWithConfig`
     pub const SESSION_MCP_RELOADWITHCONFIG: &str = "session.mcp.reloadWithConfig";
     /// `session.mcp.executeSampling`
@@ -549,10 +555,10 @@ pub mod rpc_methods {
     pub const SESSION_PERMISSIONS_PENDINGREQUESTS: &str = "session.permissions.pendingRequests";
     /// `session.permissions.setApproveAll`
     pub const SESSION_PERMISSIONS_SETAPPROVEALL: &str = "session.permissions.setApproveAll";
-    /// `session.permissions.setAllowAll`
-    pub const SESSION_PERMISSIONS_SETALLOWALL: &str = "session.permissions.setAllowAll";
-    /// `session.permissions.getAllowAll`
-    pub const SESSION_PERMISSIONS_GETALLOWALL: &str = "session.permissions.getAllowAll";
+    /// `session.permissions.setMode`
+    pub const SESSION_PERMISSIONS_SETMODE: &str = "session.permissions.setMode";
+    /// `session.permissions.getMode`
+    pub const SESSION_PERMISSIONS_GETMODE: &str = "session.permissions.getMode";
     /// `session.permissions.modifyRules`
     pub const SESSION_PERMISSIONS_MODIFYRULES: &str = "session.permissions.modifyRules";
     /// `session.permissions.setRequired`
@@ -1905,44 +1911,6 @@ pub struct AgentsGetDiscoveryPathsRequest {
     pub project_paths: Option<Vec<String>>,
 }
 
-/// Indicates whether the operation succeeded and reports the post-mutation state.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct AllowAllPermissionSetResult {
-    /// Authoritative full allow-all state after the mutation
-    pub enabled: bool,
-    /// Authoritative allow-all mode after the mutation
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mode: Option<PermissionsAllowAllMode>,
-    /// Whether the operation succeeded
-    pub success: bool,
-}
-
-/// Current allow-all permission mode.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct AllowAllPermissionState {
-    /// Whether full allow-all permissions are currently active
-    pub enabled: bool,
-    /// Current allow-all mode
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mode: Option<PermissionsAllowAllMode>,
-}
-
 /// Blob attachment with inline base64-encoded data
 ///
 /// <div class="warning">
@@ -3023,7 +2991,7 @@ pub struct CapiSessionOptions {
     pub enable_web_socket_responses: Option<bool>,
 }
 
-/// A literal choice the command input accepts, with a human-facing description
+/// Semantic digest of a strictly parsed and schema-validated JSON MCP card. Both URL-backed and embedded cards are canonicalised with RFC 8785 JSON Canonicalization Scheme, encoded as UTF-8, and hashed with SHA-256.
 ///
 /// <div class="warning">
 ///
@@ -3033,14 +3001,14 @@ pub struct CapiSessionOptions {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SlashCommandInputChoice {
-    /// Human-readable description shown alongside the choice
-    pub description: String,
-    /// The literal choice value (e.g. 'on', 'off', 'show')
-    pub name: String,
+pub struct CardDigest {
+    /// Digest algorithm and canonical representation
+    pub algorithm: CardDigestAlgorithm,
+    /// SHA-256 digest of the RFC 8785 canonical UTF-8 bytes, encoded as exactly 64 lowercase hexadecimal characters.
+    pub value: String,
 }
 
-/// Optional unstructured input hint
+/// Where and when an AI skill catalog reference was observed. Discovery provenance deliberately carries no content digest because search does not establish the exact validated content a later plan will bind.
 ///
 /// <div class="warning">
 ///
@@ -3050,24 +3018,16 @@ pub struct SlashCommandInputChoice {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SlashCommandInput {
-    /// Optional literal choices the input accepts, each with a human-facing description; clients may render these as selectable options
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub choices: Option<Vec<SlashCommandInputChoice>>,
-    /// Optional completion hint for the input (e.g. 'directory' for filesystem path completion)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub completion: Option<SlashCommandInputCompletion>,
-    /// Hint to display when command input has not been provided
-    pub hint: String,
-    /// When true, clients should pass the full text after the command name as a single argument rather than splitting on whitespace
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub preserve_multiline_input: Option<bool>,
-    /// When true, the command requires non-empty input; clients should render the input hint as required
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub required: Option<bool>,
+pub struct CatalogAiSkillCandidateProvenance {
+    /// Host of the catalog authority that advertised the reference, without path, query, or credentials. Inert untrusted data.
+    pub authority: String,
+    /// Media type advertised for the referenced AI skill card
+    pub media_type: CatalogAiSkillCandidateProvenanceMediaType,
+    /// ISO 8601 timestamp at which the runtime observed the catalog reference. This is not a retrieval or validation timestamp.
+    pub observed_at: String,
 }
 
-/// Slash-command metadata with name, aliases, description, kind, input hint, execution allowance, and schedulability.
+/// Candidate whose card is retrieved from a URL through the runtime's hardened fetch boundary.
 ///
 /// <div class="warning">
 ///
@@ -3077,30 +3037,14 @@ pub struct SlashCommandInput {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SlashCommandInfo {
-    /// Canonical aliases without leading slashes
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub aliases: Option<Vec<String>>,
-    /// Whether the command may run while an agent turn is active
-    pub allow_during_agent_execution: bool,
-    /// Human-readable command description
-    pub description: String,
-    /// Whether the command is experimental
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub experimental: Option<bool>,
-    /// Optional unstructured input hint
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub input: Option<SlashCommandInput>,
-    /// Coarse command category for grouping and behavior: runtime built-in, skill-backed command, or SDK/client-owned command
-    pub kind: SlashCommandKind,
-    /// Canonical command name without a leading slash
-    pub name: String,
-    /// Whether the command may be the target of `/every` / `/after` schedules. Resolution happens at every tick, so only set this when the command is safe to re-invoke and produces an agent prompt.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub schedulable: Option<bool>,
+pub struct CatalogCandidateSourceUrl {
+    /// Discriminator: the card is URL-backed, and carries no embedded data
+    pub kind: CatalogCandidateSourceUrlKind,
+    /// Card URL as advertised. Inert untrusted data: the runtime retrieves it only through its own hardened boundary, and it is never logged.
+    pub url: String,
 }
 
-/// Slash commands available in the session, after applying any include/exclude filters.
+/// Candidate whose card reference arrived inline. The document and its content-derived properties stay behind the runtime boundary.
 ///
 /// <div class="warning">
 ///
@@ -3110,12 +3054,12 @@ pub struct SlashCommandInfo {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct CommandList {
-    /// Commands available in this session
-    pub commands: Vec<SlashCommandInfo>,
+pub struct CatalogCandidateSourceEmbedded {
+    /// Discriminator: the card is embedded, and carries no URL
+    pub kind: CatalogCandidateSourceEmbeddedKind,
 }
 
-/// The pending slash-command invocation effect to finalize, plus whether the host applied or cancelled it.
+/// An inert AI skill catalog result. AI skills are discovery-only and cannot be represented as installable through this surface.
 ///
 /// <div class="warning">
 ///
@@ -3123,16 +3067,34 @@ pub struct CommandList {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct CommandsFinalizeInvocationEffectRequest {
-    /// The slash-command result object that produced the pending effect, echoed back unchanged.
-    pub effect: serde_json::Value,
-    /// Whether the host applied or cancelled the pending invocation effect.
-    pub outcome: CommandsInvocationEffectOutcome,
+pub struct CatalogAiSkillCandidate {
+    /// Description taken verbatim from the card. Inert untrusted text.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// Display name taken verbatim from the card. Inert untrusted text.
+    pub display_name: String,
+    /// Opaque, runtime-instance scoped, TTL-bound, single-use handle for this candidate. Carries no readable information and is rejected when stale, replayed, or presented to a different runtime instance. Never logged.
+    pub handle: String,
+    /// ISO 8601 timestamp after which the handle is stale and will be rejected.
+    pub handle_expires_at: String,
+    /// AI skills are discovery-only and cannot be installed through this surface
+    pub installability: CatalogAiSkillCandidateInstallability,
+    /// Discriminator: this candidate describes an AI skill
+    pub kind: CatalogAiSkillCandidateKind,
+    /// Media type of the underlying AI skill card
+    pub media_type: CatalogAiSkillCandidateMediaType,
+    /// Where the catalog reference was observed, without the card itself or any content digest.
+    pub provenance: CatalogAiSkillCandidateProvenance,
+    /// Publisher taken verbatim from the card. Inert untrusted text.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub publisher: Option<String>,
+    /// Where the card came from: exactly one of a URL or embedded data, encoded as a tagged union so neither both nor neither can be represented.
+    pub source: CatalogCandidateSource,
 }
 
-/// Whether finalizing the invocation effect succeeded, and the failure reason when it did not.
+/// An optional catalog authentication exchange did not establish the caller's identity. Anonymous search remains supported; this refusal is reserved for an operation that cannot continue after the attempted exchange. It is distinct from `policy-rejected` and from a network failure, and the reason identifies the recovery action.
 ///
 /// <div class="warning">
 ///
@@ -3142,15 +3104,16 @@ pub struct CommandsFinalizeInvocationEffectRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct CommandsFinalizeInvocationEffectResult {
-    /// Failure reason when the invocation effect could not be finalized.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Whether the pending invocation effect was finalized successfully.
-    pub success: bool,
+pub struct CatalogAuthenticationRequiredError {
+    /// Discriminator: the caller is not authenticated
+    pub kind: CatalogAuthenticationRequiredErrorKind,
+    /// Human-readable explanation, safe to surface. Never contains a credential or token, nor a query, URL, handle, or secret.
+    pub message: String,
+    /// Why authentication failed. Only an expired credential justifies attempting a silent refresh; an absent or rejected credential requires sign-in.
+    pub reason: CatalogAuthenticationRequiredReason,
 }
 
-/// Pending command request ID and an optional error if the client handler failed.
+/// Where and when an MCP server catalog reference was observed. Discovery provenance deliberately carries no content digest because search does not establish the exact validated content a later plan will bind.
 ///
 /// <div class="warning">
 ///
@@ -3160,15 +3123,16 @@ pub struct CommandsFinalizeInvocationEffectResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct CommandsHandlePendingCommandRequest {
-    /// Error message if the command handler failed
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Request ID from the command invocation event
-    pub request_id: RequestId,
+pub struct CatalogMcpServerCandidateProvenance {
+    /// Host of the catalog authority that advertised the reference, without path, query, or credentials. Inert untrusted data.
+    pub authority: String,
+    /// JSON MCP media type advertised for the referenced card.
+    pub media_type: McpServerCardMediaType,
+    /// ISO 8601 timestamp at which the runtime observed the catalog reference. This is not a retrieval or validation timestamp.
+    pub observed_at: String,
 }
 
-/// Indicates whether the pending client-handled command was completed successfully.
+/// An inert MCP server catalog result. Every free-text field is untrusted external data and must never be treated as an instruction, and the handle is the only way to refer to the candidate in a later operation.
 ///
 /// <div class="warning">
 ///
@@ -3176,14 +3140,34 @@ pub struct CommandsHandlePendingCommandRequest {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct CommandsHandlePendingCommandResult {
-    /// Whether the command was handled successfully
-    pub success: bool,
+pub struct CatalogMcpServerCandidate {
+    /// Description taken verbatim from the card. Inert untrusted text.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// Display name taken verbatim from the card. Inert untrusted text.
+    pub display_name: String,
+    /// Opaque, runtime-instance scoped, TTL-bound, single-use handle for this candidate. Carries no readable information and is rejected when stale, replayed, or presented to a different runtime instance. Never logged.
+    pub handle: String,
+    /// ISO 8601 timestamp after which the handle is stale and will be rejected.
+    pub handle_expires_at: String,
+    /// Whether this MCP server can be planned for installation, and if policy prevents it.
+    pub installability: CatalogMcpServerInstallability,
+    /// Discriminator: this candidate describes an MCP server
+    pub kind: CatalogMcpServerCandidateKind,
+    /// JSON MCP media type of the underlying card.
+    pub media_type: McpServerCardMediaType,
+    /// Where the catalog reference was observed, without the card itself or any content digest.
+    pub provenance: CatalogMcpServerCandidateProvenance,
+    /// Publisher taken verbatim from the card. Inert untrusted text.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub publisher: Option<String>,
+    /// Where the card came from: exactly one of a URL or embedded data, encoded as a tagged union so neither both nor neither can be represented.
+    pub source: CatalogCandidateSource,
 }
 
-/// Slash command name and optional raw input string to invoke.
+/// The protocol version and capability set a caller requires, supplied on every catalog request so negotiation cannot be skipped by omission.
 ///
 /// <div class="warning">
 ///
@@ -3193,18 +3177,14 @@ pub struct CommandsHandlePendingCommandResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct CommandsInvokeRequest {
-    /// Raw input after the command name
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub input: Option<String>,
-    /// Command name. Leading slashes are stripped and the name is matched case-insensitively.
-    pub name: String,
-    /// Optional client surface that initiated the invocation
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub origin: Option<CommandsInvocationOrigin>,
+pub struct CatalogClientContract {
+    /// SDK protocol version the caller was generated against. A caller below the runtime's minimum supported version is refused rather than served a partial result.
+    pub protocol_version: i64,
+    /// Wire features the caller requires the runtime to understand. Identifiers are bounded but extensible so a newer caller can negotiate with an older runtime. Requiring an unknown feature yields a typed refusal listing what is understood, never a partial grant. A grant does not promise that a deployment has enabled the operation; typed unavailable results report that separately.
+    pub required_capabilities: Vec<String>,
 }
 
-/// Optional filters controlling which command sources to include in the listing.
+/// An upstream catalog response broke the wire contract. Most importantly, every result must carry exactly one of a URL or embedded data: a result carrying both, or neither, is refused here rather than being guessed at.
 ///
 /// <div class="warning">
 ///
@@ -3214,19 +3194,16 @@ pub struct CommandsInvokeRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct CommandsListRequest {
-    /// Include runtime built-in commands
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub include_builtins: Option<bool>,
-    /// Include commands registered by protocol clients, including SDK clients and extensions
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub include_client_commands: Option<bool>,
-    /// Include enabled user-invocable skills and commands
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub include_skills: Option<bool>,
+pub struct CatalogContractViolationError {
+    /// Discriminator: the upstream response broke the contract
+    pub kind: CatalogContractViolationErrorKind,
+    /// Human-readable explanation, safe to surface. Never echoes response content, nor a query, URL, handle, or secret.
+    pub message: String,
+    /// Which rule the response broke.
+    pub reason: CatalogContractViolationReason,
 }
 
-/// Queued-command request ID and the result indicating whether the host executed it (and whether to stop processing further queued commands).
+/// A presented handle was not accepted. Handles are runtime-instance scoped, TTL-bound, and single-use, so each way of failing is reported distinctly.
 ///
 /// <div class="warning">
 ///
@@ -3236,14 +3213,18 @@ pub struct CommandsListRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct CommandsRespondToQueuedCommandRequest {
-    /// Request ID from the `command.queued` event the host is responding to.
-    pub request_id: RequestId,
-    /// Result of the queued command execution.
-    pub result: serde_json::Value,
+pub struct CatalogHandleRejectedError {
+    /// Which kind of handle was presented.
+    pub handle_type: CatalogHandleType,
+    /// Discriminator: a handle was rejected
+    pub kind: CatalogHandleRejectedErrorKind,
+    /// Human-readable explanation, safe to surface. Never contains the handle itself, nor a query, URL, or secret.
+    pub message: String,
+    /// Why the handle was rejected.
+    pub reason: CatalogHandleRejectionReason,
 }
 
-/// Indicates whether the queued-command response was matched to a pending request.
+/// The request was rejected before any work was done, because a bounded field fell outside its permitted range or a required field was unusable.
 ///
 /// <div class="warning">
 ///
@@ -3253,12 +3234,16 @@ pub struct CommandsRespondToQueuedCommandRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct CommandsRespondToQueuedCommandResult {
-    /// Whether a pending queued command with the given request ID was found and resolved. False when the request was already resolved, cancelled, or unknown.
-    pub success: bool,
+pub struct CatalogInvalidRequestError {
+    /// Which request field was rejected.
+    pub field: CatalogInvalidRequestField,
+    /// Discriminator: the request itself was invalid
+    pub kind: CatalogInvalidRequestErrorKind,
+    /// Human-readable explanation, safe to surface. Never echoes the offending value, nor a query, URL, handle, or secret.
+    pub message: String,
 }
 
-/// Characters that, when typed in the composer, should trigger a `completions.request`. Empty when the session has no host-driven completions (e.g. local sessions, or a relay host that does not advertise `completionTriggerCharacters`).
+/// A card could not be parsed or did not satisfy its declared media type's schema.
 ///
 /// <div class="warning">
 ///
@@ -3268,12 +3253,19 @@ pub struct CommandsRespondToQueuedCommandResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct CompletionsGetTriggerCharactersResult {
-    /// Trigger characters advertised by the host (e.g. `["@", "#"]`). Empty disables host-driven completions for the session.
-    pub trigger_characters: Vec<String>,
+pub struct CatalogMalformedCardError {
+    /// Discriminator: the card was malformed
+    pub kind: CatalogMalformedCardErrorKind,
+    /// Media type the card was interpreted as, when it declared one this runtime recognises.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub media_type: Option<CatalogMediaType>,
+    /// Human-readable explanation, safe to surface. Never echoes card content, nor a query, URL, handle, or secret.
+    pub message: String,
+    /// How the card failed validation.
+    pub reason: CatalogMalformedCardReason,
 }
 
-/// Request host-driven completions for the current composer input.
+/// The protocol version and capability set the runtime actually honoured for a successful catalog operation.
 ///
 /// <div class="warning">
 ///
@@ -3283,14 +3275,14 @@ pub struct CompletionsGetTriggerCharactersResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct CompletionsRequestRequest {
-    /// Cursor offset within `text`, in UTF-16 code units.
-    pub offset: i64,
-    /// The full composed composer input.
-    pub text: String,
+pub struct CatalogNegotiatedContract {
+    /// Wire features the runtime understood for this operation. Always a superset of the caller's required features, because any shortfall is a refusal instead. Operation availability remains a separate typed result.
+    pub granted_capabilities: Vec<CatalogCapability>,
+    /// Protocol version of the runtime that served the request.
+    pub runtime_protocol_version: i64,
 }
 
-/// A single host-driven completion. Accepting an item replaces `[rangeStart, rangeEnd)` (UTF-16 code units) in the composer with `insertText`; when the range is absent, the active token around the cursor is replaced.
+/// The caller's protocol version or required capabilities cannot be honoured. Returned instead of a partial or ambiguous success.
 ///
 /// <div class="warning">
 ///
@@ -3300,24 +3292,24 @@ pub struct CompletionsRequestRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionCompletionItem {
-    /// Text spliced into the composer when the item is accepted.
-    pub insert_text: String,
-    /// Render-kind hint for the picker row (e.g. `"document"`, `"directory"`), derived from the host's display kind.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub kind: Option<String>,
-    /// Primary display label for the picker row. Falls back to `insertText` when absent.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub label: Option<String>,
-    /// End (exclusive) of the replacement range in `text`, in UTF-16 code units.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub range_end: Option<i64>,
-    /// Start of the replacement range in `text`, in UTF-16 code units.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub range_start: Option<i64>,
+pub struct CatalogNegotiationRefusedError {
+    /// Discriminator: capability or protocol-version negotiation failed
+    pub kind: CatalogNegotiationRefusedErrorKind,
+    /// Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.
+    pub message: String,
+    /// Lowest caller protocol version this runtime will serve.
+    pub minimum_supported_protocol_version: i64,
+    /// Whether the version or the capability set was the problem.
+    pub reason: CatalogNegotiationRefusedReason,
+    /// Protocol version of the runtime that refused the request.
+    pub runtime_protocol_version: i64,
+    /// Every wire feature this runtime understands, so the caller can retry within that contract. This list does not imply that every deployment has enabled every operation.
+    pub supported_capabilities: Vec<CatalogCapability>,
+    /// The subset of the caller's bounded extensible capability identifiers this runtime cannot honour.
+    pub unsupported_capabilities: Vec<String>,
 }
 
-/// Host-driven completion items for the current composer input. Empty when the host returns no items or does not support completions.
+/// The runtime could not reach the catalog authority or retrieve a card. Covers being offline as well as transport-level failure.
 ///
 /// <div class="warning">
 ///
@@ -3327,12 +3319,19 @@ pub struct SessionCompletionItem {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct CompletionsRequestResult {
-    /// Completion items in host-ranked order.
-    pub items: Vec<SessionCompletionItem>,
+pub struct CatalogNetworkFailureError {
+    /// Discriminator: the network operation failed
+    pub kind: CatalogNetworkFailureErrorKind,
+    /// Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.
+    pub message: String,
+    /// Categorised failure, low cardinality so it can be aggregated without carrying a URL.
+    pub reason: CatalogNetworkFailureReason,
+    /// HTTP status code, when the failure was a rejected response.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status_code: Option<i32>,
 }
 
-/// Params to attach or detach an in-process ExtensionController delegate.
+/// The candidate is discoverable but cannot be installed. `application/ai-skill` resolves here, because it stays searchable while remaining typed non-installable.
 ///
 /// <div class="warning">
 ///
@@ -3342,16 +3341,16 @@ pub struct CompletionsRequestResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub(crate) struct ConfigureSessionExtensionsParams {
-    /// In-process ExtensionController delegate (CLI-only optimization). Marked internal: this field is excluded from the public SDK surface. The post-SDK extension surface exposes list/enable/disable/reload via dedicated RPCs served by the runtime.
-    #[doc(hidden)]
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub(crate) controller: Option<serde_json::Value>,
-    /// Session to attach the extension controller delegate to.
-    pub session_id: SessionId,
+pub struct CatalogNotInstallableError {
+    /// Discriminator: the candidate cannot be installed
+    pub kind: CatalogNotInstallableErrorKind,
+    /// Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.
+    pub message: String,
+    /// Why the candidate cannot be installed.
+    pub reason: CatalogNotInstallableReason,
 }
 
-/// Repository associated with the connected remote session.
+/// Registry or enterprise policy refused the operation.
 ///
 /// <div class="warning">
 ///
@@ -3361,16 +3360,16 @@ pub(crate) struct ConfigureSessionExtensionsParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ConnectedRemoteSessionMetadataRepository {
-    /// Branch associated with the remote session.
-    pub branch: String,
-    /// Repository name.
-    pub name: String,
-    /// Repository owner or organization login.
-    pub owner: String,
+pub struct CatalogPolicyRejectedError {
+    /// Discriminator: policy refused the operation
+    pub kind: CatalogPolicyRejectedErrorKind,
+    /// Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.
+    pub message: String,
+    /// Which authority produced the decision.
+    pub source: McpPlanPolicySource,
 }
 
-/// Metadata for a connected remote session.
+/// A bounded catalog search. Both the query length and the result count are capped by the schema so a caller cannot request an unbounded scan.
 ///
 /// <div class="warning">
 ///
@@ -3380,38 +3379,20 @@ pub struct ConnectedRemoteSessionMetadataRepository {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ConnectedRemoteSessionMetadata {
-    /// Neutral SDK discriminator for the connected remote session kind.
-    pub kind: ConnectedRemoteSessionMetadataKind,
-    /// Last session update time as an ISO 8601 string.
-    pub modified_time: String,
-    /// Optional friendly session name.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    /// Pull request number associated with the session.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub pull_request_number: Option<i64>,
-    /// Repository associated with the connected remote session.
-    pub repository: ConnectedRemoteSessionMetadataRepository,
-    /// Original remote resource identifier.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub resource_id: Option<String>,
-    /// SDK session ID for the connected remote session.
-    pub session_id: SessionId,
-    /// Remote session staleness deadline as an ISO 8601 string.
+pub struct CatalogSearchRequest {
+    /// Protocol version and capabilities the caller requires.
+    pub contract: CatalogClientContract,
+    /// Restrict results to these candidate kinds. When omitted, every kind the runtime supports is searched.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub stale_at: Option<String>,
-    /// Session start time as an ISO 8601 string.
-    pub start_time: String,
-    /// Remote session state returned by the backing service.
+    pub kinds: Option<Vec<CatalogCandidateKind>>,
+    /// Maximum number of candidates to return. Defaults to 10 when omitted.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub state: Option<String>,
-    /// Optional session summary.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub summary: Option<String>,
+    pub limit: Option<i32>,
+    /// Free-text search query. Never written to logs or telemetry.
+    pub query: String,
 }
 
-/// Remote session connection parameters.
+/// A completed catalog search: inert candidate summaries, each carrying a single-use handle.
 ///
 /// <div class="warning">
 ///
@@ -3421,12 +3402,20 @@ pub struct ConnectedRemoteSessionMetadata {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ConnectRemoteSessionParams {
-    /// Session ID to connect to.
-    pub session_id: SessionId,
+pub struct CatalogSearchSucceeded {
+    /// Matching candidates, never more than the requested limit. All text is inert untrusted data.
+    pub candidates: Vec<CatalogCandidate>,
+    /// Discriminator: the search completed
+    pub kind: CatalogSearchSucceededKind,
+    /// Protocol version and capabilities the runtime honoured.
+    pub negotiated: CatalogNegotiatedContract,
+    /// Pseudonymous identifier for this search, issued by the runtime or by the catalog authority it queried and never by the caller, so it cannot be forged or replayed to attribute an install to a search that never happened. Always present on a success, so a result set can be tied to the installs it leads to. It identifies a search rather than a person: it is derived from no user, account, device, or query data, and must never be joined with user identity to re-identify anyone.
+    pub search_id: String,
+    /// Whether further matches existed beyond the requested limit.
+    pub truncated: bool,
 }
 
-/// Connection-level opt-ins for the `server.connect` handshake. Transport authentication is consumed by the native protocol boundary before dispatch.
+/// The request asked for a candidate kind this runtime does not serve.
 ///
 /// <div class="warning">
 ///
@@ -3436,16 +3425,18 @@ pub struct ConnectRemoteSessionParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub(crate) struct ConnectRequest {
-    /// Opt this connection in to GitHub telemetry forwarding for its lifetime. When set, the runtime forwards every internal telemetry event it emits — across all sessions, plus sessionless events — to this connection over the `gitHubTelemetry.event` notification. Regular events are also written to the runtime's normal GitHub/CTS path (dual-write); host-only compatibility events are forward-only and intentionally skip that path. Intended for first-party hosts that re-emit the events into their own telemetry stores. Both unrestricted and restricted events are forwarded, each tagged with a `restricted` discriminator; a backstop drops restricted events when restricted telemetry is disabled — using the process-global gate for ordinary events and an explicit session-scoped decision for host-only events.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub enable_git_hub_telemetry_forwarding: Option<bool>,
-    /// Connection token; required when the server was started with COPILOT_CONNECTION_TOKEN
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub token: Option<String>,
+pub struct CatalogUnsupportedKindError {
+    /// Discriminator: an unsupported candidate kind was requested
+    pub kind: CatalogUnsupportedKindErrorKind,
+    /// Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.
+    pub message: String,
+    /// The kinds from the request that are not supported.
+    pub requested_kinds: Vec<CatalogCandidateKind>,
+    /// Every candidate kind this runtime can serve.
+    pub supported_kinds: Vec<CatalogCandidateKind>,
 }
 
-/// Handshake result reporting the server's protocol version and package version on success.
+/// Retrieval was refused by the runtime's hardened fetch boundary before any request left the process, or before a redirect was followed.
 ///
 /// <div class="warning">
 ///
@@ -3455,16 +3446,16 @@ pub(crate) struct ConnectRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub(crate) struct ConnectResult {
-    /// Always true on success
-    pub ok: bool,
-    /// Server protocol version number
-    pub protocol_version: i64,
-    /// Server package version
-    pub version: String,
+pub struct CatalogUnsafeRetrievalError {
+    /// Discriminator: retrieval was refused as unsafe
+    pub kind: CatalogUnsafeRetrievalErrorKind,
+    /// Human-readable explanation, safe to surface. Never contains the refused URL, nor a query, handle, or secret.
+    pub message: String,
+    /// Which control refused the retrieval, low cardinality so it can be aggregated without carrying a URL.
+    pub reason: CatalogUnsafeRetrievalReason,
 }
 
-/// Local file system absolute paths within the session working directory to check against its content-exclusion policy.
+/// The operation is not available on this runtime. Distinct from a network failure: nothing was attempted.
 ///
 /// <div class="warning">
 ///
@@ -3474,12 +3465,16 @@ pub(crate) struct ConnectResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ContentExclusionCheckPathsRequest {
-    /// Local file system absolute paths within the session working directory to check. Results are returned in the same order, including duplicates.
-    pub paths: Vec<String>,
+pub struct CatalogUnavailableError {
+    /// Discriminator: the operation is not available
+    pub kind: CatalogUnavailableErrorKind,
+    /// Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.
+    pub message: String,
+    /// Why the operation is unavailable.
+    pub reason: CatalogUnavailableReason,
 }
 
-/// Content-exclusion decision for one requested path.
+/// No transport this runtime can use is available for the requested server.
 ///
 /// <div class="warning">
 ///
@@ -3489,14 +3484,16 @@ pub struct ContentExclusionCheckPathsRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ContentExclusionPathCheck {
-    /// Whether the session's complete content-exclusion policy excludes the path.
-    pub excluded: bool,
-    /// The path supplied by the caller.
-    pub path: String,
+pub struct CatalogUnavailableTransportError {
+    /// Discriminator: no usable transport is available
+    pub kind: CatalogUnavailableTransportErrorKind,
+    /// Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.
+    pub message: String,
+    /// Why no transport could be offered.
+    pub reason: CatalogUnavailableTransportReason,
 }
 
-/// Batch content-exclusion result. Callers must fail closed when policy evaluation is unavailable.
+/// A literal choice the command input accepts, with a human-facing description
 ///
 /// <div class="warning">
 ///
@@ -3506,14 +3503,14 @@ pub struct ContentExclusionPathCheck {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ContentExclusionCheckPathsResult {
-    /// Whether the session's policy service was available for the complete batch. When false, checks is empty and callers must treat every requested path as excluded.
-    pub available: bool,
-    /// Per-path decisions in request order. Empty when available is false.
-    pub checks: Vec<ContentExclusionPathCheck>,
+pub struct SlashCommandInputChoice {
+    /// Human-readable description shown alongside the choice
+    pub description: String,
+    /// The literal choice value (e.g. 'on', 'off', 'show')
+    pub name: String,
 }
 
-/// A single large message currently in context.
+/// Optional unstructured input hint
 ///
 /// <div class="warning">
 ///
@@ -3523,18 +3520,24 @@ pub struct ContentExclusionCheckPathsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ContextHeaviestMessage {
-    /// Stable identifier for this message within the snapshot.
-    pub id: String,
-    /// Human-readable source label, e.g. `tool: bash` or `skill: tmux`. Presentation-only.
-    pub label: String,
-    /// Role of the chat message (`user`, `assistant`, or `tool`).
-    pub role: String,
-    /// Token count currently in context for this individual message.
-    pub tokens: i64,
+pub struct SlashCommandInput {
+    /// Optional literal choices the input accepts, each with a human-facing description; clients may render these as selectable options
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub choices: Option<Vec<SlashCommandInputChoice>>,
+    /// Optional completion hint for the input (e.g. 'directory' for filesystem path completion)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub completion: Option<SlashCommandInputCompletion>,
+    /// Hint to display when command input has not been provided
+    pub hint: String,
+    /// When true, clients should pass the full text after the command name as a single argument rather than splitting on whitespace
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub preserve_multiline_input: Option<bool>,
+    /// When true, the command requires non-empty input; clients should render the input hint as required
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub required: Option<bool>,
 }
 
-/// The currently selected model, reasoning effort, and context tier for the session. The context tier reflects `Session.getContextTier()`, restored from the session journal on resume.
+/// Slash-command metadata with name, aliases, description, kind, input hint, execution allowance, and schedulability.
 ///
 /// <div class="warning">
 ///
@@ -3544,19 +3547,30 @@ pub struct ContextHeaviestMessage {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct CurrentModel {
-    /// Context tier for models that support multiple context-window sizes.
+pub struct SlashCommandInfo {
+    /// Canonical aliases without leading slashes
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub context_tier: Option<ContextTier>,
-    /// Currently active model identifier
+    pub aliases: Option<Vec<String>>,
+    /// Whether the command may run while an agent turn is active
+    pub allow_during_agent_execution: bool,
+    /// Human-readable command description
+    pub description: String,
+    /// Whether the command is experimental
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub model_id: Option<String>,
-    /// Reasoning effort level currently applied to the active model, when one is set. Reads `Session.getReasoningEffort()` synchronously after `getSelectedModel()` resolves so the two values are reported as a snapshot.
+    pub experimental: Option<bool>,
+    /// Optional unstructured input hint
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub reasoning_effort: Option<String>,
+    pub input: Option<SlashCommandInput>,
+    /// Coarse command category for grouping and behavior: runtime built-in, skill-backed command, or SDK/client-owned command
+    pub kind: SlashCommandKind,
+    /// Canonical command name without a leading slash
+    pub name: String,
+    /// Whether the command may be the target of `/every` / `/after` schedules. Resolution happens at every tick, so only set this when the command is safe to re-invoke and produces an agent prompt.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub schedulable: Option<bool>,
 }
 
-/// Lightweight metadata for a currently initialized session tool
+/// Slash commands available in the session, after applying any include/exclude filters.
 ///
 /// <div class="warning">
 ///
@@ -3566,29 +3580,12 @@ pub struct CurrentModel {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct CurrentToolMetadata {
-    /// Whether the tool is loaded on demand via tool search
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub defer_loading: Option<bool>,
-    /// Tool description
-    pub description: String,
-    /// JSON Schema for tool input
-    #[serde(rename = "input_schema", skip_serializing_if = "Option::is_none")]
-    pub input_schema: Option<HashMap<String, serde_json::Value>>,
-    /// MCP server name for MCP-backed tools
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mcp_server_name: Option<String>,
-    /// Raw MCP tool name for MCP-backed tools
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mcp_tool_name: Option<String>,
-    /// Model-facing tool name
-    pub name: String,
-    /// Optional MCP/config namespaced tool name
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub namespaced_name: Option<String>,
+pub struct CommandList {
+    /// Commands available in this session
+    pub commands: Vec<SlashCommandInfo>,
 }
 
-/// A file included in the redacted debug bundle.
+/// The pending slash-command invocation effect to finalize, plus whether the host applied or cancelled it.
 ///
 /// <div class="warning">
 ///
@@ -3598,37 +3595,32 @@ pub struct CurrentToolMetadata {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct DebugCollectLogsCollectedEntry {
-    /// Relative path of the file in the staged bundle/archive.
-    pub bundle_path: String,
-    /// Redacted output size in bytes.
-    pub size_bytes: i64,
-    /// Source category for this entry.
-    pub source: DebugCollectLogsSource,
+pub struct CommandsFinalizeInvocationEffectRequest {
+    /// The slash-command result object that produced the pending effect, echoed back unchanged.
+    pub effect: serde_json::Value,
+    /// Whether the host applied or cancelled the pending invocation effect.
+    pub outcome: CommandsInvocationEffectOutcome,
 }
 
+/// Whether finalizing the invocation effect succeeded, and the failure reason when it did not.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct DebugCollectLogsDestinationArchive {
-    /// Destination variant discriminator.
-    pub kind: DebugCollectLogsDestinationArchiveKind,
-    /// When true, create the archive atomically without overwriting an existing file by appending ` (N)` before the extension as needed. Defaults to false.
+pub struct CommandsFinalizeInvocationEffectResult {
+    /// Failure reason when the invocation effect could not be finalized.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub no_overwrite: Option<bool>,
-    /// Absolute or server-relative path for the .tgz archive to create.
-    pub output_path: String,
-}
-
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct DebugCollectLogsDestinationDirectory {
-    /// Destination variant discriminator.
-    pub kind: DebugCollectLogsDestinationDirectoryKind,
-    /// Directory where redacted files should be staged. The directory is created if needed.
-    pub output_directory: String,
+    pub error: Option<String>,
+    /// Whether the pending invocation effect was finalized successfully.
+    pub success: bool,
 }
 
-/// A caller-provided server-local file or directory to include in the debug bundle.
+/// Pending command request ID and an optional error if the client handler failed.
 ///
 /// <div class="warning">
 ///
@@ -3638,22 +3630,15 @@ pub struct DebugCollectLogsDestinationDirectory {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct DebugCollectLogsEntry {
-    /// Relative path to use inside the staged bundle/archive.
-    pub bundle_path: String,
-    /// Kind of source path to include.
-    pub kind: DebugCollectLogsEntryKind,
-    /// Server-local source path to read.
-    pub path: String,
-    /// How text content from this entry should be redacted. Defaults to plain-text.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub redaction: Option<DebugCollectLogsRedaction>,
-    /// When true, collection fails if this entry cannot be read. Defaults to false, which records the entry in `skippedEntries`.
+pub struct CommandsHandlePendingCommandRequest {
+    /// Error message if the command handler failed
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub required: Option<bool>,
+    pub error: Option<String>,
+    /// Request ID from the command invocation event
+    pub request_id: RequestId,
 }
 
-/// Built-in session diagnostics to include in the bundle. Omitted fields default to true.
+/// Indicates whether the pending client-handled command was completed successfully.
 ///
 /// <div class="warning">
 ///
@@ -3663,31 +3648,12 @@ pub struct DebugCollectLogsEntry {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct DebugCollectLogsInclude {
-    /// Server-local path to the current process log. When set, it is included as `process.log` and its directory is searched for prior logs from the same session.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub current_process_log_path: Option<String>,
-    /// Include the session event log (`events.jsonl`). Defaults to true.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub events: Option<bool>,
-    /// Server-local path to the session's events.jsonl file. Internal callers normally omit this and let the runtime derive it from the session.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub events_path: Option<String>,
-    /// Maximum number of previous process logs to include. Defaults to 5.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub previous_process_log_limit: Option<i64>,
-    /// Server-local process log directory to search when `currentProcessLogPath` is unavailable, useful for collecting logs for inactive sessions.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub process_log_directory: Option<String>,
-    /// Include process logs for the session. Defaults to true.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub process_logs: Option<bool>,
-    /// Include interactive shell logs written under the session's `shell-logs` directory. Defaults to true.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub shell_logs: Option<bool>,
+pub struct CommandsHandlePendingCommandResult {
+    /// Whether the command was handled successfully
+    pub success: bool,
 }
 
-/// Options for collecting a redacted session debug bundle.
+/// Slash command name and optional raw input string to invoke.
 ///
 /// <div class="warning">
 ///
@@ -3695,20 +3661,20 @@ pub struct DebugCollectLogsInclude {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct DebugCollectLogsRequest {
-    /// Caller-provided server-local files or directories to include in addition to the runtime's built-in session diagnostics. This lets host applications add their own diagnostics without changing the API shape.
+pub struct CommandsInvokeRequest {
+    /// Raw input after the command name
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub additional_entries: Option<Vec<DebugCollectLogsEntry>>,
-    /// Where the redacted bundle should be written. Use `archive` to produce a .tgz, or `directory` to stage redacted files for caller-managed upload/post-processing.
-    pub destination: DebugCollectLogsDestination,
-    /// Which built-in session diagnostics to include. Omitted fields default to true.
+    pub input: Option<String>,
+    /// Command name. Leading slashes are stripped and the name is matched case-insensitively.
+    pub name: String,
+    /// Optional client surface that initiated the invocation
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub include: Option<DebugCollectLogsInclude>,
+    pub origin: Option<CommandsInvocationOrigin>,
 }
 
-/// An optional debug bundle entry that could not be included.
+/// Optional filters controlling which command sources to include in the listing.
 ///
 /// <div class="warning">
 ///
@@ -3718,17 +3684,19 @@ pub struct DebugCollectLogsRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct DebugCollectLogsSkippedEntry {
-    /// Relative path requested for this bundle entry.
-    pub bundle_path: String,
-    /// Server-local source path that could not be read.
+pub struct CommandsListRequest {
+    /// Include runtime built-in commands
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub path: Option<String>,
-    /// Reason the entry was skipped.
-    pub reason: String,
+    pub include_builtins: Option<bool>,
+    /// Include commands registered by protocol clients, including SDK clients and extensions
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub include_client_commands: Option<bool>,
+    /// Include enabled user-invocable skills and commands
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub include_skills: Option<bool>,
 }
 
-/// Result of collecting a redacted debug bundle.
+/// Queued-command request ID and the result indicating whether the host executed it (and whether to stop processing further queued commands).
 ///
 /// <div class="warning">
 ///
@@ -3738,19 +3706,14 @@ pub struct DebugCollectLogsSkippedEntry {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct DebugCollectLogsResult {
-    /// Files included in the redacted bundle.
-    pub entries: Vec<DebugCollectLogsCollectedEntry>,
-    /// Destination kind that was written.
-    pub kind: DebugCollectLogsResultKind,
-    /// Actual archive path or staging directory path written. This may differ from the requested path when no-overwrite suffixing or fallback-to-temp-directory was needed.
-    pub path: String,
-    /// Optional files or directories that could not be included.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub skipped_entries: Option<Vec<DebugCollectLogsSkippedEntry>>,
+pub struct CommandsRespondToQueuedCommandRequest {
+    /// Request ID from the `command.queued` event the host is responding to.
+    pub request_id: RequestId,
+    /// Result of the queued command execution.
+    pub result: serde_json::Value,
 }
 
-/// Installed plugin that contributes a discovered extension.
+/// Indicates whether the queued-command response was matched to a pending request.
 ///
 /// <div class="warning">
 ///
@@ -3760,12 +3723,12 @@ pub struct DebugCollectLogsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct DiscoveredExtensionPlugin {
-    /// Installed plugin name
-    pub name: String,
+pub struct CommandsRespondToQueuedCommandResult {
+    /// Whether a pending queued command with the given request ID was found and resolved. False when the request was already resolved, cancelled, or unknown.
+    pub success: bool,
 }
 
-/// Discovered extension metadata and persistent enablement state.
+/// Characters that, when typed in the composer, should trigger a `completions.request`. Empty when the session has no host-driven completions (e.g. local sessions, or a relay host that does not advertise `completionTriggerCharacters`).
 ///
 /// <div class="warning">
 ///
@@ -3775,23 +3738,12 @@ pub struct DiscoveredExtensionPlugin {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct DiscoveredExtension {
-    /// Whether this extension's persistent per-ID preference is enabled
-    pub enabled: bool,
-    /// Source-qualified ID accepted by both server and session extension enablement methods
-    pub id: String,
-    /// Human-readable extension name
-    pub name: String,
-    /// Absolute path to the extension entry module, suitable for revealing it in a file manager
-    pub path: String,
-    /// Containing plugin metadata for plugin-contributed extensions
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub plugin: Option<DiscoveredExtensionPlugin>,
-    /// Discovery source
-    pub source: DiscoveredExtensionSource,
+pub struct CompletionsGetTriggerCharactersResult {
+    /// Trigger characters advertised by the host (e.g. `["@", "#"]`). Empty disables host-driven completions for the session.
+    pub trigger_characters: Vec<String>,
 }
 
-/// Extensions discovered from persisted Copilot home state and their effective loading mode. Launch-scoped additional plugins are not included.
+/// Request host-driven completions for the current composer input.
 ///
 /// <div class="warning">
 ///
@@ -3801,14 +3753,14 @@ pub struct DiscoveredExtension {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct DiscoveredExtensions {
-    /// Discovered user and enabled installed-plugin extensions from persisted Copilot home state
-    pub extensions: Vec<DiscoveredExtension>,
-    /// Effective extension loading mode. Defaults to load_and_augment when unset.
-    pub mode: DiscoveredExtensionMode,
+pub struct CompletionsRequestRequest {
+    /// Cursor offset within `text`, in UTF-16 code units.
+    pub offset: i64,
+    /// The full composed composer input.
+    pub text: String,
 }
 
-/// Source-qualified extension identifiers to persistently disable for future sessions.
+/// A single host-driven completion. Accepting an item replaces `[rangeStart, rangeEnd)` (UTF-16 code units) in the composer with `insertText`; when the range is absent, the active token around the cursor is replaced.
 ///
 /// <div class="warning">
 ///
@@ -3818,12 +3770,24 @@ pub struct DiscoveredExtensions {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct DiscoveredExtensionsDisableRequest {
-    /// Source-qualified user or plugin extension IDs to disable
-    pub ids: Vec<String>,
+pub struct SessionCompletionItem {
+    /// Text spliced into the composer when the item is accepted.
+    pub insert_text: String,
+    /// Render-kind hint for the picker row (e.g. `"document"`, `"directory"`), derived from the host's display kind.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub kind: Option<String>,
+    /// Primary display label for the picker row. Falls back to `insertText` when absent.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub label: Option<String>,
+    /// End (exclusive) of the replacement range in `text`, in UTF-16 code units.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub range_end: Option<i64>,
+    /// Start of the replacement range in `text`, in UTF-16 code units.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub range_start: Option<i64>,
 }
 
-/// Source-qualified extension identifiers to persistently enable for future sessions.
+/// Host-driven completion items for the current composer input. Empty when the host returns no items or does not support completions.
 ///
 /// <div class="warning">
 ///
@@ -3833,12 +3797,12 @@ pub struct DiscoveredExtensionsDisableRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct DiscoveredExtensionsEnableRequest {
-    /// Source-qualified user or plugin extension IDs to enable
-    pub ids: Vec<String>,
+pub struct CompletionsRequestResult {
+    /// Completion items in host-ranked order.
+    pub items: Vec<SessionCompletionItem>,
 }
 
-/// MCP server discovered by `mcp.discover`, with config source, optional plugin source, transport type, and enabled state.
+/// Params to attach or detach an in-process ExtensionController delegate.
 ///
 /// <div class="warning">
 ///
@@ -3848,40 +3812,16 @@ pub struct DiscoveredExtensionsEnableRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct DiscoveredMcpServer {
-    /// Whether the server is enabled (not in the disabled list)
-    pub enabled: bool,
-    /// Server name (config key)
-    pub name: String,
-    /// Configuration source: user, workspace, plugin, or builtin
-    pub source: McpServerSource,
-    /// Plugin name that provided this server, when source is plugin.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source_plugin: Option<String>,
-    /// Plugin version that provided this server, when source is plugin.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source_plugin_version: Option<String>,
-    /// Server transport type: stdio, http, sse (deprecated), or memory
+pub(crate) struct ConfigureSessionExtensionsParams {
+    /// In-process ExtensionController delegate (CLI-only optimization). Marked internal: this field is excluded from the public SDK surface. The post-SDK extension surface exposes list/enable/disable/reload via dedicated RPCs served by the runtime.
+    #[doc(hidden)]
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub r#type: Option<DiscoveredMcpServerType>,
-}
-
-/// Slash-prefixed command string to enqueue for FIFO processing.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct EnqueueCommandParams {
-    /// Slash-prefixed command string to enqueue, e.g. '/compact' or '/model gpt-4'. Queued FIFO with any in-flight items; if the session is idle, processing kicks off immediately.
-    pub command: String,
+    pub(crate) controller: Option<serde_json::Value>,
+    /// Session to attach the extension controller delegate to.
+    pub session_id: SessionId,
 }
 
-/// Indicates whether the command was accepted into the local execution queue.
+/// Repository associated with the connected remote session.
 ///
 /// <div class="warning">
 ///
@@ -3891,12 +3831,16 @@ pub struct EnqueueCommandParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct EnqueueCommandResult {
-    /// True when the command was accepted into the local execution queue. False when the call targets a session that does not support local command queueing (e.g. remote sessions).
-    pub queued: bool,
+pub struct ConnectedRemoteSessionMetadataRepository {
+    /// Branch associated with the remote session.
+    pub branch: String,
+    /// Repository name.
+    pub name: String,
+    /// Repository owner or organization login.
+    pub owner: String,
 }
 
-/// Cursor, batch size, and optional long-poll/filter parameters for reading session events.
+/// Metadata for a connected remote session.
 ///
 /// <div class="warning">
 ///
@@ -3906,34 +3850,38 @@ pub struct EnqueueCommandResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct EventLogReadRequest {
-    /// Optional non-empty list of subagent identifiers. When provided, only events owned by one of these agents are returned; ownership recognizes the event envelope's agentId plus legacy data.agentId and data.parentToolCallId markers. This filter takes precedence over agentScope.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub agent_ids: Option<Vec<String>>,
-    /// Agent-scope filter: 'primary' returns only main-agent events plus events whose type starts with 'subagent.' (matching the typed-subscription default behavior); 'all' returns events from all agents (matching wildcard-subscription behavior). Default is 'all' to preserve wildcard semantics for catch-up callers.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub agent_scope: Option<EventsAgentScope>,
-    /// Opaque cursor returned by a previous read. Omit on the first call to start from the beginning of the session's persisted history.
+pub struct ConnectedRemoteSessionMetadata {
+    /// Neutral SDK discriminator for the connected remote session kind.
+    pub kind: ConnectedRemoteSessionMetadataKind,
+    /// Last session update time as an ISO 8601 string.
+    pub modified_time: String,
+    /// Optional friendly session name.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub cursor: Option<String>,
-    /// Direction to page through the session's persisted event history. 'forward' (default) pages from the cursor toward newer events (or from the start of history when no cursor is given). 'backward' enables tail-first reads: with no cursor it returns the NEWEST `max` events, and the returned cursor pages toward OLDER events on subsequent backward reads. Events within a returned batch are always in chronological (oldest-to-newest) order, even for a backward read. Backward reads cover PERSISTED history only; ephemeral events are never returned by a backward read. `direction` selects the INITIAL read only: the returned cursor is self-describing, so a continuation read pages in the cursor's own direction regardless of the `direction` passed alongside it — a forward cursor always pages forward and a backward cursor always pages backward. Pass the direction that matches the cursor to avoid confusion.
+    pub name: Option<String>,
+    /// Pull request number associated with the session.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub direction: Option<EventsReadDirection>,
-    /// When false, skip ephemeral events entirely and return only durable (persisted) events. History-backfill callers that discard ephemerals anyway should set this so the read is bounded by the durable log length instead of racing the ephemeral ring on a busy session. Defaults to true (ephemerals are interleaved with durable events in creation order). Ignored by backward reads, which always cover persisted history only.
+    pub pull_request_number: Option<i64>,
+    /// Repository associated with the connected remote session.
+    pub repository: ConnectedRemoteSessionMetadataRepository,
+    /// Original remote resource identifier.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub include_ephemeral: Option<bool>,
-    /// Maximum number of events to return in this batch (1–1000, default 200).
+    pub resource_id: Option<String>,
+    /// SDK session ID for the connected remote session.
+    pub session_id: SessionId,
+    /// Remote session staleness deadline as an ISO 8601 string.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub max: Option<i64>,
-    /// Either '*' to receive all event types, or a non-empty list of event types to receive
+    pub stale_at: Option<String>,
+    /// Session start time as an ISO 8601 string.
+    pub start_time: String,
+    /// Remote session state returned by the backing service.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub types: Option<serde_json::Value>,
-    /// Milliseconds to wait for new events when the cursor is at the tail of history. 0 (default) returns immediately even if no events are available. Capped at 30000ms. Ephemeral events that arrive during the wait are delivered in this batch but are NOT replayable on a subsequent read (use a non-zero waitMs in your next call to capture future ephemerals as they happen). This applies to forward reads only: a backward read always returns immediately and ignores `waitMs`, because backward paging covers persisted history only while new events append at the tail (the opposite end from a backward page), so no blocking or ephemeral delivery can occur.
+    pub state: Option<String>,
+    /// Optional session summary.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub wait_ms: Option<i32>,
+    pub summary: Option<String>,
 }
 
-/// Indicates whether the operation succeeded.
+/// Remote session connection parameters.
 ///
 /// <div class="warning">
 ///
@@ -3943,12 +3891,12 @@ pub struct EventLogReadRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct EventLogReleaseInterestResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct ConnectRemoteSessionParams {
+    /// Session ID to connect to.
+    pub session_id: SessionId,
 }
 
-/// Snapshot of the current tail cursor without returning any events. Use this when a consumer wants to subscribe to live events going forward without first paginating through the entire persisted history (which would happen if `read` were called without a cursor on a long-lived session).
+/// Connection-level opt-ins for the `server.connect` handshake. Transport authentication is consumed by the native protocol boundary before dispatch.
 ///
 /// <div class="warning">
 ///
@@ -3958,12 +3906,16 @@ pub struct EventLogReleaseInterestResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct EventLogTailResult {
-    /// Opaque cursor pointing at the current tail of the session's persisted-events history. Pass back to `read` to receive only events that arrive AFTER this snapshot. When the session has no events, this returns the same sentinel as an unset cursor (i.e. equivalent to omitting the cursor on a first read).
-    pub cursor: String,
+pub(crate) struct ConnectRequest {
+    /// Opt this connection in to GitHub telemetry forwarding for its lifetime. When set, the runtime forwards every internal telemetry event it emits — across all sessions, plus sessionless events — to this connection over the `gitHubTelemetry.event` notification. Regular events are also written to the runtime's normal GitHub/CTS path (dual-write); host-only compatibility events are forward-only and intentionally skip that path. Intended for first-party hosts that re-emit the events into their own telemetry stores. Both unrestricted and restricted events are forwarded, each tagged with a `restricted` discriminator; a backstop drops restricted events when restricted telemetry is disabled — using the process-global gate for ordinary events and an explicit session-scoped decision for host-only events.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enable_git_hub_telemetry_forwarding: Option<bool>,
+    /// Connection token; required when the server was started with COPILOT_CONNECTION_TOKEN
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub token: Option<String>,
 }
 
-/// Batch of session events returned by a read, with cursor and continuation metadata.
+/// Handshake result reporting the server's protocol version and package version on success.
 ///
 /// <div class="warning">
 ///
@@ -3973,18 +3925,16 @@ pub struct EventLogTailResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct EventsReadResult {
-    /// Opaque cursor for the next read. Pass back unchanged in the next read.cursor to continue from where this read left off. Always present, even when no events were returned. For a backward read this cursor pages toward OLDER events; keep passing `direction: backward` with it (the cursor is also self-describing, so backward paging continues correctly).
-    pub cursor: String,
-    /// Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history. For a forward read the fallback starts from the beginning of the remaining history; for a backward read it falls back to the tail (the newest window). Because the fallback page is a fresh boundary snapshot rather than a continuation of the requested cursor, it may overlap events the consumer has already rendered — a backward fallback to the tail in particular can repeat the newest window. On 'expired', consumers should reset or rebase their local pagination state (or deduplicate by event id) before continuing from the returned cursor rather than blindly appending/prepending the fallback page.
-    pub cursor_status: EventsCursorStatus,
-    /// Session events for this batch, merged into a single stream in creation order: durable (persisted) events and ephemeral events interleave exactly as they were emitted. Set `includeEphemeral: false` to receive only durable events. Ephemeral events are never replayable once pruned from the in-memory ring, so a consumer that needs them should keep reading with a non-zero `waitMs`. For a backward (tail-first) read, the returned window contains persisted events only, still in chronological (oldest-to-newest) append order.
-    pub events: Vec<SessionEvent>,
-    /// True when more events are available in the read's direction. For a forward read, true means the batch returned `max` events and more are available immediately. For a backward read, true means older persisted events remain before the returned window.
-    pub has_more: bool,
+pub(crate) struct ConnectResult {
+    /// Always true on success
+    pub ok: bool,
+    /// Server protocol version number
+    pub protocol_version: i64,
+    /// Server package version
+    pub version: String,
 }
 
-/// Slash command name and argument string to execute synchronously.
+/// Local file system absolute paths within the session working directory to check against its content-exclusion policy.
 ///
 /// <div class="warning">
 ///
@@ -3994,14 +3944,12 @@ pub struct EventsReadResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ExecuteCommandParams {
-    /// Argument string to pass to the command (empty string if none).
-    pub args: String,
-    /// Name of the slash command to invoke (without the leading '/').
-    pub command_name: String,
+pub struct ContentExclusionCheckPathsRequest {
+    /// Local file system absolute paths within the session working directory to check. Results are returned in the same order, including duplicates.
+    pub paths: Vec<String>,
 }
 
-/// Error message produced while executing the command, if any.
+/// Content-exclusion decision for one requested path.
 ///
 /// <div class="warning">
 ///
@@ -4011,13 +3959,14 @@ pub struct ExecuteCommandParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ExecuteCommandResult {
-    /// Error message produced while executing the command, if any. Omitted when the handler succeeded.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
+pub struct ContentExclusionPathCheck {
+    /// Whether the session's complete content-exclusion policy excludes the path.
+    pub excluded: bool,
+    /// The path supplied by the caller.
+    pub path: String,
 }
 
-/// Discovered extension metadata, including source-qualified ID, name, discovery source, status, and optional process ID.
+/// Batch content-exclusion result. Callers must fail closed when policy evaluation is unavailable.
 ///
 /// <div class="warning">
 ///
@@ -4027,21 +3976,14 @@ pub struct ExecuteCommandResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct Extension {
-    /// Source-qualified ID (e.g., 'project:my-ext', 'user:auth-helper', 'plugin:my-plugin:my-ext')
-    pub id: String,
-    /// Extension name (directory name)
-    pub name: String,
-    /// Process ID if the extension is running
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub pid: Option<i64>,
-    /// Discovery source: project (.github/extensions/), user (~/.copilot/extensions/), plugin (installed plugin), or session (session-state/<id>/extensions/)
-    pub source: ExtensionSource,
-    /// Current status: running, disabled, failed, or starting
-    pub status: ExtensionStatus,
+pub struct ContentExclusionCheckPathsResult {
+    /// Whether the session's policy service was available for the complete batch. When false, checks is empty and callers must treat every requested path as excluded.
+    pub available: bool,
+    /// Per-path decisions in request order. Empty when available is false.
+    pub checks: Vec<ContentExclusionPathCheck>,
 }
 
-/// Slim input shape for extension_context attachments; identity fields are runtime-derived.
+/// A single large message currently in context.
 ///
 /// <div class="warning">
 ///
@@ -4051,16 +3993,18 @@ pub struct Extension {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ExtensionContextPushInput {
-    /// Caller-supplied JSON payload (required, may be null but not undefined)
-    pub payload: serde_json::Value,
-    /// Human-readable composer pill label
-    pub title: String,
-    /// Attachment type discriminator
-    pub r#type: ExtensionContextPushInputType,
+pub struct ContextHeaviestMessage {
+    /// Stable identifier for this message within the snapshot.
+    pub id: String,
+    /// Human-readable source label, e.g. `tool: bash` or `skill: tmux`. Presentation-only.
+    pub label: String,
+    /// Role of the chat message (`user`, `assistant`, or `tool`).
+    pub role: String,
+    /// Token count currently in context for this individual message.
+    pub tokens: i64,
 }
 
-/// Opaque integrator-owned process launch profile for one extension entrypoint.
+/// The currently selected model, reasoning effort, and context tier for the session. The context tier reflects `Session.getContextTier()`, restored from the session journal on resume.
 ///
 /// <div class="warning">
 ///
@@ -4070,16 +4014,19 @@ pub struct ExtensionContextPushInput {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ExtensionLaunchProfile {
-    /// Opaque integrator-defined arguments passed to the executable. The runtime does not append the extension entrypoint.
-    pub args: Vec<String>,
-    /// Opaque integrator-defined environment variables. Runtime-owned COPILOT_SDK_PATH, SESSION_ID, and COPILOT_EXTENSION_PARENT_PID values take precedence.
-    pub env: HashMap<String, String>,
-    /// Executable used to launch the extension entrypoint.
-    pub executable: String,
-}
-
-/// A discovered extension entrypoint that the registered integrator may classify and resolve to an opaque launch profile.
+pub struct CurrentModel {
+    /// Context tier for models that support multiple context-window sizes.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub context_tier: Option<ContextTier>,
+    /// Currently active model identifier
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_id: Option<String>,
+    /// Reasoning effort level currently applied to the active model, when one is set. Reads `Session.getReasoningEffort()` synchronously after `getSelectedModel()` resolves so the two values are reported as a snapshot.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reasoning_effort: Option<String>,
+}
+
+/// Lightweight metadata for a currently initialized session tool
 ///
 /// <div class="warning">
 ///
@@ -4089,18 +4036,29 @@ pub struct ExtensionLaunchProfile {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ExtensionLaunchProviderResolveRequest {
-    /// Source-qualified extension identifier.
-    pub id: String,
-    /// Absolute path to the discovered extension entrypoint.
-    pub module_path: String,
-    /// Human-readable extension name.
+pub struct CurrentToolMetadata {
+    /// Whether the tool is loaded on demand via tool search
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub defer_loading: Option<bool>,
+    /// Tool description
+    pub description: String,
+    /// JSON Schema for tool input
+    #[serde(rename = "input_schema", skip_serializing_if = "Option::is_none")]
+    pub input_schema: Option<HashMap<String, serde_json::Value>>,
+    /// MCP server name for MCP-backed tools
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mcp_server_name: Option<String>,
+    /// Raw MCP tool name for MCP-backed tools
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mcp_tool_name: Option<String>,
+    /// Model-facing tool name
     pub name: String,
-    /// Discovery source for the extension entrypoint.
-    pub source: ExtensionSource,
+    /// Optional MCP/config namespaced tool name
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub namespaced_name: Option<String>,
 }
 
-/// The launch profile for a supported entrypoint. Omit launch when the provider does not support the entrypoint.
+/// A file included in the redacted debug bundle.
 ///
 /// <div class="warning">
 ///
@@ -4110,13 +4068,37 @@ pub struct ExtensionLaunchProviderResolveRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ExtensionLaunchProviderResolveResult {
-    /// Opaque launch profile, omitted when this provider does not support the entrypoint.
+pub struct DebugCollectLogsCollectedEntry {
+    /// Relative path of the file in the staged bundle/archive.
+    pub bundle_path: String,
+    /// Redacted output size in bytes.
+    pub size_bytes: i64,
+    /// Source category for this entry.
+    pub source: DebugCollectLogsSource,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DebugCollectLogsDestinationArchive {
+    /// Destination variant discriminator.
+    pub kind: DebugCollectLogsDestinationArchiveKind,
+    /// When true, create the archive atomically without overwriting an existing file by appending ` (N)` before the extension as needed. Defaults to false.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub launch: Option<ExtensionLaunchProfile>,
+    pub no_overwrite: Option<bool>,
+    /// Absolute or server-relative path for the .tgz archive to create.
+    pub output_path: String,
 }
 
-/// Extensions discovered for the session, with their current status.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DebugCollectLogsDestinationDirectory {
+    /// Destination variant discriminator.
+    pub kind: DebugCollectLogsDestinationDirectoryKind,
+    /// Directory where redacted files should be staged. The directory is created if needed.
+    pub output_directory: String,
+}
+
+/// A caller-provided server-local file or directory to include in the debug bundle.
 ///
 /// <div class="warning">
 ///
@@ -4126,12 +4108,22 @@ pub struct ExtensionLaunchProviderResolveResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ExtensionList {
-    /// Discovered extensions and their current status
-    pub extensions: Vec<Extension>,
+pub struct DebugCollectLogsEntry {
+    /// Relative path to use inside the staged bundle/archive.
+    pub bundle_path: String,
+    /// Kind of source path to include.
+    pub kind: DebugCollectLogsEntryKind,
+    /// Server-local source path to read.
+    pub path: String,
+    /// How text content from this entry should be redacted. Defaults to plain-text.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub redaction: Option<DebugCollectLogsRedaction>,
+    /// When true, collection fails if this entry cannot be read. Defaults to false, which records the entry in `skippedEntries`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub required: Option<bool>,
 }
 
-/// Source-qualified extension identifier to disable for the session.
+/// Built-in session diagnostics to include in the bundle. Omitted fields default to true.
 ///
 /// <div class="warning">
 ///
@@ -4141,12 +4133,31 @@ pub struct ExtensionList {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ExtensionsDisableRequest {
-    /// Source-qualified extension ID to disable
-    pub id: String,
+pub struct DebugCollectLogsInclude {
+    /// Server-local path to the current process log. When set, it is included as `process.log` and its directory is searched for prior logs from the same session.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub current_process_log_path: Option<String>,
+    /// Include the session event log (`events.jsonl`). Defaults to true.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub events: Option<bool>,
+    /// Server-local path to the session's events.jsonl file. Internal callers normally omit this and let the runtime derive it from the session.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub events_path: Option<String>,
+    /// Maximum number of previous process logs to include. Defaults to 5.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub previous_process_log_limit: Option<i64>,
+    /// Server-local process log directory to search when `currentProcessLogPath` is unavailable, useful for collecting logs for inactive sessions.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub process_log_directory: Option<String>,
+    /// Include process logs for the session. Defaults to true.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub process_logs: Option<bool>,
+    /// Include interactive shell logs written under the session's `shell-logs` directory. Defaults to true.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub shell_logs: Option<bool>,
 }
 
-/// Source-qualified extension identifier to enable for the session.
+/// Options for collecting a redacted session debug bundle.
 ///
 /// <div class="warning">
 ///
@@ -4154,14 +4165,20 @@ pub struct ExtensionsDisableRequest {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ExtensionsEnableRequest {
-    /// Source-qualified extension ID to enable
-    pub id: String,
+pub struct DebugCollectLogsRequest {
+    /// Caller-provided server-local files or directories to include in addition to the runtime's built-in session diagnostics. This lets host applications add their own diagnostics without changing the API shape.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub additional_entries: Option<Vec<DebugCollectLogsEntry>>,
+    /// Where the redacted bundle should be written. Use `archive` to produce a .tgz, or `directory` to stage redacted files for caller-managed upload/post-processing.
+    pub destination: DebugCollectLogsDestination,
+    /// Which built-in session diagnostics to include. Omitted fields default to true.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub include: Option<DebugCollectLogsInclude>,
 }
 
-/// Binary result returned by a tool for the model
+/// An optional debug bundle entry that could not be included.
 ///
 /// <div class="warning">
 ///
@@ -4171,22 +4188,17 @@ pub struct ExtensionsEnableRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ExternalToolTextResultForLlmBinaryResultsForLlm {
-    /// Base64-encoded binary data
-    pub data: String,
-    /// Human-readable description of the binary data
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    /// Optional metadata from the producing tool.
+pub struct DebugCollectLogsSkippedEntry {
+    /// Relative path requested for this bundle entry.
+    pub bundle_path: String,
+    /// Server-local source path that could not be read.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub metadata: Option<HashMap<String, serde_json::Value>>,
-    /// MIME type of the binary data
-    pub mime_type: String,
-    /// Binary result type discriminator. Use "image" for images and "resource" for other binary data.
-    pub r#type: ExternalToolTextResultForLlmBinaryResultsForLlmType,
+    pub path: Option<String>,
+    /// Reason the entry was skipped.
+    pub reason: String,
 }
 
-/// Expanded external tool result payload
+/// Result of collecting a redacted debug bundle.
 ///
 /// <div class="warning">
 ///
@@ -4196,33 +4208,19 @@ pub struct ExternalToolTextResultForLlmBinaryResultsForLlm {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ExternalToolTextResultForLlm {
-    /// Base64-encoded binary results returned to the model
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub binary_results_for_llm: Option<Vec<ExternalToolTextResultForLlmBinaryResultsForLlm>>,
-    /// Structured content blocks from the tool
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub contents: Option<Vec<serde_json::Value>>,
-    /// Optional error message for failed executions
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Execution outcome classification. Optional for back-compat; normalized to 'success' (or 'failure' when error is present) when missing or unrecognized.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub result_type: Option<String>,
-    /// Detailed log content for timeline display
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub session_log: Option<String>,
-    /// Text result returned to the model
-    pub text_result_for_llm: String,
-    /// Tool references returned by a tool-search override: names of deferred tools to surface to the model. When set, the tool result is materialized as `tool_reference` content blocks (rather than plain text) so the model knows which deferred tools are now available.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub tool_references: Option<Vec<String>>,
-    /// Optional tool-specific telemetry
+pub struct DebugCollectLogsResult {
+    /// Files included in the redacted bundle.
+    pub entries: Vec<DebugCollectLogsCollectedEntry>,
+    /// Destination kind that was written.
+    pub kind: DebugCollectLogsResultKind,
+    /// Actual archive path or staging directory path written. This may differ from the requested path when no-overwrite suffixing or fallback-to-temp-directory was needed.
+    pub path: String,
+    /// Optional files or directories that could not be included.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub tool_telemetry: Option<HashMap<String, serde_json::Value>>,
+    pub skipped_entries: Option<Vec<DebugCollectLogsSkippedEntry>>,
 }
 
-/// Audio content block with base64-encoded data
+/// Installed plugin that contributes a discovered extension.
 ///
 /// <div class="warning">
 ///
@@ -4232,16 +4230,12 @@ pub struct ExternalToolTextResultForLlm {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ExternalToolTextResultForLlmContentAudio {
-    /// Base64-encoded audio data
-    pub data: String,
-    /// MIME type of the audio (e.g., audio/wav, audio/mpeg)
-    pub mime_type: String,
-    /// Content block type discriminator
-    pub r#type: ExternalToolTextResultForLlmContentAudioType,
+pub struct DiscoveredExtensionPlugin {
+    /// Installed plugin name
+    pub name: String,
 }
 
-/// Image content block with base64-encoded data
+/// Discovered extension metadata and persistent enablement state.
 ///
 /// <div class="warning">
 ///
@@ -4251,16 +4245,23 @@ pub struct ExternalToolTextResultForLlmContentAudio {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ExternalToolTextResultForLlmContentImage {
-    /// Base64-encoded image data
-    pub data: String,
-    /// MIME type of the image (e.g., image/png, image/jpeg)
-    pub mime_type: String,
-    /// Content block type discriminator
-    pub r#type: ExternalToolTextResultForLlmContentImageType,
+pub struct DiscoveredExtension {
+    /// Whether this extension's persistent per-ID preference is enabled
+    pub enabled: bool,
+    /// Source-qualified ID accepted by both server and session extension enablement methods
+    pub id: String,
+    /// Human-readable extension name
+    pub name: String,
+    /// Absolute path to the extension entry module, suitable for revealing it in a file manager
+    pub path: String,
+    /// Containing plugin metadata for plugin-contributed extensions
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub plugin: Option<DiscoveredExtensionPlugin>,
+    /// Discovery source
+    pub source: DiscoveredExtensionSource,
 }
 
-/// Embedded resource content block with inline text or binary data
+/// Extensions discovered from persisted Copilot home state and their effective loading mode. Launch-scoped additional plugins are not included.
 ///
 /// <div class="warning">
 ///
@@ -4270,14 +4271,14 @@ pub struct ExternalToolTextResultForLlmContentImage {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ExternalToolTextResultForLlmContentResource {
-    /// The embedded resource contents, either text or base64-encoded binary
-    pub resource: serde_json::Value,
-    /// Content block type discriminator
-    pub r#type: ExternalToolTextResultForLlmContentResourceType,
+pub struct DiscoveredExtensions {
+    /// Discovered user and enabled installed-plugin extensions from persisted Copilot home state
+    pub extensions: Vec<DiscoveredExtension>,
+    /// Effective extension loading mode. Defaults to load_and_augment when unset.
+    pub mode: DiscoveredExtensionMode,
 }
 
-/// Icon image for a resource
+/// Source-qualified extension identifiers to persistently disable for future sessions.
 ///
 /// <div class="warning">
 ///
@@ -4287,21 +4288,12 @@ pub struct ExternalToolTextResultForLlmContentResource {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ExternalToolTextResultForLlmContentResourceLinkIcon {
-    /// MIME type of the icon image
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mime_type: Option<String>,
-    /// Available icon sizes (e.g., ['16x16', '32x32'])
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub sizes: Option<Vec<String>>,
-    /// URL or path to the icon image
-    pub src: String,
-    /// Theme variant this icon is intended for
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub theme: Option<ExternalToolTextResultForLlmContentResourceLinkIconTheme>,
+pub struct DiscoveredExtensionsDisableRequest {
+    /// Source-qualified user or plugin extension IDs to disable
+    pub ids: Vec<String>,
 }
 
-/// Resource link content block referencing an external resource
+/// Source-qualified extension identifiers to persistently enable for future sessions.
 ///
 /// <div class="warning">
 ///
@@ -4311,31 +4303,12 @@ pub struct ExternalToolTextResultForLlmContentResourceLinkIcon {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ExternalToolTextResultForLlmContentResourceLink {
-    /// Human-readable description of the resource
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    /// Icons associated with this resource
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub icons: Option<Vec<ExternalToolTextResultForLlmContentResourceLinkIcon>>,
-    /// MIME type of the resource content
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mime_type: Option<String>,
-    /// Resource name identifier
-    pub name: String,
-    /// Size of the resource in bytes
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub size: Option<i64>,
-    /// Human-readable display title for the resource
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub title: Option<String>,
-    /// Content block type discriminator
-    pub r#type: ExternalToolTextResultForLlmContentResourceLinkType,
-    /// URI identifying the resource
-    pub uri: String,
+pub struct DiscoveredExtensionsEnableRequest {
+    /// Source-qualified user or plugin extension IDs to enable
+    pub ids: Vec<String>,
 }
 
-/// Shell command exit metadata with optional output preview
+/// MCP server discovered by `mcp.discover`, with config source, optional plugin source, transport type, and enabled state.
 ///
 /// <div class="warning">
 ///
@@ -4345,25 +4318,25 @@ pub struct ExternalToolTextResultForLlmContentResourceLink {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ExternalToolTextResultForLlmContentShellExit {
-    /// Working directory where the shell command was executed
+pub struct DiscoveredMcpServer {
+    /// Whether the server is enabled (not in the disabled list)
+    pub enabled: bool,
+    /// Server name (config key)
+    pub name: String,
+    /// Configuration source: user, workspace, plugin, or builtin
+    pub source: McpServerSource,
+    /// Plugin name that provided this server, when source is plugin.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub cwd: Option<String>,
-    /// Exit code from the completed shell command
-    pub exit_code: i64,
-    /// Output associated with this shell command, if available. May be partial, truncated, or a preview; not guaranteed to be full output.
+    pub source_plugin: Option<String>,
+    /// Plugin version that provided this server, when source is plugin.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub output_preview: Option<String>,
-    /// Whether outputPreview is known to be incomplete or truncated
+    pub source_plugin_version: Option<String>,
+    /// Server transport type: stdio, http, sse (deprecated), or memory
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub output_truncated: Option<bool>,
-    /// Shell id, as assigned by Copilot runtime
-    pub shell_id: String,
-    /// Content block type discriminator
-    pub r#type: ExternalToolTextResultForLlmContentShellExitType,
+    pub r#type: Option<DiscoveredMcpServerType>,
 }
 
-/// Terminal/shell output content block with optional exit code and working directory
+/// Slash-prefixed command string to enqueue for FIFO processing.
 ///
 /// <div class="warning">
 ///
@@ -4373,20 +4346,12 @@ pub struct ExternalToolTextResultForLlmContentShellExit {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ExternalToolTextResultForLlmContentTerminal {
-    /// Working directory where the command was executed
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cwd: Option<String>,
-    /// Process exit code, if the command has completed
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub exit_code: Option<i64>,
-    /// Terminal/shell output text
-    pub text: String,
-    /// Content block type discriminator
-    pub r#type: ExternalToolTextResultForLlmContentTerminalType,
+pub struct EnqueueCommandParams {
+    /// Slash-prefixed command string to enqueue, e.g. '/compact' or '/model gpt-4'. Queued FIFO with any in-flight items; if the session is idle, processing kicks off immediately.
+    pub command: String,
 }
 
-/// Plain text content block
+/// Indicates whether the command was accepted into the local execution queue.
 ///
 /// <div class="warning">
 ///
@@ -4396,14 +4361,12 @@ pub struct ExternalToolTextResultForLlmContentTerminal {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ExternalToolTextResultForLlmContentText {
-    /// The text content
-    pub text: String,
-    /// Content block type discriminator
-    pub r#type: ExternalToolTextResultForLlmContentTextType,
+pub struct EnqueueCommandResult {
+    /// True when the command was accepted into the local execution queue. False when the call targets a session that does not support local command queueing (e.g. remote sessions).
+    pub queued: bool,
 }
 
-/// Parameters for cooperatively aborting a factory body.
+/// Cursor, batch size, and optional long-poll/filter parameters for reading session events.
 ///
 /// <div class="warning">
 ///
@@ -4413,14 +4376,34 @@ pub struct ExternalToolTextResultForLlmContentText {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryAbortRequest {
-    /// Target session identifier
-    pub session_id: SessionId,
-    /// Factory run identifier.
-    pub run_id: String,
+pub struct EventLogReadRequest {
+    /// Optional non-empty list of subagent identifiers. When provided, only events owned by one of these agents are returned; ownership recognizes the event envelope's agentId plus legacy data.agentId and data.parentToolCallId markers. This filter takes precedence over agentScope.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub agent_ids: Option<Vec<String>>,
+    /// Agent-scope filter: 'primary' returns only main-agent events plus events whose type starts with 'subagent.' (matching the typed-subscription default behavior); 'all' returns events from all agents (matching wildcard-subscription behavior). Default is 'all' to preserve wildcard semantics for catch-up callers.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub agent_scope: Option<EventsAgentScope>,
+    /// Opaque cursor returned by a previous read. Omit on the first call to start from the beginning of the session's persisted history.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cursor: Option<String>,
+    /// Direction to page through the session's persisted event history. 'forward' (default) pages from the cursor toward newer events (or from the start of history when no cursor is given). 'backward' enables tail-first reads: with no cursor it returns the NEWEST `max` events, and the returned cursor pages toward OLDER events on subsequent backward reads. Events within a returned batch are always in chronological (oldest-to-newest) order, even for a backward read. Backward reads cover PERSISTED history only; ephemeral events are never returned by a backward read. `direction` selects the INITIAL read only: the returned cursor is self-describing, so a continuation read pages in the cursor's own direction regardless of the `direction` passed alongside it — a forward cursor always pages forward and a backward cursor always pages backward. Pass the direction that matches the cursor to avoid confusion.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub direction: Option<EventsReadDirection>,
+    /// When false, skip ephemeral events entirely and return only durable (persisted) events. History-backfill callers that discard ephemerals anyway should set this so the read is bounded by the durable log length instead of racing the ephemeral ring on a busy session. Defaults to true (ephemerals are interleaved with durable events in creation order). Ignored by backward reads, which always cover persisted history only.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub include_ephemeral: Option<bool>,
+    /// Maximum number of events to return in this batch (1–1000, default 200).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max: Option<i64>,
+    /// Either '*' to receive all event types, or a non-empty list of event types to receive
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub types: Option<serde_json::Value>,
+    /// Milliseconds to wait for new events when the cursor is at the tail of history. 0 (default) returns immediately even if no events are available. Capped at 30000ms. Ephemeral events that arrive during the wait are delivered in this batch but are NOT replayable on a subsequent read (use a non-zero waitMs in your next call to capture future ephemerals as they happen). This applies to forward reads only: a backward read always returns immediately and ignores `waitMs`, because backward paging covers persisted history only while new events append at the tail (the opposite end from a backward page), so no blocking or ephemeral delivery can occur.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub wait_ms: Option<i32>,
 }
 
-/// Acknowledgement that a factory request was accepted.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -4430,9 +4413,12 @@ pub struct FactoryAbortRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryAckResult {}
+pub struct EventLogReleaseInterestResult {
+    /// Whether the operation succeeded
+    pub success: bool,
+}
 
-/// Options for one factory-scoped subagent call.
+/// Snapshot of the current tail cursor without returning any events. Use this when a consumer wants to subscribe to live events going forward without first paginating through the entire persisted history (which would happen if `read` were called without a cursor on a long-lived session).
 ///
 /// <div class="warning">
 ///
@@ -4442,28 +4428,12 @@ pub struct FactoryAckResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryAgentOptions {
-    /// Optional custom agent name for the subagent. This field is accepted but not yet honored.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub agent: Option<String>,
-    /// Optional context tier for the subagent. This field is accepted but not yet honored.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub context_tier: Option<ContextTier>,
-    /// Optional label distinguishing otherwise identical memoized agent calls.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub label: Option<String>,
-    /// Optional model identifier for the subagent.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub model: Option<String>,
-    /// Optional reasoning effort for the subagent. This field is accepted but not yet honored.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub reasoning_effort: Option<String>,
-    /// Optional JSON Schema for structured agent output.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub schema: Option<serde_json::Value>,
+pub struct EventLogTailResult {
+    /// Opaque cursor pointing at the current tail of the session's persisted-events history. Pass back to `read` to receive only events that arrive AFTER this snapshot. When the session has no events, this returns the same sentinel as an unset cursor (i.e. equivalent to omitting the cursor on a first read).
+    pub cursor: String,
 }
 
-/// Parameters for one factory-scoped subagent call.
+/// Batch of session events returned by a read, with cursor and continuation metadata.
 ///
 /// <div class="warning">
 ///
@@ -4473,18 +4443,18 @@ pub struct FactoryAgentOptions {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryAgentRequest {
-    /// Opaque token identifying the current factory execution attempt.
-    pub execution_token: String,
-    /// Factory run identifier that owns the subagent.
-    pub factory_run_id: String,
-    /// Subagent execution options.
-    pub opts: FactoryAgentOptions,
-    /// Prompt to send to the subagent.
-    pub prompt: String,
+pub struct EventsReadResult {
+    /// Opaque cursor for the next read. Pass back unchanged in the next read.cursor to continue from where this read left off. Always present, even when no events were returned. For a backward read this cursor pages toward OLDER events; keep passing `direction: backward` with it (the cursor is also self-describing, so backward paging continues correctly).
+    pub cursor: String,
+    /// Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history. For a forward read the fallback starts from the beginning of the remaining history; for a backward read it falls back to the tail (the newest window). Because the fallback page is a fresh boundary snapshot rather than a continuation of the requested cursor, it may overlap events the consumer has already rendered — a backward fallback to the tail in particular can repeat the newest window. On 'expired', consumers should reset or rebase their local pagination state (or deduplicate by event id) before continuing from the returned cursor rather than blindly appending/prepending the fallback page.
+    pub cursor_status: EventsCursorStatus,
+    /// Session events for this batch, merged into a single stream in creation order: durable (persisted) events and ephemeral events interleave exactly as they were emitted. Set `includeEphemeral: false` to receive only durable events. Ephemeral events are never replayable once pruned from the in-memory ring, so a consumer that needs them should keep reading with a non-zero `waitMs`. For a backward (tail-first) read, the returned window contains persisted events only, still in chronological (oldest-to-newest) append order.
+    pub events: Vec<SessionEvent>,
+    /// True when more events are available in the read's direction. For a forward read, true means the batch returned `max` events and more are available immediately. For a backward read, true means older persisted events remain before the returned window.
+    pub has_more: bool,
 }
 
-/// Result of one factory-scoped subagent call.
+/// Slash command name and argument string to execute synchronously.
 ///
 /// <div class="warning">
 ///
@@ -4494,13 +4464,14 @@ pub struct FactoryAgentRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryAgentResult {
-    /// Agent result, omitted when the agent produced no result.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub result: Option<serde_json::Value>,
+pub struct ExecuteCommandParams {
+    /// Argument string to pass to the command (empty string if none).
+    pub args: String,
+    /// Name of the slash command to invoke (without the leading '/').
+    pub command_name: String,
 }
 
-/// Prompt-safe durable identity and live status for a direct factory agent.
+/// Error message produced while executing the command, if any.
 ///
 /// <div class="warning">
 ///
@@ -4510,44 +4481,13 @@ pub struct FactoryAgentResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryAgentSummary {
-    /// Accumulated active agent time in milliseconds.
-    pub active_ms: i64,
-    /// Prompt-safe live activity text.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub activity: Option<String>,
-    /// Stable direct-agent identifier.
-    pub agent_id: String,
-    /// Registered agent type.
-    pub agent_type: String,
-    /// Epoch milliseconds when the agent completed.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub completed_at: Option<i64>,
-    /// Friendly, non-unique name intended for display
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub display_name: Option<String>,
-    /// Friendly, non-unique name intended for display
-    pub label: String,
-    /// Phase identifier active when the agent was launched, or null.
-    pub phase_id: Option<String>,
-    /// Model requested when the agent was launched.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub requested_model: Option<String>,
-    /// Concrete model resolved for the agent.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub resolved_model: Option<String>,
-    /// Owning factory run identifier.
-    pub run_id: String,
-    /// Epoch milliseconds when the agent started.
+pub struct ExecuteCommandResult {
+    /// Error message produced while executing the command, if any. Omitted when the handler succeeded.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub started_at: Option<i64>,
-    /// Current durable or live agent status.
-    pub status: String,
-    /// Tool-call identifier that launched the agent.
-    pub tool_call_id: String,
+    pub error: Option<String>,
 }
 
-/// Parameters for cancelling a factory run.
+/// Discovered extension metadata, including source-qualified ID, name, discovery source, status, and optional process ID.
 ///
 /// <div class="warning">
 ///
@@ -4557,12 +4497,21 @@ pub struct FactoryAgentSummary {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryCancelRequest {
-    /// Factory run identifier.
-    pub run_id: String,
+pub struct Extension {
+    /// Source-qualified ID (e.g., 'project:my-ext', 'user:auth-helper', 'plugin:my-plugin:my-ext')
+    pub id: String,
+    /// Extension name (directory name)
+    pub name: String,
+    /// Process ID if the extension is running
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub pid: Option<i64>,
+    /// Discovery source: project (.github/extensions/), user (~/.copilot/extensions/), plugin (installed plugin), or session (session-state/<id>/extensions/)
+    pub source: ExtensionSource,
+    /// Current status: running, disabled, failed, or starting
+    pub status: ExtensionStatus,
 }
 
-/// Current factory phase identity.
+/// Slim input shape for extension_context attachments; identity fields are runtime-derived.
 ///
 /// <div class="warning">
 ///
@@ -4572,14 +4521,16 @@ pub struct FactoryCancelRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryCurrentPhase {
-    /// Current phase identifier.
-    pub id: String,
-    /// Zero-based declared phase ordinal, or null for an undeclared phase.
-    pub ordinal: Option<i64>,
+pub struct ExtensionContextPushInput {
+    /// Caller-supplied JSON payload (required, may be null but not undefined)
+    pub payload: serde_json::Value,
+    /// Human-readable composer pill label
+    pub title: String,
+    /// Attachment type discriminator
+    pub r#type: ExtensionContextPushInputType,
 }
 
-/// Declared or approved factory resource ceilings.
+/// Opaque integrator-owned process launch profile for one extension entrypoint.
 ///
 /// <div class="warning">
 ///
@@ -4589,22 +4540,16 @@ pub struct FactoryCurrentPhase {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryDeclaredLimits {
-    /// Maximum AI credits consumed by subagents and descendants.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_ai_credits: Option<f64>,
-    /// Maximum concurrently active subagents.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_concurrent_subagents: Option<i64>,
-    /// Maximum total subagents spawned by the run.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_total_subagents: Option<i64>,
-    /// Maximum accumulated active execution time in seconds.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub timeout_seconds: Option<f64>,
+pub struct ExtensionLaunchProfile {
+    /// Opaque integrator-defined arguments passed to the executable. The runtime does not append the extension entrypoint.
+    pub args: Vec<String>,
+    /// Opaque integrator-defined environment variables. Runtime-owned COPILOT_SDK_PATH, SESSION_ID, and COPILOT_EXTENSION_PARENT_PID values take precedence.
+    pub env: HashMap<String, String>,
+    /// Executable used to launch the extension entrypoint.
+    pub executable: String,
 }
 
-/// Parameters sent to the owning extension to execute a factory closure.
+/// A discovered extension entrypoint that the registered integrator may classify and resolve to an opaque launch profile.
 ///
 /// <div class="warning">
 ///
@@ -4614,20 +4559,18 @@ pub struct FactoryDeclaredLimits {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryExecuteRequest {
-    /// Target session identifier
-    pub session_id: SessionId,
-    /// Registered factory name.
+pub struct ExtensionLaunchProviderResolveRequest {
+    /// Source-qualified extension identifier.
+    pub id: String,
+    /// Absolute path to the discovered extension entrypoint.
+    pub module_path: String,
+    /// Human-readable extension name.
     pub name: String,
-    /// Factory run identifier.
-    pub run_id: String,
-    /// Opaque token identifying this factory execution attempt.
-    pub execution_token: String,
-    /// Factory input value.
-    pub args: serde_json::Value,
+    /// Discovery source for the extension entrypoint.
+    pub source: ExtensionSource,
 }
 
-/// Result returned by an extension factory closure.
+/// The launch profile for a supported entrypoint. Omit launch when the provider does not support the entrypoint.
 ///
 /// <div class="warning">
 ///
@@ -4637,13 +4580,13 @@ pub struct FactoryExecuteRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryExecuteResult {
-    /// Factory result value.
+pub struct ExtensionLaunchProviderResolveResult {
+    /// Opaque launch profile, omitted when this provider does not support the entrypoint.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub result: Option<serde_json::Value>,
+    pub launch: Option<ExtensionLaunchProfile>,
 }
 
-/// Parameters for paging factory progress.
+/// Extensions discovered for the session, with their current status.
 ///
 /// <div class="warning">
 ///
@@ -4653,24 +4596,12 @@ pub struct FactoryExecuteResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryGetRunProgressRequest {
-    /// Exclusive forward cursor.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub after_seq: Option<i64>,
-    /// Exclusive backward cursor.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub before_seq: Option<i64>,
-    /// Maximum records to return. Defaults to 200 and is capped at 500.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub limit: Option<i32>,
-    /// Optional phase identifier used to scope records and cursors.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub phase_id: Option<String>,
-    /// Factory run identifier.
-    pub run_id: String,
+pub struct ExtensionList {
+    /// Discovered extensions and their current status
+    pub extensions: Vec<Extension>,
 }
 
-/// Parameters for retrieving a factory run.
+/// Source-qualified extension identifier to disable for the session.
 ///
 /// <div class="warning">
 ///
@@ -4680,12 +4611,12 @@ pub struct FactoryGetRunProgressRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryGetRunRequest {
-    /// Factory run identifier.
-    pub run_id: String,
+pub struct ExtensionsDisableRequest {
+    /// Source-qualified extension ID to disable
+    pub id: String,
 }
 
-/// Parameters for reading a factory journal entry.
+/// Source-qualified extension identifier to enable for the session.
 ///
 /// <div class="warning">
 ///
@@ -4695,16 +4626,12 @@ pub struct FactoryGetRunRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryJournalGetRequest {
-    /// Opaque token identifying the current factory execution attempt.
-    pub execution_token: String,
-    /// Namespaced journal key.
-    pub key: String,
-    /// Factory run identifier.
-    pub run_id: String,
+pub struct ExtensionsEnableRequest {
+    /// Source-qualified extension ID to enable
+    pub id: String,
 }
 
-/// Result of reading a factory journal entry.
+/// Binary result returned by a tool for the model
 ///
 /// <div class="warning">
 ///
@@ -4714,36 +4641,22 @@ pub struct FactoryJournalGetRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryJournalGetResult {
-    /// Whether the journal contained the requested key.
-    pub hit: bool,
-    /// Cached JSON result. The hit field distinguishes a cached JSON null from a miss.
+pub struct ExternalToolTextResultForLlmBinaryResultsForLlm {
+    /// Base64-encoded binary data
+    pub data: String,
+    /// Human-readable description of the binary data
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub result_json: Option<serde_json::Value>,
-}
-
-/// Parameters for storing a factory journal entry.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct FactoryJournalPutRequest {
-    /// Opaque token identifying the current factory execution attempt.
-    pub execution_token: String,
-    /// Namespaced journal key.
-    pub key: String,
-    /// JSON result to memoize.
-    pub result_json: serde_json::Value,
-    /// Factory run identifier.
-    pub run_id: String,
+    pub description: Option<String>,
+    /// Optional metadata from the producing tool.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub metadata: Option<HashMap<String, serde_json::Value>>,
+    /// MIME type of the binary data
+    pub mime_type: String,
+    /// Binary result type discriminator. Use "image" for images and "resource" for other binary data.
+    pub r#type: ExternalToolTextResultForLlmBinaryResultsForLlmType,
 }
 
-/// Parameters for paging factory runs.
+/// Expanded external tool result payload
 ///
 /// <div class="warning">
 ///
@@ -4753,19 +4666,33 @@ pub struct FactoryJournalPutRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryListRunsRequest {
-    /// Exclusive forward cursor.
+pub struct ExternalToolTextResultForLlm {
+    /// Base64-encoded binary results returned to the model
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub after_seq: Option<i64>,
-    /// Exclusive backward cursor.
+    pub binary_results_for_llm: Option<Vec<ExternalToolTextResultForLlmBinaryResultsForLlm>>,
+    /// Structured content blocks from the tool
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub before_seq: Option<i64>,
-    /// Maximum terminal runs to return. Defaults to 200 and is capped at 500.
+    pub contents: Option<Vec<serde_json::Value>>,
+    /// Optional error message for failed executions
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub limit: Option<i32>,
+    pub error: Option<String>,
+    /// Execution outcome classification. Optional for back-compat; normalized to 'success' (or 'failure' when error is present) when missing or unrecognized.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub result_type: Option<String>,
+    /// Detailed log content for timeline display
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub session_log: Option<String>,
+    /// Text result returned to the model
+    pub text_result_for_llm: String,
+    /// Tool references returned by a tool-search override: names of deferred tools to surface to the model. When set, the tool result is materialized as `tool_reference` content blocks (rather than plain text) so the model knows which deferred tools are now available.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tool_references: Option<Vec<String>>,
+    /// Optional tool-specific telemetry
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tool_telemetry: Option<HashMap<String, serde_json::Value>>,
 }
 
-/// Durable factory resource consumption.
+/// Audio content block with base64-encoded data
 ///
 /// <div class="warning">
 ///
@@ -4775,16 +4702,16 @@ pub struct FactoryListRunsRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryRunConsumed {
-    /// Accumulated active execution time in milliseconds.
-    pub active_ms: i64,
-    /// AI usage consumed by the run in nano-AIU.
-    pub nano_aiu: i64,
-    /// Total subagents spawned by the run.
-    pub subagents: i64,
+pub struct ExternalToolTextResultForLlmContentAudio {
+    /// Base64-encoded audio data
+    pub data: String,
+    /// MIME type of the audio (e.g., audio/wav, audio/mpeg)
+    pub mime_type: String,
+    /// Content block type discriminator
+    pub r#type: ExternalToolTextResultForLlmContentAudioType,
 }
 
-/// Prompt-safe terminal factory outcome.
+/// Image content block with base64-encoded data
 ///
 /// <div class="warning">
 ///
@@ -4794,22 +4721,16 @@ pub struct FactoryRunConsumed {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryRunTerminal {
-    /// Human-readable terminal error.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Machine-readable terminal failure.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub failure: Option<serde_json::Value>,
-    /// Human-readable terminal reason.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub reason: Option<String>,
-    /// Prompt-safe preview of the completed result.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub result_preview: Option<String>,
+pub struct ExternalToolTextResultForLlmContentImage {
+    /// Base64-encoded image data
+    pub data: String,
+    /// MIME type of the image (e.g., image/png, image/jpeg)
+    pub mime_type: String,
+    /// Content block type discriminator
+    pub r#type: ExternalToolTextResultForLlmContentImageType,
 }
 
-/// Durable factory run summary with read-time live overlays.
+/// Embedded resource content block with inline text or binary data
 ///
 /// <div class="warning">
 ///
@@ -4819,48 +4740,14 @@ pub struct FactoryRunTerminal {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryRunSummary {
-    /// Epoch milliseconds when the current active segment started, or null while inactive.
-    pub active_segment_started_at: Option<i64>,
-    /// Approved effective resource ceilings, or null until approved.
-    pub approved: Option<FactoryDeclaredLimits>,
-    /// Epoch milliseconds when the run completed, or null while nonterminal.
-    pub completed_at: Option<i64>,
-    /// Durable resource consumption.
-    pub consumed: FactoryRunConsumed,
-    /// Epoch milliseconds when the run was created.
-    pub created_at: i64,
-    /// Current phase identity, or null before any phase is entered.
-    pub current_phase: Option<FactoryCurrentPhase>,
-    /// Resource ceilings declared by the factory.
-    pub declared_limits: FactoryDeclaredLimits,
-    /// Number of phases declared by the factory.
-    pub declared_phase_count: i64,
-    /// Human-readable factory description.
-    pub description: String,
-    /// Registered factory name.
-    pub factory_name: String,
-    /// Number of direct factory agents currently live.
-    pub live_agent_count: i64,
-    /// Epoch milliseconds when this live-overlay snapshot was observed.
-    pub observed_at: i64,
-    /// Monotonic durable run revision.
-    pub revision: i64,
-    /// Factory run identifier.
-    pub run_id: String,
-    /// Epoch milliseconds when execution first started, or null before start.
-    pub started_at: Option<i64>,
-    /// Current factory run status.
-    pub status: FactoryRunStatus,
-    /// Terminal run outcome, or null while nonterminal.
-    pub terminal: Option<FactoryRunTerminal>,
-    /// Total direct factory agents spawned across all attempts.
-    pub total_spawned_agent_count: i64,
-    /// Epoch milliseconds when the durable run was last updated.
-    pub updated_at: i64,
+pub struct ExternalToolTextResultForLlmContentResource {
+    /// The embedded resource contents, either text or base64-encoded binary
+    pub resource: serde_json::Value,
+    /// Content block type discriminator
+    pub r#type: ExternalToolTextResultForLlmContentResourceType,
 }
 
-/// A page of factory runs in durable creation order.
+/// Icon image for a resource
 ///
 /// <div class="warning">
 ///
@@ -4870,24 +4757,21 @@ pub struct FactoryRunSummary {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryListRunsResult {
-    /// Whether terminal runs newer than this page exist.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub has_more_newer: Option<bool>,
-    /// Newest terminal-run cursor in this page, or null when the terminal window is empty.
+pub struct ExternalToolTextResultForLlmContentResourceLinkIcon {
+    /// MIME type of the icon image
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub newest_seq: Option<i64>,
-    /// Oldest terminal-run cursor in this page, or null when the terminal window is empty.
+    pub mime_type: Option<String>,
+    /// Available icon sizes (e.g., ['16x16', '32x32'])
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub oldest_seq: Option<i64>,
-    /// Number of terminal runs older than this page.
+    pub sizes: Option<Vec<String>>,
+    /// URL or path to the icon image
+    pub src: String,
+    /// Theme variant this icon is intended for
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub omitted_older: Option<i64>,
-    /// Factory run summaries in durable creation order.
-    pub runs: Vec<FactoryRunSummary>,
+    pub theme: Option<ExternalToolTextResultForLlmContentResourceLinkIconTheme>,
 }
 
-/// One ordered factory progress line.
+/// Resource link content block referencing an external resource
 ///
 /// <div class="warning">
 ///
@@ -4897,16 +4781,31 @@ pub struct FactoryListRunsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryLogLine {
-    /// Progress line kind.
-    pub kind: FactoryLogLineKind,
-    /// Monotonic sequence number within the factory run.
-    pub seq: i64,
-    /// Progress text.
-    pub text: String,
+pub struct ExternalToolTextResultForLlmContentResourceLink {
+    /// Human-readable description of the resource
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// Icons associated with this resource
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub icons: Option<Vec<ExternalToolTextResultForLlmContentResourceLinkIcon>>,
+    /// MIME type of the resource content
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mime_type: Option<String>,
+    /// Resource name identifier
+    pub name: String,
+    /// Size of the resource in bytes
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub size: Option<i64>,
+    /// Human-readable display title for the resource
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub title: Option<String>,
+    /// Content block type discriminator
+    pub r#type: ExternalToolTextResultForLlmContentResourceLinkType,
+    /// URI identifying the resource
+    pub uri: String,
 }
 
-/// Parameters for recording factory progress.
+/// Shell command exit metadata with optional output preview
 ///
 /// <div class="warning">
 ///
@@ -4916,16 +4815,25 @@ pub struct FactoryLogLine {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryLogRequest {
-    /// Opaque token identifying the current factory execution attempt.
-    pub execution_token: String,
-    /// Ordered progress lines to append.
-    pub lines: Vec<FactoryLogLine>,
-    /// Factory run identifier.
-    pub run_id: String,
+pub struct ExternalToolTextResultForLlmContentShellExit {
+    /// Working directory where the shell command was executed
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cwd: Option<String>,
+    /// Exit code from the completed shell command
+    pub exit_code: i64,
+    /// Output associated with this shell command, if available. May be partial, truncated, or a preview; not guaranteed to be full output.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output_preview: Option<String>,
+    /// Whether outputPreview is known to be incomplete or truncated
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output_truncated: Option<bool>,
+    /// Shell id, as assigned by Copilot runtime
+    pub shell_id: String,
+    /// Content block type discriminator
+    pub r#type: ExternalToolTextResultForLlmContentShellExitType,
 }
 
-/// Durable lifecycle and timing for one factory phase.
+/// Terminal/shell output content block with optional exit code and working directory
 ///
 /// <div class="warning">
 ///
@@ -4935,39 +4843,20 @@ pub struct FactoryLogRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryPhaseObservation {
-    /// Completed active time accumulated by this phase in milliseconds.
-    pub accumulated_active_ms: i64,
-    /// Epoch milliseconds when this phase completed; for a skipped phase, the synthetic skip timestamp (equal to `startedAt`).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub completed_at: Option<i64>,
-    /// Current live active time for this phase in milliseconds.
-    pub current_active_ms: i64,
-    /// Optional human-readable phase detail.
+pub struct ExternalToolTextResultForLlmContentTerminal {
+    /// Working directory where the command was executed
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub detail: Option<String>,
-    /// Number of times execution entered this phase.
-    pub entry_count: i64,
-    /// Phase identifier.
-    pub id: String,
-    /// Most recent run attempt that entered this phase, or `0` if the phase has never been entered.
-    pub last_entered_run_attempt: i64,
-    /// Direct agents in this phase that are currently live.
-    pub live_agent_count: i64,
-    /// Zero-based declared phase ordinal, or null for an undeclared phase.
-    pub ordinal: Option<i64>,
-    /// Epoch milliseconds when this phase first started; for a skipped phase, the synthetic skip timestamp (equal to `completedAt`).
+    pub cwd: Option<String>,
+    /// Process exit code, if the command has completed
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub started_at: Option<i64>,
-    /// Derived lifecycle state of the phase.
-    pub status: FactoryPhaseStatus,
-    /// Human-readable phase title.
-    pub title: String,
-    /// Total direct agents associated with this phase.
-    pub total_agent_count: i64,
+    pub exit_code: Option<i64>,
+    /// Terminal/shell output text
+    pub text: String,
+    /// Content block type discriminator
+    pub r#type: ExternalToolTextResultForLlmContentTerminalType,
 }
 
-/// One durable factory progress record.
+/// Plain text content block
 ///
 /// <div class="warning">
 ///
@@ -4977,22 +4866,14 @@ pub struct FactoryPhaseObservation {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryProgressLine {
-    /// Resume attempt that emitted this record.
-    pub attempt: i64,
-    /// Progress record kind.
-    pub kind: FactoryLogLineKind,
-    /// Phase active when the record was emitted, or null before any phase.
-    pub phase_id: Option<String>,
-    /// Epoch milliseconds when the record was persisted.
-    pub recorded_at: i64,
-    /// Global monotonic sequence number within the run.
-    pub seq: i64,
-    /// Prompt-safe progress text.
+pub struct ExternalToolTextResultForLlmContentText {
+    /// The text content
     pub text: String,
+    /// Content block type discriminator
+    pub r#type: ExternalToolTextResultForLlmContentTextType,
 }
 
-/// A bidirectional page of factory progress.
+/// Parameters for cooperatively aborting a factory body.
 ///
 /// <div class="warning">
 ///
@@ -5002,22 +4883,14 @@ pub struct FactoryProgressLine {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryProgressPage {
-    /// Whether progress records newer than this page exist.
-    pub has_more_newer: bool,
-    /// Whether progress records older than this page exist.
-    pub has_more_older: bool,
-    /// Newest sequence number in this page, or null when empty.
-    pub newest_seq: Option<i64>,
-    /// Oldest sequence number in this page, or null when empty.
-    pub oldest_seq: Option<i64>,
-    /// Progress records in sequence order.
-    pub records: Vec<FactoryProgressLine>,
-    /// Run revision reflected by this page.
-    pub revision: i64,
+pub struct FactoryAbortRequest {
+    /// Target session identifier
+    pub session_id: SessionId,
+    /// Factory run identifier.
+    pub run_id: String,
 }
 
-/// Wire-only per-invocation factory resource ceiling overrides.
+/// Acknowledgement that a factory request was accepted.
 ///
 /// <div class="warning">
 ///
@@ -5027,22 +4900,40 @@ pub struct FactoryProgressPage {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryRunLimits {
-    /// Maximum AI credits consumed by factory subagents and their descendants. The post-paid ceiling is soft: parallel turns can settle beyond it before the run stops.
+pub struct FactoryAckResult {}
+
+/// Options for one factory-scoped subagent call.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct FactoryAgentOptions {
+    /// Optional custom agent name for the subagent. This field is accepted but not yet honored.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_ai_credits: Option<f64>,
-    /// Maximum number of factory subagents that may run concurrently.
+    pub agent: Option<String>,
+    /// Optional context tier for the subagent. This field is accepted but not yet honored.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_concurrent_subagents: Option<i64>,
-    /// Maximum total number of factory subagents that may be admitted.
+    pub context_tier: Option<ContextTier>,
+    /// Optional label distinguishing otherwise identical memoized agent calls.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_total_subagents: Option<i64>,
-    /// Maximum accumulated active-execution time in seconds. Active execution includes the entire extension body, subprocess waits, queued-agent waits, and sleeps; time between resumed attempts is not counted.
+    pub label: Option<String>,
+    /// Optional model identifier for the subagent.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub timeout_seconds: Option<f64>,
+    pub model: Option<String>,
+    /// Optional reasoning effort for the subagent. This field is accepted but not yet honored.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reasoning_effort: Option<String>,
+    /// Optional JSON Schema for structured agent output.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub schema: Option<serde_json::Value>,
 }
 
-/// Parameters for resuming a factory run from its persisted identity.
+/// Parameters for one factory-scoped subagent call.
 ///
 /// <div class="warning">
 ///
@@ -5052,15 +4943,34 @@ pub struct FactoryRunLimits {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryResumeRequest {
-    /// Optional per-invocation resource ceiling overrides.
+pub struct FactoryAgentRequest {
+    /// Opaque token identifying the current factory execution attempt.
+    pub execution_token: String,
+    /// Factory run identifier that owns the subagent.
+    pub factory_run_id: String,
+    /// Subagent execution options.
+    pub opts: FactoryAgentOptions,
+    /// Prompt to send to the subagent.
+    pub prompt: String,
+}
+
+/// Result of one factory-scoped subagent call.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct FactoryAgentResult {
+    /// Agent result, omitted when the agent produced no result.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub limits: Option<FactoryRunLimits>,
-    /// Factory run identifier.
-    pub run_id: String,
+    pub result: Option<serde_json::Value>,
 }
 
-/// Complete current or terminal factory run envelope.
+/// Prompt-safe durable identity and live status for a direct factory agent.
 ///
 /// <div class="warning">
 ///
@@ -5070,29 +4980,44 @@ pub struct FactoryResumeRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryRunResult {
-    /// Error message for an errored run.
+pub struct FactoryAgentSummary {
+    /// Accumulated active agent time in milliseconds.
+    pub active_ms: i64,
+    /// Prompt-safe live activity text.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Machine-readable failure details for an errored run.
+    pub activity: Option<String>,
+    /// Stable direct-agent identifier.
+    pub agent_id: String,
+    /// Registered agent type.
+    pub agent_type: String,
+    /// Epoch milliseconds when the agent completed.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub failure: Option<serde_json::Value>,
-    /// Reason for a halted or cancelled run.
+    pub completed_at: Option<i64>,
+    /// Friendly, non-unique name intended for display
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub reason: Option<String>,
-    /// Completed factory result.
+    pub display_name: Option<String>,
+    /// Friendly, non-unique name intended for display
+    pub label: String,
+    /// Phase identifier active when the agent was launched, or null.
+    pub phase_id: Option<String>,
+    /// Model requested when the agent was launched.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub result: Option<serde_json::Value>,
-    /// Factory run identifier.
+    pub requested_model: Option<String>,
+    /// Concrete model resolved for the agent.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub resolved_model: Option<String>,
+    /// Owning factory run identifier.
     pub run_id: String,
-    /// Partial journal and progress snapshot for a halted, cancelled, or errored run.
+    /// Epoch milliseconds when the agent started.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub snapshot: Option<serde_json::Value>,
-    /// Current or terminal factory run status.
-    pub status: FactoryRunStatus,
+    pub started_at: Option<i64>,
+    /// Current durable or live agent status.
+    pub status: String,
+    /// Tool-call identifier that launched the agent.
+    pub tool_call_id: String,
 }
 
-/// Resolved persisted factory identity and resumed run envelope.
+/// Parameters for cancelling a factory run.
 ///
 /// <div class="warning">
 ///
@@ -5102,14 +5027,12 @@ pub struct FactoryRunResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryResumeResult {
-    /// Persisted factory name resolved for the resumed run.
-    pub factory_name: String,
-    /// Terminal resumed run envelope.
-    pub run: FactoryRunResult,
+pub struct FactoryCancelRequest {
+    /// Factory run identifier.
+    pub run_id: String,
 }
 
-/// Full factory run observability detail.
+/// Current factory phase identity.
 ///
 /// <div class="warning">
 ///
@@ -5119,54 +5042,14 @@ pub struct FactoryResumeResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryRunDetail {
-    /// Epoch milliseconds when the current active segment started, or null while inactive.
-    pub active_segment_started_at: Option<i64>,
-    /// Durable identities and live statuses for direct factory agents.
-    pub agents: Vec<FactoryAgentSummary>,
-    /// Approved effective resource ceilings, or null until approved.
-    pub approved: Option<FactoryDeclaredLimits>,
-    /// Epoch milliseconds when the run completed, or null while nonterminal.
-    pub completed_at: Option<i64>,
-    /// Durable resource consumption.
-    pub consumed: FactoryRunConsumed,
-    /// Epoch milliseconds when the run was created.
-    pub created_at: i64,
-    /// Current phase identity, or null before any phase is entered.
-    pub current_phase: Option<FactoryCurrentPhase>,
-    /// Resource ceilings declared by the factory.
-    pub declared_limits: FactoryDeclaredLimits,
-    /// Number of phases declared by the factory.
-    pub declared_phase_count: i64,
-    /// Human-readable factory description.
-    pub description: String,
-    /// Registered factory name.
-    pub factory_name: String,
-    /// Number of direct factory agents currently live.
-    pub live_agent_count: i64,
-    /// Epoch milliseconds when this live-overlay snapshot was observed.
-    pub observed_at: i64,
-    /// Lifecycle and timing observations for each factory phase.
-    pub phases: Vec<FactoryPhaseObservation>,
-    /// Bidirectional page of durable factory progress.
-    pub progress: FactoryProgressPage,
-    /// Monotonic durable run revision.
-    pub revision: i64,
-    /// Factory run identifier.
-    pub run_id: String,
-    /// Epoch milliseconds when execution first started, or null before start.
-    pub started_at: Option<i64>,
-    /// Current factory run status.
-    pub status: FactoryRunStatus,
-    /// Terminal run outcome, or null while nonterminal.
-    pub terminal: Option<FactoryRunTerminal>,
-    /// Total direct factory agents spawned across all attempts.
-    pub total_spawned_agent_count: i64,
-    /// Epoch milliseconds when the durable run was last updated.
-    pub updated_at: i64,
+pub struct FactoryCurrentPhase {
+    /// Current phase identifier.
+    pub id: String,
+    /// Zero-based declared phase ordinal, or null for an undeclared phase.
+    pub ordinal: Option<i64>,
 }
 
-/// Options controlling factory invocation.
+/// Declared or approved factory resource ceilings.
 ///
 /// <div class="warning">
 ///
@@ -5176,16 +5059,22 @@ pub struct FactoryRunDetail {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct RunOptions {
-    /// Per-invocation resource ceiling overrides.
+pub struct FactoryDeclaredLimits {
+    /// Maximum AI credits consumed by subagents and descendants.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub limits: Option<FactoryRunLimits>,
-    /// Run identifier whose journal and progress should seed this resumed run.
+    pub max_ai_credits: Option<f64>,
+    /// Maximum concurrently active subagents.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub resume_from_run_id: Option<String>,
+    pub max_concurrent_subagents: Option<i64>,
+    /// Maximum total subagents spawned by the run.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_total_subagents: Option<i64>,
+    /// Maximum accumulated active execution time in seconds.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub timeout_seconds: Option<f64>,
 }
 
-/// Parameters for invoking a registered factory.
+/// Parameters sent to the owning extension to execute a factory closure.
 ///
 /// <div class="warning">
 ///
@@ -5195,17 +5084,20 @@ pub struct RunOptions {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FactoryRunRequest {
-    /// Factory input value.
-    pub args: serde_json::Value,
+pub struct FactoryExecuteRequest {
+    /// Target session identifier
+    pub session_id: SessionId,
     /// Registered factory name.
     pub name: String,
-    /// Factory invocation options.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub options: Option<RunOptions>,
+    /// Factory run identifier.
+    pub run_id: String,
+    /// Opaque token identifying this factory execution attempt.
+    pub execution_token: String,
+    /// Factory input value.
+    pub args: serde_json::Value,
 }
 
-/// Optional user prompt to combine with the fleet orchestration instructions.
+/// Result returned by an extension factory closure.
 ///
 /// <div class="warning">
 ///
@@ -5215,13 +5107,13 @@ pub struct FactoryRunRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FleetStartRequest {
-    /// Optional user prompt to combine with fleet instructions
+pub struct FactoryExecuteResult {
+    /// Factory result value.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub prompt: Option<String>,
+    pub result: Option<serde_json::Value>,
 }
 
-/// Indicates whether fleet mode was successfully activated.
+/// Parameters for paging factory progress.
 ///
 /// <div class="warning">
 ///
@@ -5231,12 +5123,24 @@ pub struct FleetStartRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FleetStartResult {
-    /// Whether fleet mode was successfully activated
-    pub started: bool,
+pub struct FactoryGetRunProgressRequest {
+    /// Exclusive forward cursor.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub after_seq: Option<i64>,
+    /// Exclusive backward cursor.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub before_seq: Option<i64>,
+    /// Maximum records to return. Defaults to 200 and is capped at 500.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub limit: Option<i32>,
+    /// Optional phase identifier used to scope records and cursors.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub phase_id: Option<String>,
+    /// Factory run identifier.
+    pub run_id: String,
 }
 
-/// Folder path to add to trusted folders.
+/// Parameters for retrieving a factory run.
 ///
 /// <div class="warning">
 ///
@@ -5246,12 +5150,12 @@ pub struct FleetStartResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FolderTrustAddParams {
-    /// Folder path to mark as trusted
-    pub path: String,
+pub struct FactoryGetRunRequest {
+    /// Factory run identifier.
+    pub run_id: String,
 }
 
-/// Folder path to check for trust.
+/// Parameters for reading a factory journal entry.
 ///
 /// <div class="warning">
 ///
@@ -5261,12 +5165,16 @@ pub struct FolderTrustAddParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FolderTrustCheckParams {
-    /// Folder path to check
-    pub path: String,
+pub struct FactoryJournalGetRequest {
+    /// Opaque token identifying the current factory execution attempt.
+    pub execution_token: String,
+    /// Namespaced journal key.
+    pub key: String,
+    /// Factory run identifier.
+    pub run_id: String,
 }
 
-/// Folder trust check result.
+/// Result of reading a factory journal entry.
 ///
 /// <div class="warning">
 ///
@@ -5276,12 +5184,15 @@ pub struct FolderTrustCheckParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FolderTrustCheckResult {
-    /// Whether the folder is trusted
-    pub trusted: bool,
+pub struct FactoryJournalGetResult {
+    /// Whether the journal contained the requested key.
+    pub hit: bool,
+    /// Cached JSON result. The hit field distinguishes a cached JSON null from a miss.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub result_json: Option<serde_json::Value>,
 }
 
-/// Client environment metadata describing the process that produced a telemetry event.
+/// Parameters for storing a factory journal entry.
 ///
 /// <div class="warning">
 ///
@@ -5291,40 +5202,18 @@ pub struct FolderTrustCheckResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct GitHubTelemetryClientInfo {
-    /// Copilot CLI version string.
-    #[serde(rename = "cli_version")]
-    pub cli_version: String,
-    /// Name of the client application.
-    #[serde(rename = "client_name", skip_serializing_if = "Option::is_none")]
-    pub client_name: Option<String>,
-    /// Type of client.
-    #[serde(rename = "client_type", skip_serializing_if = "Option::is_none")]
-    pub client_type: Option<String>,
-    /// Copilot subscription plan, when known.
-    #[serde(rename = "copilot_plan", skip_serializing_if = "Option::is_none")]
-    pub copilot_plan: Option<String>,
-    /// Stable machine identifier for the device.
-    #[serde(rename = "dev_device_id", skip_serializing_if = "Option::is_none")]
-    pub dev_device_id: Option<String>,
-    /// Whether the user is a GitHub/Microsoft staff member.
-    #[serde(rename = "is_staff", skip_serializing_if = "Option::is_none")]
-    pub is_staff: Option<bool>,
-    /// Node.js runtime version string.
-    #[serde(rename = "node_version")]
-    pub node_version: String,
-    /// Operating system architecture (e.g. arm64, x64).
-    #[serde(rename = "os_arch")]
-    pub os_arch: String,
-    /// Operating system platform (e.g. darwin, linux, win32).
-    #[serde(rename = "os_platform")]
-    pub os_platform: String,
-    /// Operating system version string.
-    #[serde(rename = "os_version")]
-    pub os_version: String,
+pub struct FactoryJournalPutRequest {
+    /// Opaque token identifying the current factory execution attempt.
+    pub execution_token: String,
+    /// Namespaced journal key.
+    pub key: String,
+    /// JSON result to memoize.
+    pub result_json: serde_json::Value,
+    /// Factory run identifier.
+    pub run_id: String,
 }
 
-/// A single telemetry event in the runtime's native GitHub-shaped telemetry format, forwarded verbatim to opted-in hosts. The `restricted` flag on the enclosing GitHubTelemetryNotification distinguishes standard from restricted events; the payload shape is identical for both.
+/// Parameters for paging factory runs.
 ///
 /// <div class="warning">
 ///
@@ -5334,43 +5223,19 @@ pub struct GitHubTelemetryClientInfo {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct GitHubTelemetryEvent {
-    /// Client environment metadata.
+pub struct FactoryListRunsRequest {
+    /// Exclusive forward cursor.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub client: Option<GitHubTelemetryClientInfo>,
-    /// Copilot tracking ID for user-level attribution.
-    #[serde(
-        rename = "copilot_tracking_id",
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub copilot_tracking_id: Option<String>,
-    /// Timestamp when the event was created (ISO 8601 format).
-    #[serde(rename = "created_at", skip_serializing_if = "Option::is_none")]
-    pub created_at: Option<String>,
-    /// Experiment assignment context.
-    #[serde(
-        rename = "exp_assignment_context",
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub exp_assignment_context: Option<String>,
-    /// Feature flags enabled for this session, as a map from flag to value.
+    pub after_seq: Option<i64>,
+    /// Exclusive backward cursor.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub features: Option<HashMap<String, String>>,
-    /// Event type/kind (e.g. get_completion_with_tools_turn, tool_call_executed).
-    pub kind: String,
-    /// Numeric metrics as a map from key to value.
-    pub metrics: HashMap<String, f64>,
-    /// Reference to the model call that produced this event.
-    #[serde(rename = "model_call_id", skip_serializing_if = "Option::is_none")]
-    pub model_call_id: Option<String>,
-    /// String-valued properties as a map from key to value.
-    pub properties: HashMap<String, String>,
-    /// Session identifier the event belongs to.
-    #[serde(rename = "session_id", skip_serializing_if = "Option::is_none")]
-    pub session_id: Option<String>,
+    pub before_seq: Option<i64>,
+    /// Maximum terminal runs to return. Defaults to 200 and is capped at 500.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub limit: Option<i32>,
 }
 
-/// Payload for a `gitHubTelemetry.event` notification: a single GitHub telemetry event the runtime forwards to a host connection that opted into telemetry forwarding during the `server.connect` handshake.
+/// Durable factory resource consumption.
 ///
 /// <div class="warning">
 ///
@@ -5380,17 +5245,16 @@ pub struct GitHubTelemetryEvent {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct GitHubTelemetryNotification {
-    /// The telemetry event, in the runtime's native GitHub-shaped telemetry format.
-    pub event: GitHubTelemetryEvent,
-    /// Whether this is a restricted telemetry event (cli.restricted_telemetry). Hosts must route restricted events to first-party Microsoft stores only.
-    pub restricted: bool,
-    /// Session the telemetry event belongs to, when it is session-scoped. Omitted for sessionless events (for example, `server.sendTelemetry` calls with no session id), which are still forwarded to opted-in connections.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub session_id: Option<SessionId>,
+pub struct FactoryRunConsumed {
+    /// Accumulated active execution time in milliseconds.
+    pub active_ms: i64,
+    /// AI usage consumed by the run in nano-AIU.
+    pub nano_aiu: i64,
+    /// Total subagents spawned by the run.
+    pub subagents: i64,
 }
 
-/// Pending external tool call request ID, with the tool result or an error describing why it failed.
+/// Prompt-safe terminal factory outcome.
 ///
 /// <div class="warning">
 ///
@@ -5400,33 +5264,22 @@ pub struct GitHubTelemetryNotification {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct HandlePendingToolCallRequest {
-    /// Error message if the tool call failed
+pub struct FactoryRunTerminal {
+    /// Human-readable terminal error.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub error: Option<String>,
-    /// Request ID of the pending tool call
-    pub request_id: RequestId,
-    /// Tool call result (string or expanded result object)
+    /// Machine-readable terminal failure.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub result: Option<serde_json::Value>,
-}
-
-/// Indicates whether the external tool call result was handled successfully.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct HandlePendingToolCallResult {
-    /// Whether the tool call result was handled successfully
-    pub success: bool,
+    pub failure: Option<serde_json::Value>,
+    /// Human-readable terminal reason.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reason: Option<String>,
+    /// Prompt-safe preview of the completed result.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub result_preview: Option<String>,
 }
 
-/// Indicates whether an in-progress manual compaction was aborted.
+/// Durable factory run summary with read-time live overlays.
 ///
 /// <div class="warning">
 ///
@@ -5436,12 +5289,48 @@ pub struct HandlePendingToolCallResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct HistoryAbortManualCompactionResult {
-    /// Whether an in-progress manual compaction was aborted. False when no manual compaction was running, when its abort controller was already aborted, or when the session is remote.
-    pub aborted: bool,
+pub struct FactoryRunSummary {
+    /// Epoch milliseconds when the current active segment started, or null while inactive.
+    pub active_segment_started_at: Option<i64>,
+    /// Approved effective resource ceilings, or null until approved.
+    pub approved: Option<FactoryDeclaredLimits>,
+    /// Epoch milliseconds when the run completed, or null while nonterminal.
+    pub completed_at: Option<i64>,
+    /// Durable resource consumption.
+    pub consumed: FactoryRunConsumed,
+    /// Epoch milliseconds when the run was created.
+    pub created_at: i64,
+    /// Current phase identity, or null before any phase is entered.
+    pub current_phase: Option<FactoryCurrentPhase>,
+    /// Resource ceilings declared by the factory.
+    pub declared_limits: FactoryDeclaredLimits,
+    /// Number of phases declared by the factory.
+    pub declared_phase_count: i64,
+    /// Human-readable factory description.
+    pub description: String,
+    /// Registered factory name.
+    pub factory_name: String,
+    /// Number of direct factory agents currently live.
+    pub live_agent_count: i64,
+    /// Epoch milliseconds when this live-overlay snapshot was observed.
+    pub observed_at: i64,
+    /// Monotonic durable run revision.
+    pub revision: i64,
+    /// Factory run identifier.
+    pub run_id: String,
+    /// Epoch milliseconds when execution first started, or null before start.
+    pub started_at: Option<i64>,
+    /// Current factory run status.
+    pub status: FactoryRunStatus,
+    /// Terminal run outcome, or null while nonterminal.
+    pub terminal: Option<FactoryRunTerminal>,
+    /// Total direct factory agents spawned across all attempts.
+    pub total_spawned_agent_count: i64,
+    /// Epoch milliseconds when the durable run was last updated.
+    pub updated_at: i64,
 }
 
-/// Indicates whether an in-progress background compaction was cancelled.
+/// A page of factory runs in durable creation order.
 ///
 /// <div class="warning">
 ///
@@ -5451,12 +5340,24 @@ pub struct HistoryAbortManualCompactionResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct HistoryCancelBackgroundCompactionResult {
-    /// Whether an in-progress background compaction was cancelled. False when no compaction was running, when the session is remote, or when the underlying processor was unavailable.
-    pub cancelled: bool,
+pub struct FactoryListRunsResult {
+    /// Whether terminal runs newer than this page exist.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub has_more_newer: Option<bool>,
+    /// Newest terminal-run cursor in this page, or null when the terminal window is empty.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub newest_seq: Option<i64>,
+    /// Oldest terminal-run cursor in this page, or null when the terminal window is empty.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub oldest_seq: Option<i64>,
+    /// Number of terminal runs older than this page.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub omitted_older: Option<i64>,
+    /// Factory run summaries in durable creation order.
+    pub runs: Vec<FactoryRunSummary>,
 }
 
-/// Parameters for clearing the conversation and seeding the window that replaces it.
+/// One ordered factory progress line.
 ///
 /// <div class="warning">
 ///
@@ -5466,12 +5367,16 @@ pub struct HistoryCancelBackgroundCompactionResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct HistoryClearContextRequest {
-    /// First user message of the fresh context window. Required: a cleared window holding only system and developer messages is not a conversation a model can answer, so every clear seeds the window it creates. Delivered by the enclosing turn driver once the agentic loop exits, which is why the call must be made from inside a tool handler.
-    pub prompt: String,
+pub struct FactoryLogLine {
+    /// Progress line kind.
+    pub kind: FactoryLogLineKind,
+    /// Monotonic sequence number within the factory run.
+    pub seq: i64,
+    /// Progress text.
+    pub text: String,
 }
 
-/// What a successful clear removed. A clear that could not be applied rejects instead of reporting a count.
+/// Parameters for recording factory progress.
 ///
 /// <div class="warning">
 ///
@@ -5481,12 +5386,16 @@ pub struct HistoryClearContextRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct HistoryClearContextResult {
-    /// Number of non-system, non-developer messages that were removed from the conversation. Zero only when the window already held no conversation.
-    pub messages_cleared: i64,
+pub struct FactoryLogRequest {
+    /// Opaque token identifying the current factory execution attempt.
+    pub execution_token: String,
+    /// Ordered progress lines to append.
+    pub lines: Vec<FactoryLogLine>,
+    /// Factory run identifier.
+    pub run_id: String,
 }
 
-/// Post-compaction context window usage breakdown
+/// Durable lifecycle and timing for one factory phase.
 ///
 /// <div class="warning">
 ///
@@ -5496,25 +5405,39 @@ pub struct HistoryClearContextResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct HistoryCompactContextWindow {
-    /// Token count from non-system messages (user, assistant, tool)
+pub struct FactoryPhaseObservation {
+    /// Completed active time accumulated by this phase in milliseconds.
+    pub accumulated_active_ms: i64,
+    /// Epoch milliseconds when this phase completed; for a skipped phase, the synthetic skip timestamp (equal to `startedAt`).
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub conversation_tokens: Option<i64>,
-    /// Current total tokens in the context window (system + conversation + tool definitions)
-    pub current_tokens: i64,
-    /// Current number of messages in the conversation
-    pub messages_length: i64,
-    /// Token count from system message(s)
+    pub completed_at: Option<i64>,
+    /// Current live active time for this phase in milliseconds.
+    pub current_active_ms: i64,
+    /// Optional human-readable phase detail.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub system_tokens: Option<i64>,
-    /// Maximum token count for the model's context window
-    pub token_limit: i64,
-    /// Token count from tool definitions
+    pub detail: Option<String>,
+    /// Number of times execution entered this phase.
+    pub entry_count: i64,
+    /// Phase identifier.
+    pub id: String,
+    /// Most recent run attempt that entered this phase, or `0` if the phase has never been entered.
+    pub last_entered_run_attempt: i64,
+    /// Direct agents in this phase that are currently live.
+    pub live_agent_count: i64,
+    /// Zero-based declared phase ordinal, or null for an undeclared phase.
+    pub ordinal: Option<i64>,
+    /// Epoch milliseconds when this phase first started; for a skipped phase, the synthetic skip timestamp (equal to `completedAt`).
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub tool_definitions_tokens: Option<i64>,
+    pub started_at: Option<i64>,
+    /// Derived lifecycle state of the phase.
+    pub status: FactoryPhaseStatus,
+    /// Human-readable phase title.
+    pub title: String,
+    /// Total direct agents associated with this phase.
+    pub total_agent_count: i64,
 }
 
-/// Optional compaction parameters.
+/// One durable factory progress record.
 ///
 /// <div class="warning">
 ///
@@ -5524,19 +5447,22 @@ pub struct HistoryCompactContextWindow {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct HistoryCompactRequest {
-    /// Optional user-provided instructions to focus the compaction summary
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub custom_instructions: Option<String>,
-    /// Context window token limit this compaction is targeting, recorded as the `tokenLimit` on the persisted `session.compaction_start` / `session.compaction_complete` events. Set it when the compaction targets a window other than the compacting model's own, e.g. switching to a model with a smaller context window: the compaction still runs on the current model, so the limit that motivated it would otherwise be lost. When absent, the events record the compacting model's own resolved limit. Attribution metadata only - it does not change how much the compaction removes.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub token_limit: Option<i64>,
-    /// What initiated this compaction request, recorded as the `trigger` on the persisted `session.compaction_start` / `session.compaction_complete` events. When absent, the compaction is persisted without trigger attribution (initiator unknown).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub trigger: Option<HistoryCompactRequestTrigger>,
+pub struct FactoryProgressLine {
+    /// Resume attempt that emitted this record.
+    pub attempt: i64,
+    /// Progress record kind.
+    pub kind: FactoryLogLineKind,
+    /// Phase active when the record was emitted, or null before any phase.
+    pub phase_id: Option<String>,
+    /// Epoch milliseconds when the record was persisted.
+    pub recorded_at: i64,
+    /// Global monotonic sequence number within the run.
+    pub seq: i64,
+    /// Prompt-safe progress text.
+    pub text: String,
 }
 
-/// Compaction outcome with the number of tokens and messages removed, summary text, and the resulting context window breakdown.
+/// A bidirectional page of factory progress.
 ///
 /// <div class="warning">
 ///
@@ -5546,22 +5472,22 @@ pub struct HistoryCompactRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct HistoryCompactResult {
-    /// Post-compaction context window usage breakdown
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub context_window: Option<HistoryCompactContextWindow>,
-    /// Number of messages removed during compaction
-    pub messages_removed: i64,
-    /// Whether compaction completed successfully
-    pub success: bool,
-    /// Summary text produced by compaction. Omitted when compaction did not produce a summary (e.g. failure path).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub summary_content: Option<String>,
-    /// Number of tokens freed by compaction
-    pub tokens_removed: i64,
+pub struct FactoryProgressPage {
+    /// Whether progress records newer than this page exist.
+    pub has_more_newer: bool,
+    /// Whether progress records older than this page exist.
+    pub has_more_older: bool,
+    /// Newest sequence number in this page, or null when empty.
+    pub newest_seq: Option<i64>,
+    /// Oldest sequence number in this page, or null when empty.
+    pub oldest_seq: Option<i64>,
+    /// Progress records in sequence order.
+    pub records: Vec<FactoryProgressLine>,
+    /// Run revision reflected by this page.
+    pub revision: i64,
 }
 
-/// A root user turn that the session can rewind to.
+/// Wire-only per-invocation factory resource ceiling overrides.
 ///
 /// <div class="warning">
 ///
@@ -5571,28 +5497,22 @@ pub struct HistoryCompactResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct HistoryRewindPoint {
-    /// Whether at least one file in this turn or a later turn can be restored.
-    pub can_restore_files: bool,
-    /// ID of the user.message event that begins the discarded suffix.
-    pub event_id: String,
-    /// Number of unique files in this turn and all later turns that have captured changes.
-    pub file_count: i64,
-    /// Whether this turn was an automatically injected autopilot continuation.
-    pub is_autopilot_continuation: bool,
-    /// Lines added by this turn's captured file changes.
-    pub lines_added: i64,
-    /// Lines removed by this turn's captured file changes.
-    pub lines_removed: i64,
-    /// ISO timestamp of the user turn.
-    pub timestamp: String,
-    /// Whether this turn itself captured any file changes.
-    pub turn_changed_files: bool,
-    /// User-visible message text for the turn.
-    pub user_message: String,
+pub struct FactoryRunLimits {
+    /// Maximum AI credits consumed by factory subagents and their descendants. The post-paid ceiling is soft: parallel turns can settle beyond it before the run stops.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_ai_credits: Option<f64>,
+    /// Maximum number of factory subagents that may run concurrently.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_concurrent_subagents: Option<i64>,
+    /// Maximum total number of factory subagents that may be admitted.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_total_subagents: Option<i64>,
+    /// Maximum accumulated active-execution time in seconds. Active execution includes the entire extension body, subprocess waits, queued-agent waits, and sleeps; time between resumed attempts is not counted.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub timeout_seconds: Option<f64>,
 }
 
-/// Rewind points and file-change-tracking availability for the session.
+/// Parameters for resuming a factory run from its persisted identity.
 ///
 /// <div class="warning">
 ///
@@ -5602,17 +5522,15 @@ pub struct HistoryRewindPoint {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct HistoryListRewindPointsResult {
-    /// Whether this session captured file changes from its first turn.
-    pub file_change_tracking_enabled: bool,
-    /// Root user turns in chronological order. Empty when `unavailableReason` is set.
-    pub points: Vec<HistoryRewindPoint>,
-    /// Why the listed points could not be produced, when applicable; the points list is empty whenever it is set. `unsupported-remote-session` is permanent for the session and comes with `fileChangeTrackingEnabled: false`. `session-busy` is transient and only ever reported by a session that *is* tracking (`fileChangeTrackingEnabled: true`), because the file-change captures cannot be read while work that may still mutate them is in flight; the same request succeeds once the session settles, so a client that wants points should retry rather than treat it as a failure. It is never `file-change-tracking-disabled`: an untracked local session still lists conversation-only points and reports that through `fileChangeTrackingEnabled: false`.
+pub struct FactoryResumeRequest {
+    /// Optional per-invocation resource ceiling overrides.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub unavailable_reason: Option<HistoryRewindUnavailableReason>,
+    pub limits: Option<FactoryRunLimits>,
+    /// Factory run identifier.
+    pub run_id: String,
 }
 
-/// Event boundary to preview for conversation-and-files rewind.
+/// Complete current or terminal factory run envelope.
 ///
 /// <div class="warning">
 ///
@@ -5622,12 +5540,29 @@ pub struct HistoryListRewindPointsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct HistoryPreviewRewindRequest {
-    /// ID of the user.message event that begins the discarded suffix.
-    pub event_id: String,
+pub struct FactoryRunResult {
+    /// Error message for an errored run.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// Machine-readable failure details for an errored run.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub failure: Option<serde_json::Value>,
+    /// Reason for a halted or cancelled run.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reason: Option<String>,
+    /// Completed factory result.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub result: Option<serde_json::Value>,
+    /// Factory run identifier.
+    pub run_id: String,
+    /// Partial journal and progress snapshot for a halted, cancelled, or errored run.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub snapshot: Option<serde_json::Value>,
+    /// Current or terminal factory run status.
+    pub status: FactoryRunStatus,
 }
 
-/// A file that a conversation-and-files rewind would restore.
+/// Resolved persisted factory identity and resumed run envelope.
 ///
 /// <div class="warning">
 ///
@@ -5637,18 +5572,14 @@ pub struct HistoryPreviewRewindRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct HistoryRewindFilePreview {
-    /// Aggregate change made across the discarded turns.
-    pub change_type: HistoryRewindChangeType,
-    /// Lines added across the discarded turns.
-    pub lines_added: i64,
-    /// Lines removed across the discarded turns.
-    pub lines_removed: i64,
-    /// Absolute path of the captured file.
-    pub path: String,
+pub struct FactoryResumeResult {
+    /// Persisted factory name resolved for the resumed run.
+    pub factory_name: String,
+    /// Terminal resumed run envelope.
+    pub run: FactoryRunResult,
 }
 
-/// Files and aggregate changes for a prospective rewind.
+/// Full factory run observability detail.
 ///
 /// <div class="warning">
 ///
@@ -5658,19 +5589,54 @@ pub struct HistoryRewindFilePreview {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct HistoryPreviewRewindResult {
-    /// Whether file restore is available for this session. This is authoritative: switch on it and read `reason` only when it is false.
-    pub available: bool,
-    /// Number of unique files in the preview.
-    pub file_count: i64,
-    /// Files ordered by path.
-    pub files: Vec<HistoryRewindFilePreview>,
-    /// Why file restore is unavailable, when applicable. Populated only when `available` is false and never set when `available` is true.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub reason: Option<HistoryRewindUnavailableReason>,
+pub struct FactoryRunDetail {
+    /// Epoch milliseconds when the current active segment started, or null while inactive.
+    pub active_segment_started_at: Option<i64>,
+    /// Durable identities and live statuses for direct factory agents.
+    pub agents: Vec<FactoryAgentSummary>,
+    /// Approved effective resource ceilings, or null until approved.
+    pub approved: Option<FactoryDeclaredLimits>,
+    /// Epoch milliseconds when the run completed, or null while nonterminal.
+    pub completed_at: Option<i64>,
+    /// Durable resource consumption.
+    pub consumed: FactoryRunConsumed,
+    /// Epoch milliseconds when the run was created.
+    pub created_at: i64,
+    /// Current phase identity, or null before any phase is entered.
+    pub current_phase: Option<FactoryCurrentPhase>,
+    /// Resource ceilings declared by the factory.
+    pub declared_limits: FactoryDeclaredLimits,
+    /// Number of phases declared by the factory.
+    pub declared_phase_count: i64,
+    /// Human-readable factory description.
+    pub description: String,
+    /// Registered factory name.
+    pub factory_name: String,
+    /// Number of direct factory agents currently live.
+    pub live_agent_count: i64,
+    /// Epoch milliseconds when this live-overlay snapshot was observed.
+    pub observed_at: i64,
+    /// Lifecycle and timing observations for each factory phase.
+    pub phases: Vec<FactoryPhaseObservation>,
+    /// Bidirectional page of durable factory progress.
+    pub progress: FactoryProgressPage,
+    /// Monotonic durable run revision.
+    pub revision: i64,
+    /// Factory run identifier.
+    pub run_id: String,
+    /// Epoch milliseconds when execution first started, or null before start.
+    pub started_at: Option<i64>,
+    /// Current factory run status.
+    pub status: FactoryRunStatus,
+    /// Terminal run outcome, or null while nonterminal.
+    pub terminal: Option<FactoryRunTerminal>,
+    /// Total direct factory agents spawned across all attempts.
+    pub total_spawned_agent_count: i64,
+    /// Epoch milliseconds when the durable run was last updated.
+    pub updated_at: i64,
 }
 
-/// Boundary and mode for rewinding session history.
+/// Options controlling factory invocation.
 ///
 /// <div class="warning">
 ///
@@ -5680,14 +5646,16 @@ pub struct HistoryPreviewRewindResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct HistoryRewindRequest {
-    /// ID of the user.message event that begins the discarded suffix.
-    pub event_id: String,
-    /// Whether to rewind only conversation history or also restore captured files.
-    pub mode: HistoryRewindMode,
+pub struct RunOptions {
+    /// Per-invocation resource ceiling overrides.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub limits: Option<FactoryRunLimits>,
+    /// Run identifier whose journal and progress should seed this resumed run.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub resume_from_run_id: Option<String>,
 }
 
-/// A captured file that rewind intentionally left unchanged.
+/// Parameters for invoking a registered factory.
 ///
 /// <div class="warning">
 ///
@@ -5697,14 +5665,17 @@ pub struct HistoryRewindRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct HistorySkippedFileRestore {
-    /// Absolute path of the skipped file.
-    pub path: String,
-    /// Reason the file was not restored.
-    pub reason: HistoryFileRestoreSkipReason,
+pub struct FactoryRunRequest {
+    /// Factory input value.
+    pub args: serde_json::Value,
+    /// Registered factory name.
+    pub name: String,
+    /// Factory invocation options.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub options: Option<RunOptions>,
 }
 
-/// Structured outcome of a rewind request.
+/// Optional user prompt to combine with the fleet orchestration instructions.
 ///
 /// <div class="warning">
 ///
@@ -5714,22 +5685,13 @@ pub struct HistorySkippedFileRestore {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct HistoryRewindResult {
-    /// Failure detail. Set only for the failure and partial-failure outcomes (`files-rolled-back`, `rollback-incomplete`, `truncation-failed`, `checkpoint-cleanup-failed`, `snapshot-prune-failed`); omitted for `success` and for the unavailable outcomes (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Number of persisted events removed by conversation truncation. Present only when truncation succeeded (outcomes `success`, `checkpoint-cleanup-failed`, and `snapshot-prune-failed`); omitted for every unavailable outcome (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`) and for `truncation-failed`, `files-rolled-back`, and `rollback-incomplete`.
+pub struct FleetStartRequest {
+    /// Optional user prompt to combine with fleet instructions
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub events_removed: Option<i64>,
-    /// Overall rewind outcome. This discriminates the result: it governs which of the remaining fields are populated, so consumers must switch on it before reading `eventsRemoved`, `restoredFiles`, `skippedFiles`, or `error`. See each field for the outcomes that populate it.
-    pub outcome: HistoryRewindOutcome,
-    /// Absolute paths restored to their captured preimages. Always empty for conversation-only rewinds and for the unavailable outcomes (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`); only conversation-and-files outcomes that reached the file-restore stage populate it.
-    pub restored_files: Vec<String>,
-    /// Captured files intentionally left unchanged. Always empty for conversation-only rewinds and for the unavailable outcomes (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`); only conversation-and-files outcomes that reached the file-restore stage populate it.
-    pub skipped_files: Vec<HistorySkippedFileRestore>,
+    pub prompt: Option<String>,
 }
 
-/// Markdown summary of the conversation context (empty when not available).
+/// Indicates whether fleet mode was successfully activated.
 ///
 /// <div class="warning">
 ///
@@ -5739,12 +5701,12 @@ pub struct HistoryRewindResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct HistorySummarizeForHandoffResult {
-    /// Markdown summary of the conversation context produced by an LLM. Empty string when there are no messages or when the session does not support local summarization.
-    pub summary: String,
+pub struct FleetStartResult {
+    /// Whether fleet mode was successfully activated
+    pub started: bool,
 }
 
-/// Identifier of the event to truncate to; this event and all later events are removed.
+/// Folder path to add to trusted folders.
 ///
 /// <div class="warning">
 ///
@@ -5754,12 +5716,12 @@ pub struct HistorySummarizeForHandoffResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct HistoryTruncateRequest {
-    /// Event ID to truncate to. This event and all events after it are removed from the session.
-    pub event_id: String,
+pub struct FolderTrustAddParams {
+    /// Folder path to mark as trusted
+    pub path: String,
 }
 
-/// Number of events that were removed by the truncation.
+/// Folder path to check for trust.
 ///
 /// <div class="warning">
 ///
@@ -5769,36 +5731,27 @@ pub struct HistoryTruncateRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct HistoryTruncateResult {
-    /// Failure detail when checkpointCleanupFailed is true.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub checkpoint_cleanup_error: Option<String>,
-    /// True when conversation truncation succeeded but post-truncation workspace checkpoint cleanup failed. History is already truncated; callers may still prune snapshots but should report a checkpoint-cleanup rather than a truncation failure.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub checkpoint_cleanup_failed: Option<bool>,
-    /// Number of events that were removed
-    pub events_removed: i64,
-}
-
-/// Runtime-owned wire payload for a server-to-client hook callback invocation.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub(crate) struct HookInvokeRequest {
-    #[doc(hidden)]
-    pub(crate) hook_type: HookType,
-    pub input: serde_json::Value,
-    pub session_id: SessionId,
+pub struct FolderTrustCheckParams {
+    /// Folder path to check
+    pub path: String,
 }
 
-/// Optional output returned by an SDK callback hook.
+/// Folder trust check result.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub(crate) struct HookInvokeResponse {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub output: Option<serde_json::Value>,
+pub struct FolderTrustCheckResult {
+    /// Whether the folder is trusted
+    pub trusted: bool,
 }
 
-/// Installed plugin record from global state, with marketplace, version, install time, enabled state, cache path, and source.
+/// Client environment metadata describing the process that produced a telemetry event.
 ///
 /// <div class="warning">
 ///
@@ -5808,31 +5761,40 @@ pub(crate) struct HookInvokeResponse {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct InstalledPlugin {
-    /// Path where the plugin is cached locally
-    #[serde(rename = "cache_path", skip_serializing_if = "Option::is_none")]
-    pub cache_path: Option<String>,
-    /// Whether the plugin is currently enabled
-    pub enabled: bool,
-    /// Installation timestamp
-    #[serde(rename = "installed_at")]
-    pub installed_at: String,
-    /// Marketplace the plugin came from (empty string for direct repo installs)
-    pub marketplace: String,
-    /// Plugin name
-    pub name: String,
-    /// Source for direct repo installs (when marketplace is empty)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source: Option<serde_json::Value>,
-    /// Per-plugin source fingerprint (a SHA-256 hash of the plugin's catalog source spec plus its resolved source subtree — NOT a Git commit SHA) captured at marketplace install/update time. Auto-update compares it against the freshly recomputed fingerprint to detect a content change that does not bump the version. Absent for pre-existing installs and for direct (non-marketplace) installs.
-    #[serde(rename = "source_sha", skip_serializing_if = "Option::is_none")]
-    pub source_sha: Option<String>,
-    /// Version installed (if available)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub version: Option<String>,
+pub struct GitHubTelemetryClientInfo {
+    /// Copilot CLI version string.
+    #[serde(rename = "cli_version")]
+    pub cli_version: String,
+    /// Name of the client application.
+    #[serde(rename = "client_name", skip_serializing_if = "Option::is_none")]
+    pub client_name: Option<String>,
+    /// Type of client.
+    #[serde(rename = "client_type", skip_serializing_if = "Option::is_none")]
+    pub client_type: Option<String>,
+    /// Copilot subscription plan, when known.
+    #[serde(rename = "copilot_plan", skip_serializing_if = "Option::is_none")]
+    pub copilot_plan: Option<String>,
+    /// Stable machine identifier for the device.
+    #[serde(rename = "dev_device_id", skip_serializing_if = "Option::is_none")]
+    pub dev_device_id: Option<String>,
+    /// Whether the user is a GitHub/Microsoft staff member.
+    #[serde(rename = "is_staff", skip_serializing_if = "Option::is_none")]
+    pub is_staff: Option<bool>,
+    /// Node.js runtime version string.
+    #[serde(rename = "node_version")]
+    pub node_version: String,
+    /// Operating system architecture (e.g. arm64, x64).
+    #[serde(rename = "os_arch")]
+    pub os_arch: String,
+    /// Operating system platform (e.g. darwin, linux, win32).
+    #[serde(rename = "os_platform")]
+    pub os_platform: String,
+    /// Operating system version string.
+    #[serde(rename = "os_version")]
+    pub os_version: String,
 }
 
-/// Information about an installed plugin tracked in global state.
+/// A single telemetry event in the runtime's native GitHub-shaped telemetry format, forwarded verbatim to opted-in hosts. The `restricted` flag on the enclosing GitHubTelemetryNotification distinguishes standard from restricted events; the payload shape is identical for both.
 ///
 /// <div class="warning">
 ///
@@ -5842,22 +5804,43 @@ pub struct InstalledPlugin {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct InstalledPluginInfo {
-    /// Opaque, stable hash identifying a direct (non-marketplace) install source. Present only for direct repo / URL / local installs; absent for marketplace plugins. Same source yields the same id; distinct sources never collide.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub direct_source_id: Option<String>,
-    /// Whether the plugin is currently enabled for new sessions
-    pub enabled: bool,
-    /// Marketplace the plugin came from. Empty string ("") for direct repo / URL / local installs.
-    pub marketplace: String,
-    /// Plugin name
-    pub name: String,
-    /// Installed version (when reported by the plugin manifest)
+pub struct GitHubTelemetryEvent {
+    /// Client environment metadata.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub version: Option<String>,
+    pub client: Option<GitHubTelemetryClientInfo>,
+    /// Copilot tracking ID for user-level attribution.
+    #[serde(
+        rename = "copilot_tracking_id",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub copilot_tracking_id: Option<String>,
+    /// Timestamp when the event was created (ISO 8601 format).
+    #[serde(rename = "created_at", skip_serializing_if = "Option::is_none")]
+    pub created_at: Option<String>,
+    /// Experiment assignment context.
+    #[serde(
+        rename = "exp_assignment_context",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub exp_assignment_context: Option<String>,
+    /// Feature flags enabled for this session, as a map from flag to value.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub features: Option<HashMap<String, String>>,
+    /// Event type/kind (e.g. get_completion_with_tools_turn, tool_call_executed).
+    pub kind: String,
+    /// Numeric metrics as a map from key to value.
+    pub metrics: HashMap<String, f64>,
+    /// Reference to the model call that produced this event.
+    #[serde(rename = "model_call_id", skip_serializing_if = "Option::is_none")]
+    pub model_call_id: Option<String>,
+    /// String-valued properties as a map from key to value.
+    pub properties: HashMap<String, String>,
+    /// Session identifier the event belongs to.
+    #[serde(rename = "session_id", skip_serializing_if = "Option::is_none")]
+    pub session_id: Option<String>,
 }
 
-/// Source descriptor for a direct GitHub plugin install, with `owner/repo`, optional ref or full commit SHA, and optional subpath.
+/// Payload for a `gitHubTelemetry.event` notification: a single GitHub telemetry event the runtime forwards to a host connection that opted into telemetry forwarding during the `server.connect` handshake.
 ///
 /// <div class="warning">
 ///
@@ -5867,23 +5850,38 @@ pub struct InstalledPluginInfo {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct InstalledPluginSourceGitHub {
-    /// Optional repository-relative path to the plugin.
+pub struct GitHubTelemetryNotification {
+    /// The telemetry event, in the runtime's native GitHub-shaped telemetry format.
+    pub event: GitHubTelemetryEvent,
+    /// Whether this is a restricted telemetry event (cli.restricted_telemetry). Hosts must route restricted events to first-party Microsoft stores only.
+    pub restricted: bool,
+    /// Session the telemetry event belongs to, when it is session-scoped. Omitted for sessionless events (for example, `server.sendTelemetry` calls with no session id), which are still forwarded to opted-in connections.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub path: Option<String>,
-    /// Optional Git ref to resolve.
+    pub session_id: Option<SessionId>,
+}
+
+/// Pending external tool call request ID, with the tool result or an error describing why it failed.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct HandlePendingToolCallRequest {
+    /// Error message if the tool call failed
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub r#ref: Option<String>,
-    /// GitHub repository in `owner/repo` form.
-    pub repo: String,
-    /// Optional full 40-character hexadecimal commit SHA.
+    pub error: Option<String>,
+    /// Request ID of the pending tool call
+    pub request_id: RequestId,
+    /// Tool call result (string or expanded result object)
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub sha: Option<String>,
-    /// Constant value. Always "github".
-    pub source: InstalledPluginSourceGitHubSource,
+    pub result: Option<serde_json::Value>,
 }
 
-/// Source descriptor for a direct local plugin install, with a local filesystem path.
+/// Indicates whether the external tool call result was handled successfully.
 ///
 /// <div class="warning">
 ///
@@ -5893,14 +5891,12 @@ pub struct InstalledPluginSourceGitHub {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct InstalledPluginSourceLocal {
-    /// Local filesystem path to the plugin.
-    pub path: String,
-    /// Constant value. Always "local".
-    pub source: InstalledPluginSourceLocalSource,
+pub struct HandlePendingToolCallResult {
+    /// Whether the tool call result was handled successfully
+    pub success: bool,
 }
 
-/// Source descriptor for a direct URL plugin install, with URL, optional ref or full commit SHA, and optional subpath.
+/// Indicates whether an in-progress manual compaction was aborted.
 ///
 /// <div class="warning">
 ///
@@ -5910,23 +5906,12 @@ pub struct InstalledPluginSourceLocal {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct InstalledPluginSourceUrl {
-    /// Optional source-relative path to the plugin.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub path: Option<String>,
-    /// Optional Git ref to resolve.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub r#ref: Option<String>,
-    /// Optional full 40-character hexadecimal commit SHA.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub sha: Option<String>,
-    /// Constant value. Always "url".
-    pub source: InstalledPluginSourceUrlSource,
-    /// URL of the plugin source.
-    pub url: String,
+pub struct HistoryAbortManualCompactionResult {
+    /// Whether an in-progress manual compaction was aborted. False when no manual compaction was running, when its abort controller was already aborted, or when the session is remote.
+    pub aborted: bool,
 }
 
-/// Canonical file or directory where custom instructions can be discovered or created, with location, kind, preference, and project path.
+/// Indicates whether an in-progress background compaction was cancelled.
 ///
 /// <div class="warning">
 ///
@@ -5936,21 +5921,12 @@ pub struct InstalledPluginSourceUrl {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct InstructionDiscoveryPath {
-    /// Whether the target is a single file or a directory of instruction files
-    pub kind: InstructionDiscoveryPathKind,
-    /// Which tier this target belongs to
-    pub location: InstructionDiscoveryPathLocation,
-    /// Absolute path of the file or directory (may not exist on disk yet)
-    pub path: String,
-    /// Whether this is the canonical target to create new instructions in its tier. At most one entry per tier is preferred.
-    pub preferred_for_creation: bool,
-    /// The input project path this target was derived from (only for repository targets)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub project_path: Option<String>,
+pub struct HistoryCancelBackgroundCompactionResult {
+    /// Whether an in-progress background compaction was cancelled. False when no compaction was running, when the session is remote, or when the underlying processor was unavailable.
+    pub cancelled: bool,
 }
 
-/// Canonical files and directories where custom instructions can be created so the runtime will recognize them.
+/// Parameters for clearing the conversation and seeding the window that replaces it.
 ///
 /// <div class="warning">
 ///
@@ -5960,12 +5936,12 @@ pub struct InstructionDiscoveryPath {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct InstructionDiscoveryPathList {
-    /// Canonical instruction create/discovery files and directories, in priority order
-    pub paths: Vec<InstructionDiscoveryPath>,
+pub struct HistoryClearContextRequest {
+    /// First user message of the fresh context window. Required: a cleared window holding only system and developer messages is not a conversation a model can answer, so every clear seeds the window it creates. Delivered by the enclosing turn driver once the agentic loop exits, which is why the call must be made from inside a tool handler.
+    pub prompt: String,
 }
 
-/// Optional project paths to include in instruction discovery.
+/// What a successful clear removed. A clear that could not be applied rejects instead of reporting a count.
 ///
 /// <div class="warning">
 ///
@@ -5975,16 +5951,12 @@ pub struct InstructionDiscoveryPathList {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct InstructionsDiscoverRequest {
-    /// When true, omit the host's instruction sources (user/home-level files and plugin rules), leaving only repository and working-directory sources. For multitenant deployments.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub exclude_host_instructions: Option<bool>,
-    /// Optional list of project directory paths to scan for repository/working-directory instruction sources. When omitted or empty, only user-level and plugin instruction sources are returned (no project scan).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub project_paths: Option<Vec<String>>,
+pub struct HistoryClearContextResult {
+    /// Number of non-system, non-developer messages that were removed from the conversation. Zero only when the window already held no conversation.
+    pub messages_cleared: i64,
 }
 
-/// Optional project paths to include when enumerating instruction discovery targets.
+/// Post-compaction context window usage breakdown
 ///
 /// <div class="warning">
 ///
@@ -5994,16 +5966,25 @@ pub struct InstructionsDiscoverRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct InstructionsGetDiscoveryPathsRequest {
-    /// When true, omit the host's user-level instruction targets, leaving only repository targets. For multitenant deployments (mirrors `discover`'s `excludeHostInstructions`).
+pub struct HistoryCompactContextWindow {
+    /// Token count from non-system messages (user, assistant, tool)
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub exclude_host_instructions: Option<bool>,
-    /// Optional list of project directory paths. When omitted or empty, only the user-level targets are returned.
+    pub conversation_tokens: Option<i64>,
+    /// Current total tokens in the context window (system + conversation + tool definitions)
+    pub current_tokens: i64,
+    /// Current number of messages in the conversation
+    pub messages_length: i64,
+    /// Token count from system message(s)
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub project_paths: Option<Vec<String>>,
+    pub system_tokens: Option<i64>,
+    /// Maximum token count for the model's context window
+    pub token_limit: i64,
+    /// Token count from tool definitions
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tool_definitions_tokens: Option<i64>,
 }
 
-/// Loaded instruction source for a session, including path, content, category, location, applicability, and optional description.
+/// Optional compaction parameters.
 ///
 /// <div class="warning">
 ///
@@ -6013,34 +5994,19 @@ pub struct InstructionsGetDiscoveryPathsRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct InstructionSource {
-    /// Glob pattern(s) from frontmatter — when set, this instruction applies only to matching files
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub apply_to: Option<Vec<String>>,
-    /// Raw content of the instruction file
-    pub content: String,
-    /// When true, this source starts disabled and must be toggled on by the user
+pub struct HistoryCompactRequest {
+    /// Optional user-provided instructions to focus the compaction summary
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub default_disabled: Option<bool>,
-    /// Short description (body after frontmatter) for use in instruction tables
+    pub custom_instructions: Option<String>,
+    /// Context window token limit this compaction is targeting, recorded as the `tokenLimit` on the persisted `session.compaction_start` / `session.compaction_complete` events. Set it when the compaction targets a window other than the compacting model's own, e.g. switching to a model with a smaller context window: the compaction still runs on the current model, so the limit that motivated it would otherwise be lost. When absent, the events record the compacting model's own resolved limit. Attribution metadata only - it does not change how much the compaction removes.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    /// Unique identifier for this source (used for toggling)
-    pub id: String,
-    /// Human-readable label
-    pub label: String,
-    /// Where this source lives — used for UI grouping
-    pub location: InstructionSourceLocation,
-    /// The project path this source was discovered from. Only set by sessionless discovery for repository, working-directory, and project-scoped plugin sources, where it disambiguates sources across multiple workspace roots. The session-scoped getSources leaves it unset.
+    pub token_limit: Option<i64>,
+    /// What initiated this compaction request, recorded as the `trigger` on the persisted `session.compaction_start` / `session.compaction_complete` events. When absent, the compaction is persisted without trigger attribution (initiator unknown).
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub project_path: Option<String>,
-    /// File path relative to repo or absolute for home
-    pub source_path: String,
-    /// Category of instruction source — used for merge logic
-    pub r#type: InstructionSourceType,
+    pub trigger: Option<HistoryCompactRequestTrigger>,
 }
 
-/// Instruction sources loaded for the session, in merge order.
+/// Compaction outcome with the number of tokens and messages removed, summary text, and the resulting context window breakdown.
 ///
 /// <div class="warning">
 ///
@@ -6050,12 +6016,22 @@ pub struct InstructionSource {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct InstructionsGetSourcesResult {
-    /// Instruction sources for the session
-    pub sources: Vec<InstructionSource>,
+pub struct HistoryCompactResult {
+    /// Post-compaction context window usage breakdown
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub context_window: Option<HistoryCompactContextWindow>,
+    /// Number of messages removed during compaction
+    pub messages_removed: i64,
+    /// Whether compaction completed successfully
+    pub success: bool,
+    /// Summary text produced by compaction. Omitted when compaction did not produce a summary (e.g. failure path).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub summary_content: Option<String>,
+    /// Number of tokens freed by compaction
+    pub tokens_removed: i64,
 }
 
-/// Parameters for interrupting the main agent turn.
+/// A root user turn that the session can rewind to.
 ///
 /// <div class="warning">
 ///
@@ -6065,13 +6041,28 @@ pub struct InstructionsGetSourcesResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct InterruptMainTurnRequest {
-    /// When true, the user's queued prompts are preserved and run as the next turn once the interrupted turn unwinds; when false (the default), the queue is cleared like a plain abort.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub flush_queued: Option<bool>,
+pub struct HistoryRewindPoint {
+    /// Whether at least one file in this turn or a later turn can be restored.
+    pub can_restore_files: bool,
+    /// ID of the user.message event that begins the discarded suffix.
+    pub event_id: String,
+    /// Number of unique files in this turn and all later turns that have captured changes.
+    pub file_count: i64,
+    /// Whether this turn was an automatically injected autopilot continuation.
+    pub is_autopilot_continuation: bool,
+    /// Lines added by this turn's captured file changes.
+    pub lines_added: i64,
+    /// Lines removed by this turn's captured file changes.
+    pub lines_removed: i64,
+    /// ISO timestamp of the user turn.
+    pub timestamp: String,
+    /// Whether this turn itself captured any file changes.
+    pub turn_changed_files: bool,
+    /// User-visible message text for the turn.
+    pub user_message: String,
 }
 
-/// Result of interrupting the main agent turn.
+/// Rewind points and file-change-tracking availability for the session.
 ///
 /// <div class="warning">
 ///
@@ -6081,79 +6072,32 @@ pub struct InterruptMainTurnRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct InterruptMainTurnResult {
-    /// Whether an in-flight main agent turn was interrupted. False when the main loop was not processing.
-    pub interrupted: bool,
+pub struct HistoryListRewindPointsResult {
+    /// Whether this session captured file changes from its first turn.
+    pub file_change_tracking_enabled: bool,
+    /// Root user turns in chronological order. Empty when `unavailableReason` is set.
+    pub points: Vec<HistoryRewindPoint>,
+    /// Why the listed points could not be produced, when applicable; the points list is empty whenever it is set. `unsupported-remote-session` is permanent for the session and comes with `fileChangeTrackingEnabled: false`. `session-busy` is transient and only ever reported by a session that *is* tracking (`fileChangeTrackingEnabled: true`), because the file-change captures cannot be read while work that may still mutate them is in flight; the same request succeeds once the session settles, so a client that wants points should retry rather than treat it as a failure. It is never `file-change-tracking-disabled`: an untracked local session still lists conversation-only points and reports that through `fileChangeTrackingEnabled: false`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub unavailable_reason: Option<HistoryRewindUnavailableReason>,
 }
 
-/// A request body chunk or cancellation signal.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct LlmInferenceHttpRequestChunkRequest {
-    /// Identity of the agent invocation (one agentic loop) this body chunk belongs to, matching the `agentInvocationId` semantics on httpRequestStart. Carried per chunk so a persistent transport can attribute successive turns correctly: when a WebSocket connection is reused across turns, the httpRequestStart identity reflects only the turn that opened the connection, so each later turn stamps its own invocation id here. Absent when the runtime has no invocation context for the request, or on the plain-HTTP transport where every request has its own httpRequestStart.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub agent_invocation_id: Option<String>,
-    /// When true, `data` is base64-encoded bytes. When absent or false, `data` is UTF-8 text.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub binary: Option<bool>,
-    /// When true, the runtime is cancelling the in-flight request (e.g. upstream consumer aborted). `data` is ignored. Implies end-of-request.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cancel: Option<bool>,
-    /// Optional human-readable reason for the cancellation, propagated for logging.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cancel_reason: Option<String>,
-    /// Body byte range. UTF-8 text when `binary` is absent or false; base64-encoded bytes when `binary` is true. May be empty.
-    pub data: String,
-    /// When true, this is the final body chunk for the request. The SDK may rely on having received an end-marked chunk before treating the request body as complete.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub end: Option<bool>,
-    /// Matches the requestId from the originating httpRequestStart frame.
-    pub request_id: RequestId,
-}
-
-/// Acknowledgement. The SDK is free to ignore the ack and treat chunk delivery as fire-and-forget.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct LlmInferenceHttpRequestChunkResult {}
-
-/// The head of an outbound model-layer HTTP request.
+/// Event boundary to preview for conversation-and-files rewind.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct LlmInferenceHttpRequestStartRequest {
-    /// Stable identity of the agent trajectory that issued this request. Present when the request originates from an agent turn; absent for requests outside any agent context. This is the same identity used by lifecycle and bridged session events and remains constant across turns and retries.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub agent_id: Option<String>,
-    /// Identity of the agent invocation (one agentic loop) that issued this request. It remains fixed across physical retries within the invocation and is distinct from the stable trajectory `agentId`. A caller-supplied invocation id always takes precedence (this covers auxiliary calls that have no model call id). Otherwise, first-party CAPI requests fall back to the runtime's agent task id — the same value the runtime emits as the `X-Agent-Task-Id` header — while custom-provider requests fall back to the model call id.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub agent_invocation_id: Option<String>,
-    /// HTTP request headers, preserving multiple values per name.
-    pub headers: HashMap<String, Vec<String>>,
-    /// Coarse classification of the interaction that produced this request. Open string for forward-compatibility; known values include `conversation-agent`, `conversation-subagent`, `conversation-sampling`, `conversation-background`, `conversation-compaction`, and `conversation-user`. Absent when the runtime did not classify the request. Comes from the runtime's per-request agent context independently of transport; on the CAPI transport the runtime derives the upstream `X-Interaction-Type` header from this same context.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub interaction_type: Option<String>,
-    /// HTTP method, e.g. GET, POST.
-    pub method: String,
-    /// Stable identity of the immediate parent trajectory. Present for child trajectories such as subagents and conversation-sampling requests; absent for root-agent and non-agent requests.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub parent_agent_id: Option<String>,
-    /// Opaque runtime-minted id, unique per in-flight request. The SDK uses this to correlate httpRequestChunk frames and to address its httpResponseStart / httpResponseChunk replies back to the runtime.
-    pub request_id: RequestId,
-    /// Id of the runtime session that triggered this request, when one is in scope. Absent for requests issued outside any session (e.g. startup model-catalog or capability resolution). This is a payload field — not a dispatch key — because the client-global API is registered process-wide rather than per session.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub session_id: Option<SessionId>,
-    /// Transport the runtime would otherwise use for this request. `http` (the default when absent) covers plain HTTP and SSE responses; `websocket` indicates a full-duplex message channel where each body chunk maps to one WebSocket message and the `binary` flag distinguishes text from binary frames. The SDK consumer uses this to decide whether to service the request with an HTTP client or a WebSocket client. It is the one piece of request metadata the consumer cannot reliably infer from the URL or headers alone.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub transport: Option<LlmInferenceHttpRequestStartTransport>,
-    /// Absolute request URL.
-    pub url: String,
+pub struct HistoryPreviewRewindRequest {
+    /// ID of the user.message event that begins the discarded suffix.
+    pub event_id: String,
 }
 
-/// Acknowledgement. Returning successfully simply means the SDK accepted the start frame; it does not imply the request will succeed.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct LlmInferenceHttpRequestStartResult {}
-
-/// Set to terminate the response with a transport-level failure. Implies end-of-stream; any further chunks for this requestId are ignored.
+/// A file that a conversation-and-files rewind would restore.
 ///
 /// <div class="warning">
 ///
@@ -6163,15 +6107,18 @@ pub struct LlmInferenceHttpRequestStartResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct LlmInferenceHttpResponseChunkError {
-    /// Optional machine-readable error code.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub code: Option<String>,
-    /// Human-readable failure description.
-    pub message: String,
+pub struct HistoryRewindFilePreview {
+    /// Aggregate change made across the discarded turns.
+    pub change_type: HistoryRewindChangeType,
+    /// Lines added across the discarded turns.
+    pub lines_added: i64,
+    /// Lines removed across the discarded turns.
+    pub lines_removed: i64,
+    /// Absolute path of the captured file.
+    pub path: String,
 }
 
-/// A response body chunk or terminal error.
+/// Files and aggregate changes for a prospective rewind.
 ///
 /// <div class="warning">
 ///
@@ -6181,23 +6128,19 @@ pub struct LlmInferenceHttpResponseChunkError {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct LlmInferenceHttpResponseChunkRequest {
-    /// When true, `data` is base64-encoded bytes. When absent or false, `data` is UTF-8 text.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub binary: Option<bool>,
-    /// Body byte range. UTF-8 text when `binary` is absent or false; base64-encoded bytes when `binary` is true. May be empty (e.g. when the response body is empty: send a single chunk with empty data and end=true).
-    pub data: String,
-    /// When true, this is the final body chunk for the response. The runtime treats the response body as complete after receiving an end-marked chunk.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub end: Option<bool>,
-    /// Set to terminate the response with a transport-level failure. Implies end-of-stream; any further chunks for this requestId are ignored.
+pub struct HistoryPreviewRewindResult {
+    /// Whether file restore is available for this session. This is authoritative: switch on it and read `reason` only when it is false.
+    pub available: bool,
+    /// Number of unique files in the preview.
+    pub file_count: i64,
+    /// Files ordered by path.
+    pub files: Vec<HistoryRewindFilePreview>,
+    /// Why file restore is unavailable, when applicable. Populated only when `available` is false and never set when `available` is true.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<LlmInferenceHttpResponseChunkError>,
-    /// Matches the requestId from the originating httpRequestStart frame.
-    pub request_id: RequestId,
+    pub reason: Option<HistoryRewindUnavailableReason>,
 }
 
-/// Whether the chunk was accepted.
+/// Boundary and mode for rewinding session history.
 ///
 /// <div class="warning">
 ///
@@ -6207,12 +6150,14 @@ pub struct LlmInferenceHttpResponseChunkRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct LlmInferenceHttpResponseChunkResult {
-    /// True when the chunk was matched to a pending request; false when unknown.
-    pub accepted: bool,
+pub struct HistoryRewindRequest {
+    /// ID of the user.message event that begins the discarded suffix.
+    pub event_id: String,
+    /// Whether to rewind only conversation history or also restore captured files.
+    pub mode: HistoryRewindMode,
 }
 
-/// Response head.
+/// A captured file that rewind intentionally left unchanged.
 ///
 /// <div class="warning">
 ///
@@ -6222,19 +6167,14 @@ pub struct LlmInferenceHttpResponseChunkResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct LlmInferenceHttpResponseStartRequest {
-    /// HTTP response headers, preserving multiple values per name.
-    pub headers: HashMap<String, Vec<String>>,
-    /// Matches the requestId from the originating httpRequestStart frame.
-    pub request_id: RequestId,
-    /// HTTP status code.
-    pub status: i64,
-    /// Optional HTTP status reason phrase.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub status_text: Option<String>,
+pub struct HistorySkippedFileRestore {
+    /// Absolute path of the skipped file.
+    pub path: String,
+    /// Reason the file was not restored.
+    pub reason: HistoryFileRestoreSkipReason,
 }
 
-/// Whether the start frame was accepted.
+/// Structured outcome of a rewind request.
 ///
 /// <div class="warning">
 ///
@@ -6244,12 +6184,22 @@ pub struct LlmInferenceHttpResponseStartRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct LlmInferenceHttpResponseStartResult {
-    /// True when the response start was matched to a pending request; false when unknown.
-    pub accepted: bool,
+pub struct HistoryRewindResult {
+    /// Failure detail. Set only for the failure and partial-failure outcomes (`files-rolled-back`, `rollback-incomplete`, `truncation-failed`, `checkpoint-cleanup-failed`, `snapshot-prune-failed`); omitted for `success` and for the unavailable outcomes (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// Number of persisted events removed by conversation truncation. Present only when truncation succeeded (outcomes `success`, `checkpoint-cleanup-failed`, and `snapshot-prune-failed`); omitted for every unavailable outcome (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`) and for `truncation-failed`, `files-rolled-back`, and `rollback-incomplete`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub events_removed: Option<i64>,
+    /// Overall rewind outcome. This discriminates the result: it governs which of the remaining fields are populated, so consumers must switch on it before reading `eventsRemoved`, `restoredFiles`, `skippedFiles`, or `error`. See each field for the outcomes that populate it.
+    pub outcome: HistoryRewindOutcome,
+    /// Absolute paths restored to their captured preimages. Always empty for conversation-only rewinds and for the unavailable outcomes (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`); only conversation-and-files outcomes that reached the file-restore stage populate it.
+    pub restored_files: Vec<String>,
+    /// Captured files intentionally left unchanged. Always empty for conversation-only rewinds and for the unavailable outcomes (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`); only conversation-and-files outcomes that reached the file-restore stage populate it.
+    pub skipped_files: Vec<HistorySkippedFileRestore>,
 }
 
-/// Indicates whether the calling client was registered as the LLM inference provider.
+/// Markdown summary of the conversation context (empty when not available).
 ///
 /// <div class="warning">
 ///
@@ -6259,12 +6209,12 @@ pub struct LlmInferenceHttpResponseStartResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct LlmInferenceSetProviderResult {
-    /// Whether the provider was set successfully
-    pub success: bool,
+pub struct HistorySummarizeForHandoffResult {
+    /// Markdown summary of the conversation context produced by an LLM. Empty string when there are no messages or when the session does not support local summarization.
+    pub summary: String,
 }
 
-/// Pre-resolved working-directory context for session startup.
+/// Identifier of the event to truncate to; this event and all later events are removed.
 ///
 /// <div class="warning">
 ///
@@ -6274,24 +6224,12 @@ pub struct LlmInferenceSetProviderResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionContext {
-    /// Active git branch
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub branch: Option<String>,
-    /// Most recent working directory for this session
-    pub cwd: String,
-    /// Git repository root, if the cwd was inside a git repo
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub git_root: Option<String>,
-    /// Repository host type
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub host_type: Option<SessionContextHostType>,
-    /// Repository slug in `owner/name` form, when known
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub repository: Option<String>,
+pub struct HistoryTruncateRequest {
+    /// Event ID to truncate to. This event and all events after it are removed from the session.
+    pub event_id: String,
 }
 
-/// Persisted local session metadata, including identifiers, timestamps, summary/name, client, context, detached state, and task ID.
+/// Number of events that were removed by the truncation.
 ///
 /// <div class="warning">
 ///
@@ -6301,36 +6239,36 @@ pub struct SessionContext {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct LocalSessionMetadataValue {
-    /// Runtime client name that created/last resumed this session
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub client_name: Option<String>,
-    /// Pre-resolved working-directory context for session startup.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub context: Option<SessionContext>,
-    /// True for detached maintenance sessions that should be hidden from normal resume lists.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub is_detached: Option<bool>,
-    /// Always false for local sessions.
-    pub is_remote: bool,
-    /// GitHub task ID, when this local session is bound to one. Only present for local sessions exported to remote control.
+pub struct HistoryTruncateResult {
+    /// Failure detail when checkpointCleanupFailed is true.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub mc_task_id: Option<String>,
-    /// Last-modified time of the session's persisted state, as ISO 8601
-    pub modified_time: String,
-    /// Optional human-friendly name set via /rename
+    pub checkpoint_cleanup_error: Option<String>,
+    /// True when conversation truncation succeeded but post-truncation workspace checkpoint cleanup failed. History is already truncated; callers may still prune snapshots but should report a checkpoint-cleanup rather than a truncation failure.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    /// Stable session identifier
+    pub checkpoint_cleanup_failed: Option<bool>,
+    /// Number of events that were removed
+    pub events_removed: i64,
+}
+
+/// Runtime-owned wire payload for a server-to-client hook callback invocation.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct HookInvokeRequest {
+    #[doc(hidden)]
+    pub(crate) hook_type: HookType,
+    pub input: serde_json::Value,
     pub session_id: SessionId,
-    /// Session creation time as an ISO 8601 timestamp
-    pub start_time: String,
-    /// Short summary of the session, when one has been derived
+}
+
+/// Optional output returned by an SDK callback hook.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct HookInvokeResponse {
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub summary: Option<String>,
+    pub output: Option<serde_json::Value>,
 }
 
-/// Message text, optional severity level, persistence flag, optional follow-up URL, and optional tip.
+/// Installed plugin record from global state, with marketplace, version, install time, enabled state, cache path, and source.
 ///
 /// <div class="warning">
 ///
@@ -6340,27 +6278,31 @@ pub struct LocalSessionMetadataValue {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct LogRequest {
-    /// When true, the message is transient and not persisted to the session event log on disk
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub ephemeral: Option<bool>,
-    /// Log severity level. Determines how the message is displayed in the timeline. Defaults to "info".
+pub struct InstalledPlugin {
+    /// Path where the plugin is cached locally
+    #[serde(rename = "cache_path", skip_serializing_if = "Option::is_none")]
+    pub cache_path: Option<String>,
+    /// Whether the plugin is currently enabled
+    pub enabled: bool,
+    /// Installation timestamp
+    #[serde(rename = "installed_at")]
+    pub installed_at: String,
+    /// Marketplace the plugin came from (empty string for direct repo installs)
+    pub marketplace: String,
+    /// Plugin name
+    pub name: String,
+    /// Source for direct repo installs (when marketplace is empty)
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub level: Option<SessionLogLevel>,
-    /// Human-readable message
-    pub message: String,
-    /// Optional actionable tip displayed alongside the message. Only honored on `level: "info"`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub tip: Option<String>,
-    /// Domain category for this log entry (e.g., "mcp", "subscription", "policy", "model"). Maps to `infoType`/`warningType`/`errorType` on the emitted event. Defaults to "notification".
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub r#type: Option<String>,
-    /// Optional URL the user can open in their browser for more details
+    pub source: Option<serde_json::Value>,
+    /// Per-plugin source fingerprint (a SHA-256 hash of the plugin's catalog source spec plus its resolved source subtree — NOT a Git commit SHA) captured at marketplace install/update time. Auto-update compares it against the freshly recomputed fingerprint to detect a content change that does not bump the version. Absent for pre-existing installs and for direct (non-marketplace) installs.
+    #[serde(rename = "source_sha", skip_serializing_if = "Option::is_none")]
+    pub source_sha: Option<String>,
+    /// Version installed (if available)
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub url: Option<String>,
+    pub version: Option<String>,
 }
 
-/// Identifier of the session event that was emitted for the log message.
+/// Information about an installed plugin tracked in global state.
 ///
 /// <div class="warning">
 ///
@@ -6370,12 +6312,22 @@ pub struct LogRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct LogResult {
-    /// The unique identifier of the emitted session event
-    pub event_id: String,
+pub struct InstalledPluginInfo {
+    /// Opaque, stable hash identifying a direct (non-marketplace) install source. Present only for direct repo / URL / local installs; absent for marketplace plugins. Same source yields the same id; distinct sources never collide.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub direct_source_id: Option<String>,
+    /// Whether the plugin is currently enabled for new sessions
+    pub enabled: bool,
+    /// Marketplace the plugin came from. Empty string ("") for direct repo / URL / local installs.
+    pub marketplace: String,
+    /// Plugin name
+    pub name: String,
+    /// Installed version (when reported by the plugin manifest)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub version: Option<String>,
 }
 
-/// Parameters for (re)loading the merged LSP configuration set.
+/// Source descriptor for a direct GitHub plugin install, with `owner/repo`, optional ref or full commit SHA, and optional subpath.
 ///
 /// <div class="warning">
 ///
@@ -6385,19 +6337,23 @@ pub struct LogResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct LspInitializeRequest {
-    /// Force re-initialization even when LSP configs were already loaded for the working directory.
+pub struct InstalledPluginSourceGitHub {
+    /// Optional repository-relative path to the plugin.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub force: Option<bool>,
-    /// Git root used as the boundary when traversing for project-level LSP configs (supports monorepos).
+    pub path: Option<String>,
+    /// Optional Git ref to resolve.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub git_root: Option<String>,
-    /// Working directory used to load project-level LSP configs. Defaults to the session working directory when omitted.
+    pub r#ref: Option<String>,
+    /// GitHub repository in `owner/repo` form.
+    pub repo: String,
+    /// Optional full 40-character hexadecimal commit SHA.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub working_directory: Option<String>,
+    pub sha: Option<String>,
+    /// Constant value. Always "github".
+    pub source: InstalledPluginSourceGitHubSource,
 }
 
-/// Validated device-managed settings discovered before a session exists.
+/// Source descriptor for a direct local plugin install, with a local filesystem path.
 ///
 /// <div class="warning">
 ///
@@ -6407,16 +6363,14 @@ pub struct LspInitializeRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ManagedSettingsReadResult {
-    /// Discovery or validation error text when managed settings could not be read safely.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error_message: Option<String>,
-    /// Validated, canonical managed-settings JSON. Omitted when no managed settings were discovered or when discovered settings failed validation.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub settings_json: Option<serde_json::Value>,
+pub struct InstalledPluginSourceLocal {
+    /// Local filesystem path to the plugin.
+    pub path: String,
+    /// Constant value. Always "local".
+    pub source: InstalledPluginSourceLocalSource,
 }
 
-/// Result of registering a new marketplace.
+/// Source descriptor for a direct URL plugin install, with URL, optional ref or full commit SHA, and optional subpath.
 ///
 /// <div class="warning">
 ///
@@ -6426,12 +6380,23 @@ pub struct ManagedSettingsReadResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MarketplaceAddResult {
-    /// Final name of the marketplace as resolved from its manifest
-    pub name: String,
+pub struct InstalledPluginSourceUrl {
+    /// Optional source-relative path to the plugin.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub path: Option<String>,
+    /// Optional Git ref to resolve.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub r#ref: Option<String>,
+    /// Optional full 40-character hexadecimal commit SHA.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub sha: Option<String>,
+    /// Constant value. Always "url".
+    pub source: InstalledPluginSourceUrlSource,
+    /// URL of the plugin source.
+    pub url: String,
 }
 
-/// Plugin entry advertised by a marketplace.
+/// Canonical file or directory where custom instructions can be discovered or created, with location, kind, preference, and project path.
 ///
 /// <div class="warning">
 ///
@@ -6441,15 +6406,21 @@ pub struct MarketplaceAddResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MarketplacePluginInfo {
-    /// Short description from the marketplace catalog, when present
+pub struct InstructionDiscoveryPath {
+    /// Whether the target is a single file or a directory of instruction files
+    pub kind: InstructionDiscoveryPathKind,
+    /// Which tier this target belongs to
+    pub location: InstructionDiscoveryPathLocation,
+    /// Absolute path of the file or directory (may not exist on disk yet)
+    pub path: String,
+    /// Whether this is the canonical target to create new instructions in its tier. At most one entry per tier is preferred.
+    pub preferred_for_creation: bool,
+    /// The input project path this target was derived from (only for repository targets)
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    /// Plugin name as listed in the marketplace catalog
-    pub name: String,
+    pub project_path: Option<String>,
 }
 
-/// Plugins advertised by the marketplace.
+/// Canonical files and directories where custom instructions can be created so the runtime will recognize them.
 ///
 /// <div class="warning">
 ///
@@ -6459,12 +6430,12 @@ pub struct MarketplacePluginInfo {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MarketplaceBrowseResult {
-    /// Plugins advertised by the marketplace
-    pub plugins: Vec<MarketplacePluginInfo>,
+pub struct InstructionDiscoveryPathList {
+    /// Canonical instruction create/discovery files and directories, in priority order
+    pub paths: Vec<InstructionDiscoveryPath>,
 }
 
-/// Registered marketplace summary.
+/// Optional project paths to include in instruction discovery.
 ///
 /// <div class="warning">
 ///
@@ -6474,17 +6445,16 @@ pub struct MarketplaceBrowseResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MarketplaceInfo {
-    /// True when this is a default marketplace shipped with the runtime. Defaults are not removable.
+pub struct InstructionsDiscoverRequest {
+    /// When true, omit the host's instruction sources (user/home-level files and plugin rules), leaving only repository and working-directory sources. For multitenant deployments.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub is_default: Option<bool>,
-    /// Marketplace name (matches the @marketplace suffix in plugin specs)
-    pub name: String,
-    /// Human-readable description of where the marketplace data is fetched from (e.g. "GitHub: owner/repo").
-    pub source: String,
+    pub exclude_host_instructions: Option<bool>,
+    /// Optional list of project directory paths to scan for repository/working-directory instruction sources. When omitted or empty, only user-level and plugin instruction sources are returned (no project scan).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub project_paths: Option<Vec<String>>,
 }
 
-/// All registered marketplaces, including built-in defaults.
+/// Optional project paths to include when enumerating instruction discovery targets.
 ///
 /// <div class="warning">
 ///
@@ -6494,12 +6464,16 @@ pub struct MarketplaceInfo {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MarketplaceListResult {
-    /// Registered marketplaces
-    pub marketplaces: Vec<MarketplaceInfo>,
+pub struct InstructionsGetDiscoveryPathsRequest {
+    /// When true, omit the host's user-level instruction targets, leaving only repository targets. For multitenant deployments (mirrors `discover`'s `excludeHostInstructions`).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub exclude_host_instructions: Option<bool>,
+    /// Optional list of project directory paths. When omitted or empty, only the user-level targets are returned.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub project_paths: Option<Vec<String>>,
 }
 
-/// Per-marketplace refresh result, including marketplace name, success flag, and optional failure error.
+/// Loaded instruction source for a session, including path, content, category, location, applicability, and optional description.
 ///
 /// <div class="warning">
 ///
@@ -6509,17 +6483,34 @@ pub struct MarketplaceListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MarketplaceRefreshEntry {
-    /// Error message (failure only)
+pub struct InstructionSource {
+    /// Glob pattern(s) from frontmatter — when set, this instruction applies only to matching files
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Marketplace name that was refreshed
-    pub name: String,
-    /// Whether the refresh succeeded
-    pub success: bool,
+    pub apply_to: Option<Vec<String>>,
+    /// Raw content of the instruction file
+    pub content: String,
+    /// When true, this source starts disabled and must be toggled on by the user
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub default_disabled: Option<bool>,
+    /// Short description (body after frontmatter) for use in instruction tables
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// Unique identifier for this source (used for toggling)
+    pub id: String,
+    /// Human-readable label
+    pub label: String,
+    /// Where this source lives — used for UI grouping
+    pub location: InstructionSourceLocation,
+    /// The project path this source was discovered from. Only set by sessionless discovery for repository, working-directory, and project-scoped plugin sources, where it disambiguates sources across multiple workspace roots. The session-scoped getSources leaves it unset.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub project_path: Option<String>,
+    /// File path relative to repo or absolute for home
+    pub source_path: String,
+    /// Category of instruction source — used for merge logic
+    pub r#type: InstructionSourceType,
 }
 
-/// Result of refreshing one or more marketplace catalogs.
+/// Instruction sources loaded for the session, in merge order.
 ///
 /// <div class="warning">
 ///
@@ -6529,12 +6520,12 @@ pub struct MarketplaceRefreshEntry {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MarketplaceRefreshResult {
-    /// Per-marketplace refresh results in deterministic order.
-    pub results: Vec<MarketplaceRefreshEntry>,
+pub struct InstructionsGetSourcesResult {
+    /// Instruction sources for the session
+    pub sources: Vec<InstructionSource>,
 }
 
-/// Outcome of the remove attempt, including dependent-plugin info when applicable.
+/// Parameters for interrupting the main agent turn.
 ///
 /// <div class="warning">
 ///
@@ -6544,15 +6535,13 @@ pub struct MarketplaceRefreshResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MarketplaceRemoveResult {
-    /// Names of installed plugins that prevented removal. Populated only when `removed=false`.
+pub struct InterruptMainTurnRequest {
+    /// When true, the user's queued prompts are preserved and run as the next turn once the interrupted turn unwinds; when false (the default), the queue is cleared like a plain abort.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub dependent_plugins: Option<Vec<String>>,
-    /// True when the marketplace was actually removed. False when removal was skipped because the marketplace has dependent plugins and `force` was not set.
-    pub removed: bool,
+    pub flush_queued: Option<bool>,
 }
 
-/// MCP server allowed by policy, with server name and optional PII-free explanatory note.
+/// Result of interrupting the main agent turn.
 ///
 /// <div class="warning">
 ///
@@ -6562,56 +6551,79 @@ pub struct MarketplaceRemoveResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpAllowedServer {
-    /// Allowed server name
-    pub name: String,
-    /// PII-free note explaining why the server was allowed
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub redacted_note: Option<String>,
+pub struct InterruptMainTurnResult {
+    /// Whether an in-flight main agent turn was interrupted. False when the main loop was not processing.
+    pub interrupted: bool,
 }
 
-/// MCP server, tool name, and arguments to invoke from an MCP App view.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
+/// A request body chunk or cancellation signal.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpAppsCallToolRequest {
-    /// Tool arguments
+pub struct LlmInferenceHttpRequestChunkRequest {
+    /// Identity of the agent invocation (one agentic loop) this body chunk belongs to, matching the `agentInvocationId` semantics on httpRequestStart. Carried per chunk so a persistent transport can attribute successive turns correctly: when a WebSocket connection is reused across turns, the httpRequestStart identity reflects only the turn that opened the connection, so each later turn stamps its own invocation id here. Absent when the runtime has no invocation context for the request, or on the plain-HTTP transport where every request has its own httpRequestStart.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub arguments: Option<HashMap<String, serde_json::Value>>,
-    /// **Required.** Server whose ui:// view issued the request. Per SEP-1865 ('callable by the app from this server only'), the call is rejected when this differs from `serverName`, and rejected outright when missing.
-    pub origin_server_name: String,
-    /// MCP server hosting the tool
-    pub server_name: String,
-    /// MCP tool name
-    pub tool_name: String,
+    pub agent_invocation_id: Option<String>,
+    /// When true, `data` is base64-encoded bytes. When absent or false, `data` is UTF-8 text.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub binary: Option<bool>,
+    /// When true, the runtime is cancelling the in-flight request (e.g. upstream consumer aborted). `data` is ignored. Implies end-of-request.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cancel: Option<bool>,
+    /// Optional human-readable reason for the cancellation, propagated for logging.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cancel_reason: Option<String>,
+    /// Body byte range. UTF-8 text when `binary` is absent or false; base64-encoded bytes when `binary` is true. May be empty.
+    pub data: String,
+    /// When true, this is the final body chunk for the request. The SDK may rely on having received an end-marked chunk before treating the request body as complete.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub end: Option<bool>,
+    /// Matches the requestId from the originating httpRequestStart frame.
+    pub request_id: RequestId,
 }
 
-/// Capability negotiation snapshot
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
+/// Acknowledgement. The SDK is free to ignore the ack and treat chunk delivery as fire-and-forget.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpAppsDiagnoseCapability {
-    /// Whether the runtime advertises `extensions.io.modelcontextprotocol/ui` to MCP servers
-    pub advertised: bool,
-    /// Whether the MCP_APPS feature flag (or COPILOT_MCP_APPS env override) is on
-    pub feature_flag_enabled: bool,
-    /// Whether the session has the `mcp-apps` capability
-    pub session_has_mcp_apps: bool,
+pub struct LlmInferenceHttpRequestChunkResult {}
+
+/// The head of an outbound model-layer HTTP request.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct LlmInferenceHttpRequestStartRequest {
+    /// Stable identity of the agent trajectory that issued this request. Present when the request originates from an agent turn; absent for requests outside any agent context. This is the same identity used by lifecycle and bridged session events and remains constant across turns and retries.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub agent_id: Option<String>,
+    /// Identity of the agent invocation (one agentic loop) that issued this request. It remains fixed across physical retries within the invocation and is distinct from the stable trajectory `agentId`. A caller-supplied invocation id always takes precedence (this covers auxiliary calls that have no model call id). Otherwise, first-party CAPI requests fall back to the runtime's agent task id — the same value the runtime emits as the `X-Agent-Task-Id` header — while custom-provider requests fall back to the model call id.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub agent_invocation_id: Option<String>,
+    /// HTTP request headers, preserving multiple values per name.
+    pub headers: HashMap<String, Vec<String>>,
+    /// Coarse classification of the interaction that produced this request. Open string for forward-compatibility; known values include `conversation-agent`, `conversation-subagent`, `conversation-sampling`, `conversation-background`, `conversation-compaction`, and `conversation-user`. Absent when the runtime did not classify the request. Comes from the runtime's per-request agent context independently of transport; on the CAPI transport the runtime derives the upstream `X-Interaction-Type` header from this same context.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub interaction_type: Option<String>,
+    /// HTTP method, e.g. GET, POST.
+    pub method: String,
+    /// Stable identity of the immediate parent trajectory. Present for child trajectories such as subagents and conversation-sampling requests; absent for root-agent and non-agent requests.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub parent_agent_id: Option<String>,
+    /// Opaque runtime-minted id, unique per in-flight request. The SDK uses this to correlate httpRequestChunk frames and to address its httpResponseStart / httpResponseChunk replies back to the runtime.
+    pub request_id: RequestId,
+    /// Id of the runtime session that triggered this request, when one is in scope. Absent for requests issued outside any session (e.g. startup model-catalog or capability resolution). This is a payload field — not a dispatch key — because the client-global API is registered process-wide rather than per session.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub session_id: Option<SessionId>,
+    /// Transport the runtime would otherwise use for this request. `http` (the default when absent) covers plain HTTP and SSE responses; `websocket` indicates a full-duplex message channel where each body chunk maps to one WebSocket message and the `binary` flag distinguishes text from binary frames. The SDK consumer uses this to decide whether to service the request with an HTTP client or a WebSocket client. It is the one piece of request metadata the consumer cannot reliably infer from the URL or headers alone.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub transport: Option<LlmInferenceHttpRequestStartTransport>,
+    /// Absolute request URL.
+    pub url: String,
 }
 
-/// MCP server to diagnose MCP Apps wiring for.
+/// Acknowledgement. Returning successfully simply means the SDK accepted the start frame; it does not imply the request will succeed.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct LlmInferenceHttpRequestStartResult {}
+
+/// Set to terminate the response with a transport-level failure. Implies end-of-stream; any further chunks for this requestId are ignored.
 ///
 /// <div class="warning">
 ///
@@ -6621,12 +6633,15 @@ pub struct McpAppsDiagnoseCapability {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpAppsDiagnoseRequest {
-    /// MCP server to probe
-    pub server_name: String,
+pub struct LlmInferenceHttpResponseChunkError {
+    /// Optional machine-readable error code.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub code: Option<String>,
+    /// Human-readable failure description.
+    pub message: String,
 }
 
-/// What the server returned for this session
+/// A response body chunk or terminal error.
 ///
 /// <div class="warning">
 ///
@@ -6636,18 +6651,23 @@ pub struct McpAppsDiagnoseRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpAppsDiagnoseServer {
-    /// Whether the named server is currently connected
-    pub connected: bool,
-    /// Up to 5 tool names with `_meta.ui` for quick inspection
-    pub sample_tool_names: Vec<String>,
-    /// Total tools returned by the server's tools/list
-    pub tool_count: f64,
-    /// Tools whose `_meta.ui` is populated (resourceUri and/or visibility set)
-    pub tools_with_ui_meta: f64,
+pub struct LlmInferenceHttpResponseChunkRequest {
+    /// When true, `data` is base64-encoded bytes. When absent or false, `data` is UTF-8 text.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub binary: Option<bool>,
+    /// Body byte range. UTF-8 text when `binary` is absent or false; base64-encoded bytes when `binary` is true. May be empty (e.g. when the response body is empty: send a single chunk with empty data and end=true).
+    pub data: String,
+    /// When true, this is the final body chunk for the response. The runtime treats the response body as complete after receiving an end-marked chunk.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub end: Option<bool>,
+    /// Set to terminate the response with a transport-level failure. Implies end-of-stream; any further chunks for this requestId are ignored.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<LlmInferenceHttpResponseChunkError>,
+    /// Matches the requestId from the originating httpRequestStart frame.
+    pub request_id: RequestId,
 }
 
-/// Diagnostic snapshot of MCP Apps wiring for the named server.
+/// Whether the chunk was accepted.
 ///
 /// <div class="warning">
 ///
@@ -6657,14 +6677,12 @@ pub struct McpAppsDiagnoseServer {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpAppsDiagnoseResult {
-    /// Capability negotiation snapshot
-    pub capability: McpAppsDiagnoseCapability,
-    /// What the server returned for this session
-    pub server: McpAppsDiagnoseServer,
+pub struct LlmInferenceHttpResponseChunkResult {
+    /// True when the chunk was matched to a pending request; false when unknown.
+    pub accepted: bool,
 }
 
-/// Current host context
+/// Response head.
 ///
 /// <div class="warning">
 ///
@@ -6674,31 +6692,19 @@ pub struct McpAppsDiagnoseResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpAppsHostContextDetails {
-    /// Display modes the host supports
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub available_display_modes: Option<Vec<McpAppsHostContextDetailsAvailableDisplayMode>>,
-    /// Current display mode (SEP-1865)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub display_mode: Option<McpAppsHostContextDetailsDisplayMode>,
-    /// BCP-47 locale, e.g. 'en-US'
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub locale: Option<String>,
-    /// Platform type for responsive design
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub platform: Option<McpAppsHostContextDetailsPlatform>,
-    /// UI theme preference per SEP-1865
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub theme: Option<McpAppsHostContextDetailsTheme>,
-    /// IANA timezone, e.g. 'America/New_York'
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub time_zone: Option<String>,
-    /// Host application identifier
+pub struct LlmInferenceHttpResponseStartRequest {
+    /// HTTP response headers, preserving multiple values per name.
+    pub headers: HashMap<String, Vec<String>>,
+    /// Matches the requestId from the originating httpRequestStart frame.
+    pub request_id: RequestId,
+    /// HTTP status code.
+    pub status: i64,
+    /// Optional HTTP status reason phrase.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub user_agent: Option<String>,
+    pub status_text: Option<String>,
 }
 
-/// Current host context advertised to MCP App guests.
+/// Whether the start frame was accepted.
 ///
 /// <div class="warning">
 ///
@@ -6708,12 +6714,12 @@ pub struct McpAppsHostContextDetails {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpAppsHostContext {
-    /// Current host context
-    pub context: McpAppsHostContextDetails,
+pub struct LlmInferenceHttpResponseStartResult {
+    /// True when the response start was matched to a pending request; false when unknown.
+    pub accepted: bool,
 }
 
-/// MCP server to list app-callable tools for.
+/// Indicates whether the calling client was registered as the LLM inference provider.
 ///
 /// <div class="warning">
 ///
@@ -6723,14 +6729,12 @@ pub struct McpAppsHostContext {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpAppsListToolsRequest {
-    /// **Required.** Server whose ui:// view issued the request. Per SEP-1865 ('callable by the app from this server only'), the call is rejected when this differs from `serverName`, and rejected outright when missing.
-    pub origin_server_name: String,
-    /// MCP server hosting the app
-    pub server_name: String,
+pub struct LlmInferenceSetProviderResult {
+    /// Whether the provider was set successfully
+    pub success: bool,
 }
 
-/// App-callable tools from the named MCP server.
+/// Pre-resolved working-directory context for session startup.
 ///
 /// <div class="warning">
 ///
@@ -6740,12 +6744,24 @@ pub struct McpAppsListToolsRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpAppsListToolsResult {
-    /// App-callable tools from the server
-    pub tools: Vec<HashMap<String, serde_json::Value>>,
+pub struct SessionContext {
+    /// Active git branch
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub branch: Option<String>,
+    /// Most recent working directory for this session
+    pub cwd: String,
+    /// Git repository root, if the cwd was inside a git repo
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub git_root: Option<String>,
+    /// Repository host type
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub host_type: Option<SessionContextHostType>,
+    /// Repository slug in `owner/name` form, when known
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub repository: Option<String>,
 }
 
-/// MCP server and resource URI to fetch.
+/// Persisted local session metadata, including identifiers, timestamps, summary/name, client, context, detached state, and task ID.
 ///
 /// <div class="warning">
 ///
@@ -6755,14 +6771,36 @@ pub struct McpAppsListToolsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpAppsReadResourceRequest {
-    /// Name of the MCP server hosting the resource
-    pub server_name: String,
-    /// Resource URI (typically ui://...)
-    pub uri: String,
+pub struct LocalSessionMetadataValue {
+    /// Runtime client name that created/last resumed this session
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub client_name: Option<String>,
+    /// Pre-resolved working-directory context for session startup.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub context: Option<SessionContext>,
+    /// True for detached maintenance sessions that should be hidden from normal resume lists.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub is_detached: Option<bool>,
+    /// Always false for local sessions.
+    pub is_remote: bool,
+    /// GitHub task ID, when this local session is bound to one. Only present for local sessions exported to remote control.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mc_task_id: Option<String>,
+    /// Last-modified time of the session's persisted state, as ISO 8601
+    pub modified_time: String,
+    /// Optional human-friendly name set via /rename
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    /// Stable session identifier
+    pub session_id: SessionId,
+    /// Session creation time as an ISO 8601 timestamp
+    pub start_time: String,
+    /// Short summary of the session, when one has been derived
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub summary: Option<String>,
 }
 
-/// MCP Apps resource content with URI, optional MIME type, text or base64 blob, and resource metadata.
+/// Message text, optional severity level, persistence flag, optional follow-up URL, and optional tip.
 ///
 /// <div class="warning">
 ///
@@ -6772,24 +6810,27 @@ pub struct McpAppsReadResourceRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpAppsResourceContent {
-    /// Resource-level metadata (CSP, permissions, etc.)
-    #[serde(rename = "_meta", skip_serializing_if = "Option::is_none")]
-    pub meta: Option<HashMap<String, serde_json::Value>>,
-    /// Base64-encoded binary content
+pub struct LogRequest {
+    /// When true, the message is transient and not persisted to the session event log on disk
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub blob: Option<String>,
-    /// MIME type of the content
+    pub ephemeral: Option<bool>,
+    /// Log severity level. Determines how the message is displayed in the timeline. Defaults to "info".
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub mime_type: Option<String>,
-    /// Text content (e.g. HTML)
+    pub level: Option<SessionLogLevel>,
+    /// Human-readable message
+    pub message: String,
+    /// Optional actionable tip displayed alongside the message. Only honored on `level: "info"`.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub text: Option<String>,
-    /// The resource URI (typically ui://...)
-    pub uri: String,
+    pub tip: Option<String>,
+    /// Domain category for this log entry (e.g., "mcp", "subscription", "policy", "model"). Maps to `infoType`/`warningType`/`errorType` on the emitted event. Defaults to "notification".
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub r#type: Option<String>,
+    /// Optional URL the user can open in their browser for more details
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub url: Option<String>,
 }
 
-/// Resource contents returned by the MCP server.
+/// Identifier of the session event that was emitted for the log message.
 ///
 /// <div class="warning">
 ///
@@ -6799,12 +6840,12 @@ pub struct McpAppsResourceContent {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpAppsReadResourceResult {
-    /// Resource contents returned by the server
-    pub contents: Vec<McpAppsResourceContent>,
+pub struct LogResult {
+    /// The unique identifier of the emitted session event
+    pub event_id: String,
 }
 
-/// Host context advertised to MCP App guests
+/// Parameters for (re)loading the merged LSP configuration set.
 ///
 /// <div class="warning">
 ///
@@ -6814,31 +6855,19 @@ pub struct McpAppsReadResourceResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpAppsSetHostContextDetails {
-    /// Display modes the host supports
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub available_display_modes: Option<Vec<McpAppsSetHostContextDetailsAvailableDisplayMode>>,
-    /// Current display mode (SEP-1865)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub display_mode: Option<McpAppsSetHostContextDetailsDisplayMode>,
-    /// BCP-47 locale, e.g. 'en-US'
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub locale: Option<String>,
-    /// Platform type for responsive design
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub platform: Option<McpAppsSetHostContextDetailsPlatform>,
-    /// UI theme preference per SEP-1865
+pub struct LspInitializeRequest {
+    /// Force re-initialization even when LSP configs were already loaded for the working directory.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub theme: Option<McpAppsSetHostContextDetailsTheme>,
-    /// IANA timezone, e.g. 'America/New_York'
+    pub force: Option<bool>,
+    /// Git root used as the boundary when traversing for project-level LSP configs (supports monorepos).
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub time_zone: Option<String>,
-    /// Host application identifier
+    pub git_root: Option<String>,
+    /// Working directory used to load project-level LSP configs. Defaults to the session working directory when omitted.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub user_agent: Option<String>,
+    pub working_directory: Option<String>,
 }
 
-/// Host context to advertise to MCP App guests.
+/// Validated device-managed settings discovered before a session exists.
 ///
 /// <div class="warning">
 ///
@@ -6848,12 +6877,16 @@ pub struct McpAppsSetHostContextDetails {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpAppsSetHostContextRequest {
-    /// Host context advertised to MCP App guests
-    pub context: McpAppsSetHostContextDetails,
+pub struct ManagedSettingsReadResult {
+    /// Discovery or validation error text when managed settings could not be read safely.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error_message: Option<String>,
+    /// Validated, canonical managed-settings JSON. Omitted when no managed settings were discovered or when discovered settings failed validation.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub settings_json: Option<serde_json::Value>,
 }
 
-/// The requestId previously passed to executeSampling that should be cancelled.
+/// Result of registering a new marketplace.
 ///
 /// <div class="warning">
 ///
@@ -6863,12 +6896,12 @@ pub struct McpAppsSetHostContextRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpCancelSamplingExecutionParams {
-    /// The requestId previously passed to executeSampling that should be cancelled
-    pub request_id: RequestId,
+pub struct MarketplaceAddResult {
+    /// Final name of the marketplace as resolved from its manifest
+    pub name: String,
 }
 
-/// Indicates whether an in-flight sampling execution with the given requestId was found and cancelled.
+/// Plugin entry advertised by a marketplace.
 ///
 /// <div class="warning">
 ///
@@ -6878,12 +6911,15 @@ pub struct McpCancelSamplingExecutionParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpCancelSamplingExecutionResult {
-    /// True if an in-flight execution with the given requestId was found and signalled to cancel. False when no such execution is in flight (already completed, never started, or cancelled by another caller).
-    pub cancelled: bool,
+pub struct MarketplacePluginInfo {
+    /// Short description from the marketplace catalog, when present
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// Plugin name as listed in the marketplace catalog
+    pub name: String,
 }
 
-/// MCP server name and configuration to add to user configuration.
+/// Plugins advertised by the marketplace.
 ///
 /// <div class="warning">
 ///
@@ -6893,14 +6929,12 @@ pub struct McpCancelSamplingExecutionResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpConfigAddRequest {
-    /// MCP server configuration (stdio process or remote HTTP/SSE)
-    pub config: serde_json::Value,
-    /// Unique name for the MCP server
-    pub name: String,
+pub struct MarketplaceBrowseResult {
+    /// Plugins advertised by the marketplace
+    pub plugins: Vec<MarketplacePluginInfo>,
 }
 
-/// MCP server names to disable for new sessions.
+/// Registered marketplace summary.
 ///
 /// <div class="warning">
 ///
@@ -6910,12 +6944,17 @@ pub struct McpConfigAddRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpConfigDisableRequest {
-    /// Names of MCP servers to disable. Each server is added to the persisted disabled list so new sessions skip it. Already-disabled names are ignored. Active sessions keep their current connections until they end.
-    pub names: Vec<String>,
+pub struct MarketplaceInfo {
+    /// True when this is a default marketplace shipped with the runtime. Defaults are not removable.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub is_default: Option<bool>,
+    /// Marketplace name (matches the @marketplace suffix in plugin specs)
+    pub name: String,
+    /// Human-readable description of where the marketplace data is fetched from (e.g. "GitHub: owner/repo").
+    pub source: String,
 }
 
-/// MCP server names to enable for new sessions.
+/// All registered marketplaces, including built-in defaults.
 ///
 /// <div class="warning">
 ///
@@ -6925,12 +6964,12 @@ pub struct McpConfigDisableRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpConfigEnableRequest {
-    /// Names of MCP servers to enable. Each server is removed from the persisted disabled list so new sessions spawn it. Unknown or already-enabled names are ignored.
-    pub names: Vec<String>,
+pub struct MarketplaceListResult {
+    /// Registered marketplaces
+    pub marketplaces: Vec<MarketplaceInfo>,
 }
 
-/// User-configured MCP servers, keyed by server name.
+/// Per-marketplace refresh result, including marketplace name, success flag, and optional failure error.
 ///
 /// <div class="warning">
 ///
@@ -6940,12 +6979,17 @@ pub struct McpConfigEnableRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpConfigList {
-    /// All MCP servers from user config, keyed by name
-    pub servers: HashMap<String, serde_json::Value>,
+pub struct MarketplaceRefreshEntry {
+    /// Error message (failure only)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// Marketplace name that was refreshed
+    pub name: String,
+    /// Whether the refresh succeeded
+    pub success: bool,
 }
 
-/// MCP server name to remove from user configuration.
+/// Result of refreshing one or more marketplace catalogs.
 ///
 /// <div class="warning">
 ///
@@ -6955,12 +6999,12 @@ pub struct McpConfigList {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpConfigRemoveRequest {
-    /// Name of the MCP server to remove
-    pub name: String,
+pub struct MarketplaceRefreshResult {
+    /// Per-marketplace refresh results in deterministic order.
+    pub results: Vec<MarketplaceRefreshEntry>,
 }
 
-/// MCP server name and replacement configuration to write to user configuration.
+/// Outcome of the remove attempt, including dependent-plugin info when applicable.
 ///
 /// <div class="warning">
 ///
@@ -6970,14 +7014,15 @@ pub struct McpConfigRemoveRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpConfigUpdateRequest {
-    /// MCP server configuration (stdio process or remote HTTP/SSE)
-    pub config: serde_json::Value,
-    /// Name of the MCP server to update
-    pub name: String,
+pub struct MarketplaceRemoveResult {
+    /// Names of installed plugins that prevented removal. Populated only when `removed=false`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub dependent_plugins: Option<Vec<String>>,
+    /// True when the marketplace was actually removed. False when removal was skipped because the marketplace has dependent plugins and `force` was not set.
+    pub removed: bool,
 }
 
-/// Credential-free authentication identity used to configure GitHub MCP.
+/// MCP server allowed by policy, with server name and optional PII-free explanatory note.
 ///
 /// <div class="warning">
 ///
@@ -6987,13 +7032,15 @@ pub struct McpConfigUpdateRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub(crate) struct McpConfigureGitHubRequest {
-    /// Opaque runtime auth info for GitHub MCP configuration. Marked internal: an in-process runtime shape (configureGitHubMcp is a no-op over the wire).
-    #[doc(hidden)]
-    pub(crate) auth_info: serde_json::Value,
+pub struct McpAllowedServer {
+    /// Allowed server name
+    pub name: String,
+    /// PII-free note explaining why the server was allowed
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub redacted_note: Option<String>,
 }
 
-/// Result of configuring GitHub MCP.
+/// MCP server, tool name, and arguments to invoke from an MCP App view.
 ///
 /// <div class="warning">
 ///
@@ -7003,12 +7050,19 @@ pub(crate) struct McpConfigureGitHubRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpConfigureGitHubResult {
-    /// Whether GitHub MCP configuration changed.
-    pub changed: bool,
+pub struct McpAppsCallToolRequest {
+    /// Tool arguments
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub arguments: Option<HashMap<String, serde_json::Value>>,
+    /// **Required.** Server whose ui:// view issued the request. Per SEP-1865 ('callable by the app from this server only'), the call is rejected when this differs from `serverName`, and rejected outright when missing.
+    pub origin_server_name: String,
+    /// MCP server hosting the tool
+    pub server_name: String,
+    /// MCP tool name
+    pub tool_name: String,
 }
 
-/// Name of the MCP server to disable for the session.
+/// Capability negotiation snapshot
 ///
 /// <div class="warning">
 ///
@@ -7018,12 +7072,16 @@ pub struct McpConfigureGitHubResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpDisableRequest {
-    /// Name of the MCP server to disable
-    pub server_name: String,
+pub struct McpAppsDiagnoseCapability {
+    /// Whether the runtime advertises `extensions.io.modelcontextprotocol/ui` to MCP servers
+    pub advertised: bool,
+    /// Whether the MCP_APPS feature flag (or COPILOT_MCP_APPS env override) is on
+    pub feature_flag_enabled: bool,
+    /// Whether the session has the `mcp-apps` capability
+    pub session_has_mcp_apps: bool,
 }
 
-/// Optional working directory used as context for MCP server discovery.
+/// MCP server to diagnose MCP Apps wiring for.
 ///
 /// <div class="warning">
 ///
@@ -7033,13 +7091,12 @@ pub struct McpDisableRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpDiscoverRequest {
-    /// Working directory used as context for discovery (e.g., plugin resolution)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub working_directory: Option<String>,
+pub struct McpAppsDiagnoseRequest {
+    /// MCP server to probe
+    pub server_name: String,
 }
 
-/// MCP servers discovered from user, workspace, plugin, and built-in sources.
+/// What the server returned for this session
 ///
 /// <div class="warning">
 ///
@@ -7049,12 +7106,18 @@ pub struct McpDiscoverRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpDiscoverResult {
-    /// MCP servers discovered from all sources
-    pub servers: Vec<DiscoveredMcpServer>,
+pub struct McpAppsDiagnoseServer {
+    /// Whether the named server is currently connected
+    pub connected: bool,
+    /// Up to 5 tool names with `_meta.ui` for quick inspection
+    pub sample_tool_names: Vec<String>,
+    /// Total tools returned by the server's tools/list
+    pub tool_count: f64,
+    /// Tools whose `_meta.ui` is populated (resourceUri and/or visibility set)
+    pub tools_with_ui_meta: f64,
 }
 
-/// Name of the MCP server to enable for the session.
+/// Diagnostic snapshot of MCP Apps wiring for the named server.
 ///
 /// <div class="warning">
 ///
@@ -7064,12 +7127,14 @@ pub struct McpDiscoverResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpEnableRequest {
-    /// Name of the MCP server to enable
-    pub server_name: String,
+pub struct McpAppsDiagnoseResult {
+    /// Capability negotiation snapshot
+    pub capability: McpAppsDiagnoseCapability,
+    /// What the server returned for this session
+    pub server: McpAppsDiagnoseServer,
 }
 
-/// Raw MCP CreateMessageRequest params, as received in the `sampling.requested` event. Treated as opaque at the schema layer; the runtime converts the embedded MCP messages into the OpenAI chat-completion shape internally.
+/// Current host context
 ///
 /// <div class="warning">
 ///
@@ -7079,9 +7144,31 @@ pub struct McpEnableRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpExecuteSamplingRequest {}
+pub struct McpAppsHostContextDetails {
+    /// Display modes the host supports
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub available_display_modes: Option<Vec<McpAppsHostContextDetailsAvailableDisplayMode>>,
+    /// Current display mode (SEP-1865)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub display_mode: Option<McpAppsHostContextDetailsDisplayMode>,
+    /// BCP-47 locale, e.g. 'en-US'
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub locale: Option<String>,
+    /// Platform type for responsive design
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub platform: Option<McpAppsHostContextDetailsPlatform>,
+    /// UI theme preference per SEP-1865
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub theme: Option<McpAppsHostContextDetailsTheme>,
+    /// IANA timezone, e.g. 'America/New_York'
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub time_zone: Option<String>,
+    /// Host application identifier
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub user_agent: Option<String>,
+}
 
-/// Identifiers and raw MCP CreateMessageRequest params used to run a sampling inference.
+/// Current host context advertised to MCP App guests.
 ///
 /// <div class="warning">
 ///
@@ -7091,18 +7178,12 @@ pub struct McpExecuteSamplingRequest {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpExecuteSamplingParams {
-    /// The original MCP JSON-RPC request ID (string or number). Used by the runtime to correlate the inference with the originating MCP request for telemetry; this is distinct from `requestId` (which is the schema-level cancellation handle).
-    pub mcp_request_id: serde_json::Value,
-    /// Raw MCP CreateMessageRequest params, as received in the `sampling.requested` event. Treated as opaque at the schema layer; the runtime converts the embedded MCP messages into the OpenAI chat-completion shape internally.
-    pub request: McpExecuteSamplingRequest,
-    /// Caller-provided unique identifier for this sampling execution. Use this same ID with cancelSamplingExecution to cancel the in-flight call. Must be unique within the session for the lifetime of the call.
-    pub request_id: RequestId,
-    /// Name of the MCP server that initiated the sampling request
-    pub server_name: String,
+pub struct McpAppsHostContext {
+    /// Current host context
+    pub context: McpAppsHostContextDetails,
 }
 
-/// MCP server whose connection attempt failed.
+/// MCP server to list app-callable tools for.
 ///
 /// <div class="warning">
 ///
@@ -7112,15 +7193,14 @@ pub struct McpExecuteSamplingParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpFailedServer {
-    /// The captured connection failure detail.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// The config key of the server that failed to connect.
-    pub name: String,
+pub struct McpAppsListToolsRequest {
+    /// **Required.** Server whose ui:// view issued the request. Per SEP-1865 ('callable by the app from this server only'), the call is rejected when this differs from `serverName`, and rejected outright when missing.
+    pub origin_server_name: String,
+    /// MCP server hosting the app
+    pub server_name: String,
 }
 
-/// MCP server filtered by policy, with name, reason, and optional redacted reason.
+/// App-callable tools from the named MCP server.
 ///
 /// <div class="warning">
 ///
@@ -7130,38 +7210,12 @@ pub struct McpFailedServer {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpFilteredServer {
-    /// Deprecated. This field is no longer populated.
-    #[doc(hidden)]
-    #[deprecated]
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub enterprise_name: Option<String>,
-    /// Filtered server name
-    pub name: String,
-    /// Human-readable filter reason
-    pub reason: String,
-    /// PII-free filter reason
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub redacted_reason: Option<String>,
-}
-
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct McpHeadersHandlePendingHeadersRefreshRequestHeaders {
-    /// Headers to overlay onto the MCP request. Dynamic headers override static config headers but do not replace SDK-managed request headers.
-    pub headers: HashMap<String, String>,
-    /// Headers-refresh response variant discriminator.
-    pub kind: McpHeadersHandlePendingHeadersRefreshRequestHeadersKind,
-}
-
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct McpHeadersHandlePendingHeadersRefreshRequestNone {
-    /// Headers-refresh response variant discriminator.
-    pub kind: McpHeadersHandlePendingHeadersRefreshRequestNoneKind,
+pub struct McpAppsListToolsResult {
+    /// App-callable tools from the server
+    pub tools: Vec<HashMap<String, serde_json::Value>>,
 }
 
-/// MCP headers refresh request id and the host response.
+/// MCP server and resource URI to fetch.
 ///
 /// <div class="warning">
 ///
@@ -7169,16 +7223,16 @@ pub struct McpHeadersHandlePendingHeadersRefreshRequestNone {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpHeadersHandlePendingHeadersRefreshRequestRequest {
-    /// Headers refresh request identifier from mcp.headers_refresh_required
-    pub request_id: RequestId,
-    /// Host response: supply dynamic headers or decline this refresh.
-    pub result: McpHeadersHandlePendingHeadersRefreshRequest,
+pub struct McpAppsReadResourceRequest {
+    /// Name of the MCP server hosting the resource
+    pub server_name: String,
+    /// Resource URI (typically ui://...)
+    pub uri: String,
 }
 
-/// Indicates whether the pending MCP headers refresh response was accepted.
+/// MCP Apps resource content with URI, optional MIME type, text or base64 blob, and resource metadata.
 ///
 /// <div class="warning">
 ///
@@ -7188,12 +7242,24 @@ pub struct McpHeadersHandlePendingHeadersRefreshRequestRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpHeadersHandlePendingHeadersRefreshRequestResult {
-    /// Whether the response was accepted. False if the request was unknown, timed out, or already resolved.
-    pub success: bool,
+pub struct McpAppsResourceContent {
+    /// Resource-level metadata (CSP, permissions, etc.)
+    #[serde(rename = "_meta", skip_serializing_if = "Option::is_none")]
+    pub meta: Option<HashMap<String, serde_json::Value>>,
+    /// Base64-encoded binary content
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub blob: Option<String>,
+    /// MIME type of the content
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mime_type: Option<String>,
+    /// Text content (e.g. HTML)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub text: Option<String>,
+    /// The resource URI (typically ui://...)
+    pub uri: String,
 }
 
-/// Recorded MCP server connection failure.
+/// Resource contents returned by the MCP server.
 ///
 /// <div class="warning">
 ///
@@ -7203,14 +7269,12 @@ pub struct McpHeadersHandlePendingHeadersRefreshRequestResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpServerFailureInfo {
-    /// Failure message produced when the MCP server connection failed.
-    pub message: String,
-    /// epoch-ms timestamp at which the failure was recorded.
-    pub timestamp: i64,
+pub struct McpAppsReadResourceResult {
+    /// Resource contents returned by the server
+    pub contents: Vec<McpAppsResourceContent>,
 }
 
-/// Recorded MCP server pending-auth state.
+/// Host context advertised to MCP App guests
 ///
 /// <div class="warning">
 ///
@@ -7220,12 +7284,31 @@ pub struct McpServerFailureInfo {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpServerNeedsAuthInfo {
-    /// epoch-ms timestamp at which the server signalled it needs authentication.
-    pub timestamp: i64,
+pub struct McpAppsSetHostContextDetails {
+    /// Display modes the host supports
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub available_display_modes: Option<Vec<McpAppsSetHostContextDetailsAvailableDisplayMode>>,
+    /// Current display mode (SEP-1865)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub display_mode: Option<McpAppsSetHostContextDetailsDisplayMode>,
+    /// BCP-47 locale, e.g. 'en-US'
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub locale: Option<String>,
+    /// Platform type for responsive design
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub platform: Option<McpAppsSetHostContextDetailsPlatform>,
+    /// UI theme preference per SEP-1865
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub theme: Option<McpAppsSetHostContextDetailsTheme>,
+    /// IANA timezone, e.g. 'America/New_York'
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub time_zone: Option<String>,
+    /// Host application identifier
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub user_agent: Option<String>,
 }
 
-/// Host-level state, omitted when no MCP host is initialized.
+/// Host context to advertise to MCP App guests.
 ///
 /// <div class="warning">
 ///
@@ -7235,24 +7318,12 @@ pub struct McpServerNeedsAuthInfo {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpHostState {
-    /// Names of currently-connected MCP clients.
-    pub clients: Vec<String>,
-    /// Configured servers that are explicitly disabled.
-    pub disabled_servers: Vec<String>,
-    /// Map of server name to recorded connection failure.
-    pub failed_servers: HashMap<String, McpServerFailureInfo>,
-    /// Configured servers filtered out by MCP server policy.
-    pub filtered_servers: Vec<String>,
-    /// Whether third-party MCP servers are policy-enabled for this session.
-    pub mcp3p_enabled: bool,
-    /// Map of server name to recorded pending-auth state.
-    pub needs_auth_servers: HashMap<String, McpServerNeedsAuthInfo>,
-    /// Names of servers with in-flight connection attempts.
-    pub pending_connections: Vec<String>,
+pub struct McpAppsSetHostContextRequest {
+    /// Host context advertised to MCP App guests
+    pub context: McpAppsSetHostContextDetails,
 }
 
-/// Server name to check running status for.
+/// The requestId previously passed to executeSampling that should be cancelled.
 ///
 /// <div class="warning">
 ///
@@ -7262,12 +7333,12 @@ pub struct McpHostState {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpIsServerRunningRequest {
-    /// Name of the MCP server to check
-    pub server_name: String,
+pub struct McpCancelSamplingExecutionParams {
+    /// The requestId previously passed to executeSampling that should be cancelled
+    pub request_id: RequestId,
 }
 
-/// Whether the named MCP server is running.
+/// Indicates whether an in-flight sampling execution with the given requestId was found and cancelled.
 ///
 /// <div class="warning">
 ///
@@ -7277,12 +7348,12 @@ pub struct McpIsServerRunningRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpIsServerRunningResult {
-    /// True if the server has an active client and transport.
-    pub running: bool,
+pub struct McpCancelSamplingExecutionResult {
+    /// True if an in-flight execution with the given requestId was found and signalled to cancel. False when no such execution is in flight (already completed, never started, or cancelled by another caller).
+    pub cancelled: bool,
 }
 
-/// Server name whose tool list should be returned.
+/// MCP server name and configuration to add to user configuration.
 ///
 /// <div class="warning">
 ///
@@ -7292,12 +7363,14 @@ pub struct McpIsServerRunningResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpListToolsRequest {
-    /// Name of the connected MCP server whose tools to list.
-    pub server_name: String,
+pub struct McpConfigAddRequest {
+    /// MCP server configuration (stdio process or remote HTTP/SSE)
+    pub config: serde_json::Value,
+    /// Unique name for the MCP server
+    pub name: String,
 }
 
-/// Normalized MCP Apps discovery metadata from a tool's `_meta.ui` block.
+/// MCP server names to disable for new sessions.
 ///
 /// <div class="warning">
 ///
@@ -7307,16 +7380,12 @@ pub struct McpListToolsRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpToolUi {
-    /// URI of the tool's MCP App resource, typically a `ui://` resource identifier. Use `session.mcp.resources.read` to fetch its HTML and resource metadata.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub resource_uri: Option<String>,
-    /// Tool visibility advertised by the server. When absent, MCP Apps defaults apply.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub visibility: Option<Vec<McpToolUiVisibility>>,
+pub struct McpConfigDisableRequest {
+    /// Names of MCP servers to disable. Each server is added to the persisted disabled list so new sessions skip it. Already-disabled names are ignored. Active sessions keep their current connections until they end.
+    pub names: Vec<String>,
 }
 
-/// MCP tool metadata with tool name, optional description, and normalized MCP Apps discovery metadata.
+/// MCP server names to enable for new sessions.
 ///
 /// <div class="warning">
 ///
@@ -7326,18 +7395,12 @@ pub struct McpToolUi {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpTools {
-    /// Tool description, when provided.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    /// Tool name.
-    pub name: String,
-    /// Normalized MCP Apps discovery metadata. An empty object indicates that a valid `_meta.ui` block was present without recognized fields.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub ui: Option<McpToolUi>,
+pub struct McpConfigEnableRequest {
+    /// Names of MCP servers to enable. Each server is removed from the persisted disabled list so new sessions spawn it. Unknown or already-enabled names are ignored.
+    pub names: Vec<String>,
 }
 
-/// Tools exposed by the connected MCP server. Throws when the server is not connected.
+/// User-configured MCP servers, keyed by server name.
 ///
 /// <div class="warning">
 ///
@@ -7347,12 +7410,12 @@ pub struct McpTools {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpListToolsResult {
-    /// Tools exposed by the server.
-    pub tools: Vec<McpTools>,
+pub struct McpConfigList {
+    /// All MCP servers from user config, keyed by name
+    pub servers: HashMap<String, serde_json::Value>,
 }
 
-/// Identifies the MCP server whose persisted OAuth credentials were updated.
+/// MCP server name to remove from user configuration.
 ///
 /// <div class="warning">
 ///
@@ -7362,38 +7425,45 @@ pub struct McpListToolsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpOauthAuthenticationStateChangedRequest {
-    /// Whether the target session must mint a session-scoped access token instead of reusing a shared access token persisted by another session.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub refresh_session_token: Option<bool>,
-    /// Name of the MCP server whose OAuth credentials were updated. Omit only when the host cannot identify the server.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub server_name: Option<String>,
+pub struct McpConfigRemoveRequest {
+    /// Name of the MCP server to remove
+    pub name: String,
 }
 
+/// MCP server name and replacement configuration to write to user configuration.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpOauthPendingRequestResponseToken {
-    /// Access token acquired by the SDK host
-    pub access_token: String,
-    /// Token lifetime in seconds, if known.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub expires_in: Option<i64>,
-    /// OAuth response variant discriminator.
-    pub kind: McpOauthPendingRequestResponseTokenKind,
-    /// OAuth token type. Defaults to Bearer when omitted.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub token_type: Option<String>,
+pub struct McpConfigUpdateRequest {
+    /// MCP server configuration (stdio process or remote HTTP/SSE)
+    pub config: serde_json::Value,
+    /// Name of the MCP server to update
+    pub name: String,
 }
 
+/// Credential-free authentication identity used to configure GitHub MCP.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpOauthPendingRequestResponseCancelled {
-    /// OAuth response variant discriminator.
-    pub kind: McpOauthPendingRequestResponseCancelledKind,
+pub(crate) struct McpConfigureGitHubRequest {
+    /// Opaque runtime auth info for GitHub MCP configuration. Marked internal: an in-process runtime shape (configureGitHubMcp is a no-op over the wire).
+    #[doc(hidden)]
+    pub(crate) auth_info: serde_json::Value,
 }
 
-/// Pending MCP OAuth request ID and host-provided token or cancellation response.
+/// Result of configuring GitHub MCP.
 ///
 /// <div class="warning">
 ///
@@ -7401,16 +7471,14 @@ pub struct McpOauthPendingRequestResponseCancelled {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpOauthHandlePendingRequest {
-    /// OAuth request identifier from the mcp.oauth_required event
-    pub request_id: RequestId,
-    /// Host response to the pending OAuth request.
-    pub result: McpOauthPendingRequestResponse,
+pub struct McpConfigureGitHubResult {
+    /// Whether GitHub MCP configuration changed.
+    pub changed: bool,
 }
 
-/// Indicates whether the pending MCP OAuth response was accepted.
+/// Name of the MCP server to disable for the session.
 ///
 /// <div class="warning">
 ///
@@ -7420,12 +7488,12 @@ pub struct McpOauthHandlePendingRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpOauthHandlePendingResult {
-    /// Whether the response was accepted. False if the request was unknown, timed out, or already resolved.
-    pub success: bool,
+pub struct McpDisableRequest {
+    /// Name of the MCP server to disable
+    pub server_name: String,
 }
 
-/// Remote MCP server name and optional overrides controlling reauthentication, OAuth client display name, callback success-page copy, and static OAuth client selection.
+/// Optional working directory used as context for MCP server discovery.
 ///
 /// <div class="warning">
 ///
@@ -7435,33 +7503,13 @@ pub struct McpOauthHandlePendingResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpOauthLoginRequest {
-    /// Optional override for the body text shown on the OAuth loopback callback success page. When omitted, the runtime applies a neutral fallback; callers driving interactive auth should pass surface-specific copy telling the user where to return.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub callback_success_message: Option<String>,
-    /// Optional OAuth client ID override for this login. When set, the runtime uses this pre-registered static client instead of dynamic client registration.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub client_id: Option<String>,
-    /// Optional override for the OAuth client display name shown on the consent screen. Applies to newly registered dynamic clients only — existing registrations keep the name they were created with. When omitted, the runtime applies a neutral fallback; callers driving interactive auth should pass their own surface-specific label so the consent screen matches the product the user sees.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub client_name: Option<String>,
-    /// Optional OAuth client secret override for this login. The runtime treats this as an ephemeral host-owned secret, uses it for this authentication attempt and does not persist it.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub client_secret: Option<String>,
-    /// When true, clears any cached OAuth token for the server and runs a full new authorization. Use when the user explicitly wants to switch accounts or believes their session is stuck.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub force_reauth: Option<bool>,
-    /// Optional OAuth grant type override for this login. Defaults to the server configuration, or authorization_code when no grant type is specified.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub grant_type: Option<McpOauthLoginGrantType>,
-    /// Optional override indicating whether the static OAuth client is public. When false, the runtime treats it as confidential and uses the per-login clientSecret if provided, otherwise retrieving the client secret from the MCP OAuth secret store.
+pub struct McpDiscoverRequest {
+    /// Working directory used as context for discovery (e.g., plugin resolution)
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub public_client: Option<bool>,
-    /// Name of the remote MCP server to authenticate
-    pub server_name: String,
+    pub working_directory: Option<String>,
 }
 
-/// OAuth authorization URL the caller should open, or empty when cached tokens already authenticated the server.
+/// MCP servers discovered from user, workspace, plugin, and built-in sources.
 ///
 /// <div class="warning">
 ///
@@ -7471,13 +7519,12 @@ pub struct McpOauthLoginRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpOauthLoginResult {
-    /// URL the caller should open in a browser to complete OAuth. Omitted when cached tokens were still valid and no browser interaction was needed — the server is already reconnected in that case. When present, the runtime starts the callback listener before returning and continues the flow in the background; completion is signaled via session.mcp_server_status_changed.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub authorization_url: Option<String>,
+pub struct McpDiscoverResult {
+    /// MCP servers discovered from all sources
+    pub servers: Vec<DiscoveredMcpServer>,
 }
 
-/// Remote MCP server name for a passive OAuth status probe.
+/// Name of the MCP server to enable for the session.
 ///
 /// <div class="warning">
 ///
@@ -7487,56 +7534,104 @@ pub struct McpOauthLoginResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpOauthProbeRequest {
-    /// Name of the configured remote MCP server to probe.
+pub struct McpEnableRequest {
+    /// Name of the MCP server to enable
     pub server_name: String,
 }
 
+/// Raw MCP CreateMessageRequest params, as received in the `sampling.requested` event. Treated as opaque at the schema layer; the runtime converts the embedded MCP messages into the OpenAI chat-completion shape internally.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpOauthProbeResultNoAuthRequired {
-    /// HTTP response returned by the server.
-    pub http_response: McpOauthHttpResponse,
-    /// Probe outcome variant discriminator.
-    pub status: McpOauthProbeResultNoAuthRequiredStatus,
-}
+pub struct McpExecuteSamplingRequest {}
 
+/// Identifiers and raw MCP CreateMessageRequest params used to run a sampling inference.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpOauthProbeResultAuthenticated {
-    /// HTTP response returned by the server.
-    pub http_response: McpOauthHttpResponse,
-    /// Probe outcome variant discriminator.
-    pub status: McpOauthProbeResultAuthenticatedStatus,
+pub struct McpExecuteSamplingParams {
+    /// The original MCP JSON-RPC request ID (string or number). Used by the runtime to correlate the inference with the originating MCP request for telemetry; this is distinct from `requestId` (which is the schema-level cancellation handle).
+    pub mcp_request_id: serde_json::Value,
+    /// Raw MCP CreateMessageRequest params, as received in the `sampling.requested` event. Treated as opaque at the schema layer; the runtime converts the embedded MCP messages into the OpenAI chat-completion shape internally.
+    pub request: McpExecuteSamplingRequest,
+    /// Caller-provided unique identifier for this sampling execution. Use this same ID with cancelSamplingExecution to cancel the in-flight call. Must be unique within the session for the lifetime of the call.
+    pub request_id: RequestId,
+    /// Name of the MCP server that initiated the sampling request
+    pub server_name: String,
 }
 
+/// MCP server whose connection attempt failed.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpOauthProbeResultNeedsAuth {
-    /// HTTP 401 or 403 response returned by the server.
-    pub http_response: McpOauthHttpResponse,
-    /// Why authentication is needed.
-    pub reason: McpOauthProbeNeedsAuthReason,
-    /// Probe outcome variant discriminator.
-    pub status: McpOauthProbeResultNeedsAuthStatus,
-    /// Parsed WWW-Authenticate challenge parameters, when present and parseable.
+pub struct McpFailedServer {
+    /// The captured connection failure detail.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub www_authenticate_params: Option<McpOauthWWWAuthenticateParams>,
+    pub error: Option<String>,
+    /// The config key of the server that failed to connect.
+    pub name: String,
 }
 
+/// MCP server filtered by policy, with name, reason, and optional redacted reason.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpOauthProbeResultFailed {
-    /// Human-readable probe failure detail.
-    pub error: String,
-    /// HTTP response returned by the server, when the probe reached the server and captured the complete response.
+pub struct McpFilteredServer {
+    /// Deprecated. This field is no longer populated.
+    #[doc(hidden)]
+    #[deprecated]
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub http_response: Option<McpOauthHttpResponse>,
-    /// Probe outcome variant discriminator.
-    pub status: McpOauthProbeResultFailedStatus,
+    pub enterprise_name: Option<String>,
+    /// Filtered server name
+    pub name: String,
+    /// Human-readable filter reason
+    pub reason: String,
+    /// PII-free filter reason
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub redacted_reason: Option<String>,
 }
 
-/// Pending MCP OAuth request id to respond to.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct McpHeadersHandlePendingHeadersRefreshRequestHeaders {
+    /// Headers to overlay onto the MCP request. Dynamic headers override static config headers but do not replace SDK-managed request headers.
+    pub headers: HashMap<String, String>,
+    /// Headers-refresh response variant discriminator.
+    pub kind: McpHeadersHandlePendingHeadersRefreshRequestHeadersKind,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct McpHeadersHandlePendingHeadersRefreshRequestNone {
+    /// Headers-refresh response variant discriminator.
+    pub kind: McpHeadersHandlePendingHeadersRefreshRequestNoneKind,
+}
+
+/// MCP headers refresh request id and the host response.
 ///
 /// <div class="warning">
 ///
@@ -7544,14 +7639,16 @@ pub struct McpOauthProbeResultFailed {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpOauthRespondRequest {
-    /// OAuth request identifier from the mcp.oauth_required event
+pub struct McpHeadersHandlePendingHeadersRefreshRequestRequest {
+    /// Headers refresh request identifier from mcp.headers_refresh_required
     pub request_id: RequestId,
+    /// Host response: supply dynamic headers or decline this refresh.
+    pub result: McpHeadersHandlePendingHeadersRefreshRequest,
 }
 
-/// Indicates whether the pending MCP OAuth response was accepted.
+/// Indicates whether the pending MCP headers refresh response was accepted.
 ///
 /// <div class="warning">
 ///
@@ -7561,12 +7658,12 @@ pub struct McpOauthRespondRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpOauthRespondResult {
+pub struct McpHeadersHandlePendingHeadersRefreshRequestResult {
     /// Whether the response was accepted. False if the request was unknown, timed out, or already resolved.
     pub success: bool,
 }
 
-/// Registration parameters for an external MCP client.
+/// Recorded MCP server connection failure.
 ///
 /// <div class="warning">
 ///
@@ -7576,21 +7673,14 @@ pub struct McpOauthRespondResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub(crate) struct McpRegisterExternalClientRequest {
-    /// In-process MCP Client instance. Marked internal: cannot be serialized across the JSON-RPC boundary.
-    #[doc(hidden)]
-    pub(crate) client: serde_json::Value,
-    /// In-process server config (MCPServerConfig) paired with the in-process client/transport. Marked internal alongside its companions.
-    #[doc(hidden)]
-    pub(crate) config: serde_json::Value,
-    /// Logical server name for the external client
-    pub server_name: String,
-    /// In-process MCP Transport instance. Marked internal: cannot be serialized across the JSON-RPC boundary.
-    #[doc(hidden)]
-    pub(crate) transport: serde_json::Value,
+pub struct McpServerFailureInfo {
+    /// Failure message produced when the MCP server connection failed.
+    pub message: String,
+    /// epoch-ms timestamp at which the failure was recorded.
+    pub timestamp: i64,
 }
 
-/// In-process MCP reload configuration.
+/// Recorded MCP server pending-auth state.
 ///
 /// <div class="warning">
 ///
@@ -7600,36 +7690,12 @@ pub(crate) struct McpRegisterExternalClientRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub(crate) struct McpReloadConfig {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub active_git_hub_token: Option<String>,
-    /// Server names the CLI enabled for this session via `--enable-mcp-server`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cli_enabled_servers: Option<Vec<String>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub config_filter: Option<serde_json::Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub disabled_servers: Option<Vec<String>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub enabled_servers: Option<Vec<String>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub force_restart: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub github_mcp_tool_options: Option<serde_json::Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub github_mcp_user_override: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub include_workspace_sources: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mcp3p_enabled: Option<bool>,
-    pub mcp_servers: HashMap<String, serde_json::Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub secret_store: Option<serde_json::Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub use_cached_tool_snapshots: Option<bool>,
+pub struct McpServerNeedsAuthInfo {
+    /// epoch-ms timestamp at which the server signalled it needs authentication.
+    pub timestamp: i64,
 }
 
-/// Opaque MCP reload configuration.
+/// Host-level state, omitted when no MCP host is initialized.
 ///
 /// <div class="warning">
 ///
@@ -7639,13 +7705,24 @@ pub(crate) struct McpReloadConfig {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub(crate) struct McpReloadWithConfigRequest {
-    /// Opaque runtime MCP reload configuration. Marked internal: an in-process runtime shape (reloadMcpServers throws over the wire).
-    #[doc(hidden)]
-    pub(crate) config: serde_json::Value,
+pub struct McpHostState {
+    /// Names of currently-connected MCP clients.
+    pub clients: Vec<String>,
+    /// Configured servers that are explicitly disabled.
+    pub disabled_servers: Vec<String>,
+    /// Map of server name to recorded connection failure.
+    pub failed_servers: HashMap<String, McpServerFailureInfo>,
+    /// Configured servers filtered out by MCP server policy.
+    pub filtered_servers: Vec<String>,
+    /// Whether third-party MCP servers are policy-enabled for this session.
+    pub mcp3p_enabled: bool,
+    /// Map of server name to recorded pending-auth state.
+    pub needs_auth_servers: HashMap<String, McpServerNeedsAuthInfo>,
+    /// Names of servers with in-flight connection attempts.
+    pub pending_connections: Vec<String>,
 }
 
-/// Indicates whether the auto-managed `github` MCP server was removed (false when nothing to remove).
+/// One change applying the plan would make, described rather than serialised so the configuration payload stays behind the runtime boundary.
 ///
 /// <div class="warning">
 ///
@@ -7655,12 +7732,20 @@ pub(crate) struct McpReloadWithConfigRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpRemoveGitHubResult {
-    /// True when the auto-managed `github` MCP server was removed; false when no removal happened (e.g. user has explicitly configured a `github` server, or the server was not registered).
-    pub removed: bool,
+pub struct McpPlanConfigurationChange {
+    /// Names of the configuration fields the change would set, without their values.
+    pub changed_fields: Vec<String>,
+    /// Configuration key the change applies to.
+    pub config_key: String,
+    /// Whether the change would create a new entry or modify an existing one.
+    pub operation: McpPlanConfigurationOperation,
+    /// Scope the change would be written to.
+    pub scope: McpPlanScope,
+    /// Secret placeholders the written configuration would reference. The constrained placeholder type cannot carry a literal secret value.
+    pub secret_references: Vec<String>,
 }
 
-/// Standard MCP resource annotations plus preserved non-standard annotation fields.
+/// Normalised identity of the MCP server a plan targets, independent of how the card spelled it.
 ///
 /// <div class="warning">
 ///
@@ -7670,22 +7755,20 @@ pub struct McpRemoveGitHubResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpResourceAnnotations {
-    /// Server-provided non-standard annotation fields preserved from the MCP response
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub additional_properties: Option<HashMap<String, serde_json::Value>>,
-    /// Intended audience roles for this resource
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub audience: Option<Vec<String>>,
-    /// Last-modified timestamp hint
+pub struct McpPlanResourceIdentity {
+    /// Canonical, normalised name of the server, for example `io.github.owner/server`.
+    pub canonical_name: String,
+    /// Registry identifier of the server, when it came from a registry.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub last_modified: Option<String>,
-    /// Priority hint for model/client use
+    pub registry_id: Option<String>,
+    /// Local configuration key the server would be recorded under.
+    pub server_name: String,
+    /// Version advertised by the card, when it declares one.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub priority: Option<f64>,
+    pub version: Option<String>,
 }
 
-/// A resource icon descriptor plus preserved non-standard icon fields.
+/// Outcome of evaluating the planned server against registry and enterprise policy. Evaluation is read-only.
 ///
 /// <div class="warning">
 ///
@@ -7695,24 +7778,17 @@ pub struct McpResourceAnnotations {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpResourceIcon {
-    /// Server-provided non-standard icon fields preserved from the MCP response
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub additional_properties: Option<HashMap<String, serde_json::Value>>,
-    /// Icon MIME type, when known
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mime_type: Option<String>,
-    /// Icon sizes hint
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub sizes: Option<String>,
-    /// Icon URI
-    pub src: String,
-    /// Theme hint for this icon
+pub struct McpPlanPolicyResult {
+    /// What policy decided for this server.
+    pub decision: McpPlanPolicyDecision,
+    /// Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub theme: Option<String>,
+    pub reason: Option<String>,
+    /// Which authority produced the decision.
+    pub source: McpPlanPolicySource,
 }
 
-/// An MCP resource descriptor (spec `Resource`): URI, name, and optional title, description, MIME type, size, icons, annotations, and metadata. Server-provided fields outside the standard descriptor shape are exposed under `additionalProperties`.
+/// Provenance of the exact validated JSON MCP card content bound privately to a completed plan and its opaque handle.
 ///
 /// <div class="warning">
 ///
@@ -7722,38 +7798,18 @@ pub struct McpResourceIcon {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpResource {
-    /// Resource-level metadata
-    #[serde(rename = "_meta", skip_serializing_if = "Option::is_none")]
-    pub meta: Option<HashMap<String, serde_json::Value>>,
-    /// Server-provided non-standard descriptor fields preserved from the MCP response
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub additional_properties: Option<HashMap<String, serde_json::Value>>,
-    /// Model/client annotations associated with this resource
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub annotations: Option<McpResourceAnnotations>,
-    /// Optional description of what this resource represents
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    /// Icons associated with this resource
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub icons: Option<Vec<McpResourceIcon>>,
-    /// MIME type of the resource, if known
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mime_type: Option<String>,
-    /// The programmatic name of the resource
-    pub name: String,
-    /// Resource size in bytes, when known
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub size: Option<i64>,
-    /// Optional human-readable display title
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub title: Option<String>,
-    /// The resource URI (e.g. ui://... or file:///...)
-    pub uri: String,
+pub struct McpPlanProvenance {
+    /// Authority associated with the validated card, without path, query, or credentials. Inert untrusted data.
+    pub authority: String,
+    /// Semantic digest of the exact validated JSON content bound to the plan handle.
+    pub card_digest: CardDigest,
+    /// JSON MCP media type the validated card was interpreted as.
+    pub media_type: McpServerCardMediaType,
+    /// ISO 8601 timestamp at which the runtime completed strict parsing and schema validation of the card content.
+    pub validated_at: String,
 }
 
-/// MCP resource content with URI, optional MIME type, text or base64 blob, and resource metadata.
+/// Where a plan would be written.
 ///
 /// <div class="warning">
 ///
@@ -7763,24 +7819,14 @@ pub struct McpResource {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpResourceContent {
-    /// Resource-level metadata (CSP, permissions, etc.)
-    #[serde(rename = "_meta", skip_serializing_if = "Option::is_none")]
-    pub meta: Option<HashMap<String, serde_json::Value>>,
-    /// Base64-encoded binary content
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub blob: Option<String>,
-    /// MIME type of the content
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mime_type: Option<String>,
-    /// Text content (e.g. HTML)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub text: Option<String>,
-    /// The resource URI
-    pub uri: String,
+pub struct McpPlanTarget {
+    /// Configuration key the server would be recorded under within that scope.
+    pub config_key: String,
+    /// Configuration scope the plan targets.
+    pub scope: McpPlanScope,
 }
 
-/// MCP server whose resources to enumerate.
+/// A normalised, inert description of what installing an MCP server would involve. Carries no raw card, no install specification, and no secret value.
 ///
 /// <div class="warning">
 ///
@@ -7790,15 +7836,33 @@ pub struct McpResourceContent {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpResourcesListRequest {
-    /// Opaque MCP pagination cursor from a prior `nextCursor` value
+pub struct McpInstallPlan {
+    /// The configuration changes installing would make, described rather than serialised, so the mutable configuration payload stays behind the runtime boundary.
+    pub configuration_changes: Vec<McpPlanConfigurationChange>,
+    /// Normalised identity of the server the plan would install.
+    pub identity: McpPlanResourceIdentity,
+    /// Opaque, runtime-instance scoped, TTL-bound, single-use handle for this plan. Rejected when stale, replayed, or presented to a different runtime instance. Never logged.
+    pub plan_handle: String,
+    /// ISO 8601 timestamp after which the plan handle is stale and will be rejected. Abandoning a plan needs no call: an unused handle simply expires, so cancellation before commit is side-effect free.
+    pub plan_handle_expires_at: String,
+    /// Outcome of evaluating the server against registry and enterprise policy.
+    pub policy: McpPlanPolicyResult,
+    /// Origin and semantic digest of the exact validated JSON MCP card content bound to this plan.
+    pub provenance: McpPlanProvenance,
+    /// Identifier of the choice the runtime would pick by default. Omitted when there is no eligible transport, or when the runtime expresses no preference.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub cursor: Option<String>,
-    /// Name of the MCP server whose resources to enumerate
-    pub server_name: String,
+    pub recommended_transport_choice_id: Option<String>,
+    /// Whether applying this plan would require an MCP reload to take effect. Planning itself never reloads.
+    pub reload_required: bool,
+    /// Whether the plan cannot be applied without further input, because a required value has no default or a secret must be supplied.
+    pub requires_interactive_configuration: bool,
+    /// Configuration scope and key the plan would write to.
+    pub target: McpPlanTarget,
+    /// Every eligible transport, so a host can present an explicit choice. A completed plan always has at least one; when none is eligible, planning returns `CatalogUnavailableTransportError` instead.
+    pub transport_choices: Vec<serde_json::Value>,
 }
 
-/// One page of resources advertised by the named MCP server.
+/// Server name to check running status for.
 ///
 /// <div class="warning">
 ///
@@ -7808,15 +7872,12 @@ pub struct McpResourcesListRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpResourcesListResult {
-    /// Opaque cursor for the next page, if the server has more resources
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub next_cursor: Option<String>,
-    /// Resources advertised by the server (proxied MCP `resources/list`)
-    pub resources: Vec<McpResource>,
+pub struct McpIsServerRunningRequest {
+    /// Name of the MCP server to check
+    pub server_name: String,
 }
 
-/// MCP server whose resource templates to enumerate.
+/// Whether the named MCP server is running.
 ///
 /// <div class="warning">
 ///
@@ -7826,15 +7887,12 @@ pub struct McpResourcesListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpResourcesListTemplatesRequest {
-    /// Opaque MCP pagination cursor from a prior `nextCursor` value
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cursor: Option<String>,
-    /// Name of the MCP server whose resource templates to enumerate
-    pub server_name: String,
+pub struct McpIsServerRunningResult {
+    /// True if the server has an active client and transport.
+    pub running: bool,
 }
 
-/// An MCP resource template descriptor (spec `ResourceTemplate`): an RFC 6570 URI template, name, and optional title, description, MIME type, icons, annotations, and metadata. Server-provided fields outside the standard descriptor shape are exposed under `additionalProperties`.
+/// Server name whose tool list should be returned.
 ///
 /// <div class="warning">
 ///
@@ -7844,35 +7902,12 @@ pub struct McpResourcesListTemplatesRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpResourceTemplate {
-    /// Resource-template-level metadata
-    #[serde(rename = "_meta", skip_serializing_if = "Option::is_none")]
-    pub meta: Option<HashMap<String, serde_json::Value>>,
-    /// Server-provided non-standard descriptor fields preserved from the MCP response
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub additional_properties: Option<HashMap<String, serde_json::Value>>,
-    /// Model/client annotations associated with this template
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub annotations: Option<McpResourceAnnotations>,
-    /// Optional description of what this template is for
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    /// Icons associated with resources matching this template
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub icons: Option<Vec<McpResourceIcon>>,
-    /// MIME type for resources matching this template, if uniform
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mime_type: Option<String>,
-    /// The programmatic name of the resource template
-    pub name: String,
-    /// Optional human-readable display title
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub title: Option<String>,
-    /// An RFC 6570 URI template for constructing resource URIs
-    pub uri_template: String,
+pub struct McpListToolsRequest {
+    /// Name of the connected MCP server whose tools to list.
+    pub server_name: String,
 }
 
-/// One page of resource templates advertised by the named MCP server.
+/// Normalized MCP Apps discovery metadata from a tool's `_meta.ui` block.
 ///
 /// <div class="warning">
 ///
@@ -7882,15 +7917,16 @@ pub struct McpResourceTemplate {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpResourcesListTemplatesResult {
-    /// Opaque cursor for the next page, if the server has more resource templates
+pub struct McpToolUi {
+    /// URI of the tool's MCP App resource, typically a `ui://` resource identifier. Use `session.mcp.resources.read` to fetch its HTML and resource metadata.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub next_cursor: Option<String>,
-    /// Resource templates advertised by the server (proxied MCP `resources/templates/list`)
-    pub resource_templates: Vec<McpResourceTemplate>,
+    pub resource_uri: Option<String>,
+    /// Tool visibility advertised by the server. When absent, MCP Apps defaults apply.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub visibility: Option<Vec<McpToolUiVisibility>>,
 }
 
-/// MCP server and resource URI to fetch.
+/// MCP tool metadata with tool name, optional description, and normalized MCP Apps discovery metadata.
 ///
 /// <div class="warning">
 ///
@@ -7900,14 +7936,18 @@ pub struct McpResourcesListTemplatesResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpResourcesReadRequest {
-    /// Name of the MCP server hosting the resource
-    pub server_name: String,
-    /// Resource URI
-    pub uri: String,
+pub struct McpTools {
+    /// Tool description, when provided.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// Tool name.
+    pub name: String,
+    /// Normalized MCP Apps discovery metadata. An empty object indicates that a valid `_meta.ui` block was present without recognized fields.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub ui: Option<McpToolUi>,
 }
 
-/// Resource contents returned by the MCP server.
+/// Tools exposed by the connected MCP server. Throws when the server is not connected.
 ///
 /// <div class="warning">
 ///
@@ -7917,12 +7957,12 @@ pub struct McpResourcesReadRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpResourcesReadResult {
-    /// Resource contents returned by the server
-    pub contents: Vec<McpResourceContent>,
+pub struct McpListToolsResult {
+    /// Tools exposed by the server.
+    pub tools: Vec<McpTools>,
 }
 
-/// Server name and optional replacement configuration for an individual MCP server restart. Omit `config` for a config-free restart-by-name of an already-configured server.
+/// Identifies the MCP server whose persisted OAuth credentials were updated.
 ///
 /// <div class="warning">
 ///
@@ -7932,15 +7972,38 @@ pub struct McpResourcesReadResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpRestartServerRequest {
-    /// Replacement MCP server configuration (stdio process or remote HTTP/SSE). Omit to restart the server with its already-registered configuration (config-free restart-by-name).
+pub struct McpOauthAuthenticationStateChangedRequest {
+    /// Whether the target session must mint a session-scoped access token instead of reusing a shared access token persisted by another session.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub config: Option<serde_json::Value>,
-    /// Name of the MCP server to restart
-    pub server_name: String,
+    pub refresh_session_token: Option<bool>,
+    /// Name of the MCP server whose OAuth credentials were updated. Omit only when the host cannot identify the server.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub server_name: Option<String>,
 }
 
-/// Per-field MCP telemetry-obfuscation policy.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct McpOauthPendingRequestResponseToken {
+    /// Access token acquired by the SDK host
+    pub access_token: String,
+    /// Token lifetime in seconds, if known.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub expires_in: Option<i64>,
+    /// OAuth response variant discriminator.
+    pub kind: McpOauthPendingRequestResponseTokenKind,
+    /// OAuth token type. Defaults to Bearer when omitted.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub token_type: Option<String>,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct McpOauthPendingRequestResponseCancelled {
+    /// OAuth response variant discriminator.
+    pub kind: McpOauthPendingRequestResponseCancelledKind,
+}
+
+/// Pending MCP OAuth request ID and host-provided token or cancellation response.
 ///
 /// <div class="warning">
 ///
@@ -7948,16 +8011,16 @@ pub struct McpRestartServerRequest {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpSafeForTelemetryFields {
-    /// Whether MCP tool input names may be included in telemetry without obfuscation.
-    pub inputs_names: bool,
-    /// Whether the MCP tool name may be included in telemetry without obfuscation.
-    pub name: bool,
+pub struct McpOauthHandlePendingRequest {
+    /// OAuth request identifier from the mcp.oauth_required event
+    pub request_id: RequestId,
+    /// Host response to the pending OAuth request.
+    pub result: McpOauthPendingRequestResponse,
 }
 
-/// Outcome of an MCP sampling execution: success result, failure error, or cancellation.
+/// Indicates whether the pending MCP OAuth response was accepted.
 ///
 /// <div class="warning">
 ///
@@ -7967,18 +8030,12 @@ pub struct McpSafeForTelemetryFields {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpSamplingExecutionResult {
-    /// Outcome of the sampling inference. 'success' produced a response; 'failure' encountered an error (including agent-side rejection by content filter or criteria); 'cancelled' the caller cancelled this execution via cancelSamplingExecution.
-    pub action: McpSamplingExecutionAction,
-    /// Error description, present when action='failure'.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// MCP CreateMessageResult payload (with optional 'tools' extension), present when action='success'. Treated as opaque at the schema layer; consumers should construct/consume it per the MCP CreateMessageResult shape.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub result: Option<McpExecuteSamplingResult>,
+pub struct McpOauthHandlePendingResult {
+    /// Whether the response was accepted. False if the request was unknown, timed out, or already resolved.
+    pub success: bool,
 }
 
-/// MCP server status entry, including config source/plugin source and any connection error.
+/// Remote MCP server name and optional overrides controlling reauthentication, OAuth client display name, callback success-page copy, and static OAuth client selection.
 ///
 /// <div class="warning">
 ///
@@ -7988,26 +8045,33 @@ pub struct McpSamplingExecutionResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpServer {
-    /// Error message if the server failed to connect
+pub struct McpOauthLoginRequest {
+    /// Optional override for the body text shown on the OAuth loopback callback success page. When omitted, the runtime applies a neutral fallback; callers driving interactive auth should pass surface-specific copy telling the user where to return.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Server name (config key)
-    pub name: String,
-    /// Configuration source: user, workspace, plugin, or builtin
+    pub callback_success_message: Option<String>,
+    /// Optional OAuth client ID override for this login. When set, the runtime uses this pre-registered static client instead of dynamic client registration.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub source: Option<McpServerSource>,
-    /// Plugin name that provided this server, when source is plugin.
+    pub client_id: Option<String>,
+    /// Optional override for the OAuth client display name shown on the consent screen. Applies to newly registered dynamic clients only — existing registrations keep the name they were created with. When omitted, the runtime applies a neutral fallback; callers driving interactive auth should pass their own surface-specific label so the consent screen matches the product the user sees.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub source_plugin: Option<String>,
-    /// Plugin version that provided this server, when source is plugin.
+    pub client_name: Option<String>,
+    /// Optional OAuth client secret override for this login. The runtime treats this as an ephemeral host-owned secret, uses it for this authentication attempt and does not persist it.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub source_plugin_version: Option<String>,
-    /// Connection status: connected, failed, needs-auth, pending, disabled, stopped, or not_configured
-    pub status: McpServerStatus,
+    pub client_secret: Option<String>,
+    /// When true, clears any cached OAuth token for the server and runs a full new authorization. Use when the user explicitly wants to switch accounts or believes their session is stuck.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub force_reauth: Option<bool>,
+    /// Optional OAuth grant type override for this login. Defaults to the server configuration, or authorization_code when no grant type is specified.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub grant_type: Option<McpOauthLoginGrantType>,
+    /// Optional override indicating whether the static OAuth client is public. When false, the runtime treats it as confidential and uses the per-login clientSecret if provided, otherwise retrieving the client secret from the MCP OAuth secret store.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub public_client: Option<bool>,
+    /// Name of the remote MCP server to authenticate
+    pub server_name: String,
 }
 
-/// Authentication settings with optional redirect port configuration.
+/// OAuth authorization URL the caller should open, or empty when cached tokens already authenticated the server.
 ///
 /// <div class="warning">
 ///
@@ -8017,13 +8081,13 @@ pub struct McpServer {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpServerAuthConfigRedirectPort {
-    /// Fixed port for the OAuth redirect callback server.
+pub struct McpOauthLoginResult {
+    /// URL the caller should open in a browser to complete OAuth. Omitted when cached tokens were still valid and no browser interaction was needed — the server is already reconnected in that case. When present, the runtime starts the callback listener before returning and continues the flow in the background; completion is signaled via session.mcp_server_status_changed.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub redirect_port: Option<i32>,
+    pub authorization_url: Option<String>,
 }
 
-/// Remote MCP server configuration accessed over HTTP or SSE.
+/// Remote MCP server name for a passive OAuth status probe.
 ///
 /// <div class="warning">
 ///
@@ -8033,90 +8097,56 @@ pub struct McpServerAuthConfigRedirectPort {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpServerConfigHttp {
-    /// Set to `true` to use defaults, or provide an object with additional auth or OIDC settings.
+pub struct McpOauthProbeRequest {
+    /// Name of the configured remote MCP server to probe.
+    pub server_name: String,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct McpOauthProbeResultNoAuthRequired {
+    /// HTTP response returned by the server.
+    pub http_response: McpOauthHttpResponse,
+    /// Probe outcome variant discriminator.
+    pub status: McpOauthProbeResultNoAuthRequiredStatus,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct McpOauthProbeResultAuthenticated {
+    /// HTTP response returned by the server.
+    pub http_response: McpOauthHttpResponse,
+    /// Probe outcome variant discriminator.
+    pub status: McpOauthProbeResultAuthenticatedStatus,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct McpOauthProbeResultNeedsAuth {
+    /// HTTP 401 or 403 response returned by the server.
+    pub http_response: McpOauthHttpResponse,
+    /// Why authentication is needed.
+    pub reason: McpOauthProbeNeedsAuthReason,
+    /// Probe outcome variant discriminator.
+    pub status: McpOauthProbeResultNeedsAuthStatus,
+    /// Parsed WWW-Authenticate challenge parameters, when present and parseable.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub auth: Option<serde_json::Value>,
-    /// Configuration warnings recorded while loading the server.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub config_warnings: Option<Vec<String>>,
-    /// Controls if tools provided by this server can be loaded on demand via tool search (auto) or always included in the initial tool list (never)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub defer_tools: Option<McpServerConfigDeferTools>,
-    /// Whether secret masking is disabled for calls to this server.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub disable_secret_masking: Option<bool>,
-    /// Set to true to disable persisted MCP tool snapshots for this server. Live tool discovery is unaffected.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub disable_tool_cache: Option<bool>,
-    /// Optional human-readable server name.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub display_name: Option<String>,
-    /// Event types this server receives as Copilot notifications.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub events: Option<Vec<String>>,
-    /// Tool names excluded after the include filter is applied.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub exclude_tools: Option<Vec<String>>,
-    /// Content filtering mode to apply to all tools, or a map of tool name to content filtering mode.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub filter_mapping: Option<serde_json::Value>,
-    /// HTTP headers to include in requests to the remote MCP server.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub headers: Option<HashMap<String, String>>,
-    /// Dynamic-header refresh cache lifetime in milliseconds.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub headers_refresh_ttl_ms: Option<i64>,
-    /// Whether this server is a built-in fallback used when the user has not configured their own server.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub is_default_server: Option<bool>,
-    /// Copilot notification types this server may send to the host.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub notifications: Option<Vec<String>>,
-    /// OAuth client ID for a pre-registered remote MCP OAuth client.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub oauth_client_id: Option<String>,
-    /// OAuth grant type to use when authenticating to the remote MCP server.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub oauth_grant_type: Option<McpServerConfigHttpOauthGrantType>,
-    /// Whether the configured OAuth client is public and does not require a client secret.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub oauth_public_client: Option<bool>,
-    /// Set to `true` to use defaults, or provide an object with additional auth or OIDC settings.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub oidc: Option<serde_json::Value>,
-    /// Telemetry-obfuscation policy for this server's tools.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub safe_for_telemetry: Option<serde_json::Value>,
-    /// The origin of this server configuration.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source: Option<McpServerSource>,
-    /// Source file path recorded while loading the config.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source_path: Option<String>,
-    /// Plugin that provided this server.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source_plugin: Option<String>,
-    /// Whether the providing plugin uses the Open Plugin Spec.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source_plugin_spec: Option<bool>,
-    /// Version of the plugin that provided this server.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source_plugin_version: Option<String>,
-    /// Timeout in milliseconds for tool discovery and tool calls.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub timeout: Option<i64>,
-    /// Tools to include. Defaults to all tools if not specified.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub tools: Option<Vec<String>>,
-    /// Remote transport type. Defaults to "http" when omitted.
+    pub www_authenticate_params: Option<McpOauthWWWAuthenticateParams>,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct McpOauthProbeResultFailed {
+    /// Human-readable probe failure detail.
+    pub error: String,
+    /// HTTP response returned by the server, when the probe reached the server and captured the complete response.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub r#type: Option<McpServerConfigHttpType>,
-    /// URL of the remote MCP server endpoint.
-    pub url: String,
+    pub http_response: Option<McpOauthHttpResponse>,
+    /// Probe outcome variant discriminator.
+    pub status: McpOauthProbeResultFailedStatus,
 }
 
-/// In-process MCP server configuration used by embedded SDK clients.
+/// Pending MCP OAuth request id to respond to.
 ///
 /// <div class="warning">
 ///
@@ -8126,72 +8156,12 @@ pub struct McpServerConfigHttp {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub(crate) struct McpServerConfigMemory {
-    /// Configuration warnings recorded while loading the server.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub config_warnings: Option<Vec<String>>,
-    /// Controls whether tools can be loaded on demand.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub defer_tools: Option<McpServerConfigDeferTools>,
-    /// Whether secret masking is disabled for calls to this server.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub disable_secret_masking: Option<bool>,
-    /// Whether persisted tool snapshots are disabled.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub disable_tool_cache: Option<bool>,
-    /// Optional human-readable server name.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub display_name: Option<String>,
-    /// Event types this server receives as Copilot notifications.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub events: Option<Vec<String>>,
-    /// Tool names excluded after the include filter is applied.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub exclude_tools: Option<Vec<String>>,
-    /// Content filtering mode to apply to this server's tools.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub filter_mapping: Option<serde_json::Value>,
-    /// Whether this server is a built-in fallback.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub is_default_server: Option<bool>,
-    /// Copilot notification types this server may send to the host.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub notifications: Option<Vec<String>>,
-    /// Set to `true` to use default OIDC settings.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub oidc: Option<serde_json::Value>,
-    /// Telemetry-obfuscation policy for this server's tools.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub safe_for_telemetry: Option<serde_json::Value>,
-    /// In-process MCP server instance. This value cannot cross a JSON-RPC boundary.
-    #[doc(hidden)]
-    pub(crate) server_instance: serde_json::Value,
-    /// The origin of this server configuration.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source: Option<McpServerSource>,
-    /// Source file path recorded while loading the config.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source_path: Option<String>,
-    /// Plugin that provided this server.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source_plugin: Option<String>,
-    /// Whether the providing plugin uses the Open Plugin Spec.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source_plugin_spec: Option<bool>,
-    /// Version of the plugin that provided this server.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source_plugin_version: Option<String>,
-    /// Timeout in milliseconds for tool discovery and tool calls.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub timeout: Option<i64>,
-    /// Tools to include. Defaults to all tools if not specified.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub tools: Option<Vec<String>>,
-    #[doc(hidden)]
-    pub(crate) r#type: McpServerConfigMemoryType,
+pub struct McpOauthRespondRequest {
+    /// OAuth request identifier from the mcp.oauth_required event
+    pub request_id: RequestId,
 }
 
-/// Stdio MCP server configuration launched as a child process.
+/// Indicates whether the pending MCP OAuth response was accepted.
 ///
 /// <div class="warning">
 ///
@@ -8201,84 +8171,12 @@ pub(crate) struct McpServerConfigMemory {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpServerConfigStdio {
-    /// Command-line arguments passed to the Stdio MCP server process.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub args: Option<Vec<String>>,
-    /// Set to `true` to use defaults, or provide an object with additional auth or OIDC settings.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub auth: Option<serde_json::Value>,
-    /// Executable command used to start the Stdio MCP server process.
-    pub command: String,
-    /// Configuration warnings recorded while loading the server.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub config_warnings: Option<Vec<String>>,
-    /// Working directory for the Stdio MCP server process.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cwd: Option<String>,
-    /// Controls if tools provided by this server can be loaded on demand via tool search (auto) or always included in the initial tool list (never)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub defer_tools: Option<McpServerConfigDeferTools>,
-    /// Whether secret masking is disabled for calls to this server.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub disable_secret_masking: Option<bool>,
-    /// Set to true to disable persisted MCP tool snapshots for this server. Live tool discovery is unaffected.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub disable_tool_cache: Option<bool>,
-    /// Optional human-readable server name.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub display_name: Option<String>,
-    /// Environment variables to pass to the Stdio MCP server process.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub env: Option<HashMap<String, String>>,
-    /// Event types this server receives as Copilot notifications.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub events: Option<Vec<String>>,
-    /// Tool names excluded after the include filter is applied.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub exclude_tools: Option<Vec<String>>,
-    /// Content filtering mode to apply to all tools, or a map of tool name to content filtering mode.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub filter_mapping: Option<serde_json::Value>,
-    /// Whether this server is a built-in fallback used when the user has not configured their own server.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub is_default_server: Option<bool>,
-    /// Copilot notification types this server may send to the host.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub notifications: Option<Vec<String>>,
-    /// Set to `true` to use defaults, or provide an object with additional auth or OIDC settings.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub oidc: Option<serde_json::Value>,
-    /// Telemetry-obfuscation policy for this server's tools.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub safe_for_telemetry: Option<serde_json::Value>,
-    /// The origin of this server configuration.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source: Option<McpServerSource>,
-    /// Source file path recorded while loading the config.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source_path: Option<String>,
-    /// Plugin that provided this server.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source_plugin: Option<String>,
-    /// Whether the providing plugin uses the Open Plugin Spec.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source_plugin_spec: Option<bool>,
-    /// Version of the plugin that provided this server.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source_plugin_version: Option<String>,
-    /// Timeout in milliseconds for tool discovery and tool calls.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub timeout: Option<i64>,
-    /// Tools to include. Defaults to all tools if not specified.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub tools: Option<Vec<String>>,
-    /// Local transport type. Defaults to stdio when omitted.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub r#type: Option<McpServerConfigStdioType>,
+pub struct McpOauthRespondResult {
+    /// Whether the response was accepted. False if the request was unknown, timed out, or already resolved.
+    pub success: bool,
 }
 
-/// MCP servers configured for the session, with their connection status and host-level state.
+/// A computed MCP install plan. Nothing has been applied: the plan describes what installing would change, and the plan handle is what a later apply operation would consume.
 ///
 /// <div class="warning">
 ///
@@ -8288,15 +8186,16 @@ pub struct McpServerConfigStdio {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpServerList {
-    /// Host-level state, omitted when no MCP host is initialized.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub host: Option<McpHostState>,
-    /// Configured MCP servers
-    pub servers: Vec<McpServer>,
+pub struct McpPlanInstallPlanned {
+    /// Discriminator: a plan was computed and nothing was changed
+    pub kind: McpPlanInstallPlannedKind,
+    /// Protocol version and capabilities the runtime honoured.
+    pub negotiated: CatalogNegotiatedContract,
+    /// The normalised plan.
+    pub plan: McpInstallPlan,
 }
 
-/// Mode controlling how MCP server env values are resolved (`direct` or `indirect`).
+/// Plan from a candidate returned by a previous catalog search.
 ///
 /// <div class="warning">
 ///
@@ -8306,12 +8205,16 @@ pub struct McpServerList {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpSetEnvValueModeParams {
-    /// How environment-variable values supplied to MCP servers are resolved. "direct" passes literal string values; "indirect" treats values as references (e.g. names of environment variables on the host) that the runtime resolves before launch. Defaults to the runtime's startup mode; clients that intentionally launch MCP servers with literal values (e.g. CLI prompt mode and ACP) set this to "direct".
-    pub mode: McpSetEnvValueModeDetails,
+pub struct McpPlanInstallSourceCandidate {
+    /// Single-use candidate handle. Consumed by this call, so a replay of the same handle is rejected.
+    pub candidate_handle: String,
+    /// Discriminator: plan from a previously returned candidate
+    pub kind: McpPlanInstallSourceCandidateKind,
+    /// The runtime- or authority-minted `searchId` returned with the search that produced this candidate. A search implementation binds it to private candidate-handle context; a planning implementation must verify that context before returning a plan. The unavailable planning implementation in this contract layer validates presence but does not claim the verification has occurred. It identifies a search rather than a person and must never be joined with user identity to re-identify anyone.
+    pub search_id: String,
 }
 
-/// Env-value mode recorded on the session after the update.
+/// An MCP server card to be retrieved from a URL through the runtime's hardened fetch boundary.
 ///
 /// <div class="warning">
 ///
@@ -8321,12 +8224,16 @@ pub struct McpSetEnvValueModeParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpSetEnvValueModeResult {
-    /// Mode recorded on the session after the update
-    pub mode: McpSetEnvValueModeDetails,
+pub struct McpServerCardUrl {
+    /// Discriminator: the card is URL-backed, and carries no embedded data
+    pub kind: McpServerCardUrlKind,
+    /// Media type the card is expected to conform to.
+    pub media_type: McpServerCardMediaType,
+    /// Card URL. Retrieved only through the runtime's hardened boundary, with scheme, credential, address-range, redirect, timeout, and response-size controls applied. Never logged.
+    pub url: String,
 }
 
-/// Server name and optional configuration for an individual MCP server start. Omit `config` for a config-free start-by-name of an already-configured server.
+/// An MCP server card supplied inline as an inert document.
 ///
 /// <div class="warning">
 ///
@@ -8336,15 +8243,16 @@ pub struct McpSetEnvValueModeResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpStartServerRequest {
-    /// MCP server configuration (stdio process or remote HTTP/SSE). Omit to start the server with its already-registered configuration (config-free start-by-name).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub config: Option<serde_json::Value>,
-    /// Name of the MCP server to start
-    pub server_name: String,
+pub struct McpServerCardEmbedded {
+    /// The card document verbatim, treated as inert untrusted bytes. The runtime parses and validates it; the host is not expected to interpret it. Never logged.
+    pub data: String,
+    /// Discriminator: the card is embedded, and carries no URL
+    pub kind: McpServerCardEmbeddedKind,
+    /// Media type the card is expected to conform to.
+    pub media_type: McpServerCardMediaType,
 }
 
-/// MCP server startup filtering result.
+/// Plan from a card supplied directly by the caller, without a preceding search.
 ///
 /// <div class="warning">
 ///
@@ -8352,20 +8260,16 @@ pub struct McpStartServerRequest {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpStartServersResult {
-    /// Non-default servers allowed by policy
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub allowed_servers: Option<Vec<McpAllowedServer>>,
-    /// Servers whose connection attempt failed.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub failed_servers: Option<Vec<McpFailedServer>>,
-    /// Servers filtered out before startup
-    pub filtered_servers: Vec<McpFilteredServer>,
+pub struct McpPlanInstallSourceCard {
+    /// The card to plan from: exactly one of a URL or embedded data.
+    pub card: McpServerCardReference,
+    /// Discriminator: plan from a caller-supplied card
+    pub kind: McpPlanInstallSourceCardKind,
 }
 
-/// Server name for an individual MCP server stop.
+/// A side-effect-free request for an MCP install plan. Computing a plan never writes configuration, stores a secret, or reloads MCP servers.
 ///
 /// <div class="warning">
 ///
@@ -8373,14 +8277,19 @@ pub struct McpStartServersResult {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpStopServerRequest {
-    /// Name of the MCP server to stop
-    pub server_name: String,
+pub struct McpPlanInstallRequest {
+    /// Protocol version and capabilities the caller requires.
+    pub contract: CatalogClientContract,
+    /// Configuration scope the plan targets. Defaults to user scope when omitted.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub scope: Option<McpPlanScope>,
+    /// What to plan: either a candidate handle from a previous search, or a card supplied directly.
+    pub source: McpPlanInstallSource,
 }
 
-/// Metadata controlling an MCP task's lifetime.
+/// One non-secret scalar value a transport choice needs before it can be applied.
 ///
 /// <div class="warning">
 ///
@@ -8390,13 +8299,31 @@ pub struct McpStopServerRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpTaskMetadata {
-    /// Task time-to-live.
+pub struct McpPlanRequiredValueScalar {
+    /// Where the value is applied when the server is launched.
+    pub category: McpPlanValueCategory,
+    /// Default supplied by the card, when the value can be resolved without input. Presence is the authoritative indication that a default exists. Inert untrusted data.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub ttl: Option<i64>,
+    pub default_value: Option<String>,
+    /// Human-readable explanation from the card. Inert untrusted text.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// Whether the value may be supplied more than once.
+    pub is_repeated: bool,
+    /// Key the value is supplied under. Inert untrusted data.
+    pub key: String,
+    /// Discriminator: this required value uses a scalar type.
+    pub kind: McpPlanRequiredValueScalarKind,
+    /// Whether the value must be present for the plan to be applicable.
+    pub required: bool,
+    /// Human-readable label from the card. Inert untrusted text.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub title: Option<String>,
+    /// Scalar type the value must conform to.
+    pub value_type: McpPlanScalarValueType,
 }
 
-/// Server name identifying the external client to remove.
+/// One enumerated non-secret value a transport choice needs before it can be applied. The permitted values are structurally required.
 ///
 /// <div class="warning">
 ///
@@ -8406,12 +8333,33 @@ pub struct McpTaskMetadata {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub(crate) struct McpUnregisterExternalClientRequest {
-    /// Server name of the external client to unregister
-    pub server_name: String,
+pub struct McpPlanRequiredValueEnum {
+    /// Where the value is applied when the server is launched.
+    pub category: McpPlanValueCategory,
+    /// Default supplied by the card, when the value can be resolved without input. Presence is the authoritative indication that a default exists. Inert untrusted data.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub default_value: Option<String>,
+    /// Human-readable explanation from the card. Inert untrusted text.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// Non-empty permitted value set. Inert untrusted data.
+    pub enum_values: Vec<String>,
+    /// Whether the value may be supplied more than once.
+    pub is_repeated: bool,
+    /// Key the value is supplied under. Inert untrusted data.
+    pub key: String,
+    /// Discriminator: this required value uses a fixed enumeration.
+    pub kind: McpPlanRequiredValueEnumKind,
+    /// Whether the value must be present for the plan to be applicable.
+    pub required: bool,
+    /// Human-readable label from the card. Inert untrusted text.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub title: Option<String>,
+    /// Discriminator: the value must be one of `enumValues`.
+    pub value_type: McpPlanEnumValueType,
 }
 
-/// Memory configuration for this session.
+/// A secret a transport choice needs, referenced by placeholder. No secret value ever appears in a plan, and the placeholder resolves against the keychain only when a plan is applied.
 ///
 /// <div class="warning">
 ///
@@ -8421,85 +8369,17 @@ pub(crate) struct McpUnregisterExternalClientRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MemoryConfiguration {
-    /// Whether memory is enabled for the session.
-    pub enabled: bool,
-}
-
-/// The six normalized `/context` header buckets, computed from the same tokenization as `entries` so the two never disagree. Convenience rollups: `freeSpace` and `buffer` describe window capacity rather than occupied context, so the values do not sum to `totalTokens`.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct MetadataContextAttributionResultContextAttributionCategories {
-    /// Output reserve plus post-blocking-threshold buffer.
-    pub buffer: i64,
-    /// Custom-instructions tokens (0 when none are configured).
-    pub custom_instructions: i64,
-    /// Remaining unused window capacity (clamped at 0).
-    pub free_space: i64,
-    /// MCP tool-definition tokens.
-    pub mcp_tools: i64,
-    /// Conversation (user/assistant/tool) message tokens.
-    pub messages: i64,
-    /// System prompt tokens, excluding custom instructions.
-    pub system_prompt: i64,
-    /// Non-MCP tool-definition tokens.
-    pub system_tools: i64,
-}
-
-/// Successful compaction history for the session.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct MetadataContextAttributionResultContextAttributionCompactions {
-    /// Number of successful compactions in this session.
-    pub count: i64,
-}
-
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct MetadataContextAttributionResultContextAttributionEntriesItem {
-    /// Supplementary per-entry metadata (e.g. `messageCount`, `role`, `evictable`, `pluginSource`). Values are stringified; parse as needed and ignore unrecognized keys.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub attributes: Option<HashMap<String, String>>,
-    /// Identifier for this entry, formed by joining its `kind` and source name (e.g. `tool:bash`, `skill:tmux`, `toolDefinition:bash`); unique within the snapshot. Use it to match the same entry across snapshots, to correlate with other APIs (skill/agent/MCP registries), and as the `parentId` target for nesting. Distinct from the human-facing `label`.
-    pub id: String,
-    /// Source category for this entry. Not a closed set — tolerate unknown values. Known values today: `skill`, `subagent`, `mcpServer`, `tool`, `system`, `toolDefinition`, `plugin`.
-    pub kind: String,
-    /// Human-readable display label, e.g. `bash` or `skill: tmux`. Presentation-only; may be localized/reformatted without notice — do not key off it.
-    pub label: String,
-    /// Optional `id` of the parent entry: e.g. a `plugin` entry parenting its `skill`/`mcpServer` entries, or the `system` entry parenting `toolDefinition` entries. Omitted for top-level entries.
+pub struct McpPlanSecretPlaceholder {
+    /// Key the secret is supplied under. Inert untrusted data.
+    pub key: String,
+    /// The runtime-assigned `${secret:<id>}` placeholder written into configuration in place of the value.
+    pub placeholder: String,
+    /// Human-readable label from the card. Inert untrusted text.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub parent_id: Option<String>,
-    /// Token count currently in context attributable to this entry.
-    pub tokens: i64,
-}
-
-/// Per-source token attribution snapshot for the current context window. The heaviest individual messages are available separately via `metadata.getContextHeaviestMessages`.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct MetadataContextAttributionResultContextAttribution {
-    /// Output reserve plus the tokens past the buffer-exhaustion blocking threshold. Mirrors `SessionContextInfo.bufferTokens`.
-    pub buffer_tokens: i64,
-    /// The six normalized `/context` header buckets, computed from the same tokenization as `entries` so the two never disagree. Convenience rollups: `freeSpace` and `buffer` describe window capacity rather than occupied context, so the values do not sum to `totalTokens`.
-    pub categories: MetadataContextAttributionResultContextAttributionCategories,
-    /// Successful compaction history for the session.
-    pub compactions: MetadataContextAttributionResultContextAttributionCompactions,
-    /// Token count at which background compaction starts. Mirrors `SessionContextInfo.compactionThreshold`.
-    pub compaction_threshold: i64,
-    /// Flat list of per-source attribution entries. Group by `kind` and render unrecognized kinds generically. Nesting and rollups are expressed via `parentId`.
-    pub entries: Vec<MetadataContextAttributionResultContextAttributionEntriesItem>,
-    /// Prompt limit plus the model's output reserve: the full context window `categories.freeSpace` and `categories.buffer` are measured against. Mirrors `SessionContextInfo.limit`.
-    pub limit: i64,
-    /// The concrete model id the entire breakdown was tokenized against (feeds the per-model token multiplier). Under `Auto` (Free/Student) this is the resolved model, not the literal `auto` sentinel, so totals are not undercounted. A single-model approximation of a potentially multi-model Auto session.
-    pub model_id: String,
-    /// How `modelId` was chosen. Not a closed set — tolerate unknown values. Known values today: `autoResolved` (the model Auto resolved to), `selected` (the user's explicitly selected model), `default` (a fallback before any model is known).
-    pub model_source: String,
-    /// Maximum prompt tokens the resolved model accepts — the denominator for a `##k/###k` context-usage display. Mirrors `SessionContextInfo.promptTokenLimit`.
-    pub prompt_token_limit: i64,
-    /// Total token count of the current context window the entries are measured against (system message + conversation messages + tool definitions — the same total reported by /context). Divide an entry's `tokens` by this to derive its share.
-    pub total_tokens: i64,
+    pub title: Option<String>,
 }
 
-/// Per-source attribution breakdown for the session's current context window, or null if uninitialized.
+/// An eligible local-package transport choice. Package identity is required and a remote endpoint cannot be represented.
 ///
 /// <div class="warning">
 ///
@@ -8509,12 +8389,24 @@ pub struct MetadataContextAttributionResultContextAttribution {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MetadataContextAttributionResult {
-    /// Per-source context-window attribution, or null if the session has not yet been initialized (no system prompt or tool metadata cached).
-    pub context_attribution: Option<MetadataContextAttributionResultContextAttribution>,
+pub struct McpPlanTransportChoicePackage {
+    /// Stable identifier for this choice within the plan, used to select it when the plan is applied.
+    pub choice_id: String,
+    /// Discriminator: this choice runs a local package
+    pub install_method: McpPlanPackageInstallMethod,
+    /// Package identifier. Inert untrusted data.
+    pub package_identifier: String,
+    /// Packaging ecosystem, for example `oci` or `npm`.
+    pub package_type: String,
+    /// Typed values this choice requires, excluding secrets.
+    pub required_values: Vec<McpPlanRequiredValue>,
+    /// Secrets this choice requires, referenced by placeholder only.
+    pub secret_placeholders: Vec<McpPlanSecretPlaceholder>,
+    /// Local process transport this package choice would use.
+    pub transport: McpPlanPackageTransport,
 }
 
-/// Parameters for the heaviest-messages query.
+/// An eligible remote-endpoint transport choice. The endpoint is required and package identity cannot be represented.
 ///
 /// <div class="warning">
 ///
@@ -8524,13 +8416,22 @@ pub struct MetadataContextAttributionResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MetadataContextHeaviestMessagesRequest {
-    /// Maximum number of messages to return, most-expensive first. Omit for the server default.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub limit: Option<i64>,
+pub struct McpPlanTransportChoiceRemote {
+    /// Stable identifier for this choice within the plan, used to select it when the plan is applied.
+    pub choice_id: String,
+    /// Endpoint URL. Inert untrusted data.
+    pub endpoint: String,
+    /// Discriminator: this choice connects to a remote endpoint
+    pub install_method: McpPlanRemoteInstallMethod,
+    /// Typed values this choice requires, excluding secrets.
+    pub required_values: Vec<McpPlanRequiredValue>,
+    /// Secrets this choice requires, referenced by placeholder only.
+    pub secret_placeholders: Vec<McpPlanSecretPlaceholder>,
+    /// Endpoint transport this remote choice would use.
+    pub transport: McpPlanRemoteTransport,
 }
 
-/// The heaviest individual messages in the session's context window, most-expensive first.
+/// Registration parameters for an external MCP client.
 ///
 /// <div class="warning">
 ///
@@ -8540,14 +8441,21 @@ pub struct MetadataContextHeaviestMessagesRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MetadataContextHeaviestMessagesResult {
-    /// Heaviest messages, most-expensive first.
-    pub messages: Vec<ContextHeaviestMessage>,
-    /// Total token count of the current context window, so callers can compute each message's share without a second call.
-    pub total_tokens: i64,
+pub(crate) struct McpRegisterExternalClientRequest {
+    /// In-process MCP Client instance. Marked internal: cannot be serialized across the JSON-RPC boundary.
+    #[doc(hidden)]
+    pub(crate) client: serde_json::Value,
+    /// In-process server config (MCPServerConfig) paired with the in-process client/transport. Marked internal alongside its companions.
+    #[doc(hidden)]
+    pub(crate) config: serde_json::Value,
+    /// Logical server name for the external client
+    pub server_name: String,
+    /// In-process MCP Transport instance. Marked internal: cannot be serialized across the JSON-RPC boundary.
+    #[doc(hidden)]
+    pub(crate) transport: serde_json::Value,
 }
 
-/// Model identifier and token limits used to compute the context-info breakdown.
+/// In-process MCP reload configuration.
 ///
 /// <div class="warning">
 ///
@@ -8557,43 +8465,36 @@ pub struct MetadataContextHeaviestMessagesResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MetadataContextInfoRequest {
-    /// Maximum output tokens allowed by the target model. Pass 0 if unknown.
-    pub output_token_limit: i64,
-    /// Maximum prompt tokens allowed by the target model. Pass 0 to use the runtime default.
-    pub prompt_token_limit: i64,
-    /// Model identifier used for tokenization. Omit to use the session default. Used both for token counting and to compute display values.
+pub(crate) struct McpReloadConfig {
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub selected_model: Option<String>,
-}
-
-/// Token-usage breakdown for the session's current context window
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct MetadataContextInfoResultContextInfo {
-    /// Output reserve plus tokens after the buffer-exhaustion blocking threshold (default 95%)
-    pub buffer_tokens: i64,
-    /// Token count at which background compaction starts (configurable percentage of promptTokenLimit)
-    pub compaction_threshold: i64,
-    /// Tokens consumed by user/assistant/tool messages
-    pub conversation_tokens: i64,
-    /// Prompt token limit plus the model's full output token limit.
-    pub limit: i64,
-    /// Tokens consumed by MCP tool definitions (subset of toolDefinitionsTokens, excludes deferred tools)
-    pub mcp_tools_tokens: i64,
-    /// The model used for token counting
-    pub model_name: String,
-    /// Maximum prompt tokens allowed by the model (or DEFAULT_TOKEN_LIMIT if unspecified)
-    pub prompt_token_limit: i64,
-    /// Tokens consumed by the system prompt
-    pub system_tokens: i64,
-    /// Tokens consumed by tool definitions sent to the model (excludes deferred tools)
-    pub tool_definitions_tokens: i64,
-    /// Sum of system, conversation and tool-definition tokens
-    pub total_tokens: i64,
+    pub active_git_hub_token: Option<String>,
+    /// Server names the CLI enabled for this session via `--enable-mcp-server`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cli_enabled_servers: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub config_filter: Option<serde_json::Value>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub disabled_servers: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enabled_servers: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub force_restart: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub github_mcp_tool_options: Option<serde_json::Value>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub github_mcp_user_override: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub include_workspace_sources: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mcp3p_enabled: Option<bool>,
+    pub mcp_servers: HashMap<String, serde_json::Value>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub secret_store: Option<serde_json::Value>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub use_cached_tool_snapshots: Option<bool>,
 }
 
-/// Token breakdown for the session's current context window, or null if uninitialized.
+/// Opaque MCP reload configuration.
 ///
 /// <div class="warning">
 ///
@@ -8603,12 +8504,13 @@ pub struct MetadataContextInfoResultContextInfo {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MetadataContextInfoResult {
-    /// Token breakdown for the current context window, or null if the session has not yet been initialized (no system prompt or tool metadata cached).
-    pub context_info: Option<MetadataContextInfoResultContextInfo>,
+pub(crate) struct McpReloadWithConfigRequest {
+    /// Opaque runtime MCP reload configuration. Marked internal: an in-process runtime shape (reloadMcpServers throws over the wire).
+    #[doc(hidden)]
+    pub(crate) config: serde_json::Value,
 }
 
-/// Indicates whether the local session is currently processing a turn or background continuation.
+/// Indicates whether the auto-managed `github` MCP server was removed (false when nothing to remove).
 ///
 /// <div class="warning">
 ///
@@ -8618,12 +8520,12 @@ pub struct MetadataContextInfoResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MetadataIsProcessingResult {
-    /// Whether the session is currently processing user/agent messages. False for non-local sessions (which don't run a local agentic loop). Reflects an in-flight turn or background continuation.
-    pub processing: bool,
+pub struct McpRemoveGitHubResult {
+    /// True when the auto-managed `github` MCP server was removed; false when no removal happened (e.g. user has explicitly configured a `github` server, or the server was not registered).
+    pub removed: bool,
 }
 
-/// Model identifier to use when re-tokenizing the session's existing messages.
+/// Standard MCP resource annotations plus preserved non-standard annotation fields.
 ///
 /// <div class="warning">
 ///
@@ -8633,12 +8535,22 @@ pub struct MetadataIsProcessingResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MetadataRecomputeContextTokensRequest {
-    /// Model identifier used for tokenization. The runtime token-counts both chat-context and system-context messages against this model.
-    pub model_id: String,
+pub struct McpResourceAnnotations {
+    /// Server-provided non-standard annotation fields preserved from the MCP response
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub additional_properties: Option<HashMap<String, serde_json::Value>>,
+    /// Intended audience roles for this resource
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub audience: Option<Vec<String>>,
+    /// Last-modified timestamp hint
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub last_modified: Option<String>,
+    /// Priority hint for model/client use
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub priority: Option<f64>,
 }
 
-/// Re-tokenize the session's existing messages against `modelId` and return the token totals. Useful for hosts that want an initial estimate of context usage on session resume, before the next agent turn fires `session.context_info_changed` events. Returns zeros for an empty session.
+/// A resource icon descriptor plus preserved non-standard icon fields.
 ///
 /// <div class="warning">
 ///
@@ -8648,16 +8560,24 @@ pub struct MetadataRecomputeContextTokensRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MetadataRecomputeContextTokensResult {
-    /// Tokens contributed by user/assistant/tool messages (excludes system/developer prompts).
-    pub messages_token_count: i64,
-    /// Tokens contributed by system/developer prompt snapshots.
-    pub system_token_count: i64,
-    /// Sum of tokens across chat-context and system-context messages currently held by the session.
-    pub total_tokens: i64,
-}
+pub struct McpResourceIcon {
+    /// Server-provided non-standard icon fields preserved from the MCP response
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub additional_properties: Option<HashMap<String, serde_json::Value>>,
+    /// Icon MIME type, when known
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mime_type: Option<String>,
+    /// Icon sizes hint
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub sizes: Option<String>,
+    /// Icon URI
+    pub src: String,
+    /// Theme hint for this icon
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub theme: Option<String>,
+}
 
-/// Updated working directory and git context. Emitted as the new payload of `session.context_changed`.
+/// An MCP resource descriptor (spec `Resource`): URI, name, and optional title, description, MIME type, size, icons, annotations, and metadata. Server-provided fields outside the standard descriptor shape are exposed under `additionalProperties`.
 ///
 /// <div class="warning">
 ///
@@ -8667,33 +8587,38 @@ pub struct MetadataRecomputeContextTokensResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkingDirectoryContext {
-    /// Merge-base commit SHA (fork point from the remote default branch)
+pub struct McpResource {
+    /// Resource-level metadata
+    #[serde(rename = "_meta", skip_serializing_if = "Option::is_none")]
+    pub meta: Option<HashMap<String, serde_json::Value>>,
+    /// Server-provided non-standard descriptor fields preserved from the MCP response
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub base_commit: Option<String>,
-    /// Current git branch name
+    pub additional_properties: Option<HashMap<String, serde_json::Value>>,
+    /// Model/client annotations associated with this resource
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub branch: Option<String>,
-    /// Current working directory path
-    pub cwd: String,
-    /// Root directory of the git repository, resolved via git rev-parse
+    pub annotations: Option<McpResourceAnnotations>,
+    /// Optional description of what this resource represents
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub git_root: Option<String>,
-    /// Head commit of the current git branch
+    pub description: Option<String>,
+    /// Icons associated with this resource
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub head_commit: Option<String>,
-    /// Hosting platform type of the repository
+    pub icons: Option<Vec<McpResourceIcon>>,
+    /// MIME type of the resource, if known
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub host_type: Option<SessionWorkingDirectoryContextHostType>,
-    /// Repository identifier derived from the git remote URL ("owner/name" for GitHub, "org/project/repo" for Azure DevOps)
+    pub mime_type: Option<String>,
+    /// The programmatic name of the resource
+    pub name: String,
+    /// Resource size in bytes, when known
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub repository: Option<String>,
-    /// Raw host string from the git remote URL (e.g. "github.com", "dev.azure.com")
+    pub size: Option<i64>,
+    /// Optional human-readable display title
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub repository_host: Option<String>,
+    pub title: Option<String>,
+    /// The resource URI (e.g. ui://... or file:///...)
+    pub uri: String,
 }
 
-/// Updated working-directory/git context to record on the session.
+/// MCP resource content with URI, optional MIME type, text or base64 blob, and resource metadata.
 ///
 /// <div class="warning">
 ///
@@ -8703,12 +8628,24 @@ pub struct SessionWorkingDirectoryContext {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MetadataRecordContextChangeRequest {
-    /// Updated working directory and git context. Emitted as the new payload of `session.context_changed`.
-    pub context: SessionWorkingDirectoryContext,
+pub struct McpResourceContent {
+    /// Resource-level metadata (CSP, permissions, etc.)
+    #[serde(rename = "_meta", skip_serializing_if = "Option::is_none")]
+    pub meta: Option<HashMap<String, serde_json::Value>>,
+    /// Base64-encoded binary content
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub blob: Option<String>,
+    /// MIME type of the content
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mime_type: Option<String>,
+    /// Text content (e.g. HTML)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub text: Option<String>,
+    /// The resource URI
+    pub uri: String,
 }
 
-/// Notify the session that its working directory context has changed. Emits a `session.context_changed` event so consumers (telemetry, OTel tracker, ACP, the timeline UI) can react. Use this when the host has detected a cwd/branch/repo change outside the session's normal lifecycle (e.g., after a shell command in interactive mode). For a local session, a report whose `cwd` diverges from the session's current working directory is ignored (the call still succeeds but records nothing and emits no event); move a local session's working directory via `metadata.setWorkingDirectory` instead.
+/// MCP server whose resources to enumerate.
 ///
 /// <div class="warning">
 ///
@@ -8718,9 +8655,15 @@ pub struct MetadataRecordContextChangeRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MetadataRecordContextChangeResult {}
+pub struct McpResourcesListRequest {
+    /// Opaque MCP pagination cursor from a prior `nextCursor` value
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cursor: Option<String>,
+    /// Name of the MCP server whose resources to enumerate
+    pub server_name: String,
+}
 
-/// Absolute path to set as the session's new working directory. For local sessions the path must be absolute and exist on disk: it is validated before any session state changes, and a failing validation rejects the call with nothing mutated, persisted, or emitted. Remote sessions record the path as-is.
+/// One page of resources advertised by the named MCP server.
 ///
 /// <div class="warning">
 ///
@@ -8730,12 +8673,15 @@ pub struct MetadataRecordContextChangeResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MetadataSetWorkingDirectoryRequest {
-    /// Absolute path to set as the session's working directory. The runtime updates the session's recorded cwd so subsequent operations (shell tools, file lookups, telemetry) anchor to it.
-    pub working_directory: String,
+pub struct McpResourcesListResult {
+    /// Opaque cursor for the next page, if the server has more resources
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_cursor: Option<String>,
+    /// Resources advertised by the server (proxied MCP `resources/list`)
+    pub resources: Vec<McpResource>,
 }
 
-/// Update the session's working directory. Used by the host when the user explicitly changes cwd (e.g., the `/cd` slash command). The host is responsible for any related side-effects (file index, etc.); it does NOT change the process working directory (a session's cwd is per-session, not process-global). For local sessions the runtime validates the target first (an absolute path that exists on disk) and re-bases the permission primary directory; a rejected validation fails the call before anything is mutated, persisted, or emitted. Location-scoped permission rules are then re-keyed to the new directory (best-effort). Remote sessions only record the path.
+/// MCP server whose resource templates to enumerate.
 ///
 /// <div class="warning">
 ///
@@ -8745,12 +8691,15 @@ pub struct MetadataSetWorkingDirectoryRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MetadataSetWorkingDirectoryResult {
-    /// Working directory after the update
-    pub working_directory: String,
+pub struct McpResourcesListTemplatesRequest {
+    /// Opaque MCP pagination cursor from a prior `nextCursor` value
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cursor: Option<String>,
+    /// Name of the MCP server whose resource templates to enumerate
+    pub server_name: String,
 }
 
-/// The repository the remote session targets.
+/// An MCP resource template descriptor (spec `ResourceTemplate`): an RFC 6570 URI template, name, and optional title, description, MIME type, icons, annotations, and metadata. Server-provided fields outside the standard descriptor shape are exposed under `additionalProperties`.
 ///
 /// <div class="warning">
 ///
@@ -8760,16 +8709,35 @@ pub struct MetadataSetWorkingDirectoryResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MetadataSnapshotRemoteMetadataRepository {
-    /// The branch the remote session is operating on.
-    pub branch: String,
-    /// The GitHub repository name (without owner).
+pub struct McpResourceTemplate {
+    /// Resource-template-level metadata
+    #[serde(rename = "_meta", skip_serializing_if = "Option::is_none")]
+    pub meta: Option<HashMap<String, serde_json::Value>>,
+    /// Server-provided non-standard descriptor fields preserved from the MCP response
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub additional_properties: Option<HashMap<String, serde_json::Value>>,
+    /// Model/client annotations associated with this template
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub annotations: Option<McpResourceAnnotations>,
+    /// Optional description of what this template is for
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// Icons associated with resources matching this template
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub icons: Option<Vec<McpResourceIcon>>,
+    /// MIME type for resources matching this template, if uniform
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mime_type: Option<String>,
+    /// The programmatic name of the resource template
     pub name: String,
-    /// The GitHub owner (user or organization) of the target repository.
-    pub owner: String,
+    /// Optional human-readable display title
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub title: Option<String>,
+    /// An RFC 6570 URI template for constructing resource URIs
+    pub uri_template: String,
 }
 
-/// Remote-session-specific metadata. Populated only when `isRemote` is true. Fields are immutable for the lifetime of the session.
+/// One page of resource templates advertised by the named MCP server.
 ///
 /// <div class="warning">
 ///
@@ -8779,21 +8747,15 @@ pub struct MetadataSnapshotRemoteMetadataRepository {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct MetadataSnapshotRemoteMetadata {
-    /// The pull request number the remote session is associated with, if any.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub pull_request_number: Option<i64>,
-    /// The repository the remote session targets.
-    pub repository: MetadataSnapshotRemoteMetadataRepository,
-    /// The original resource identifier (task ID or PR node ID), preserved across event-replay reconstructions. Falls back to `sessionId` when absent.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub resource_id: Option<String>,
-    /// Whether the remote task originated from Copilot Coding Agent (cca) or a CLI `--remote` invocation.
+pub struct McpResourcesListTemplatesResult {
+    /// Opaque cursor for the next page, if the server has more resource templates
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub task_type: Option<MetadataSnapshotRemoteMetadataTaskType>,
+    pub next_cursor: Option<String>,
+    /// Resource templates advertised by the server (proxied MCP `resources/templates/list`)
+    pub resource_templates: Vec<McpResourceTemplate>,
 }
 
-/// Active server-driven promotion for a model, including its discount and optional expiry.
+/// MCP server and resource URI to fetch.
 ///
 /// <div class="warning">
 ///
@@ -8803,22 +8765,14 @@ pub struct MetadataSnapshotRemoteMetadata {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelBillingPromo {
-    /// Percentage discount (0-100) applied while the promotion is active. May be fractional.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub discount_percent: Option<f64>,
-    /// UTC ISO 8601 timestamp marking when the promotion ends. Optional: an open-ended promotion omits this field. When present, the API only surfaces a promo whose expiry parses and is in the future, so consumers should treat a past value as expired.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub ends_at: Option<String>,
-    /// Stable identifier for the promotion campaign.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub id: Option<String>,
-    /// Human-readable promotion message. Does not include the expiry timestamp; consumers may format endsAt and append it when present.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub message: Option<String>,
+pub struct McpResourcesReadRequest {
+    /// Name of the MCP server hosting the resource
+    pub server_name: String,
+    /// Resource URI
+    pub uri: String,
 }
 
-/// Long context tier pricing (available for models with extended context windows)
+/// Resource contents returned by the MCP server.
 ///
 /// <div class="warning">
 ///
@@ -8828,38 +8782,12 @@ pub struct ModelBillingPromo {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelBillingTokenPricesLongContext {
-    /// Use cacheReadPrice instead. AI Credits cost per billing batch of cached tokens
-    #[doc(hidden)]
-    #[deprecated]
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cache_price: Option<f64>,
-    /// AI Credits cost per billing batch of cached (read) tokens
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cache_read_price: Option<f64>,
-    /// AI Credits cost per billing batch of 1-hour cache-write (cache creation) tokens.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cache_write1h_price: Option<f64>,
-    /// AI Credits cost per billing batch of cache-write (cache creation) tokens.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cache_write_price: Option<f64>,
-    /// Use maxPromptTokens instead. Prompt token budget for the long context tier. The total context window is this value plus the model's max_output_tokens.
-    #[doc(hidden)]
-    #[deprecated]
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub context_max: Option<i64>,
-    /// AI Credits cost per billing batch of input tokens
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub input_price: Option<f64>,
-    /// Prompt token budget for the long context tier. The total context window is this value plus the model's max_output_tokens.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_prompt_tokens: Option<i64>,
-    /// AI Credits cost per billing batch of output tokens
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub output_price: Option<f64>,
+pub struct McpResourcesReadResult {
+    /// Resource contents returned by the server
+    pub contents: Vec<McpResourceContent>,
 }
 
-/// Token-level pricing information for this model
+/// Server name and optional replacement configuration for an individual MCP server restart. Omit `config` for a config-free restart-by-name of an already-configured server.
 ///
 /// <div class="warning">
 ///
@@ -8869,69 +8797,15 @@ pub struct ModelBillingTokenPricesLongContext {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelBillingTokenPrices {
-    /// Number of tokens per standard billing batch
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub batch_size: Option<i64>,
-    /// Use cacheReadPrice instead. AI Credits cost per billing batch of cached tokens
-    #[doc(hidden)]
-    #[deprecated]
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cache_price: Option<f64>,
-    /// AI Credits cost per billing batch of cached (read) tokens
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cache_read_price: Option<f64>,
-    /// AI Credits cost per billing batch of 1-hour cache-write (cache creation) tokens.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cache_write1h_price: Option<f64>,
-    /// AI Credits cost per billing batch of cache-write (cache creation) tokens.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cache_write_price: Option<f64>,
-    /// Use maxPromptTokens instead. Prompt token budget for the default tier. The total context window is this value plus the model's max_output_tokens.
-    #[doc(hidden)]
-    #[deprecated]
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub context_max: Option<i64>,
-    /// AI Credits cost per billing batch of input tokens
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub input_price: Option<f64>,
-    /// Long context tier pricing (available for models with extended context windows)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub long_context: Option<ModelBillingTokenPricesLongContext>,
-    /// Prompt token budget for the default tier. The total context window is this value plus the model's max_output_tokens.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_prompt_tokens: Option<i64>,
-    /// AI Credits cost per billing batch of output tokens
+pub struct McpRestartServerRequest {
+    /// Replacement MCP server configuration (stdio process or remote HTTP/SSE). Omit to restart the server with its already-registered configuration (config-free restart-by-name).
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub output_price: Option<f64>,
+    pub config: Option<serde_json::Value>,
+    /// Name of the MCP server to restart
+    pub server_name: String,
 }
 
-/// Billing information
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ModelBilling {
-    /// Whole-number percentage discount (0-100) applied to usage billed through this model. Populated for the synthetic `auto` model, where requests routed by auto-mode are billed at a reduced rate; absent for concrete models.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub discount_percent: Option<i32>,
-    /// Billing cost multiplier relative to the base rate
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub multiplier: Option<f64>,
-    /// Active server-driven promotion for this model, if any. Present when the model is being promoted with a discount, which may be time-boxed or open-ended.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub promo: Option<ModelBillingPromo>,
-    /// Token-level pricing information for this model
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub token_prices: Option<ModelBillingTokenPrices>,
-}
-
-/// Vision-specific limits
+/// Per-field MCP telemetry-obfuscation policy.
 ///
 /// <div class="warning">
 ///
@@ -8941,19 +8815,14 @@ pub struct ModelBilling {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelCapabilitiesLimitsVision {
-    /// Maximum image size in bytes
-    #[serde(rename = "max_prompt_image_size")]
-    pub max_prompt_image_size: i64,
-    /// Maximum number of images per prompt
-    #[serde(rename = "max_prompt_images")]
-    pub max_prompt_images: i64,
-    /// MIME types the model accepts
-    #[serde(rename = "supported_media_types")]
-    pub supported_media_types: Vec<String>,
+pub struct McpSafeForTelemetryFields {
+    /// Whether MCP tool input names may be included in telemetry without obfuscation.
+    pub inputs_names: bool,
+    /// Whether the MCP tool name may be included in telemetry without obfuscation.
+    pub name: bool,
 }
 
-/// Token limits for prompts, outputs, and context window
+/// Outcome of an MCP sampling execution: success result, failure error, or cancellation.
 ///
 /// <div class="warning">
 ///
@@ -8963,25 +8832,18 @@ pub struct ModelCapabilitiesLimitsVision {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelCapabilitiesLimits {
-    /// Maximum total context window size in tokens
-    #[serde(
-        rename = "max_context_window_tokens",
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub max_context_window_tokens: Option<i64>,
-    /// Maximum number of output/completion tokens
-    #[serde(rename = "max_output_tokens", skip_serializing_if = "Option::is_none")]
-    pub max_output_tokens: Option<i64>,
-    /// Maximum number of prompt/input tokens
-    #[serde(rename = "max_prompt_tokens", skip_serializing_if = "Option::is_none")]
-    pub max_prompt_tokens: Option<i64>,
-    /// Vision-specific limits
+pub struct McpSamplingExecutionResult {
+    /// Outcome of the sampling inference. 'success' produced a response; 'failure' encountered an error (including agent-side rejection by content filter or criteria); 'cancelled' the caller cancelled this execution via cancelSamplingExecution.
+    pub action: McpSamplingExecutionAction,
+    /// Error description, present when action='failure'.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub vision: Option<ModelCapabilitiesLimitsVision>,
+    pub error: Option<String>,
+    /// MCP CreateMessageResult payload (with optional 'tools' extension), present when action='success'. Treated as opaque at the schema layer; consumers should construct/consume it per the MCP CreateMessageResult shape.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub result: Option<McpExecuteSamplingResult>,
 }
 
-/// Feature flags indicating what the model supports
+/// MCP server status entry, including config source/plugin source and any connection error.
 ///
 /// <div class="warning">
 ///
@@ -8991,38 +8853,26 @@ pub struct ModelCapabilitiesLimits {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelCapabilitiesSupports {
-    /// Resolved Anthropic adaptive-thinking capability — unsupported / optional / required. 'required' models reject thinking.type='enabled' with HTTP 400 (e.g. opus-4.7/4.8).
-    #[serde(rename = "adaptive_thinking", skip_serializing_if = "Option::is_none")]
-    pub adaptive_thinking: Option<AdaptiveThinkingSupport>,
-    /// Whether this model supports reasoning effort configuration
+pub struct McpServer {
+    /// Error message if the server failed to connect
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub reasoning_effort: Option<bool>,
-    /// Whether this model supports vision/image input
+    pub error: Option<String>,
+    /// Server name (config key)
+    pub name: String,
+    /// Configuration source: user, workspace, plugin, or builtin
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub vision: Option<bool>,
-}
-
-/// Model capabilities and limits
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ModelCapabilities {
-    /// Token limits for prompts, outputs, and context window
+    pub source: Option<McpServerSource>,
+    /// Plugin name that provided this server, when source is plugin.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub limits: Option<ModelCapabilitiesLimits>,
-    /// Feature flags indicating what the model supports
+    pub source_plugin: Option<String>,
+    /// Plugin version that provided this server, when source is plugin.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub supports: Option<ModelCapabilitiesSupports>,
+    pub source_plugin_version: Option<String>,
+    /// Connection status: connected, failed, needs-auth, pending, disabled, stopped, or not_configured
+    pub status: McpServerStatus,
 }
 
-/// Policy state (if applicable)
+/// Authentication settings with optional redirect port configuration.
 ///
 /// <div class="warning">
 ///
@@ -9032,15 +8882,13 @@ pub struct ModelCapabilities {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelPolicy {
-    /// Current policy state for this model
-    pub state: ModelPolicyState,
-    /// Usage terms or conditions for this model
+pub struct McpServerAuthConfigRedirectPort {
+    /// Fixed port for the OAuth redirect callback server.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub terms: Option<String>,
+    pub redirect_port: Option<i32>,
 }
 
-/// Copilot model metadata, including identifier, display name, capabilities, policy, billing, reasoning efforts, and picker categories.
+/// Remote MCP server configuration accessed over HTTP or SSE.
 ///
 /// <div class="warning">
 ///
@@ -9050,71 +8898,90 @@ pub struct ModelPolicy {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct Model {
-    /// Billing information
+pub struct McpServerConfigHttp {
+    /// Set to `true` to use defaults, or provide an object with additional auth or OIDC settings.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub billing: Option<ModelBilling>,
-    /// Model capabilities and limits
-    pub capabilities: ModelCapabilities,
-    /// Default reasoning effort level (only present if model supports reasoning effort)
+    pub auth: Option<serde_json::Value>,
+    /// Configuration warnings recorded while loading the server.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub default_reasoning_effort: Option<String>,
-    /// Model identifier (e.g., "claude-sonnet-4.5")
-    pub id: String,
-    /// Model capability category for grouping in the model picker
+    pub config_warnings: Option<Vec<String>>,
+    /// Controls if tools provided by this server can be loaded on demand via tool search (auto) or always included in the initial tool list (never)
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub model_picker_category: Option<ModelPickerCategory>,
-    /// Relative cost tier for token-based billing users
+    pub defer_tools: Option<McpServerConfigDeferTools>,
+    /// Whether secret masking is disabled for calls to this server.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub model_picker_price_category: Option<ModelPickerPriceCategory>,
-    /// Display name
-    pub name: String,
-    /// Policy state (if applicable)
+    pub disable_secret_masking: Option<bool>,
+    /// Set to true to disable persisted MCP tool snapshots for this server. Live tool discovery is unaffected.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub policy: Option<ModelPolicy>,
-    /// Context-window tiers this model offers, when the provider advertises them independently of tiered token pricing. Copilot models carry their tiers in `billing.tokenPrices`; a provider that has no pricing to publish (an agent host reached over AHP, for example) declares them here instead, so the model picker can still offer the tier toggle.
+    pub disable_tool_cache: Option<bool>,
+    /// Optional human-readable server name.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub supported_context_tiers: Option<Vec<String>>,
-    /// Supported reasoning effort levels (only present if model supports reasoning effort)
+    pub display_name: Option<String>,
+    /// Event types this server receives as Copilot notifications.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub supported_reasoning_efforts: Option<Vec<String>>,
-}
-
-/// Managed, repository, and CLI model overrides to overlay onto the session at startup.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ModelApplyStartupOverlayRequest {
-    /// Model explicitly selected by the CLI, when provided.
+    pub events: Option<Vec<String>>,
+    /// Tool names excluded after the include filter is applied.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub cli_model: Option<String>,
-    /// Whether the overlay is being applied while resuming a deferred session.
+    pub exclude_tools: Option<Vec<String>>,
+    /// Content filtering mode to apply to all tools, or a map of tool name to content filtering mode.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub deferred_resume: Option<bool>,
-    /// Model required by device-managed policy, when configured.
+    pub filter_mapping: Option<serde_json::Value>,
+    /// HTTP headers to include in requests to the remote MCP server.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub device_managed_model: Option<String>,
-    /// Context tier selected by repository settings, when configured.
+    pub headers: Option<HashMap<String, String>>,
+    /// Dynamic-header refresh cache lifetime in milliseconds.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub repo_context_tier: Option<String>,
-    /// Model selected by repository settings, when configured.
+    pub headers_refresh_ttl_ms: Option<i64>,
+    /// Whether this server is a built-in fallback used when the user has not configured their own server.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub repo_model: Option<String>,
-    /// Reasoning effort selected by repository settings, when configured.
+    pub is_default_server: Option<bool>,
+    /// Copilot notification types this server may send to the host.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub repo_reasoning_effort: Option<String>,
-    /// Model required by server-managed policy, when configured.
+    pub notifications: Option<Vec<String>>,
+    /// OAuth client ID for a pre-registered remote MCP OAuth client.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub server_managed_model: Option<String>,
+    pub oauth_client_id: Option<String>,
+    /// OAuth grant type to use when authenticating to the remote MCP server.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub oauth_grant_type: Option<McpServerConfigHttpOauthGrantType>,
+    /// Whether the configured OAuth client is public and does not require a client secret.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub oauth_public_client: Option<bool>,
+    /// Set to `true` to use defaults, or provide an object with additional auth or OIDC settings.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub oidc: Option<serde_json::Value>,
+    /// Telemetry-obfuscation policy for this server's tools.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub safe_for_telemetry: Option<serde_json::Value>,
+    /// The origin of this server configuration.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source: Option<McpServerSource>,
+    /// Source file path recorded while loading the config.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source_path: Option<String>,
+    /// Plugin that provided this server.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source_plugin: Option<String>,
+    /// Whether the providing plugin uses the Open Plugin Spec.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source_plugin_spec: Option<bool>,
+    /// Version of the plugin that provided this server.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source_plugin_version: Option<String>,
+    /// Timeout in milliseconds for tool discovery and tool calls.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub timeout: Option<i64>,
+    /// Tools to include. Defaults to all tools if not specified.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tools: Option<Vec<String>>,
+    /// Remote transport type. Defaults to "http" when omitted.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub r#type: Option<McpServerConfigHttpType>,
+    /// URL of the remote MCP server endpoint.
+    pub url: String,
 }
 
-/// Vision-specific limits
+/// In-process MCP server configuration used by embedded SDK clients.
 ///
 /// <div class="warning">
 ///
@@ -9124,53 +8991,72 @@ pub struct ModelApplyStartupOverlayRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelCapabilitiesOverrideLimitsVision {
-    /// Maximum image size in bytes
-    #[serde(
-        rename = "max_prompt_image_size",
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub max_prompt_image_size: Option<i64>,
-    /// Maximum number of images per prompt
-    #[serde(rename = "max_prompt_images", skip_serializing_if = "Option::is_none")]
-    pub max_prompt_images: Option<i64>,
-    /// MIME types the model accepts
-    #[serde(
-        rename = "supported_media_types",
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub supported_media_types: Option<Vec<String>>,
-}
-
-/// Token limits for prompts, outputs, and context window
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ModelCapabilitiesOverrideLimits {
-    /// Maximum total context window size in tokens
-    #[serde(
-        rename = "max_context_window_tokens",
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub max_context_window_tokens: Option<i64>,
-    /// Maximum number of output/completion tokens
-    #[serde(rename = "max_output_tokens", skip_serializing_if = "Option::is_none")]
-    pub max_output_tokens: Option<i64>,
-    /// Maximum number of prompt/input tokens
-    #[serde(rename = "max_prompt_tokens", skip_serializing_if = "Option::is_none")]
-    pub max_prompt_tokens: Option<i64>,
-    /// Vision-specific limits
+pub(crate) struct McpServerConfigMemory {
+    /// Configuration warnings recorded while loading the server.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub vision: Option<ModelCapabilitiesOverrideLimitsVision>,
+    pub config_warnings: Option<Vec<String>>,
+    /// Controls whether tools can be loaded on demand.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub defer_tools: Option<McpServerConfigDeferTools>,
+    /// Whether secret masking is disabled for calls to this server.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub disable_secret_masking: Option<bool>,
+    /// Whether persisted tool snapshots are disabled.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub disable_tool_cache: Option<bool>,
+    /// Optional human-readable server name.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub display_name: Option<String>,
+    /// Event types this server receives as Copilot notifications.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub events: Option<Vec<String>>,
+    /// Tool names excluded after the include filter is applied.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub exclude_tools: Option<Vec<String>>,
+    /// Content filtering mode to apply to this server's tools.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub filter_mapping: Option<serde_json::Value>,
+    /// Whether this server is a built-in fallback.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub is_default_server: Option<bool>,
+    /// Copilot notification types this server may send to the host.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub notifications: Option<Vec<String>>,
+    /// Set to `true` to use default OIDC settings.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub oidc: Option<serde_json::Value>,
+    /// Telemetry-obfuscation policy for this server's tools.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub safe_for_telemetry: Option<serde_json::Value>,
+    /// In-process MCP server instance. This value cannot cross a JSON-RPC boundary.
+    #[doc(hidden)]
+    pub(crate) server_instance: serde_json::Value,
+    /// The origin of this server configuration.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source: Option<McpServerSource>,
+    /// Source file path recorded while loading the config.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source_path: Option<String>,
+    /// Plugin that provided this server.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source_plugin: Option<String>,
+    /// Whether the providing plugin uses the Open Plugin Spec.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source_plugin_spec: Option<bool>,
+    /// Version of the plugin that provided this server.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source_plugin_version: Option<String>,
+    /// Timeout in milliseconds for tool discovery and tool calls.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub timeout: Option<i64>,
+    /// Tools to include. Defaults to all tools if not specified.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tools: Option<Vec<String>>,
+    #[doc(hidden)]
+    pub(crate) r#type: McpServerConfigMemoryType,
 }
 
-/// Feature flags indicating what the model supports
+/// Stdio MCP server configuration launched as a child process.
 ///
 /// <div class="warning">
 ///
@@ -9180,19 +9066,84 @@ pub struct ModelCapabilitiesOverrideLimits {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelCapabilitiesOverrideSupports {
-    /// Resolved Anthropic adaptive-thinking capability — unsupported / optional / required. 'required' models reject thinking.type='enabled' with HTTP 400 (e.g. opus-4.7/4.8).
-    #[serde(rename = "adaptive_thinking", skip_serializing_if = "Option::is_none")]
-    pub adaptive_thinking: Option<AdaptiveThinkingSupport>,
-    /// Whether this model supports reasoning effort configuration
+pub struct McpServerConfigStdio {
+    /// Command-line arguments passed to the Stdio MCP server process.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub reasoning_effort: Option<bool>,
-    /// Whether this model supports vision/image input
+    pub args: Option<Vec<String>>,
+    /// Set to `true` to use defaults, or provide an object with additional auth or OIDC settings.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub vision: Option<bool>,
+    pub auth: Option<serde_json::Value>,
+    /// Executable command used to start the Stdio MCP server process.
+    pub command: String,
+    /// Configuration warnings recorded while loading the server.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub config_warnings: Option<Vec<String>>,
+    /// Working directory for the Stdio MCP server process.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cwd: Option<String>,
+    /// Controls if tools provided by this server can be loaded on demand via tool search (auto) or always included in the initial tool list (never)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub defer_tools: Option<McpServerConfigDeferTools>,
+    /// Whether secret masking is disabled for calls to this server.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub disable_secret_masking: Option<bool>,
+    /// Set to true to disable persisted MCP tool snapshots for this server. Live tool discovery is unaffected.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub disable_tool_cache: Option<bool>,
+    /// Optional human-readable server name.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub display_name: Option<String>,
+    /// Environment variables to pass to the Stdio MCP server process.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub env: Option<HashMap<String, String>>,
+    /// Event types this server receives as Copilot notifications.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub events: Option<Vec<String>>,
+    /// Tool names excluded after the include filter is applied.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub exclude_tools: Option<Vec<String>>,
+    /// Content filtering mode to apply to all tools, or a map of tool name to content filtering mode.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub filter_mapping: Option<serde_json::Value>,
+    /// Whether this server is a built-in fallback used when the user has not configured their own server.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub is_default_server: Option<bool>,
+    /// Copilot notification types this server may send to the host.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub notifications: Option<Vec<String>>,
+    /// Set to `true` to use defaults, or provide an object with additional auth or OIDC settings.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub oidc: Option<serde_json::Value>,
+    /// Telemetry-obfuscation policy for this server's tools.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub safe_for_telemetry: Option<serde_json::Value>,
+    /// The origin of this server configuration.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source: Option<McpServerSource>,
+    /// Source file path recorded while loading the config.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source_path: Option<String>,
+    /// Plugin that provided this server.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source_plugin: Option<String>,
+    /// Whether the providing plugin uses the Open Plugin Spec.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source_plugin_spec: Option<bool>,
+    /// Version of the plugin that provided this server.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source_plugin_version: Option<String>,
+    /// Timeout in milliseconds for tool discovery and tool calls.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub timeout: Option<i64>,
+    /// Tools to include. Defaults to all tools if not specified.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tools: Option<Vec<String>>,
+    /// Local transport type. Defaults to stdio when omitted.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub r#type: Option<McpServerConfigStdioType>,
 }
 
-/// Optional capability overrides (vision, tool_calls, reasoning, etc.).
+/// MCP servers configured for the session, with their connection status and host-level state.
 ///
 /// <div class="warning">
 ///
@@ -9202,16 +9153,15 @@ pub struct ModelCapabilitiesOverrideSupports {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelCapabilitiesOverride {
-    /// Token limits for prompts, outputs, and context window
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub limits: Option<ModelCapabilitiesOverrideLimits>,
-    /// Feature flags indicating what the model supports
+pub struct McpServerList {
+    /// Host-level state, omitted when no MCP host is initialized.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub supports: Option<ModelCapabilitiesOverrideSupports>,
+    pub host: Option<McpHostState>,
+    /// Configured MCP servers
+    pub servers: Vec<McpServer>,
 }
 
-/// List of Copilot models available to the resolved user, including capabilities and billing metadata.
+/// Mode controlling how MCP server env values are resolved (`direct` or `indirect`).
 ///
 /// <div class="warning">
 ///
@@ -9221,12 +9171,12 @@ pub struct ModelCapabilitiesOverride {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelList {
-    /// List of available models with full metadata
-    pub models: Vec<Model>,
+pub struct McpSetEnvValueModeParams {
+    /// How environment-variable values supplied to MCP servers are resolved. "direct" passes literal string values; "indirect" treats values as references (e.g. names of environment variables on the host) that the runtime resolves before launch. Defaults to the runtime's startup mode; clients that intentionally launch MCP servers with literal values (e.g. CLI prompt mode and ACP) set this to "direct".
+    pub mode: McpSetEnvValueModeDetails,
 }
 
-/// Optional listing options.
+/// Env-value mode recorded on the session after the update.
 ///
 /// <div class="warning">
 ///
@@ -9236,13 +9186,12 @@ pub struct ModelList {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelListRequest {
-    /// If true, bypasses the per-session model list cache and re-fetches from CAPI.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub skip_cache: Option<bool>,
+pub struct McpSetEnvValueModeResult {
+    /// Mode recorded on the session after the update
+    pub mode: McpSetEnvValueModeDetails,
 }
 
-/// Filesystem and environment context used to resolve model-picker settings.
+/// Server name and optional configuration for an individual MCP server start. Omit `config` for a config-free start-by-name of an already-configured server.
 ///
 /// <div class="warning">
 ///
@@ -9252,16 +9201,15 @@ pub struct ModelListRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelPickerSettingsContext {
-    /// Optional Copilot configuration directory containing persisted settings.
+pub struct McpStartServerRequest {
+    /// MCP server configuration (stdio process or remote HTTP/SSE). Omit to start the server with its already-registered configuration (config-free start-by-name).
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub config_dir: Option<String>,
-    /// Environment variables consulted while resolving model-picker settings.
-    pub environment: serde_json::Value,
-    /// User home directory used when resolving persisted settings.
-    pub home_directory: String,
+    pub config: Option<serde_json::Value>,
+    /// Name of the MCP server to start
+    pub server_name: String,
 }
 
+/// MCP server startup filtering result.
 ///
 /// <div class="warning">
 ///
@@ -9271,18 +9219,18 @@ pub struct ModelPickerSettingsContext {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelPickerPersistenceRequest {
-    /// Whether context tier was explicitly selected and should be persisted.
+pub struct McpStartServersResult {
+    /// Non-default servers allowed by policy
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub context_tier_explicit: Option<bool>,
-    /// Whether reasoning effort was explicitly selected and should be persisted.
+    pub allowed_servers: Option<Vec<McpAllowedServer>>,
+    /// Servers whose connection attempt failed.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub reasoning_effort_explicit: Option<bool>,
-    /// Filesystem and environment context used to resolve settings persistence.
-    pub settings_context: ModelPickerSettingsContext,
+    pub failed_servers: Option<Vec<McpFailedServer>>,
+    /// Servers filtered out before startup
+    pub filtered_servers: Vec<McpFilteredServer>,
 }
 
-/// Reasoning effort level to apply to the currently selected model.
+/// Server name for an individual MCP server stop.
 ///
 /// <div class="warning">
 ///
@@ -9292,12 +9240,12 @@ pub struct ModelPickerPersistenceRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelSetReasoningEffortRequest {
-    /// Reasoning effort level to apply to the currently selected model. The host is responsible for validating the value against the model's supported levels before calling.
-    pub reasoning_effort: String,
+pub struct McpStopServerRequest {
+    /// Name of the MCP server to stop
+    pub server_name: String,
 }
 
-/// Update the session's reasoning effort without changing the selected model. Use `switchTo` instead when you also need to change the model. The runtime stores the effort on the session and applies it to subsequent turns.
+/// Metadata controlling an MCP task's lifetime.
 ///
 /// <div class="warning">
 ///
@@ -9307,12 +9255,13 @@ pub struct ModelSetReasoningEffortRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelSetReasoningEffortResult {
-    /// Reasoning effort level recorded on the session after the update
-    pub reasoning_effort: String,
+pub struct McpTaskMetadata {
+    /// Task time-to-live.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub ttl: Option<i64>,
 }
 
-/// Optional opaque account selection or compatibility GitHub token used to list models.
+/// Server name identifying the external client to remove.
 ///
 /// <div class="warning">
 ///
@@ -9322,15 +9271,12 @@ pub struct ModelSetReasoningEffortResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelsListRequest {
-    /// GitHub token accepted for compatibility with existing SDK clients. When provided, resolves this token instead of using the current account.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub git_hub_token: Option<String>,
-    /// Opaque account identifier returned by `account.getAllUsers`. When omitted, the current account is used.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub selection_id: Option<String>,
+pub(crate) struct McpUnregisterExternalClientRequest {
+    /// Server name of the external client to unregister
+    pub server_name: String,
 }
 
+/// Memory configuration for this session.
 ///
 /// <div class="warning">
 ///
@@ -9340,70 +9286,85 @@ pub struct ModelsListRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelSwitchConfirmation {
-    /// Current conversation token count before switching models.
-    pub current_tokens: f64,
-    /// Target model token limit used by the compaction preflight.
-    pub target_limit: f64,
-    /// Display name of the model that requires compaction confirmation.
-    pub target_model_display_name: String,
+pub struct MemoryConfiguration {
+    /// Whether memory is enabled for the session.
+    pub enabled: bool,
 }
 
-/// Target model identifier and optional reasoning effort, summary, capability overrides, and context tier.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
+/// The six normalized `/context` header buckets, computed from the same tokenization as `entries` so the two never disagree. Convenience rollups: `freeSpace` and `buffer` describe window capacity rather than occupied context, so the values do not sum to `totalTokens`.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelSwitchToRequest {
-    /// Explicit response to a model-switch compaction preflight. Omit to request a confirmation projection when compaction is necessary.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub compaction_decision: Option<String>,
-    /// Explicit context tier for the selected model. `"default"` / `"long_context"` apply the requested tier; omit this field to use normal model behavior with no explicit tier.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub context_tier: Option<ContextTier>,
-    /// When true, defer this switch (enqueue it) if another model change is already queued, even when no turn is active — so it drains last (FIFO) and wins over the already-queued change. Intended for genuine user-initiated model selections; internal restore/reapply switches omit it and apply immediately when no turn is active. When no other model change is queued this has no effect (a switch still applies immediately unless a turn is active).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub defer_if_model_change_queued: Option<bool>,
-    /// Override individual model capabilities resolved by the runtime
+pub struct MetadataContextAttributionResultContextAttributionCategories {
+    /// Output reserve plus post-blocking-threshold buffer.
+    pub buffer: i64,
+    /// Custom-instructions tokens (0 when none are configured).
+    pub custom_instructions: i64,
+    /// Remaining unused window capacity (clamped at 0).
+    pub free_space: i64,
+    /// MCP tool-definition tokens.
+    pub mcp_tools: i64,
+    /// Conversation (user/assistant/tool) message tokens.
+    pub messages: i64,
+    /// System prompt tokens, excluding custom instructions.
+    pub system_prompt: i64,
+    /// Non-MCP tool-definition tokens.
+    pub system_tools: i64,
+}
+
+/// Successful compaction history for the session.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct MetadataContextAttributionResultContextAttributionCompactions {
+    /// Number of successful compactions in this session.
+    pub count: i64,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct MetadataContextAttributionResultContextAttributionEntriesItem {
+    /// Supplementary per-entry metadata (e.g. `messageCount`, `role`, `evictable`, `pluginSource`). Values are stringified; parse as needed and ignore unrecognized keys.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub model_capabilities: Option<ModelCapabilitiesOverride>,
-    /// Settings scope used when persisting the selected model.
+    pub attributes: Option<HashMap<String, String>>,
+    /// Identifier for this entry, formed by joining its `kind` and source name (e.g. `tool:bash`, `skill:tmux`, `toolDefinition:bash`); unique within the snapshot. Use it to match the same entry across snapshots, to correlate with other APIs (skill/agent/MCP registries), and as the `parentId` target for nesting. Distinct from the human-facing `label`.
+    pub id: String,
+    /// Source category for this entry. Not a closed set — tolerate unknown values. Known values today: `skill`, `subagent`, `mcpServer`, `tool`, `system`, `toolDefinition`, `plugin`.
+    pub kind: String,
+    /// Human-readable display label, e.g. `bash` or `skill: tmux`. Presentation-only; may be localized/reformatted without notice — do not key off it.
+    pub label: String,
+    /// Optional `id` of the parent entry: e.g. a `plugin` entry parenting its `skill`/`mcpServer` entries, or the `system` entry parenting `toolDefinition` entries. Omitted for top-level entries.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub model_change_scope: Option<String>,
-    /// Model selection id to switch to, as returned by `list`. A bare id (e.g. `claude-sonnet-4.6`) names a Copilot (CAPI) model; a provider-qualified id (`provider/id`, e.g. `acme/claude-sonnet`) targets a registry BYOK model.
+    pub parent_id: Option<String>,
+    /// Token count currently in context attributable to this entry.
+    pub tokens: i64,
+}
+
+/// Per-source token attribution snapshot for the current context window. The heaviest individual messages are available separately via `metadata.getContextHeaviestMessages`.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct MetadataContextAttributionResultContextAttribution {
+    /// Output reserve plus the tokens past the buffer-exhaustion blocking threshold. Mirrors `SessionContextInfo.bufferTokens`.
+    pub buffer_tokens: i64,
+    /// The six normalized `/context` header buckets, computed from the same tokenization as `entries` so the two never disagree. Convenience rollups: `freeSpace` and `buffer` describe window capacity rather than occupied context, so the values do not sum to `totalTokens`.
+    pub categories: MetadataContextAttributionResultContextAttributionCategories,
+    /// Successful compaction history for the session.
+    pub compactions: MetadataContextAttributionResultContextAttributionCompactions,
+    /// Token count at which background compaction starts. Mirrors `SessionContextInfo.compactionThreshold`.
+    pub compaction_threshold: i64,
+    /// Flat list of per-source attribution entries. Group by `kind` and render unrecognized kinds generically. Nesting and rollups are expressed via `parentId`.
+    pub entries: Vec<MetadataContextAttributionResultContextAttributionEntriesItem>,
+    /// Prompt limit plus the model's output reserve: the full context window `categories.freeSpace` and `categories.buffer` are measured against. Mirrors `SessionContextInfo.limit`.
+    pub limit: i64,
+    /// The concrete model id the entire breakdown was tokenized against (feeds the per-model token multiplier). Under `Auto` (Free/Student) this is the resolved model, not the literal `auto` sentinel, so totals are not undercounted. A single-model approximation of a potentially multi-model Auto session.
     pub model_id: String,
-    /// Optional settings context and explicit-override flags used to persist a picker selection.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub picker_persistence: Option<ModelPickerPersistenceRequest>,
-    /// Reasoning effort level to use for the model. CAPI values are model-defined and validated against the selected model; BYOK providers may define additional values. "none" disables reasoning. When omitted, no effort override is applied.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub reasoning_effort: Option<String>,
-    /// Reasoning summary mode to request for supported model clients
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub reasoning_summary: Option<ReasoningSummary>,
-    /// Optional repository settings scope to persist after the switch commits.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub repo_scope: Option<String>,
-    /// Require the target to be currently available and enabled before applying the switch.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub require_available: Option<bool>,
-    /// When true, evaluate context-window compaction policy before applying the switch.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub run_compaction_preflight: Option<bool>,
-    /// Origin to record on the effective `session.model_change` event. Defaults to `sdk` when omitted.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source: Option<ModelChangeSource>,
-    /// Output verbosity level to request for supported models
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub verbosity: Option<Verbosity>,
+    /// How `modelId` was chosen. Not a closed set — tolerate unknown values. Known values today: `autoResolved` (the model Auto resolved to), `selected` (the user's explicitly selected model), `default` (a fallback before any model is known).
+    pub model_source: String,
+    /// Maximum prompt tokens the resolved model accepts — the denominator for a `##k/###k` context-usage display. Mirrors `SessionContextInfo.promptTokenLimit`.
+    pub prompt_token_limit: i64,
+    /// Total token count of the current context window the entries are measured against (system message + conversation messages + tool definitions — the same total reported by /context). Divide an entry's `tokens` by this to derive its share.
+    pub total_tokens: i64,
 }
 
-/// The model identifier active on the session after the switch.
+/// Per-source attribution breakdown for the session's current context window, or null if uninitialized.
 ///
 /// <div class="warning">
 ///
@@ -9413,34 +9374,12 @@ pub struct ModelSwitchToRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelSwitchToResult {
-    /// Compaction confirmation projection when status is confirmation_required
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub confirmation: Option<ModelSwitchConfirmation>,
-    /// True when the switch was deferred (enqueued as a cancellable `/model` command) because a turn was active or another model change was already queued, rather than applied immediately. When true, the session's live model is unchanged until the queued change drains.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub deferred: Option<bool>,
-    /// Deprecation warnings associated with the selected model or options.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub deprecation_warnings: Option<Vec<String>>,
-    /// User-facing outcome message for the model switch.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub message: Option<String>,
-    /// Currently active model identifier after the switch
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub model_id: Option<String>,
-    /// Persistence failure encountered after applying the model switch.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub persistence_error: Option<String>,
-    /// Lifecycle result for the requested switch
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub status: Option<String>,
-    /// User-facing warning produced while applying the model switch.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub warning: Option<String>,
+pub struct MetadataContextAttributionResult {
+    /// Per-source context-window attribution, or null if the session has not yet been initialized (no system prompt or tool metadata cached).
+    pub context_attribution: Option<MetadataContextAttributionResultContextAttribution>,
 }
 
-/// Agent interaction mode to apply to the session.
+/// Parameters for the heaviest-messages query.
 ///
 /// <div class="warning">
 ///
@@ -9450,42 +9389,13 @@ pub struct ModelSwitchToResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModeSetRequest {
-    /// Explicit response to a model-switch compaction preflight.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub compaction_decision: Option<String>,
-    /// Session whose plan-mode base state should be inherited.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub inherit_plan_base_from_session_id: Option<String>,
-    /// The session mode the agent is operating in
-    pub mode: SessionMode,
-    /// Whether the selected plan model should be persisted.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub persist_plan_selection: Option<bool>,
-    /// Settings context used when persisting the selected plan model.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub picker_settings_context: Option<ModelPickerSettingsContext>,
-    /// Context tier to use with the dedicated plan model.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub plan_context_tier: Option<String>,
-    /// Action to perform when leaving plan mode.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub plan_exit_action: Option<String>,
-    /// Dedicated model to use in plan mode, when configured.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub plan_model: Option<String>,
-    /// Whether a dedicated plan model is configured.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub plan_model_configured: Option<bool>,
-    /// Reasoning effort to use with the dedicated plan model.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub plan_reasoning_effort: Option<String>,
-    /// Whether leaving plan mode should restore the session's previous model.
+pub struct MetadataContextHeaviestMessagesRequest {
+    /// Maximum number of messages to return, most-expensive first. Omit for the server default.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub restore_plan_model: Option<bool>,
+    pub limit: Option<i64>,
 }
 
-/// Outcome of a session mode change, including any model switch it triggered and follow-up the host must perform.
+/// The heaviest individual messages in the session's context window, most-expensive first.
 ///
 /// <div class="warning">
 ///
@@ -9495,32 +9405,14 @@ pub struct ModeSetRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModeSetResult {
-    /// Whether the host should arm an interactive continuation after the mode change.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub arm_interactive_continuation: Option<bool>,
-    /// Compaction confirmation required before the mode change can complete.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub confirmation: Option<ModelSwitchConfirmation>,
-    /// Whether the host must defer implementing the requested mode change.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub defer_implementation: Option<bool>,
-    /// Deprecation warnings associated with the model selected by the mode change.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub deprecation_warnings: Option<Vec<String>>,
-    /// User-facing outcome message for the model switch triggered by the mode change.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub message: Option<String>,
-    /// Whether applying the mode changed the active model.
-    pub model_changed: bool,
-    /// Lifecycle status of the requested mode change.
-    pub status: String,
-    /// User-facing warning produced while applying the mode change.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub warning: Option<String>,
+pub struct MetadataContextHeaviestMessagesResult {
+    /// Heaviest messages, most-expensive first.
+    pub messages: Vec<ContextHeaviestMessage>,
+    /// Total token count of the current context window, so callers can compute each message's share without a second call.
+    pub total_tokens: i64,
 }
 
-/// Azure-specific provider options.
+/// Model identifier and token limits used to compute the context-info breakdown.
 ///
 /// <div class="warning">
 ///
@@ -9530,69 +9422,43 @@ pub struct ModeSetResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ProviderConfigAzure {
-    /// API version. When set, uses the versioned deployment route. When omitted, uses the GA versionless v1 route.
+pub struct MetadataContextInfoRequest {
+    /// Maximum output tokens allowed by the target model. Pass 0 if unknown.
+    pub output_token_limit: i64,
+    /// Maximum prompt tokens allowed by the target model. Pass 0 to use the runtime default.
+    pub prompt_token_limit: i64,
+    /// Model identifier used for tokenization. Omit to use the session default. Used both for token counting and to compute display values.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub api_version: Option<String>,
+    pub selected_model: Option<String>,
 }
 
-/// External SDK input for a named custom model provider. Ingested by the native protocol boundary before host dispatch.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
+/// Token-usage breakdown for the session's current context window
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct NamedProviderConfig {
-    /// Static API key used to authenticate provider requests.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub api_key: Option<String>,
-    /// Azure authentication configuration for the provider.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub azure: Option<ProviderConfigAzure>,
-    /// Base URL for provider API requests.
-    pub base_url: String,
-    /// Static bearer token used to authenticate provider requests.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub bearer_token: Option<String>,
-    /// Whether the host supplies bearer tokens dynamically.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub has_bearer_token_provider: Option<bool>,
-    /// Additional HTTP headers included with provider requests.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub headers: Option<HashMap<String, String>>,
-    /// Unique provider name used to qualify model selection IDs.
-    pub name: String,
-    /// Transport used to communicate with the provider.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub transport: Option<ProviderConfigTransport>,
-    /// Provider protocol family.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub r#type: Option<ProviderConfigType>,
-    /// Wire API used to communicate with the provider.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub wire_api: Option<ProviderConfigWireApi>,
-}
-
-/// The session's friendly name, or null when not yet set.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct NameGetResult {
-    /// The session name (user-set or auto-generated), or null if not yet set
-    pub name: Option<String>,
+pub struct MetadataContextInfoResultContextInfo {
+    /// Output reserve plus tokens after the buffer-exhaustion blocking threshold (default 95%)
+    pub buffer_tokens: i64,
+    /// Token count at which background compaction starts (configurable percentage of promptTokenLimit)
+    pub compaction_threshold: i64,
+    /// Tokens consumed by user/assistant/tool messages
+    pub conversation_tokens: i64,
+    /// Prompt token limit plus the model's full output token limit.
+    pub limit: i64,
+    /// Tokens consumed by MCP tool definitions (subset of toolDefinitionsTokens, excludes deferred tools)
+    pub mcp_tools_tokens: i64,
+    /// The model used for token counting
+    pub model_name: String,
+    /// Maximum prompt tokens allowed by the model (or DEFAULT_TOKEN_LIMIT if unspecified)
+    pub prompt_token_limit: i64,
+    /// Tokens consumed by the system prompt
+    pub system_tokens: i64,
+    /// Tokens consumed by tool definitions sent to the model (excludes deferred tools)
+    pub tool_definitions_tokens: i64,
+    /// Sum of system, conversation and tool-definition tokens
+    pub total_tokens: i64,
 }
 
-/// Auto-generated session summary to apply as the session's name when no user-set name exists.
+/// Token breakdown for the session's current context window, or null if uninitialized.
 ///
 /// <div class="warning">
 ///
@@ -9602,12 +9468,12 @@ pub struct NameGetResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct NameSetAutoRequest {
-    /// Auto-generated session summary. Empty/whitespace-only values are ignored; values are trimmed before persisting.
-    pub summary: String,
+pub struct MetadataContextInfoResult {
+    /// Token breakdown for the current context window, or null if the session has not yet been initialized (no system prompt or tool metadata cached).
+    pub context_info: Option<MetadataContextInfoResultContextInfo>,
 }
 
-/// Indicates whether the auto-generated summary was applied as the session's name.
+/// Indicates whether the local session is currently processing a turn or background continuation.
 ///
 /// <div class="warning">
 ///
@@ -9617,12 +9483,12 @@ pub struct NameSetAutoRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct NameSetAutoResult {
-    /// Whether the auto-generated summary was persisted. False if the session already has a user-set name, the summary normalized to empty, or the session does not have a workspace.
-    pub applied: bool,
+pub struct MetadataIsProcessingResult {
+    /// Whether the session is currently processing user/agent messages. False for non-local sessions (which don't run a local agentic loop). Reflects an in-flight turn or background continuation.
+    pub processing: bool,
 }
 
-/// New friendly name to apply to the session.
+/// Model identifier to use when re-tokenizing the session's existing messages.
 ///
 /// <div class="warning">
 ///
@@ -9632,12 +9498,12 @@ pub struct NameSetAutoResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct NameSetRequest {
-    /// New session name (1–100 characters, trimmed of leading/trailing whitespace)
-    pub name: String,
+pub struct MetadataRecomputeContextTokensRequest {
+    /// Model identifier used for tokenization. The runtime token-counts both chat-context and system-context messages against this model.
+    pub model_id: String,
 }
 
-/// Source descriptor for a `session.options.update` content-exclusion rule, with source name and type.
+/// Re-tokenize the session's existing messages against `modelId` and return the token totals. Useful for hosts that want an initial estimate of context usage on session resume, before the next agent turn fires `session.context_info_changed` events. Returns zeros for an empty session.
 ///
 /// <div class="warning">
 ///
@@ -9647,14 +9513,16 @@ pub struct NameSetRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct OptionsUpdateAdditionalContentExclusionPolicyRuleSource {
-    /// Name of the policy source.
-    pub name: String,
-    /// Type of the policy source.
-    pub r#type: String,
+pub struct MetadataRecomputeContextTokensResult {
+    /// Tokens contributed by user/assistant/tool messages (excludes system/developer prompts).
+    pub messages_token_count: i64,
+    /// Tokens contributed by system/developer prompt snapshots.
+    pub system_token_count: i64,
+    /// Sum of tokens across chat-context and system-context messages currently held by the session.
+    pub total_tokens: i64,
 }
 
-/// Single content-exclusion rule supplied to `session.options.update`, with paths, match conditions, and source.
+/// Updated working directory and git context. Emitted as the new payload of `session.context_changed`.
 ///
 /// <div class="warning">
 ///
@@ -9664,20 +9532,33 @@ pub struct OptionsUpdateAdditionalContentExclusionPolicyRuleSource {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct OptionsUpdateAdditionalContentExclusionPolicyRule {
-    /// Conditions of which at least one must match.
+pub struct SessionWorkingDirectoryContext {
+    /// Merge-base commit SHA (fork point from the remote default branch)
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub if_any_match: Option<Vec<String>>,
-    /// Conditions none of which may match.
+    pub base_commit: Option<String>,
+    /// Current git branch name
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub if_none_match: Option<Vec<String>>,
-    /// Path patterns covered by this rule.
-    pub paths: Vec<String>,
-    /// Source descriptor for a `session.options.update` content-exclusion rule, with source name and type.
-    pub source: OptionsUpdateAdditionalContentExclusionPolicyRuleSource,
+    pub branch: Option<String>,
+    /// Current working directory path
+    pub cwd: String,
+    /// Root directory of the git repository, resolved via git rev-parse
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub git_root: Option<String>,
+    /// Head commit of the current git branch
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub head_commit: Option<String>,
+    /// Hosting platform type of the repository
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub host_type: Option<SessionWorkingDirectoryContextHostType>,
+    /// Repository identifier derived from the git remote URL ("owner/name" for GitHub, "org/project/repo" for Azure DevOps)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub repository: Option<String>,
+    /// Raw host string from the git remote URL (e.g. "github.com", "dev.azure.com")
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub repository_host: Option<String>,
 }
 
-/// Content-exclusion policy supplied to `session.options.update`, with rules, last-updated data, and scope.
+/// Updated working-directory/git context to record on the session.
 ///
 /// <div class="warning">
 ///
@@ -9687,17 +9568,12 @@ pub struct OptionsUpdateAdditionalContentExclusionPolicyRule {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct OptionsUpdateAdditionalContentExclusionPolicy {
-    /// Opaque policy update timestamp supplied by the host.
-    #[serde(rename = "last_updated_at")]
-    pub last_updated_at: serde_json::Value,
-    /// Content-exclusion rules to apply.
-    pub rules: Vec<OptionsUpdateAdditionalContentExclusionPolicyRule>,
-    /// Allowed values for the `OptionsUpdateAdditionalContentExclusionPolicyScope` enumeration.
-    pub scope: OptionsUpdateAdditionalContentExclusionPolicyScope,
+pub struct MetadataRecordContextChangeRequest {
+    /// Updated working directory and git context. Emitted as the new payload of `session.context_changed`.
+    pub context: SessionWorkingDirectoryContext,
 }
 
-/// Pending permission prompt reconstructed from event history, with request ID and user-facing prompt details.
+/// Notify the session that its working directory context has changed. Emits a `session.context_changed` event so consumers (telemetry, OTel tracker, ACP, the timeline UI) can react. Use this when the host has detected a cwd/branch/repo change outside the session's normal lifecycle (e.g., after a shell command in interactive mode). For a local session, a report whose `cwd` diverges from the session's current working directory is ignored (the call still succeeds but records nothing and emits no event); move a local session's working directory via `metadata.setWorkingDirectory` instead.
 ///
 /// <div class="warning">
 ///
@@ -9705,16 +9581,11 @@ pub struct OptionsUpdateAdditionalContentExclusionPolicy {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PendingPermissionRequest {
-    /// The user-facing permission prompt details (commands, write, read, mcp, url, memory, custom-tool, path, hook)
-    pub request: PermissionPromptRequest,
-    /// Unique identifier for the pending permission request
-    pub request_id: RequestId,
-}
+pub struct MetadataRecordContextChangeResult {}
 
-/// List of pending permission requests reconstructed from event history.
+/// Absolute path to set as the session's new working directory. For local sessions the path must be absolute and exist on disk: it is validated before any session state changes, and a failing validation rejects the call with nothing mutated, persisted, or emitted. Remote sessions record the path as-is.
 ///
 /// <div class="warning">
 ///
@@ -9724,12 +9595,12 @@ pub struct PendingPermissionRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PendingPermissionRequestList {
-    /// Pending permission prompts reconstructed from the session's event history. Equivalent to the set of `permission.requested` events that have not yet been followed by a matching `permission.completed` event. Used by clients (e.g. the CLI) to hydrate UI for prompts that were emitted before the client attached to the session.
-    pub items: Vec<PendingPermissionRequest>,
+pub struct MetadataSetWorkingDirectoryRequest {
+    /// Absolute path to set as the session's working directory. The runtime updates the session's recorded cwd so subsequent operations (shell tools, file lookups, telemetry) anchor to it.
+    pub working_directory: String,
 }
 
-/// Permission-decision request variant to approve only the current permission request.
+/// Update the session's working directory. Used by the host when the user explicitly changes cwd (e.g., the `/cd` slash command). The host is responsible for any related side-effects (file index, etc.); it does NOT change the process working directory (a session's cwd is per-session, not process-global). For local sessions the runtime validates the target first (an absolute path that exists on disk) and re-bases the permission primary directory; a rejected validation fails the call before anything is mutated, persisted, or emitted. Location-scoped permission rules are then re-keyed to the new directory (best-effort). Remote sessions only record the path.
 ///
 /// <div class="warning">
 ///
@@ -9739,15 +9610,12 @@ pub struct PendingPermissionRequestList {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveOnce {
-    /// True only when a host surfaced this request to a user who approved it.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub approved_interactively: Option<bool>,
-    /// Approve this single request only
-    pub kind: PermissionDecisionApproveOnceKind,
+pub struct MetadataSetWorkingDirectoryResult {
+    /// Working directory after the update
+    pub working_directory: String,
 }
 
-/// Session-scoped approval details for specific command identifiers.
+/// The repository the remote session targets.
 ///
 /// <div class="warning">
 ///
@@ -9757,14 +9625,16 @@ pub struct PermissionDecisionApproveOnce {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForSessionApprovalCommands {
-    /// Command identifiers covered by this approval.
-    pub command_identifiers: Vec<String>,
-    /// Approval scoped to specific command identifiers.
-    pub kind: PermissionDecisionApproveForSessionApprovalCommandsKind,
+pub struct MetadataSnapshotRemoteMetadataRepository {
+    /// The branch the remote session is operating on.
+    pub branch: String,
+    /// The GitHub repository name (without owner).
+    pub name: String,
+    /// The GitHub owner (user or organization) of the target repository.
+    pub owner: String,
 }
 
-/// Session-scoped approval details for read-only filesystem operations.
+/// Remote-session-specific metadata. Populated only when `isRemote` is true. Fields are immutable for the lifetime of the session.
 ///
 /// <div class="warning">
 ///
@@ -9774,12 +9644,21 @@ pub struct PermissionDecisionApproveForSessionApprovalCommands {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForSessionApprovalRead {
-    /// Approval covering read-only filesystem operations.
-    pub kind: PermissionDecisionApproveForSessionApprovalReadKind,
+pub struct MetadataSnapshotRemoteMetadata {
+    /// The pull request number the remote session is associated with, if any.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub pull_request_number: Option<i64>,
+    /// The repository the remote session targets.
+    pub repository: MetadataSnapshotRemoteMetadataRepository,
+    /// The original resource identifier (task ID or PR node ID), preserved across event-replay reconstructions. Falls back to `sessionId` when absent.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub resource_id: Option<String>,
+    /// Whether the remote task originated from Copilot Coding Agent (cca) or a CLI `--remote` invocation.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub task_type: Option<MetadataSnapshotRemoteMetadataTaskType>,
 }
 
-/// Session-scoped approval details for filesystem write operations.
+/// Active server-driven promotion for a model, including its discount and optional expiry.
 ///
 /// <div class="warning">
 ///
@@ -9789,12 +9668,22 @@ pub struct PermissionDecisionApproveForSessionApprovalRead {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForSessionApprovalWrite {
-    /// Approval covering filesystem write operations.
-    pub kind: PermissionDecisionApproveForSessionApprovalWriteKind,
+pub struct ModelBillingPromo {
+    /// Percentage discount (0-100) applied while the promotion is active. May be fractional.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub discount_percent: Option<f64>,
+    /// UTC ISO 8601 timestamp marking when the promotion ends. Optional: an open-ended promotion omits this field. When present, the API only surfaces a promo whose expiry parses and is in the future, so consumers should treat a past value as expired.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub ends_at: Option<String>,
+    /// Stable identifier for the promotion campaign.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub id: Option<String>,
+    /// Human-readable promotion message. Does not include the expiry timestamp; consumers may format endsAt and append it when present.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub message: Option<String>,
 }
 
-/// Session-scoped approval details for an MCP server tool, or all tools on the server when `toolName` is null.
+/// Long context tier pricing (available for models with extended context windows)
 ///
 /// <div class="warning">
 ///
@@ -9804,16 +9693,38 @@ pub struct PermissionDecisionApproveForSessionApprovalWrite {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForSessionApprovalMcp {
-    /// Approval covering an MCP tool.
-    pub kind: PermissionDecisionApproveForSessionApprovalMcpKind,
-    /// MCP server name.
-    pub server_name: String,
-    /// MCP tool name, or null to cover every tool on the server.
-    pub tool_name: Option<String>,
+pub struct ModelBillingTokenPricesLongContext {
+    /// Use cacheReadPrice instead. AI Credits cost per billing batch of cached tokens
+    #[doc(hidden)]
+    #[deprecated]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cache_price: Option<f64>,
+    /// AI Credits cost per billing batch of cached (read) tokens
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cache_read_price: Option<f64>,
+    /// AI Credits cost per billing batch of 1-hour cache-write (cache creation) tokens.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cache_write1h_price: Option<f64>,
+    /// AI Credits cost per billing batch of cache-write (cache creation) tokens.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cache_write_price: Option<f64>,
+    /// Use maxPromptTokens instead. Prompt token budget for the long context tier. The total context window is this value plus the model's max_output_tokens.
+    #[doc(hidden)]
+    #[deprecated]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub context_max: Option<i64>,
+    /// AI Credits cost per billing batch of input tokens
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input_price: Option<f64>,
+    /// Prompt token budget for the long context tier. The total context window is this value plus the model's max_output_tokens.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_prompt_tokens: Option<i64>,
+    /// AI Credits cost per billing batch of output tokens
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output_price: Option<f64>,
 }
 
-/// Session-scoped approval details for MCP sampling requests from a server.
+/// Token-level pricing information for this model
 ///
 /// <div class="warning">
 ///
@@ -9823,14 +9734,44 @@ pub struct PermissionDecisionApproveForSessionApprovalMcp {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForSessionApprovalMcpSampling {
-    /// Approval covering MCP sampling requests for a server.
-    pub kind: PermissionDecisionApproveForSessionApprovalMcpSamplingKind,
-    /// MCP server name.
-    pub server_name: String,
+pub struct ModelBillingTokenPrices {
+    /// Number of tokens per standard billing batch
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub batch_size: Option<i64>,
+    /// Use cacheReadPrice instead. AI Credits cost per billing batch of cached tokens
+    #[doc(hidden)]
+    #[deprecated]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cache_price: Option<f64>,
+    /// AI Credits cost per billing batch of cached (read) tokens
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cache_read_price: Option<f64>,
+    /// AI Credits cost per billing batch of 1-hour cache-write (cache creation) tokens.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cache_write1h_price: Option<f64>,
+    /// AI Credits cost per billing batch of cache-write (cache creation) tokens.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cache_write_price: Option<f64>,
+    /// Use maxPromptTokens instead. Prompt token budget for the default tier. The total context window is this value plus the model's max_output_tokens.
+    #[doc(hidden)]
+    #[deprecated]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub context_max: Option<i64>,
+    /// AI Credits cost per billing batch of input tokens
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input_price: Option<f64>,
+    /// Long context tier pricing (available for models with extended context windows)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub long_context: Option<ModelBillingTokenPricesLongContext>,
+    /// Prompt token budget for the default tier. The total context window is this value plus the model's max_output_tokens.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_prompt_tokens: Option<i64>,
+    /// AI Credits cost per billing batch of output tokens
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output_price: Option<f64>,
 }
 
-/// Session-scoped approval details for writes to long-term memory.
+/// Billing information
 ///
 /// <div class="warning">
 ///
@@ -9840,12 +9781,22 @@ pub struct PermissionDecisionApproveForSessionApprovalMcpSampling {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForSessionApprovalMemory {
-    /// Approval covering writes to long-term memory.
-    pub kind: PermissionDecisionApproveForSessionApprovalMemoryKind,
+pub struct ModelBilling {
+    /// Whole-number percentage discount (0-100) applied to usage billed through this model. Populated for the synthetic `auto` model, where requests routed by auto-mode are billed at a reduced rate; absent for concrete models.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub discount_percent: Option<i32>,
+    /// Billing cost multiplier relative to the base rate
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub multiplier: Option<f64>,
+    /// Active server-driven promotion for this model, if any. Present when the model is being promoted with a discount, which may be time-boxed or open-ended.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub promo: Option<ModelBillingPromo>,
+    /// Token-level pricing information for this model
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub token_prices: Option<ModelBillingTokenPrices>,
 }
 
-/// Session-scoped approval details for a custom tool, keyed by tool name.
+/// Vision-specific limits
 ///
 /// <div class="warning">
 ///
@@ -9855,14 +9806,19 @@ pub struct PermissionDecisionApproveForSessionApprovalMemory {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForSessionApprovalCustomTool {
-    /// Approval covering a custom tool.
-    pub kind: PermissionDecisionApproveForSessionApprovalCustomToolKind,
-    /// Custom tool name.
-    pub tool_name: String,
+pub struct ModelCapabilitiesLimitsVision {
+    /// Maximum image size in bytes
+    #[serde(rename = "max_prompt_image_size")]
+    pub max_prompt_image_size: i64,
+    /// Maximum number of images per prompt
+    #[serde(rename = "max_prompt_images")]
+    pub max_prompt_images: i64,
+    /// MIME types the model accepts
+    #[serde(rename = "supported_media_types")]
+    pub supported_media_types: Vec<String>,
 }
 
-/// Session-scoped approval details for extension-management operations, optionally narrowed by operation.
+/// Token limits for prompts, outputs, and context window
 ///
 /// <div class="warning">
 ///
@@ -9872,15 +9828,25 @@ pub struct PermissionDecisionApproveForSessionApprovalCustomTool {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForSessionApprovalExtensionManagement {
-    /// Approval covering extension lifecycle operations such as enable, disable, or reload.
-    pub kind: PermissionDecisionApproveForSessionApprovalExtensionManagementKind,
-    /// Optional operation identifier; when omitted, the approval covers all extension management operations.
+pub struct ModelCapabilitiesLimits {
+    /// Maximum total context window size in tokens
+    #[serde(
+        rename = "max_context_window_tokens",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub max_context_window_tokens: Option<i64>,
+    /// Maximum number of output/completion tokens
+    #[serde(rename = "max_output_tokens", skip_serializing_if = "Option::is_none")]
+    pub max_output_tokens: Option<i64>,
+    /// Maximum number of prompt/input tokens
+    #[serde(rename = "max_prompt_tokens", skip_serializing_if = "Option::is_none")]
+    pub max_prompt_tokens: Option<i64>,
+    /// Vision-specific limits
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub operation: Option<String>,
+    pub vision: Option<ModelCapabilitiesLimitsVision>,
 }
 
-/// Session-scoped factory approval, optionally narrowed by approval key.
+/// Feature flags indicating what the model supports
 ///
 /// <div class="warning">
 ///
@@ -9890,15 +9856,19 @@ pub struct PermissionDecisionApproveForSessionApprovalExtensionManagement {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForSessionApprovalFactory {
-    /// Optional factory operation name or canonical approval key; when omitted, the approval covers all factory operations.
+pub struct ModelCapabilitiesSupports {
+    /// Resolved Anthropic adaptive-thinking capability — unsupported / optional / required. 'required' models reject thinking.type='enabled' with HTTP 400 (e.g. opus-4.7/4.8).
+    #[serde(rename = "adaptive_thinking", skip_serializing_if = "Option::is_none")]
+    pub adaptive_thinking: Option<AdaptiveThinkingSupport>,
+    /// Whether this model supports reasoning effort configuration
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub approval_key: Option<String>,
-    /// Approval covering factory operations.
-    pub kind: PermissionDecisionApproveForSessionApprovalFactoryKind,
+    pub reasoning_effort: Option<bool>,
+    /// Whether this model supports vision/image input
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub vision: Option<bool>,
 }
 
-/// Session-scoped approval details for an extension's permission-gated capability access, keyed by extension name.
+/// Model capabilities and limits
 ///
 /// <div class="warning">
 ///
@@ -9908,14 +9878,16 @@ pub struct PermissionDecisionApproveForSessionApprovalFactory {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForSessionApprovalExtensionPermissionAccess {
-    /// Extension name.
-    pub extension_name: String,
-    /// Approval covering an extension's request to access a permission-gated capability.
-    pub kind: PermissionDecisionApproveForSessionApprovalExtensionPermissionAccessKind,
+pub struct ModelCapabilities {
+    /// Token limits for prompts, outputs, and context window
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub limits: Option<ModelCapabilitiesLimits>,
+    /// Feature flags indicating what the model supports
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub supports: Option<ModelCapabilitiesSupports>,
 }
 
-/// Session-scoped approval details for an extension's access to sensitive environment variables, keyed by extension name and the exact set of variable names.
+/// Policy state (if applicable)
 ///
 /// <div class="warning">
 ///
@@ -9925,16 +9897,15 @@ pub struct PermissionDecisionApproveForSessionApprovalExtensionPermissionAccess
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForSessionApprovalExtensionEnvAccess {
-    /// Names of the sensitive environment variables this approval covers. Values are never persisted.
-    pub environment_variables: Vec<String>,
-    /// Extension name.
-    pub extension_name: String,
-    /// Approval covering an extension's request to read sensitive environment variables.
-    pub kind: PermissionDecisionApproveForSessionApprovalExtensionEnvAccessKind,
+pub struct ModelPolicy {
+    /// Current policy state for this model
+    pub state: ModelPolicyState,
+    /// Usage terms or conditions for this model
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub terms: Option<String>,
 }
 
-/// Permission-decision request variant to approve for the rest of the session, with optional tool approval or URL domain.
+/// Copilot model metadata, including identifier, display name, capabilities, policy, billing, reasoning efforts, and picker categories.
 ///
 /// <div class="warning">
 ///
@@ -9944,18 +9915,37 @@ pub struct PermissionDecisionApproveForSessionApprovalExtensionEnvAccess {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForSession {
-    /// Session-scoped approval to remember (tool prompts only; omitted for path/url prompts)
+pub struct Model {
+    /// Billing information
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub approval: Option<PermissionDecisionApproveForSessionApproval>,
-    /// URL domain to approve for the rest of the session (URL prompts only)
+    pub billing: Option<ModelBilling>,
+    /// Model capabilities and limits
+    pub capabilities: ModelCapabilities,
+    /// Default reasoning effort level (only present if model supports reasoning effort)
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub domain: Option<String>,
-    /// Approve and remember for the rest of the session
-    pub kind: PermissionDecisionApproveForSessionKind,
+    pub default_reasoning_effort: Option<String>,
+    /// Model identifier (e.g., "claude-sonnet-4.5")
+    pub id: String,
+    /// Model capability category for grouping in the model picker
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_picker_category: Option<ModelPickerCategory>,
+    /// Relative cost tier for token-based billing users
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_picker_price_category: Option<ModelPickerPriceCategory>,
+    /// Display name
+    pub name: String,
+    /// Policy state (if applicable)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub policy: Option<ModelPolicy>,
+    /// Context-window tiers this model offers, when the provider advertises them independently of tiered token pricing. Copilot models carry their tiers in `billing.tokenPrices`; a provider that has no pricing to publish (an agent host reached over AHP, for example) declares them here instead, so the model picker can still offer the tier toggle.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub supported_context_tiers: Option<Vec<String>>,
+    /// Supported reasoning effort levels (only present if model supports reasoning effort)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub supported_reasoning_efforts: Option<Vec<String>>,
 }
 
-/// Location-scoped approval details for specific command identifiers.
+/// Managed, repository, and CLI model overrides to overlay onto the session at startup.
 ///
 /// <div class="warning">
 ///
@@ -9965,14 +9955,31 @@ pub struct PermissionDecisionApproveForSession {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForLocationApprovalCommands {
-    /// Command identifiers covered by this approval.
-    pub command_identifiers: Vec<String>,
-    /// Approval scoped to specific command identifiers.
-    pub kind: PermissionDecisionApproveForLocationApprovalCommandsKind,
+pub struct ModelApplyStartupOverlayRequest {
+    /// Model explicitly selected by the CLI, when provided.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cli_model: Option<String>,
+    /// Whether the overlay is being applied while resuming a deferred session.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub deferred_resume: Option<bool>,
+    /// Model required by device-managed policy, when configured.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub device_managed_model: Option<String>,
+    /// Context tier selected by repository settings, when configured.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub repo_context_tier: Option<String>,
+    /// Model selected by repository settings, when configured.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub repo_model: Option<String>,
+    /// Reasoning effort selected by repository settings, when configured.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub repo_reasoning_effort: Option<String>,
+    /// Model required by server-managed policy, when configured.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub server_managed_model: Option<String>,
 }
 
-/// Location-scoped approval details for read-only filesystem operations.
+/// Vision-specific limits
 ///
 /// <div class="warning">
 ///
@@ -9982,12 +9989,25 @@ pub struct PermissionDecisionApproveForLocationApprovalCommands {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForLocationApprovalRead {
-    /// Approval covering read-only filesystem operations.
-    pub kind: PermissionDecisionApproveForLocationApprovalReadKind,
+pub struct ModelCapabilitiesOverrideLimitsVision {
+    /// Maximum image size in bytes
+    #[serde(
+        rename = "max_prompt_image_size",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub max_prompt_image_size: Option<i64>,
+    /// Maximum number of images per prompt
+    #[serde(rename = "max_prompt_images", skip_serializing_if = "Option::is_none")]
+    pub max_prompt_images: Option<i64>,
+    /// MIME types the model accepts
+    #[serde(
+        rename = "supported_media_types",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub supported_media_types: Option<Vec<String>>,
 }
 
-/// Location-scoped approval details for filesystem write operations.
+/// Token limits for prompts, outputs, and context window
 ///
 /// <div class="warning">
 ///
@@ -9997,12 +10017,25 @@ pub struct PermissionDecisionApproveForLocationApprovalRead {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForLocationApprovalWrite {
-    /// Approval covering filesystem write operations.
-    pub kind: PermissionDecisionApproveForLocationApprovalWriteKind,
+pub struct ModelCapabilitiesOverrideLimits {
+    /// Maximum total context window size in tokens
+    #[serde(
+        rename = "max_context_window_tokens",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub max_context_window_tokens: Option<i64>,
+    /// Maximum number of output/completion tokens
+    #[serde(rename = "max_output_tokens", skip_serializing_if = "Option::is_none")]
+    pub max_output_tokens: Option<i64>,
+    /// Maximum number of prompt/input tokens
+    #[serde(rename = "max_prompt_tokens", skip_serializing_if = "Option::is_none")]
+    pub max_prompt_tokens: Option<i64>,
+    /// Vision-specific limits
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub vision: Option<ModelCapabilitiesOverrideLimitsVision>,
 }
 
-/// Location-scoped approval details for an MCP server tool, or all tools on the server when `toolName` is null.
+/// Feature flags indicating what the model supports
 ///
 /// <div class="warning">
 ///
@@ -10012,16 +10045,19 @@ pub struct PermissionDecisionApproveForLocationApprovalWrite {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForLocationApprovalMcp {
-    /// Approval covering an MCP tool.
-    pub kind: PermissionDecisionApproveForLocationApprovalMcpKind,
-    /// MCP server name.
-    pub server_name: String,
-    /// MCP tool name, or null to cover every tool on the server.
-    pub tool_name: Option<String>,
-}
-
-/// Location-scoped approval details for MCP sampling requests from a server.
+pub struct ModelCapabilitiesOverrideSupports {
+    /// Resolved Anthropic adaptive-thinking capability — unsupported / optional / required. 'required' models reject thinking.type='enabled' with HTTP 400 (e.g. opus-4.7/4.8).
+    #[serde(rename = "adaptive_thinking", skip_serializing_if = "Option::is_none")]
+    pub adaptive_thinking: Option<AdaptiveThinkingSupport>,
+    /// Whether this model supports reasoning effort configuration
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reasoning_effort: Option<bool>,
+    /// Whether this model supports vision/image input
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub vision: Option<bool>,
+}
+
+/// Optional capability overrides (vision, tool_calls, reasoning, etc.).
 ///
 /// <div class="warning">
 ///
@@ -10031,14 +10067,16 @@ pub struct PermissionDecisionApproveForLocationApprovalMcp {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForLocationApprovalMcpSampling {
-    /// Approval covering MCP sampling requests for a server.
-    pub kind: PermissionDecisionApproveForLocationApprovalMcpSamplingKind,
-    /// MCP server name.
-    pub server_name: String,
+pub struct ModelCapabilitiesOverride {
+    /// Token limits for prompts, outputs, and context window
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub limits: Option<ModelCapabilitiesOverrideLimits>,
+    /// Feature flags indicating what the model supports
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub supports: Option<ModelCapabilitiesOverrideSupports>,
 }
 
-/// Location-scoped approval details for writes to long-term memory.
+/// List of Copilot models available to the resolved user, including capabilities and billing metadata.
 ///
 /// <div class="warning">
 ///
@@ -10048,12 +10086,12 @@ pub struct PermissionDecisionApproveForLocationApprovalMcpSampling {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForLocationApprovalMemory {
-    /// Approval covering writes to long-term memory.
-    pub kind: PermissionDecisionApproveForLocationApprovalMemoryKind,
+pub struct ModelList {
+    /// List of available models with full metadata
+    pub models: Vec<Model>,
 }
 
-/// Location-scoped approval details for a custom tool, keyed by tool name.
+/// Optional listing options.
 ///
 /// <div class="warning">
 ///
@@ -10063,14 +10101,13 @@ pub struct PermissionDecisionApproveForLocationApprovalMemory {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForLocationApprovalCustomTool {
-    /// Approval covering a custom tool.
-    pub kind: PermissionDecisionApproveForLocationApprovalCustomToolKind,
-    /// Custom tool name.
-    pub tool_name: String,
+pub struct ModelListRequest {
+    /// If true, bypasses the per-session model list cache and re-fetches from CAPI.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub skip_cache: Option<bool>,
 }
 
-/// Location-scoped approval details for extension-management operations, optionally narrowed by operation.
+/// Filesystem and environment context used to resolve model-picker settings.
 ///
 /// <div class="warning">
 ///
@@ -10080,15 +10117,16 @@ pub struct PermissionDecisionApproveForLocationApprovalCustomTool {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForLocationApprovalExtensionManagement {
-    /// Approval covering extension lifecycle operations such as enable, disable, or reload.
-    pub kind: PermissionDecisionApproveForLocationApprovalExtensionManagementKind,
-    /// Optional operation identifier; when omitted, the approval covers all extension management operations.
+pub struct ModelPickerSettingsContext {
+    /// Optional Copilot configuration directory containing persisted settings.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub operation: Option<String>,
+    pub config_dir: Option<String>,
+    /// Environment variables consulted while resolving model-picker settings.
+    pub environment: serde_json::Value,
+    /// User home directory used when resolving persisted settings.
+    pub home_directory: String,
 }
 
-/// Location-scoped factory approval, optionally narrowed by approval key.
 ///
 /// <div class="warning">
 ///
@@ -10098,15 +10136,18 @@ pub struct PermissionDecisionApproveForLocationApprovalExtensionManagement {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForLocationApprovalFactory {
-    /// Optional factory operation name or canonical approval key; when omitted, the approval covers all factory operations.
+pub struct ModelPickerPersistenceRequest {
+    /// Whether context tier was explicitly selected and should be persisted.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub approval_key: Option<String>,
-    /// Approval covering factory operations.
-    pub kind: PermissionDecisionApproveForLocationApprovalFactoryKind,
+    pub context_tier_explicit: Option<bool>,
+    /// Whether reasoning effort was explicitly selected and should be persisted.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reasoning_effort_explicit: Option<bool>,
+    /// Filesystem and environment context used to resolve settings persistence.
+    pub settings_context: ModelPickerSettingsContext,
 }
 
-/// Location-scoped approval details for an extension's permission-gated capability access, keyed by extension name.
+/// Reasoning effort level to apply to the currently selected model.
 ///
 /// <div class="warning">
 ///
@@ -10116,14 +10157,12 @@ pub struct PermissionDecisionApproveForLocationApprovalFactory {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForLocationApprovalExtensionPermissionAccess {
-    /// Extension name.
-    pub extension_name: String,
-    /// Approval covering an extension's request to access a permission-gated capability.
-    pub kind: PermissionDecisionApproveForLocationApprovalExtensionPermissionAccessKind,
+pub struct ModelSetReasoningEffortRequest {
+    /// Reasoning effort level to apply to the currently selected model. The host is responsible for validating the value against the model's supported levels before calling.
+    pub reasoning_effort: String,
 }
 
-/// Location-scoped approval details for an extension's access to sensitive environment variables, keyed by extension name and the exact set of variable names.
+/// Update the session's reasoning effort without changing the selected model. Use `switchTo` instead when you also need to change the model. The runtime stores the effort on the session and applies it to subsequent turns.
 ///
 /// <div class="warning">
 ///
@@ -10133,16 +10172,12 @@ pub struct PermissionDecisionApproveForLocationApprovalExtensionPermissionAccess
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForLocationApprovalExtensionEnvAccess {
-    /// Names of the sensitive environment variables this approval covers. Values are never persisted.
-    pub environment_variables: Vec<String>,
-    /// Extension name.
-    pub extension_name: String,
-    /// Approval covering an extension's request to read sensitive environment variables.
-    pub kind: PermissionDecisionApproveForLocationApprovalExtensionEnvAccessKind,
+pub struct ModelSetReasoningEffortResult {
+    /// Reasoning effort level recorded on the session after the update
+    pub reasoning_effort: String,
 }
 
-/// Permission-decision request variant to approve and persist a permission for a project location, with approval details and location key.
+/// Optional opaque account selection or compatibility GitHub token used to list models.
 ///
 /// <div class="warning">
 ///
@@ -10150,18 +10185,17 @@ pub struct PermissionDecisionApproveForLocationApprovalExtensionEnvAccess {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproveForLocation {
-    /// Approval to persist for this location
-    pub approval: PermissionDecisionApproveForLocationApproval,
-    /// Approve and persist for this project location
-    pub kind: PermissionDecisionApproveForLocationKind,
-    /// Location key (git root or cwd) to persist the approval to
-    pub location_key: String,
+pub struct ModelsListRequest {
+    /// GitHub token accepted for compatibility with existing SDK clients. When provided, resolves this token instead of using the current account.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub git_hub_token: Option<String>,
+    /// Opaque account identifier returned by `account.getAllUsers`. When omitted, the current account is used.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub selection_id: Option<String>,
 }
 
-/// Permission-decision request variant to permanently approve a URL domain across sessions.
 ///
 /// <div class="warning">
 ///
@@ -10171,14 +10205,16 @@ pub struct PermissionDecisionApproveForLocation {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApprovePermanently {
-    /// URL domain to approve permanently
-    pub domain: String,
-    /// Approve and persist across sessions (URL prompts only)
-    pub kind: PermissionDecisionApprovePermanentlyKind,
+pub struct ModelSwitchConfirmation {
+    /// Current conversation token count before switching models.
+    pub current_tokens: f64,
+    /// Target model token limit used by the compaction preflight.
+    pub target_limit: f64,
+    /// Display name of the model that requires compaction confirmation.
+    pub target_model_display_name: String,
 }
 
-/// Permission-decision request variant to reject a pending permission request, with optional feedback.
+/// Target model identifier and optional reasoning effort, summary, capability overrides, and context tier.
 ///
 /// <div class="warning">
 ///
@@ -10188,15 +10224,51 @@ pub struct PermissionDecisionApprovePermanently {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionReject {
-    /// Optional feedback explaining the rejection
+pub struct ModelSwitchToRequest {
+    /// Explicit response to a model-switch compaction preflight. Omit to request a confirmation projection when compaction is necessary.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub feedback: Option<String>,
-    /// Reject the request
-    pub kind: PermissionDecisionRejectKind,
+    pub compaction_decision: Option<String>,
+    /// Explicit context tier for the selected model. `"default"` / `"long_context"` apply the requested tier; omit this field to use normal model behavior with no explicit tier.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub context_tier: Option<ContextTier>,
+    /// When true, defer this switch (enqueue it) if another model change is already queued, even when no turn is active — so it drains last (FIFO) and wins over the already-queued change. Intended for genuine user-initiated model selections; internal restore/reapply switches omit it and apply immediately when no turn is active. When no other model change is queued this has no effect (a switch still applies immediately unless a turn is active).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub defer_if_model_change_queued: Option<bool>,
+    /// Override individual model capabilities resolved by the runtime
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_capabilities: Option<ModelCapabilitiesOverride>,
+    /// Settings scope used when persisting the selected model.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_change_scope: Option<String>,
+    /// Model selection id to switch to, as returned by `list`. A bare id (e.g. `claude-sonnet-4.6`) names a Copilot (CAPI) model; a provider-qualified id (`provider/id`, e.g. `acme/claude-sonnet`) targets a registry BYOK model.
+    pub model_id: String,
+    /// Optional settings context and explicit-override flags used to persist a picker selection.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub picker_persistence: Option<ModelPickerPersistenceRequest>,
+    /// Reasoning effort level to use for the model. CAPI values are model-defined and validated against the selected model; BYOK providers may define additional values. "none" disables reasoning. When omitted, no effort override is applied.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reasoning_effort: Option<String>,
+    /// Reasoning summary mode to request for supported model clients
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reasoning_summary: Option<ReasoningSummary>,
+    /// Optional repository settings scope to persist after the switch commits.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub repo_scope: Option<String>,
+    /// Require the target to be currently available and enabled before applying the switch.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub require_available: Option<bool>,
+    /// When true, evaluate context-window compaction policy before applying the switch.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub run_compaction_preflight: Option<bool>,
+    /// Origin to record on the effective `session.model_change` event. Defaults to `sdk` when omitted.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source: Option<ModelChangeSource>,
+    /// Output verbosity level to request for supported models
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub verbosity: Option<Verbosity>,
 }
 
-/// Permission-decision variant indicating no user was available to confirm the request.
+/// The model identifier active on the session after the switch.
 ///
 /// <div class="warning">
 ///
@@ -10206,12 +10278,34 @@ pub struct PermissionDecisionReject {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionUserNotAvailable {
-    /// No user is available to confirm the request
-    pub kind: PermissionDecisionUserNotAvailableKind,
+pub struct ModelSwitchToResult {
+    /// Compaction confirmation projection when status is confirmation_required
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub confirmation: Option<ModelSwitchConfirmation>,
+    /// True when the switch was deferred (enqueued as a cancellable `/model` command) because a turn was active or another model change was already queued, rather than applied immediately. When true, the session's live model is unchanged until the queued change drains.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub deferred: Option<bool>,
+    /// Deprecation warnings associated with the selected model or options.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub deprecation_warnings: Option<Vec<String>>,
+    /// User-facing outcome message for the model switch.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub message: Option<String>,
+    /// Currently active model identifier after the switch
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_id: Option<String>,
+    /// Persistence failure encountered after applying the model switch.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub persistence_error: Option<String>,
+    /// Lifecycle result for the requested switch
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status: Option<String>,
+    /// User-facing warning produced while applying the model switch.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub warning: Option<String>,
 }
 
-/// Permission-decision variant indicating the request was approved.
+/// Agent interaction mode to apply to the session.
 ///
 /// <div class="warning">
 ///
@@ -10221,12 +10315,42 @@ pub struct PermissionDecisionUserNotAvailable {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApproved {
-    /// The permission request was approved
-    pub kind: PermissionDecisionApprovedKind,
+pub struct ModeSetRequest {
+    /// Explicit response to a model-switch compaction preflight.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub compaction_decision: Option<String>,
+    /// Session whose plan-mode base state should be inherited.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub inherit_plan_base_from_session_id: Option<String>,
+    /// The session mode the agent is operating in
+    pub mode: SessionMode,
+    /// Whether the selected plan model should be persisted.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub persist_plan_selection: Option<bool>,
+    /// Settings context used when persisting the selected plan model.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub picker_settings_context: Option<ModelPickerSettingsContext>,
+    /// Context tier to use with the dedicated plan model.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub plan_context_tier: Option<String>,
+    /// Action to perform when leaving plan mode.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub plan_exit_action: Option<String>,
+    /// Dedicated model to use in plan mode, when configured.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub plan_model: Option<String>,
+    /// Whether a dedicated plan model is configured.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub plan_model_configured: Option<bool>,
+    /// Reasoning effort to use with the dedicated plan model.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub plan_reasoning_effort: Option<String>,
+    /// Whether leaving plan mode should restore the session's previous model.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub restore_plan_model: Option<bool>,
 }
 
-/// Permission-decision variant indicating approval was remembered for the session, with approval details.
+/// Outcome of a session mode change, including any model switch it triggered and follow-up the host must perform.
 ///
 /// <div class="warning">
 ///
@@ -10234,35 +10358,49 @@ pub struct PermissionDecisionApproved {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApprovedForSession {
-    /// The approval to add as a session-scoped rule
-    pub approval: UserToolSessionApproval,
-    /// Approved and remembered for the rest of the session
-    pub kind: PermissionDecisionApprovedForSessionKind,
-}
-
-/// Permission-decision variant indicating approval was persisted for a project location, with approval details and location key.
-///
-/// <div class="warning">
+pub struct ModeSetResult {
+    /// Whether the host should arm an interactive continuation after the mode change.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub arm_interactive_continuation: Option<bool>,
+    /// Compaction confirmation required before the mode change can complete.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub confirmation: Option<ModelSwitchConfirmation>,
+    /// Whether the host must defer implementing the requested mode change.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub defer_implementation: Option<bool>,
+    /// Deprecation warnings associated with the model selected by the mode change.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub deprecation_warnings: Option<Vec<String>>,
+    /// User-facing outcome message for the model switch triggered by the mode change.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub message: Option<String>,
+    /// Whether applying the mode changed the active model.
+    pub model_changed: bool,
+    /// Lifecycle status of the requested mode change.
+    pub status: String,
+    /// User-facing warning produced while applying the mode change.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub warning: Option<String>,
+}
+
+/// Result of moving in-flight MCP loading to the background.
+///
+/// <div class="warning">
 ///
 /// **Experimental.** This type is part of an experimental wire-protocol surface
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionApprovedForLocation {
-    /// The approval to persist for this location
-    pub approval: UserToolSessionApproval,
-    /// Approved and persisted for this project location
-    pub kind: PermissionDecisionApprovedForLocationKind,
-    /// The location key (git root or cwd) to persist the approval to
-    pub location_key: String,
+pub struct MoveMcpLoadingToBackgroundResult {
+    /// Whether an in-flight MCP load was moved to the background, releasing turns that were waiting on it. False when no MCP load was in flight or the waiting turns had already been released.
+    pub moved_to_background: bool,
 }
 
-/// Permission-decision variant indicating the request was cancelled before use, with an optional reason.
+/// Azure-specific provider options.
 ///
 /// <div class="warning">
 ///
@@ -10272,15 +10410,13 @@ pub struct PermissionDecisionApprovedForLocation {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionCancelled {
-    /// The permission request was cancelled before a response was used
-    pub kind: PermissionDecisionCancelledKind,
-    /// Optional explanation of why the request was cancelled
+pub struct ProviderConfigAzure {
+    /// API version. When set, uses the versioned deployment route. When omitted, uses the GA versionless v1 route.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub reason: Option<String>,
+    pub api_version: Option<String>,
 }
 
-/// Permission-decision variant indicating explicit denial by permission rules, with the matching rules.
+/// External SDK input for a named custom model provider. Ingested by the native protocol boundary before host dispatch.
 ///
 /// <div class="warning">
 ///
@@ -10290,14 +10426,38 @@ pub struct PermissionDecisionCancelled {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionDeniedByRules {
-    /// Denied because approval rules explicitly blocked it
-    pub kind: PermissionDecisionDeniedByRulesKind,
-    /// Rules that denied the request
-    pub rules: Vec<PermissionRule>,
+pub struct NamedProviderConfig {
+    /// Static API key used to authenticate provider requests.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub api_key: Option<String>,
+    /// Azure authentication configuration for the provider.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub azure: Option<ProviderConfigAzure>,
+    /// Base URL for provider API requests.
+    pub base_url: String,
+    /// Static bearer token used to authenticate provider requests.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub bearer_token: Option<String>,
+    /// Whether the host supplies bearer tokens dynamically.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub has_bearer_token_provider: Option<bool>,
+    /// Additional HTTP headers included with provider requests.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub headers: Option<HashMap<String, String>>,
+    /// Unique provider name used to qualify model selection IDs.
+    pub name: String,
+    /// Transport used to communicate with the provider.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub transport: Option<ProviderConfigTransport>,
+    /// Provider protocol family.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub r#type: Option<ProviderConfigType>,
+    /// Wire API used to communicate with the provider.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub wire_api: Option<ProviderConfigWireApi>,
 }
 
-/// Permission-decision variant indicating no approval rule matched and user confirmation was unavailable.
+/// The session's friendly name, or null when not yet set.
 ///
 /// <div class="warning">
 ///
@@ -10307,12 +10467,12 @@ pub struct PermissionDecisionDeniedByRules {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionDeniedNoApprovalRuleAndCouldNotRequestFromUser {
-    /// Denied because no approval rule matched and user confirmation was unavailable
-    pub kind: PermissionDecisionDeniedNoApprovalRuleAndCouldNotRequestFromUserKind,
+pub struct NameGetResult {
+    /// The session name (user-set or auto-generated), or null if not yet set
+    pub name: Option<String>,
 }
 
-/// Permission-decision variant indicating the user denied an interactive prompt, with optional feedback and force-reject flag.
+/// Auto-generated session summary to apply as the session's name when no user-set name exists.
 ///
 /// <div class="warning">
 ///
@@ -10322,18 +10482,12 @@ pub struct PermissionDecisionDeniedNoApprovalRuleAndCouldNotRequestFromUser {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionDeniedInteractivelyByUser {
-    /// Optional feedback from the user explaining the denial
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub feedback: Option<String>,
-    /// Whether to force-reject the current agent turn
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub force_reject: Option<bool>,
-    /// Denied by the user during an interactive prompt
-    pub kind: PermissionDecisionDeniedInteractivelyByUserKind,
+pub struct NameSetAutoRequest {
+    /// Auto-generated session summary. Empty/whitespace-only values are ignored; values are trimmed before persisting.
+    pub summary: String,
 }
 
-/// Permission-decision variant indicating denial by content-exclusion policy, with path and message.
+/// Indicates whether the auto-generated summary was applied as the session's name.
 ///
 /// <div class="warning">
 ///
@@ -10343,16 +10497,12 @@ pub struct PermissionDecisionDeniedInteractivelyByUser {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionDeniedByContentExclusionPolicy {
-    /// Denied by the organization's content exclusion policy
-    pub kind: PermissionDecisionDeniedByContentExclusionPolicyKind,
-    /// Human-readable explanation of why the path was excluded
-    pub message: String,
-    /// File path that triggered the exclusion
-    pub path: String,
+pub struct NameSetAutoResult {
+    /// Whether the auto-generated summary was persisted. False if the session already has a user-set name, the summary normalized to empty, or the session does not have a workspace.
+    pub applied: bool,
 }
 
-/// Permission-decision variant indicating denial by a permission request hook, with optional message and interrupt flag.
+/// New friendly name to apply to the session.
 ///
 /// <div class="warning">
 ///
@@ -10362,18 +10512,12 @@ pub struct PermissionDecisionDeniedByContentExclusionPolicy {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionDeniedByPermissionRequestHook {
-    /// Whether to interrupt the current agent turn
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub interrupt: Option<bool>,
-    /// Denied by a permission request hook registered by an extension or plugin
-    pub kind: PermissionDecisionDeniedByPermissionRequestHookKind,
-    /// Optional message from the hook explaining the denial
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub message: Option<String>,
+pub struct NameSetRequest {
+    /// New session name (1–100 characters, trimmed of leading/trailing whitespace)
+    pub name: String,
 }
 
-/// Optional informational context describing how and where the permission decision was made. This does not affect permission behavior.
+/// Source descriptor for a `session.options.update` content-exclusion rule, with source name and type.
 ///
 /// <div class="warning">
 ///
@@ -10383,16 +10527,14 @@ pub struct PermissionDecisionDeniedByPermissionRequestHook {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionContext {
-    /// Disposition of the permission request as observed by the responding client.
-    pub outcome: PermissionDecisionOutcome,
-    /// Controlled reason or actor responsible for the response.
-    pub source: PermissionDecisionSource,
-    /// Client surface that submitted the response.
-    pub surface: PermissionDecisionSurface,
+pub struct OptionsUpdateAdditionalContentExclusionPolicyRuleSource {
+    /// Name of the policy source.
+    pub name: String,
+    /// Type of the policy source.
+    pub r#type: String,
 }
 
-/// Pending permission request ID and the decision to apply (approve/reject and scope).
+/// Single content-exclusion rule supplied to `session.options.update`, with paths, match conditions, and source.
 ///
 /// <div class="warning">
 ///
@@ -10400,19 +10542,22 @@ pub struct PermissionDecisionContext {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionDecisionRequest {
-    /// Optional informational context describing how and where this response was made. Omit it to preserve legacy behavior without attributing an origin.
+pub struct OptionsUpdateAdditionalContentExclusionPolicyRule {
+    /// Conditions of which at least one must match.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub decision_context: Option<PermissionDecisionContext>,
-    /// Request ID of the pending permission request
-    pub request_id: RequestId,
-    /// The client's response to the pending permission prompt
-    pub result: PermissionDecision,
+    pub if_any_match: Option<Vec<String>>,
+    /// Conditions none of which may match.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub if_none_match: Option<Vec<String>>,
+    /// Path patterns covered by this rule.
+    pub paths: Vec<String>,
+    /// Source descriptor for a `session.options.update` content-exclusion rule, with source name and type.
+    pub source: OptionsUpdateAdditionalContentExclusionPolicyRuleSource,
 }
 
-/// Location-persisted tool approval details for specific command identifiers.
+/// Content-exclusion policy supplied to `session.options.update`, with rules, last-updated data, and scope.
 ///
 /// <div class="warning">
 ///
@@ -10422,14 +10567,17 @@ pub struct PermissionDecisionRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsLocationsAddToolApprovalDetailsCommands {
-    /// Command identifiers covered by this approval.
-    pub command_identifiers: Vec<String>,
-    /// Approval scoped to specific command identifiers.
-    pub kind: PermissionsLocationsAddToolApprovalDetailsCommandsKind,
+pub struct OptionsUpdateAdditionalContentExclusionPolicy {
+    /// Opaque policy update timestamp supplied by the host.
+    #[serde(rename = "last_updated_at")]
+    pub last_updated_at: serde_json::Value,
+    /// Content-exclusion rules to apply.
+    pub rules: Vec<OptionsUpdateAdditionalContentExclusionPolicyRule>,
+    /// Allowed values for the `OptionsUpdateAdditionalContentExclusionPolicyScope` enumeration.
+    pub scope: OptionsUpdateAdditionalContentExclusionPolicyScope,
 }
 
-/// Location-persisted tool approval details for read-only filesystem operations.
+/// Pending permission prompt reconstructed from event history, with request ID and user-facing prompt details.
 ///
 /// <div class="warning">
 ///
@@ -10437,14 +10585,16 @@ pub struct PermissionsLocationsAddToolApprovalDetailsCommands {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsLocationsAddToolApprovalDetailsRead {
-    /// Approval covering read-only filesystem operations.
-    pub kind: PermissionsLocationsAddToolApprovalDetailsReadKind,
+pub struct PendingPermissionRequest {
+    /// The user-facing permission prompt details (commands, write, read, mcp, url, memory, custom-tool, path, hook)
+    pub request: PermissionPromptRequest,
+    /// Unique identifier for the pending permission request
+    pub request_id: RequestId,
 }
 
-/// Location-persisted tool approval details for filesystem write operations.
+/// List of pending permission requests reconstructed from event history.
 ///
 /// <div class="warning">
 ///
@@ -10454,12 +10604,12 @@ pub struct PermissionsLocationsAddToolApprovalDetailsRead {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsLocationsAddToolApprovalDetailsWrite {
-    /// Approval covering filesystem write operations.
-    pub kind: PermissionsLocationsAddToolApprovalDetailsWriteKind,
+pub struct PendingPermissionRequestList {
+    /// Pending permission prompts reconstructed from the session's event history. Equivalent to the set of `permission.requested` events that have not yet been followed by a matching `permission.completed` event. Used by clients (e.g. the CLI) to hydrate UI for prompts that were emitted before the client attached to the session.
+    pub items: Vec<PendingPermissionRequest>,
 }
 
-/// Location-persisted tool approval details for an MCP server tool, or all tools when `toolName` is null.
+/// Permission-decision request variant to approve only the current permission request.
 ///
 /// <div class="warning">
 ///
@@ -10469,16 +10619,15 @@ pub struct PermissionsLocationsAddToolApprovalDetailsWrite {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsLocationsAddToolApprovalDetailsMcp {
-    /// Approval covering an MCP tool.
-    pub kind: PermissionsLocationsAddToolApprovalDetailsMcpKind,
-    /// MCP server name.
-    pub server_name: String,
-    /// MCP tool name, or null to cover every tool on the server.
-    pub tool_name: Option<String>,
+pub struct PermissionDecisionApproveOnce {
+    /// True only when a host surfaced this request to a user who approved it.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub approved_interactively: Option<bool>,
+    /// Approve this single request only
+    pub kind: PermissionDecisionApproveOnceKind,
 }
 
-/// Location-persisted tool approval details for MCP sampling requests from a server.
+/// Session-scoped approval details for specific command identifiers.
 ///
 /// <div class="warning">
 ///
@@ -10488,14 +10637,14 @@ pub struct PermissionsLocationsAddToolApprovalDetailsMcp {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsLocationsAddToolApprovalDetailsMcpSampling {
-    /// Approval covering MCP sampling requests for a server.
-    pub kind: PermissionsLocationsAddToolApprovalDetailsMcpSamplingKind,
-    /// MCP server name.
-    pub server_name: String,
+pub struct PermissionDecisionApproveForSessionApprovalCommands {
+    /// Command identifiers covered by this approval.
+    pub command_identifiers: Vec<String>,
+    /// Approval scoped to specific command identifiers.
+    pub kind: PermissionDecisionApproveForSessionApprovalCommandsKind,
 }
 
-/// Location-persisted tool approval details for writes to long-term memory.
+/// Session-scoped approval details for read-only filesystem operations.
 ///
 /// <div class="warning">
 ///
@@ -10505,12 +10654,12 @@ pub struct PermissionsLocationsAddToolApprovalDetailsMcpSampling {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsLocationsAddToolApprovalDetailsMemory {
-    /// Approval covering writes to long-term memory.
-    pub kind: PermissionsLocationsAddToolApprovalDetailsMemoryKind,
+pub struct PermissionDecisionApproveForSessionApprovalRead {
+    /// Approval covering read-only filesystem operations.
+    pub kind: PermissionDecisionApproveForSessionApprovalReadKind,
 }
 
-/// Location-persisted tool approval details for a custom tool, keyed by tool name.
+/// Session-scoped approval details for filesystem write operations.
 ///
 /// <div class="warning">
 ///
@@ -10520,14 +10669,12 @@ pub struct PermissionsLocationsAddToolApprovalDetailsMemory {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsLocationsAddToolApprovalDetailsCustomTool {
-    /// Approval covering a custom tool.
-    pub kind: PermissionsLocationsAddToolApprovalDetailsCustomToolKind,
-    /// Custom tool name.
-    pub tool_name: String,
+pub struct PermissionDecisionApproveForSessionApprovalWrite {
+    /// Approval covering filesystem write operations.
+    pub kind: PermissionDecisionApproveForSessionApprovalWriteKind,
 }
 
-/// Location-persisted tool approval details for extension-management operations, optionally narrowed by operation.
+/// Session-scoped approval details for an MCP server tool, or all tools on the server when `toolName` is null.
 ///
 /// <div class="warning">
 ///
@@ -10537,15 +10684,16 @@ pub struct PermissionsLocationsAddToolApprovalDetailsCustomTool {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsLocationsAddToolApprovalDetailsExtensionManagement {
-    /// Approval covering extension lifecycle operations such as enable, disable, or reload.
-    pub kind: PermissionsLocationsAddToolApprovalDetailsExtensionManagementKind,
-    /// Optional operation identifier; when omitted, the approval covers all extension management operations.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub operation: Option<String>,
-}
-
-/// Location-persisted factory approval, optionally narrowed by approval key.
+pub struct PermissionDecisionApproveForSessionApprovalMcp {
+    /// Approval covering an MCP tool.
+    pub kind: PermissionDecisionApproveForSessionApprovalMcpKind,
+    /// MCP server name.
+    pub server_name: String,
+    /// MCP tool name, or null to cover every tool on the server.
+    pub tool_name: Option<String>,
+}
+
+/// Session-scoped approval details for MCP sampling requests from a server.
 ///
 /// <div class="warning">
 ///
@@ -10555,15 +10703,14 @@ pub struct PermissionsLocationsAddToolApprovalDetailsExtensionManagement {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsLocationsAddToolApprovalDetailsFactory {
-    /// Optional factory operation name or canonical approval key; when omitted, the approval covers all factory operations.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub approval_key: Option<String>,
-    /// Approval covering factory operations.
-    pub kind: PermissionsLocationsAddToolApprovalDetailsFactoryKind,
+pub struct PermissionDecisionApproveForSessionApprovalMcpSampling {
+    /// Approval covering MCP sampling requests for a server.
+    pub kind: PermissionDecisionApproveForSessionApprovalMcpSamplingKind,
+    /// MCP server name.
+    pub server_name: String,
 }
 
-/// Location-persisted tool approval details for an extension's permission-gated capability access, keyed by extension name.
+/// Session-scoped approval details for writes to long-term memory.
 ///
 /// <div class="warning">
 ///
@@ -10573,14 +10720,12 @@ pub struct PermissionsLocationsAddToolApprovalDetailsFactory {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsLocationsAddToolApprovalDetailsExtensionPermissionAccess {
-    /// Extension name.
-    pub extension_name: String,
-    /// Approval covering an extension's request to access a permission-gated capability.
-    pub kind: PermissionsLocationsAddToolApprovalDetailsExtensionPermissionAccessKind,
+pub struct PermissionDecisionApproveForSessionApprovalMemory {
+    /// Approval covering writes to long-term memory.
+    pub kind: PermissionDecisionApproveForSessionApprovalMemoryKind,
 }
 
-/// Location-persisted tool approval details for an extension's access to sensitive environment variables, keyed by extension name and the exact set of variable names.
+/// Session-scoped approval details for a custom tool, keyed by tool name.
 ///
 /// <div class="warning">
 ///
@@ -10590,16 +10735,14 @@ pub struct PermissionsLocationsAddToolApprovalDetailsExtensionPermissionAccess {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsLocationsAddToolApprovalDetailsExtensionEnvAccess {
-    /// Names of the sensitive environment variables this approval covers. Values are never persisted.
-    pub environment_variables: Vec<String>,
-    /// Extension name.
-    pub extension_name: String,
-    /// Approval covering an extension's request to read sensitive environment variables.
-    pub kind: PermissionsLocationsAddToolApprovalDetailsExtensionEnvAccessKind,
+pub struct PermissionDecisionApproveForSessionApprovalCustomTool {
+    /// Approval covering a custom tool.
+    pub kind: PermissionDecisionApproveForSessionApprovalCustomToolKind,
+    /// Custom tool name.
+    pub tool_name: String,
 }
 
-/// Location-scoped tool approval to persist.
+/// Session-scoped approval details for extension-management operations, optionally narrowed by operation.
 ///
 /// <div class="warning">
 ///
@@ -10607,16 +10750,17 @@ pub struct PermissionsLocationsAddToolApprovalDetailsExtensionEnvAccess {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionLocationAddToolApprovalParams {
-    /// Tool approval to persist and apply
-    pub approval: PermissionsLocationsAddToolApprovalDetails,
-    /// Location key (git root or cwd) to persist the approval to
-    pub location_key: String,
+pub struct PermissionDecisionApproveForSessionApprovalExtensionManagement {
+    /// Approval covering extension lifecycle operations such as enable, disable, or reload.
+    pub kind: PermissionDecisionApproveForSessionApprovalExtensionManagementKind,
+    /// Optional operation identifier; when omitted, the approval covers all extension management operations.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub operation: Option<String>,
 }
 
-/// Working directory to load persisted location permissions for.
+/// Session-scoped factory approval, optionally narrowed by approval key.
 ///
 /// <div class="warning">
 ///
@@ -10626,12 +10770,15 @@ pub struct PermissionLocationAddToolApprovalParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionLocationApplyParams {
-    /// Working directory whose persisted location permissions should be applied
-    pub working_directory: String,
+pub struct PermissionDecisionApproveForSessionApprovalFactory {
+    /// Optional factory operation name or canonical approval key; when omitted, the approval covers all factory operations.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub approval_key: Option<String>,
+    /// Approval covering factory operations.
+    pub kind: PermissionDecisionApproveForSessionApprovalFactoryKind,
 }
 
-/// Summary of persisted location permissions applied to the session.
+/// Session-scoped approval details for an extension's permission-gated capability access, keyed by extension name.
 ///
 /// <div class="warning">
 ///
@@ -10641,22 +10788,14 @@ pub struct PermissionLocationApplyParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionLocationApplyResult {
-    /// Number of persisted allowed directories added to the live path manager
-    pub applied_directory_count: i64,
-    /// Number of location-scoped rules added to the live permission service
-    pub applied_rule_count: i64,
-    /// Location-scoped rules applied to the live permission service
-    pub applied_rules: Vec<PermissionRule>,
-    /// Whether a different location was applied since the previous apply call
-    pub changed: bool,
-    /// Location key used in the location-permissions store
-    pub location_key: String,
-    /// Whether the location is a git repo or directory
-    pub location_type: PermissionLocationType,
+pub struct PermissionDecisionApproveForSessionApprovalExtensionPermissionAccess {
+    /// Extension name.
+    pub extension_name: String,
+    /// Approval covering an extension's request to access a permission-gated capability.
+    pub kind: PermissionDecisionApproveForSessionApprovalExtensionPermissionAccessKind,
 }
 
-/// Working directory to resolve into a location-permissions key.
+/// Session-scoped approval details for an extension's access to sensitive environment variables, keyed by extension name and the exact set of variable names.
 ///
 /// <div class="warning">
 ///
@@ -10666,12 +10805,16 @@ pub struct PermissionLocationApplyResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionLocationResolveParams {
-    /// Working directory whose permission location should be resolved
-    pub working_directory: String,
+pub struct PermissionDecisionApproveForSessionApprovalExtensionEnvAccess {
+    /// Names of the sensitive environment variables this approval covers. Values are never persisted.
+    pub environment_variables: Vec<String>,
+    /// Extension name.
+    pub extension_name: String,
+    /// Approval covering an extension's request to read sensitive environment variables.
+    pub kind: PermissionDecisionApproveForSessionApprovalExtensionEnvAccessKind,
 }
 
-/// Resolved location-permissions key and type.
+/// Permission-decision request variant to approve for the rest of the session, with optional tool approval or URL domain.
 ///
 /// <div class="warning">
 ///
@@ -10681,14 +10824,18 @@ pub struct PermissionLocationResolveParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionLocationResolveResult {
-    /// Location key used in the location-permissions store
-    pub location_key: String,
-    /// Whether the location is a git repo or directory
-    pub location_type: PermissionLocationType,
+pub struct PermissionDecisionApproveForSession {
+    /// Session-scoped approval to remember (tool prompts only; omitted for path/url prompts)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub approval: Option<PermissionDecisionApproveForSessionApproval>,
+    /// URL domain to approve for the rest of the session (URL prompts only)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub domain: Option<String>,
+    /// Approve and remember for the rest of the session
+    pub kind: PermissionDecisionApproveForSessionKind,
 }
 
-/// Directory path to add to the session's allowed directories.
+/// Location-scoped approval details for specific command identifiers.
 ///
 /// <div class="warning">
 ///
@@ -10698,12 +10845,14 @@ pub struct PermissionLocationResolveResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionPathsAddParams {
-    /// Directory to add to the allow-list. The runtime resolves and validates the path before adding.
-    pub path: String,
+pub struct PermissionDecisionApproveForLocationApprovalCommands {
+    /// Command identifiers covered by this approval.
+    pub command_identifiers: Vec<String>,
+    /// Approval scoped to specific command identifiers.
+    pub kind: PermissionDecisionApproveForLocationApprovalCommandsKind,
 }
 
-/// Path to evaluate against the session's allowed directories.
+/// Location-scoped approval details for read-only filesystem operations.
 ///
 /// <div class="warning">
 ///
@@ -10713,12 +10862,12 @@ pub struct PermissionPathsAddParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionPathsAllowedCheckParams {
-    /// Path to check against the session's allowed directories
-    pub path: String,
+pub struct PermissionDecisionApproveForLocationApprovalRead {
+    /// Approval covering read-only filesystem operations.
+    pub kind: PermissionDecisionApproveForLocationApprovalReadKind,
 }
 
-/// Indicates whether the supplied path is within the session's allowed directories.
+/// Location-scoped approval details for filesystem write operations.
 ///
 /// <div class="warning">
 ///
@@ -10728,12 +10877,12 @@ pub struct PermissionPathsAllowedCheckParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionPathsAllowedCheckResult {
-    /// Whether the path is within the session's allowed directories
-    pub allowed: bool,
+pub struct PermissionDecisionApproveForLocationApprovalWrite {
+    /// Approval covering filesystem write operations.
+    pub kind: PermissionDecisionApproveForLocationApprovalWriteKind,
 }
 
-/// If specified, replaces the session's path-permission policy. The runtime constructs the appropriate PathManager based on these inputs (rooted at the session's working directory). Omit to leave the current path policy unchanged.
+/// Location-scoped approval details for an MCP server tool, or all tools on the server when `toolName` is null.
 ///
 /// <div class="warning">
 ///
@@ -10743,22 +10892,16 @@ pub struct PermissionPathsAllowedCheckResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionPathsConfig {
-    /// Additional directories to allow tool access to (in addition to the session's working directory). When `unrestricted` is true, these are still pre-populated on the UnrestrictedPathManager so they remain visible via getDirectories() (e.g. for @-mention completion).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub additional_directories: Option<Vec<String>>,
-    /// Whether to include the system temp directory in the allowed list (defaults to true). Ignored when `unrestricted` is true.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub include_temp_directory: Option<bool>,
-    /// If true, the runtime allows access to all paths without prompting. Equivalent to constructing an UnrestrictedPathManager.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub unrestricted: Option<bool>,
-    /// Workspace root path (special-cased to be allowed even before the directory exists). Ignored when `unrestricted` is true.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub workspace_path: Option<String>,
+pub struct PermissionDecisionApproveForLocationApprovalMcp {
+    /// Approval covering an MCP tool.
+    pub kind: PermissionDecisionApproveForLocationApprovalMcpKind,
+    /// MCP server name.
+    pub server_name: String,
+    /// MCP tool name, or null to cover every tool on the server.
+    pub tool_name: Option<String>,
 }
 
-/// Snapshot of the session's allow-listed directories and primary working directory.
+/// Location-scoped approval details for MCP sampling requests from a server.
 ///
 /// <div class="warning">
 ///
@@ -10768,14 +10911,14 @@ pub struct PermissionPathsConfig {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionPathsList {
-    /// All directories currently allowed for tool access on this session.
-    pub directories: Vec<String>,
-    /// The primary working directory for this session.
-    pub primary: String,
+pub struct PermissionDecisionApproveForLocationApprovalMcpSampling {
+    /// Approval covering MCP sampling requests for a server.
+    pub kind: PermissionDecisionApproveForLocationApprovalMcpSamplingKind,
+    /// MCP server name.
+    pub server_name: String,
 }
 
-/// Directory path to set as the session's new primary working directory.
+/// Location-scoped approval details for writes to long-term memory.
 ///
 /// <div class="warning">
 ///
@@ -10785,12 +10928,12 @@ pub struct PermissionPathsList {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionPathsUpdatePrimaryParams {
-    /// Directory to set as the new primary working directory for the session's permission policy.
-    pub path: String,
+pub struct PermissionDecisionApproveForLocationApprovalMemory {
+    /// Approval covering writes to long-term memory.
+    pub kind: PermissionDecisionApproveForLocationApprovalMemoryKind,
 }
 
-/// Path to evaluate against the session's workspace (primary) directory.
+/// Location-scoped approval details for a custom tool, keyed by tool name.
 ///
 /// <div class="warning">
 ///
@@ -10800,12 +10943,14 @@ pub struct PermissionPathsUpdatePrimaryParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionPathsWorkspaceCheckParams {
-    /// Path to check against the session workspace directory
-    pub path: String,
+pub struct PermissionDecisionApproveForLocationApprovalCustomTool {
+    /// Approval covering a custom tool.
+    pub kind: PermissionDecisionApproveForLocationApprovalCustomToolKind,
+    /// Custom tool name.
+    pub tool_name: String,
 }
 
-/// Indicates whether the supplied path is within the session's workspace directory.
+/// Location-scoped approval details for extension-management operations, optionally narrowed by operation.
 ///
 /// <div class="warning">
 ///
@@ -10815,12 +10960,15 @@ pub struct PermissionPathsWorkspaceCheckParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionPathsWorkspaceCheckResult {
-    /// Whether the path is within the session workspace directory
-    pub allowed: bool,
+pub struct PermissionDecisionApproveForLocationApprovalExtensionManagement {
+    /// Approval covering extension lifecycle operations such as enable, disable, or reload.
+    pub kind: PermissionDecisionApproveForLocationApprovalExtensionManagementKind,
+    /// Optional operation identifier; when omitted, the approval covers all extension management operations.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub operation: Option<String>,
 }
 
-/// Notification payload describing the permission prompt that the client just rendered.
+/// Location-scoped factory approval, optionally narrowed by approval key.
 ///
 /// <div class="warning">
 ///
@@ -10830,12 +10978,15 @@ pub struct PermissionPathsWorkspaceCheckResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionPromptShownNotification {
-    /// Human-readable description of the prompt the user is being asked to approve. Used by the runtime to fire the registered `permission_prompt` notification hook (e.g. terminal bell, desktop notification).
-    pub message: String,
+pub struct PermissionDecisionApproveForLocationApprovalFactory {
+    /// Optional factory operation name or canonical approval key; when omitted, the approval covers all factory operations.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub approval_key: Option<String>,
+    /// Approval covering factory operations.
+    pub kind: PermissionDecisionApproveForLocationApprovalFactoryKind,
 }
 
-/// Indicates whether the permission decision was applied; false when the request was already resolved.
+/// Location-scoped approval details for an extension's permission-gated capability access, keyed by extension name.
 ///
 /// <div class="warning">
 ///
@@ -10845,12 +10996,14 @@ pub struct PermissionPromptShownNotification {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionRequestResult {
-    /// Whether the permission request was handled successfully
-    pub success: bool,
+pub struct PermissionDecisionApproveForLocationApprovalExtensionPermissionAccess {
+    /// Extension name.
+    pub extension_name: String,
+    /// Approval covering an extension's request to access a permission-gated capability.
+    pub kind: PermissionDecisionApproveForLocationApprovalExtensionPermissionAccessKind,
 }
 
-/// If specified, replaces the session's approved/denied permission rules. Omit to leave the current rules unchanged.
+/// Location-scoped approval details for an extension's access to sensitive environment variables, keyed by extension name and the exact set of variable names.
 ///
 /// <div class="warning">
 ///
@@ -10860,14 +11013,16 @@ pub struct PermissionRequestResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionRulesSet {
-    /// Rules that auto-approve matching requests
-    pub approved: Vec<PermissionRule>,
-    /// Rules that auto-deny matching requests
-    pub denied: Vec<PermissionRule>,
+pub struct PermissionDecisionApproveForLocationApprovalExtensionEnvAccess {
+    /// Names of the sensitive environment variables this approval covers. Values are never persisted.
+    pub environment_variables: Vec<String>,
+    /// Extension name.
+    pub extension_name: String,
+    /// Approval covering an extension's request to read sensitive environment variables.
+    pub kind: PermissionDecisionApproveForLocationApprovalExtensionEnvAccessKind,
 }
 
-/// Source descriptor for a `session.permissions.configure` content-exclusion rule, with source name and type.
+/// Permission-decision request variant to approve and persist a permission for a project location, with approval details and location key.
 ///
 /// <div class="warning">
 ///
@@ -10875,17 +11030,19 @@ pub struct PermissionRulesSet {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsConfigureAdditionalContentExclusionPolicyRuleSource {
-    /// Name of the policy source.
-    pub name: String,
-    /// Type of the policy source.
-    pub r#type: String,
-}
-
-/// Single content-exclusion rule supplied to `session.permissions.configure`, with paths, match conditions, and source.
-///
+pub struct PermissionDecisionApproveForLocation {
+    /// Approval to persist for this location
+    pub approval: PermissionDecisionApproveForLocationApproval,
+    /// Approve and persist for this project location
+    pub kind: PermissionDecisionApproveForLocationKind,
+    /// Location key (git root or cwd) to persist the approval to
+    pub location_key: String,
+}
+
+/// Permission-decision request variant to permanently approve a URL domain across sessions.
+///
 /// <div class="warning">
 ///
 /// **Experimental.** This type is part of an experimental wire-protocol surface
@@ -10894,20 +11051,14 @@ pub struct PermissionsConfigureAdditionalContentExclusionPolicyRuleSource {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsConfigureAdditionalContentExclusionPolicyRule {
-    /// Conditions of which at least one must match.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub if_any_match: Option<Vec<String>>,
-    /// Conditions none of which may match.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub if_none_match: Option<Vec<String>>,
-    /// Path patterns covered by this rule.
-    pub paths: Vec<String>,
-    /// Source descriptor for a `session.permissions.configure` content-exclusion rule, with source name and type.
-    pub source: PermissionsConfigureAdditionalContentExclusionPolicyRuleSource,
+pub struct PermissionDecisionApprovePermanently {
+    /// URL domain to approve permanently
+    pub domain: String,
+    /// Approve and persist across sessions (URL prompts only)
+    pub kind: PermissionDecisionApprovePermanentlyKind,
 }
 
-/// Content-exclusion policy supplied to `session.permissions.configure`, with rules, last-updated data, and scope.
+/// Permission-decision request variant to reject a pending permission request, with optional feedback.
 ///
 /// <div class="warning">
 ///
@@ -10917,17 +11068,15 @@ pub struct PermissionsConfigureAdditionalContentExclusionPolicyRule {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsConfigureAdditionalContentExclusionPolicy {
-    /// Opaque policy update timestamp supplied by the host.
-    #[serde(rename = "last_updated_at")]
-    pub last_updated_at: serde_json::Value,
-    /// Content-exclusion rules to apply.
-    pub rules: Vec<PermissionsConfigureAdditionalContentExclusionPolicyRule>,
-    /// Allowed values for the `PermissionsConfigureAdditionalContentExclusionPolicyScope` enumeration.
-    pub scope: PermissionsConfigureAdditionalContentExclusionPolicyScope,
+pub struct PermissionDecisionReject {
+    /// Optional feedback explaining the rejection
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub feedback: Option<String>,
+    /// Reject the request
+    pub kind: PermissionDecisionRejectKind,
 }
 
-/// If specified, replaces the session's URL-permission policy. The runtime constructs a fresh DefaultUrlManager based on these inputs. Omit to leave the current URL policy unchanged.
+/// Permission-decision variant indicating no user was available to confirm the request.
 ///
 /// <div class="warning">
 ///
@@ -10937,16 +11086,12 @@ pub struct PermissionsConfigureAdditionalContentExclusionPolicy {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionUrlsConfig {
-    /// Initial list of allowed URL/domain patterns. Patterns may include path components. Ignored when `unrestricted` is true.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub initial_allowed: Option<Vec<String>>,
-    /// If true, the runtime allows access to all URLs without prompting. Initial allow-list is ignored when this is true.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub unrestricted: Option<bool>,
+pub struct PermissionDecisionUserNotAvailable {
+    /// No user is available to confirm the request
+    pub kind: PermissionDecisionUserNotAvailableKind,
 }
 
-/// Patch of permission policy fields to apply (omit a field to leave it unchanged).
+/// Permission-decision variant indicating the request was approved.
 ///
 /// <div class="warning">
 ///
@@ -10956,29 +11101,12 @@ pub struct PermissionUrlsConfig {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsConfigureParams {
-    /// If specified, replaces the host-supplied GitHub Content Exclusion policies on the session (combined with natively-discovered policies when evaluating tool/file access). Omit to leave the current policies unchanged.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub additional_content_exclusion_policies:
-        Option<Vec<PermissionsConfigureAdditionalContentExclusionPolicy>>,
-    /// If specified, sets whether path/URL read permission requests are auto-approved. Omit to leave the current value unchanged.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub approve_all_read_permission_requests: Option<bool>,
-    /// If specified, sets whether tool permission requests are auto-approved without prompting. Omit to leave the current value unchanged.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub approve_all_tool_permission_requests: Option<bool>,
-    /// If specified, replaces the session's path-permission policy. The runtime constructs the appropriate PathManager based on these inputs (rooted at the session's working directory). Omit to leave the current path policy unchanged.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub paths: Option<PermissionPathsConfig>,
-    /// If specified, replaces the session's approved/denied permission rules. Omit to leave the current rules unchanged.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub rules: Option<PermissionRulesSet>,
-    /// If specified, replaces the session's URL-permission policy. The runtime constructs a fresh DefaultUrlManager based on these inputs. Omit to leave the current URL policy unchanged.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub urls: Option<PermissionUrlsConfig>,
+pub struct PermissionDecisionApproved {
+    /// The permission request was approved
+    pub kind: PermissionDecisionApprovedKind,
 }
 
-/// Indicates whether the operation succeeded.
+/// Permission-decision variant indicating approval was remembered for the session, with approval details.
 ///
 /// <div class="warning">
 ///
@@ -10986,14 +11114,16 @@ pub struct PermissionsConfigureParams {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsConfigureResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct PermissionDecisionApprovedForSession {
+    /// The approval to add as a session-scoped rule
+    pub approval: UserToolSessionApproval,
+    /// Approved and remembered for the rest of the session
+    pub kind: PermissionDecisionApprovedForSessionKind,
 }
 
-/// Indicates whether the operation succeeded.
+/// Permission-decision variant indicating approval was persisted for a project location, with approval details and location key.
 ///
 /// <div class="warning">
 ///
@@ -11001,14 +11131,18 @@ pub struct PermissionsConfigureResult {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsFolderTrustAddTrustedResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct PermissionDecisionApprovedForLocation {
+    /// The approval to persist for this location
+    pub approval: UserToolSessionApproval,
+    /// Approved and persisted for this project location
+    pub kind: PermissionDecisionApprovedForLocationKind,
+    /// The location key (git root or cwd) to persist the approval to
+    pub location_key: String,
 }
 
-/// No parameters.
+/// Permission-decision variant indicating the request was cancelled before use, with an optional reason.
 ///
 /// <div class="warning">
 ///
@@ -11018,9 +11152,15 @@ pub struct PermissionsFolderTrustAddTrustedResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsGetAllowAllRequest {}
+pub struct PermissionDecisionCancelled {
+    /// The permission request was cancelled before a response was used
+    pub kind: PermissionDecisionCancelledKind,
+    /// Optional explanation of why the request was cancelled
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reason: Option<String>,
+}
 
-/// Indicates whether the operation succeeded.
+/// Permission-decision variant indicating explicit denial by permission rules, with the matching rules.
 ///
 /// <div class="warning">
 ///
@@ -11030,12 +11170,14 @@ pub struct PermissionsGetAllowAllRequest {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsLocationsAddToolApprovalResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct PermissionDecisionDeniedByRules {
+    /// Denied because approval rules explicitly blocked it
+    pub kind: PermissionDecisionDeniedByRulesKind,
+    /// Rules that denied the request
+    pub rules: Vec<PermissionRule>,
 }
 
-/// Scope and add/remove instructions for modifying session- or location-scoped permission rules.
+/// Permission-decision variant indicating no approval rule matched and user confirmation was unavailable.
 ///
 /// <div class="warning">
 ///
@@ -11045,21 +11187,12 @@ pub struct PermissionsLocationsAddToolApprovalResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsModifyRulesParams {
-    /// Rules to add to the scope. Applied before `remove`/`removeAll`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub add: Option<Vec<PermissionRule>>,
-    /// Specific rules to remove from the scope. Ignored when `removeAll` is true.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub remove: Option<Vec<PermissionRule>>,
-    /// When true, removes every rule currently in the scope (after any `add` is applied). Useful for clearing the location scope wholesale.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub remove_all: Option<bool>,
-    /// Whether the change applies to ephemeral session-scoped rules (cleared at session end) or to location-scoped rules persisted via the location-permissions config file.
-    pub scope: PermissionsModifyRulesScope,
+pub struct PermissionDecisionDeniedNoApprovalRuleAndCouldNotRequestFromUser {
+    /// Denied because no approval rule matched and user confirmation was unavailable
+    pub kind: PermissionDecisionDeniedNoApprovalRuleAndCouldNotRequestFromUserKind,
 }
 
-/// Indicates whether the operation succeeded.
+/// Permission-decision variant indicating the user denied an interactive prompt, with optional feedback and force-reject flag.
 ///
 /// <div class="warning">
 ///
@@ -11069,12 +11202,18 @@ pub struct PermissionsModifyRulesParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsModifyRulesResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct PermissionDecisionDeniedInteractivelyByUser {
+    /// Optional feedback from the user explaining the denial
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub feedback: Option<String>,
+    /// Whether to force-reject the current agent turn
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub force_reject: Option<bool>,
+    /// Denied by the user during an interactive prompt
+    pub kind: PermissionDecisionDeniedInteractivelyByUserKind,
 }
 
-/// Indicates whether the operation succeeded.
+/// Permission-decision variant indicating denial by content-exclusion policy, with path and message.
 ///
 /// <div class="warning">
 ///
@@ -11084,12 +11223,16 @@ pub struct PermissionsModifyRulesResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsNotifyPromptShownResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct PermissionDecisionDeniedByContentExclusionPolicy {
+    /// Denied by the organization's content exclusion policy
+    pub kind: PermissionDecisionDeniedByContentExclusionPolicyKind,
+    /// Human-readable explanation of why the path was excluded
+    pub message: String,
+    /// File path that triggered the exclusion
+    pub path: String,
 }
 
-/// Indicates whether the operation succeeded.
+/// Permission-decision variant indicating denial by a permission request hook, with optional message and interrupt flag.
 ///
 /// <div class="warning">
 ///
@@ -11099,12 +11242,18 @@ pub struct PermissionsNotifyPromptShownResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsPathsAddResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct PermissionDecisionDeniedByPermissionRequestHook {
+    /// Whether to interrupt the current agent turn
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub interrupt: Option<bool>,
+    /// Denied by a permission request hook registered by an extension or plugin
+    pub kind: PermissionDecisionDeniedByPermissionRequestHookKind,
+    /// Optional message from the hook explaining the denial
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub message: Option<String>,
 }
 
-/// No parameters; returns the session's allow-listed directories.
+/// Optional informational context describing how and where the permission decision was made. This does not affect permission behavior.
 ///
 /// <div class="warning">
 ///
@@ -11114,9 +11263,16 @@ pub struct PermissionsPathsAddResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsPathsListRequest {}
+pub struct PermissionDecisionContext {
+    /// Disposition of the permission request as observed by the responding client.
+    pub outcome: PermissionDecisionOutcome,
+    /// Controlled reason or actor responsible for the response.
+    pub source: PermissionDecisionSource,
+    /// Client surface that submitted the response.
+    pub surface: PermissionDecisionSurface,
+}
 
-/// Indicates whether the operation succeeded.
+/// Pending permission request ID and the decision to apply (approve/reject and scope).
 ///
 /// <div class="warning">
 ///
@@ -11124,14 +11280,19 @@ pub struct PermissionsPathsListRequest {}
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsPathsUpdatePrimaryResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct PermissionDecisionRequest {
+    /// Optional informational context describing how and where this response was made. Omit it to preserve legacy behavior without attributing an origin.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub decision_context: Option<PermissionDecisionContext>,
+    /// Request ID of the pending permission request
+    pub request_id: RequestId,
+    /// The client's response to the pending permission prompt
+    pub result: PermissionDecision,
 }
 
-/// No parameters; returns currently-pending permission requests for the session.
+/// Location-persisted tool approval details for specific command identifiers.
 ///
 /// <div class="warning">
 ///
@@ -11141,9 +11302,14 @@ pub struct PermissionsPathsUpdatePrimaryResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsPendingRequestsRequest {}
+pub struct PermissionsLocationsAddToolApprovalDetailsCommands {
+    /// Command identifiers covered by this approval.
+    pub command_identifiers: Vec<String>,
+    /// Approval scoped to specific command identifiers.
+    pub kind: PermissionsLocationsAddToolApprovalDetailsCommandsKind,
+}
 
-/// Clears session-scoped tool permission approvals, and optionally the location-scoped ones.
+/// Location-persisted tool approval details for read-only filesystem operations.
 ///
 /// <div class="warning">
 ///
@@ -11153,13 +11319,12 @@ pub struct PermissionsPendingRequestsRequest {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsResetSessionApprovalsRequest {
-    /// Whether location-scoped approvals are cleared too. Defaults to `true`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub include_location: Option<bool>,
+pub struct PermissionsLocationsAddToolApprovalDetailsRead {
+    /// Approval covering read-only filesystem operations.
+    pub kind: PermissionsLocationsAddToolApprovalDetailsReadKind,
 }
 
-/// Indicates whether the operation succeeded.
+/// Location-persisted tool approval details for filesystem write operations.
 ///
 /// <div class="warning">
 ///
@@ -11169,12 +11334,12 @@ pub struct PermissionsResetSessionApprovalsRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsResetSessionApprovalsResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct PermissionsLocationsAddToolApprovalDetailsWrite {
+    /// Approval covering filesystem write operations.
+    pub kind: PermissionsLocationsAddToolApprovalDetailsWriteKind,
 }
 
-/// Allow-all mode to apply for the session.
+/// Location-persisted tool approval details for an MCP server tool, or all tools when `toolName` is null.
 ///
 /// <div class="warning">
 ///
@@ -11184,22 +11349,16 @@ pub struct PermissionsResetSessionApprovalsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsSetAllowAllRequest {
-    /// Legacy full allow-all toggle. Prefer `mode`; when `mode` is omitted, `enabled: true` is treated as `mode: "on"` and any other value is treated as `mode: "off"`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub enabled: Option<bool>,
-    /// Allow-all mode to apply. `on` enables full allow-all; `auto` enables advisory LLM auto-approval; `off` disables both.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mode: Option<PermissionsAllowAllMode>,
-    /// Optional model id for the `auto` mode auto-approval LLM judging. Only meaningful when `mode` is `auto`; ignored otherwise. When omitted, the session resolves a default judge model: `gpt-5.5` for CAPI sessions and the session's active model for BYOK sessions.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub model: Option<String>,
-    /// Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source: Option<PermissionsSetAllowAllSource>,
+pub struct PermissionsLocationsAddToolApprovalDetailsMcp {
+    /// Approval covering an MCP tool.
+    pub kind: PermissionsLocationsAddToolApprovalDetailsMcpKind,
+    /// MCP server name.
+    pub server_name: String,
+    /// MCP tool name, or null to cover every tool on the server.
+    pub tool_name: Option<String>,
 }
 
-/// Allow-all toggle for tool permission requests, with an optional telemetry source.
+/// Location-persisted tool approval details for MCP sampling requests from a server.
 ///
 /// <div class="warning">
 ///
@@ -11209,15 +11368,14 @@ pub struct PermissionsSetAllowAllRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsSetApproveAllRequest {
-    /// Whether to auto-approve all tool permission requests
-    pub enabled: bool,
-    /// Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub source: Option<PermissionsSetApproveAllSource>,
+pub struct PermissionsLocationsAddToolApprovalDetailsMcpSampling {
+    /// Approval covering MCP sampling requests for a server.
+    pub kind: PermissionsLocationsAddToolApprovalDetailsMcpSamplingKind,
+    /// MCP server name.
+    pub server_name: String,
 }
 
-/// Indicates whether the operation succeeded.
+/// Location-persisted tool approval details for writes to long-term memory.
 ///
 /// <div class="warning">
 ///
@@ -11227,12 +11385,12 @@ pub struct PermissionsSetApproveAllRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsSetApproveAllResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct PermissionsLocationsAddToolApprovalDetailsMemory {
+    /// Approval covering writes to long-term memory.
+    pub kind: PermissionsLocationsAddToolApprovalDetailsMemoryKind,
 }
 
-/// Toggles whether permission prompts should be bridged into session events for this client.
+/// Location-persisted tool approval details for a custom tool, keyed by tool name.
 ///
 /// <div class="warning">
 ///
@@ -11242,12 +11400,14 @@ pub struct PermissionsSetApproveAllResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsSetRequiredRequest {
-    /// Whether the client wants `permission.requested` events bridged from the session-owned permission service. CLI clients that render prompt UI set this to `true` for as long as their listener is mounted; headless callers leave it unset (the default is `false`).
-    pub required: bool,
+pub struct PermissionsLocationsAddToolApprovalDetailsCustomTool {
+    /// Approval covering a custom tool.
+    pub kind: PermissionsLocationsAddToolApprovalDetailsCustomToolKind,
+    /// Custom tool name.
+    pub tool_name: String,
 }
 
-/// Indicates whether the operation succeeded.
+/// Location-persisted tool approval details for extension-management operations, optionally narrowed by operation.
 ///
 /// <div class="warning">
 ///
@@ -11257,12 +11417,15 @@ pub struct PermissionsSetRequiredRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsSetRequiredResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct PermissionsLocationsAddToolApprovalDetailsExtensionManagement {
+    /// Approval covering extension lifecycle operations such as enable, disable, or reload.
+    pub kind: PermissionsLocationsAddToolApprovalDetailsExtensionManagementKind,
+    /// Optional operation identifier; when omitted, the approval covers all extension management operations.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub operation: Option<String>,
 }
 
-/// Indicates whether the operation succeeded.
+/// Location-persisted factory approval, optionally narrowed by approval key.
 ///
 /// <div class="warning">
 ///
@@ -11272,12 +11435,15 @@ pub struct PermissionsSetRequiredResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionsUrlsSetUnrestrictedModeResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct PermissionsLocationsAddToolApprovalDetailsFactory {
+    /// Optional factory operation name or canonical approval key; when omitted, the approval covers all factory operations.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub approval_key: Option<String>,
+    /// Approval covering factory operations.
+    pub kind: PermissionsLocationsAddToolApprovalDetailsFactoryKind,
 }
 
-/// Whether the URL-permission policy should run in unrestricted mode.
+/// Location-persisted tool approval details for an extension's permission-gated capability access, keyed by extension name.
 ///
 /// <div class="warning">
 ///
@@ -11287,12 +11453,14 @@ pub struct PermissionsUrlsSetUnrestrictedModeResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionUrlsSetUnrestrictedModeParams {
-    /// Whether to allow access to all URLs without prompting. Toggles the runtime's URL-permission policy in place.
-    pub enabled: bool,
+pub struct PermissionsLocationsAddToolApprovalDetailsExtensionPermissionAccess {
+    /// Extension name.
+    pub extension_name: String,
+    /// Approval covering an extension's request to access a permission-gated capability.
+    pub kind: PermissionsLocationsAddToolApprovalDetailsExtensionPermissionAccessKind,
 }
 
-/// Optional message to echo back to the caller.
+/// Location-persisted tool approval details for an extension's access to sensitive environment variables, keyed by extension name and the exact set of variable names.
 ///
 /// <div class="warning">
 ///
@@ -11302,13 +11470,16 @@ pub struct PermissionUrlsSetUnrestrictedModeParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PingRequest {
-    /// Optional message to echo back
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub message: Option<String>,
+pub struct PermissionsLocationsAddToolApprovalDetailsExtensionEnvAccess {
+    /// Names of the sensitive environment variables this approval covers. Values are never persisted.
+    pub environment_variables: Vec<String>,
+    /// Extension name.
+    pub extension_name: String,
+    /// Approval covering an extension's request to read sensitive environment variables.
+    pub kind: PermissionsLocationsAddToolApprovalDetailsExtensionEnvAccessKind,
 }
 
-/// Server liveness response, including the echoed message, current server timestamp, and protocol version.
+/// Location-scoped tool approval to persist.
 ///
 /// <div class="warning">
 ///
@@ -11316,18 +11487,16 @@ pub struct PingRequest {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PingResult {
-    /// Echoed message (or default greeting)
-    pub message: String,
-    /// Server protocol version number
-    pub protocol_version: i64,
-    /// ISO 8601 timestamp when the server handled the ping
-    pub timestamp: String,
+pub struct PermissionLocationAddToolApprovalParams {
+    /// Tool approval to persist and apply
+    pub approval: PermissionsLocationsAddToolApprovalDetails,
+    /// Location key (git root or cwd) to persist the approval to
+    pub location_key: String,
 }
 
-/// Existence, contents, and resolved path of the session plan file.
+/// Working directory to load persisted location permissions for.
 ///
 /// <div class="warning">
 ///
@@ -11337,16 +11506,12 @@ pub struct PingResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PlanReadResult {
-    /// The content of the plan file, or null if it does not exist
-    pub content: Option<String>,
-    /// Whether the plan file exists in the workspace
-    pub exists: bool,
-    /// Absolute file path of the plan file, or null if workspace is not enabled
-    pub path: Option<String>,
+pub struct PermissionLocationApplyParams {
+    /// Working directory whose persisted location permissions should be applied
+    pub working_directory: String,
 }
 
-/// A single todo row read from the session SQL `todos` table. All fields are optional because the SQL schema is best-effort and the agent may not have populated every column.
+/// Summary of persisted location permissions applied to the session.
 ///
 /// <div class="warning">
 ///
@@ -11356,22 +11521,22 @@ pub struct PlanReadResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PlanSqlTodosRow {
-    /// Todo description.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    /// Todo identifier.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub id: Option<String>,
-    /// Todo status.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub status: Option<String>,
-    /// Todo title.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub title: Option<String>,
+pub struct PermissionLocationApplyResult {
+    /// Number of persisted allowed directories added to the live path manager
+    pub applied_directory_count: i64,
+    /// Number of location-scoped rules added to the live permission service
+    pub applied_rule_count: i64,
+    /// Location-scoped rules applied to the live permission service
+    pub applied_rules: Vec<PermissionRule>,
+    /// Whether a different location was applied since the previous apply call
+    pub changed: bool,
+    /// Location key used in the location-permissions store
+    pub location_key: String,
+    /// Whether the location is a git repo or directory
+    pub location_type: PermissionLocationType,
 }
 
-/// Todo rows read from the session SQL database. Empty when no session database is available.
+/// Working directory to resolve into a location-permissions key.
 ///
 /// <div class="warning">
 ///
@@ -11381,12 +11546,12 @@ pub struct PlanSqlTodosRow {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PlanReadSqlTodosResult {
-    /// Rows from the session SQL todos table, ordered by creation time with insertion order used to break ties when available and id used for WITHOUT ROWID tables.
-    pub rows: Vec<PlanSqlTodosRow>,
+pub struct PermissionLocationResolveParams {
+    /// Working directory whose permission location should be resolved
+    pub working_directory: String,
 }
 
-/// A single dependency edge read from the session SQL `todo_deps` table, indicating that one todo must complete before another.
+/// Resolved location-permissions key and type.
 ///
 /// <div class="warning">
 ///
@@ -11396,14 +11561,14 @@ pub struct PlanReadSqlTodosResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PlanSqlTodoDependency {
-    /// ID of the todo it depends on.
-    pub depends_on: String,
-    /// ID of the todo that has the dependency.
-    pub todo_id: String,
+pub struct PermissionLocationResolveResult {
+    /// Location key used in the location-permissions store
+    pub location_key: String,
+    /// Whether the location is a git repo or directory
+    pub location_type: PermissionLocationType,
 }
 
-/// Todo rows + dependency edges read from the session SQL database.
+/// Directory path to add to the session's allowed directories.
 ///
 /// <div class="warning">
 ///
@@ -11413,14 +11578,12 @@ pub struct PlanSqlTodoDependency {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PlanReadSqlTodosWithDependenciesResult {
-    /// Edges from the session SQL todo_deps table. Empty when no database, no todo_deps table, or the SELECT failed. Read independently from `rows`, so a broken todo_deps table does not affect the rows result and vice versa.
-    pub dependencies: Vec<PlanSqlTodoDependency>,
-    /// Rows from the session SQL todos table, ordered by creation time with insertion order used to break ties when available and id used for WITHOUT ROWID tables. Empty when no database, no todos table, or the SELECT failed.
-    pub rows: Vec<PlanSqlTodosRow>,
+pub struct PermissionPathsAddParams {
+    /// Directory to add to the allow-list. The runtime resolves and validates the path before adding.
+    pub path: String,
 }
 
-/// Replacement contents to write to the session plan file.
+/// Path to evaluate against the session's allowed directories.
 ///
 /// <div class="warning">
 ///
@@ -11430,12 +11593,12 @@ pub struct PlanReadSqlTodosWithDependenciesResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PlanUpdateRequest {
-    /// The new content for the plan file
-    pub content: String,
+pub struct PermissionPathsAllowedCheckParams {
+    /// Path to check against the session's allowed directories
+    pub path: String,
 }
 
-/// Session plugin metadata, with name, marketplace, optional version, and enabled state.
+/// Indicates whether the supplied path is within the session's allowed directories.
 ///
 /// <div class="warning">
 ///
@@ -11445,19 +11608,12 @@ pub struct PlanUpdateRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct Plugin {
-    /// Whether the plugin is currently enabled
-    pub enabled: bool,
-    /// Marketplace the plugin came from
-    pub marketplace: String,
-    /// Plugin name
-    pub name: String,
-    /// Installed version
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub version: Option<String>,
+pub struct PermissionPathsAllowedCheckResult {
+    /// Whether the path is within the session's allowed directories
+    pub allowed: bool,
 }
 
-/// Result of installing a plugin.
+/// If specified, replaces the session's path-permission policy. The runtime constructs the appropriate PathManager based on these inputs (rooted at the session's working directory). Omit to leave the current path policy unchanged.
 ///
 /// <div class="warning">
 ///
@@ -11467,20 +11623,22 @@ pub struct Plugin {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginInstallResult {
-    /// Set when the install path is deprecated (e.g. direct repo / URL / local installs). Callers should surface this to end users.
+pub struct PermissionPathsConfig {
+    /// Additional directories to allow tool access to (in addition to the session's working directory). When `unrestricted` is true, these are still pre-populated on the UnrestrictedPathManager so they remain visible via getDirectories() (e.g. for @-mention completion).
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub deprecation_warning: Option<String>,
-    /// The newly installed plugin's metadata
-    pub plugin: InstalledPluginInfo,
-    /// Optional post-install message provided by the plugin (e.g. setup instructions)
+    pub additional_directories: Option<Vec<String>>,
+    /// Whether to include the system temp directory in the allowed list (defaults to true). Ignored when `unrestricted` is true.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub post_install_message: Option<String>,
-    /// Number of skills discovered and installed from the plugin
-    pub skills_installed: i64,
+    pub include_temp_directory: Option<bool>,
+    /// If true, the runtime allows access to all paths without prompting. Equivalent to constructing an UnrestrictedPathManager.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub unrestricted: Option<bool>,
+    /// Workspace root path (special-cased to be allowed even before the directory exists). Ignored when `unrestricted` is true.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub workspace_path: Option<String>,
 }
 
-/// Plugins installed for the session, with their enabled state and version metadata.
+/// Snapshot of the session's allow-listed directories and primary working directory.
 ///
 /// <div class="warning">
 ///
@@ -11490,12 +11648,14 @@ pub struct PluginInstallResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginList {
-    /// Installed plugins
-    pub plugins: Vec<Plugin>,
+pub struct PermissionPathsList {
+    /// All directories currently allowed for tool access on this session.
+    pub directories: Vec<String>,
+    /// The primary working directory for this session.
+    pub primary: String,
 }
 
-/// Plugins installed in user/global state.
+/// Directory path to set as the session's new primary working directory.
 ///
 /// <div class="warning">
 ///
@@ -11505,12 +11665,12 @@ pub struct PluginList {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginListResult {
-    /// Installed plugins
-    pub plugins: Vec<InstalledPluginInfo>,
+pub struct PermissionPathsUpdatePrimaryParams {
+    /// Directory to set as the new primary working directory for the session's permission policy.
+    pub path: String,
 }
 
-/// Trusted built-in plugin directories to use for this runtime process.
+/// Path to evaluate against the session's workspace (primary) directory.
 ///
 /// <div class="warning">
 ///
@@ -11520,12 +11680,12 @@ pub struct PluginListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginsBuiltinSetRequest {
-    /// Complete replacement set of trusted built-in plugin directories. Every entry must be an absolute local filesystem path no longer than 4096 characters.
-    pub paths: Vec<String>,
+pub struct PermissionPathsWorkspaceCheckParams {
+    /// Path to check against the session workspace directory
+    pub path: String,
 }
 
-/// Plugin names (or specs) to disable.
+/// Indicates whether the supplied path is within the session's workspace directory.
 ///
 /// <div class="warning">
 ///
@@ -11535,12 +11695,12 @@ pub struct PluginsBuiltinSetRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginsDisableRequest {
-    /// Plugin names or "plugin@marketplace" specs to disable. Unknown names are ignored. Non-marketplace direct installs cannot be disabled via this API; uninstall them instead. Plugin-owned MCP servers are stopped in active sessions immediately; other plugin contributions remain available until each session reloads plugins.
-    pub names: Vec<String>,
+pub struct PermissionPathsWorkspaceCheckResult {
+    /// Whether the path is within the session workspace directory
+    pub allowed: bool,
 }
 
-/// Plugin names (or specs) to enable.
+/// Notification payload describing the permission prompt that the client just rendered.
 ///
 /// <div class="warning">
 ///
@@ -11550,12 +11710,12 @@ pub struct PluginsDisableRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginsEnableRequest {
-    /// Plugin names or "plugin@marketplace" specs to enable. Unknown names are ignored. Non-marketplace direct installs are always enabled and cannot be toggled via this API.
-    pub names: Vec<String>,
+pub struct PermissionPromptShownNotification {
+    /// Human-readable description of the prompt the user is being asked to approve. Used by the runtime to fire the registered `permission_prompt` notification hook (e.g. terminal bell, desktop notification).
+    pub message: String,
 }
 
-/// Plugin source and optional working directory for relative-path resolution.
+/// Indicates whether the permission decision was applied; false when the request was already resolved.
 ///
 /// <div class="warning">
 ///
@@ -11565,15 +11725,12 @@ pub struct PluginsEnableRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginsInstallRequest {
-    /// Plugin install spec. Accepts the same forms as the CLI: "plugin@marketplace" (marketplace install), "owner/repo" or "owner/repo:subpath" (GitHub direct), an http/https/ssh URL, or a local path. Direct (non-marketplace) installs are deprecated and will produce a deprecationWarning in the result.
-    pub source: String,
-    /// Working directory used to resolve relative local paths in `source`. Defaults to the server's current working directory.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub working_directory: Option<String>,
+pub struct PermissionRequestResult {
+    /// Whether the permission request was handled successfully
+    pub success: bool,
 }
 
-/// Marketplace source and optional working directory for relative-path resolution.
+/// If specified, replaces the session's approved/denied permission rules. Omit to leave the current rules unchanged.
 ///
 /// <div class="warning">
 ///
@@ -11583,15 +11740,14 @@ pub struct PluginsInstallRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginsMarketplacesAddRequest {
-    /// Marketplace source. Accepts the same forms as the CLI: "owner/repo" or "owner/repo#ref" (GitHub), an http/https/ssh URL (optionally with #ref), a git scp-style URL (user@host:path), or a local path. The marketplace's own name (from its manifest) is used as the registration key.
-    pub source: String,
-    /// Working directory used to resolve relative local paths in `source`. Defaults to the server's current working directory.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub working_directory: Option<String>,
+pub struct PermissionRulesSet {
+    /// Rules that auto-approve matching requests
+    pub approved: Vec<PermissionRule>,
+    /// Rules that auto-deny matching requests
+    pub denied: Vec<PermissionRule>,
 }
 
-/// Name of the marketplace whose plugin catalog to fetch.
+/// Source descriptor for a `session.permissions.configure` content-exclusion rule, with source name and type.
 ///
 /// <div class="warning">
 ///
@@ -11601,12 +11757,14 @@ pub struct PluginsMarketplacesAddRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginsMarketplacesBrowseRequest {
-    /// Marketplace name to browse
+pub struct PermissionsConfigureAdditionalContentExclusionPolicyRuleSource {
+    /// Name of the policy source.
     pub name: String,
+    /// Type of the policy source.
+    pub r#type: String,
 }
 
-/// Optional marketplace name; omit to refresh all.
+/// Single content-exclusion rule supplied to `session.permissions.configure`, with paths, match conditions, and source.
 ///
 /// <div class="warning">
 ///
@@ -11616,13 +11774,20 @@ pub struct PluginsMarketplacesBrowseRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginsMarketplacesRefreshRequest {
-    /// Marketplace name to refresh. When omitted, every registered marketplace is refreshed.
+pub struct PermissionsConfigureAdditionalContentExclusionPolicyRule {
+    /// Conditions of which at least one must match.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
+    pub if_any_match: Option<Vec<String>>,
+    /// Conditions none of which may match.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub if_none_match: Option<Vec<String>>,
+    /// Path patterns covered by this rule.
+    pub paths: Vec<String>,
+    /// Source descriptor for a `session.permissions.configure` content-exclusion rule, with source name and type.
+    pub source: PermissionsConfigureAdditionalContentExclusionPolicyRuleSource,
 }
 
-/// Name of the marketplace to remove and an optional force flag.
+/// Content-exclusion policy supplied to `session.permissions.configure`, with rules, last-updated data, and scope.
 ///
 /// <div class="warning">
 ///
@@ -11632,15 +11797,36 @@ pub struct PluginsMarketplacesRefreshRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginsMarketplacesRemoveRequest {
-    /// When true, also uninstall every plugin sourced from this marketplace. When false (default), removal is a no-op if any plugin from this marketplace is installed and the dependent plugin names are returned in the result.
+pub struct PermissionsConfigureAdditionalContentExclusionPolicy {
+    /// Opaque policy update timestamp supplied by the host.
+    #[serde(rename = "last_updated_at")]
+    pub last_updated_at: serde_json::Value,
+    /// Content-exclusion rules to apply.
+    pub rules: Vec<PermissionsConfigureAdditionalContentExclusionPolicyRule>,
+    /// Allowed values for the `PermissionsConfigureAdditionalContentExclusionPolicyScope` enumeration.
+    pub scope: PermissionsConfigureAdditionalContentExclusionPolicyScope,
+}
+
+/// If specified, replaces the session's URL-permission policy. The runtime constructs a fresh DefaultUrlManager based on these inputs. Omit to leave the current URL policy unchanged.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PermissionUrlsConfig {
+    /// Initial list of allowed URL/domain patterns. Patterns may include path components. Ignored when `unrestricted` is true.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub force: Option<bool>,
-    /// Marketplace name to remove
-    pub name: String,
+    pub initial_allowed: Option<Vec<String>>,
+    /// If true, the runtime allows access to all URLs without prompting. Initial allow-list is ignored when this is true.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub unrestricted: Option<bool>,
 }
 
-/// Optional flags controlling which side effects the reload performs.
+/// Patch of permission policy fields to apply (omit a field to leave it unchanged).
 ///
 /// <div class="warning">
 ///
@@ -11650,25 +11836,29 @@ pub struct PluginsMarketplacesRemoveRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginsReloadRequest {
-    /// When true, skip repo-level hooks during the hook reload. Use before folder trust is confirmed; load them post-trust via `sessions.loadDeferredRepoHooks`.
+pub struct PermissionsConfigureParams {
+    /// If specified, replaces the host-supplied GitHub Content Exclusion policies on the session (combined with natively-discovered policies when evaluating tool/file access). Omit to leave the current policies unchanged.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub defer_repo_hooks: Option<bool>,
-    /// Re-run custom-agent discovery after refreshing plugins. Defaults to true.
+    pub additional_content_exclusion_policies:
+        Option<Vec<PermissionsConfigureAdditionalContentExclusionPolicy>>,
+    /// If specified, sets whether path/URL read permission requests are auto-approved. Omit to leave the current value unchanged.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub reload_custom_agents: Option<bool>,
-    /// Re-discover and relaunch subprocess extensions (including plugin-shipped extensions) after refreshing plugins. Defaults to true. Has no effect when the session has no active extension controller (e.g. extensions were not requested for the session).
+    pub approve_all_read_permission_requests: Option<bool>,
+    /// If specified, sets whether tool permission requests are auto-approved without prompting. Omit to leave the current value unchanged.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub reload_extensions: Option<bool>,
-    /// Re-load user, plugin, and (subject to `deferRepoHooks`) repo hooks. Defaults to true. Has no effect when the host has not registered a hook reloader (e.g. remote sessions).
+    pub approve_all_tool_permission_requests: Option<bool>,
+    /// If specified, replaces the session's path-permission policy. The runtime constructs the appropriate PathManager based on these inputs (rooted at the session's working directory). Omit to leave the current path policy unchanged.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub reload_hooks: Option<bool>,
-    /// Reload MCP server connections after refreshing plugins. Defaults to true.
+    pub paths: Option<PermissionPathsConfig>,
+    /// If specified, replaces the session's approved/denied permission rules. Omit to leave the current rules unchanged.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub reload_mcp: Option<bool>,
+    pub rules: Option<PermissionRulesSet>,
+    /// If specified, replaces the session's URL-permission policy. The runtime constructs a fresh DefaultUrlManager based on these inputs. Omit to leave the current URL policy unchanged.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub urls: Option<PermissionUrlsConfig>,
 }
 
-/// Name (or spec) of the plugin to uninstall.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -11678,15 +11868,12 @@ pub struct PluginsReloadRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginsUninstallRequest {
-    /// Stable source identity for a direct (non-marketplace) install. Disambiguates uninstall when multiple installed plugins share the same name.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub direct_source_id: Option<String>,
-    /// Plugin name or "plugin@marketplace" spec to uninstall. When ambiguous, prefer the fully-qualified spec.
-    pub name: String,
+pub struct PermissionsConfigureResult {
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// Name (or spec) of the plugin to update.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -11696,12 +11883,12 @@ pub struct PluginsUninstallRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginsUpdateRequest {
-    /// Plugin name or "plugin@marketplace" spec to update.
-    pub name: String,
+pub struct PermissionsFolderTrustAddTrustedResult {
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// Per-plugin result from updating all plugins, with versions, skills installed, success flag, and optional error.
+/// No parameters.
 ///
 /// <div class="warning">
 ///
@@ -11711,28 +11898,9 @@ pub struct PluginsUpdateRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginUpdateAllEntry {
-    /// Error message (failure only)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Marketplace the plugin came from. Empty string ("") for direct installs.
-    pub marketplace: String,
-    /// Plugin name that was updated
-    pub name: String,
-    /// Version after the update, when available
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub new_version: Option<String>,
-    /// Previously installed version, when available
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub previous_version: Option<String>,
-    /// Number of skills installed after the update (success only)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub skills_installed: Option<i64>,
-    /// Whether the update succeeded for this plugin
-    pub success: bool,
-}
+pub struct PermissionsGetModeRequest {}
 
-/// Result of updating all installed plugins.
+/// Current permission mode.
 ///
 /// <div class="warning">
 ///
@@ -11742,12 +11910,12 @@ pub struct PluginUpdateAllEntry {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginUpdateAllResult {
-    /// Per-plugin update results in deterministic order.
-    pub results: Vec<PluginUpdateAllEntry>,
+pub struct PermissionsGetModeResult {
+    /// Current permission mode
+    pub mode: PermissionMode,
 }
 
-/// Result of updating a single plugin.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -11757,18 +11925,12 @@ pub struct PluginUpdateAllResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginUpdateResult {
-    /// Version after the update, when reported by the plugin manifest
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub new_version: Option<String>,
-    /// Version that was previously installed, when available
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub previous_version: Option<String>,
-    /// Number of skills discovered and installed after the update
-    pub skills_installed: i64,
+pub struct PermissionsLocationsAddToolApprovalResult {
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// Serializable definition of a caller-implemented tool whose execution is handled over the SDK connection.
+/// Scope and add/remove instructions for modifying session- or location-scoped permission rules.
 ///
 /// <div class="warning">
 ///
@@ -11778,35 +11940,21 @@ pub struct PluginUpdateResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ProtocolExternalToolDefinition {
-    /// Tool-loading deferral policy.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub defer: Option<ProtocolExternalToolDefer>,
-    /// Model-visible explanation of what the tool does.
-    pub description: String,
-    /// Whether the tool executes commands in a terminal.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub is_terminal: Option<bool>,
-    /// Optional caller-defined metadata associated with the tool.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub metadata: Option<HashMap<String, serde_json::Value>>,
-    /// Unique model-visible tool name.
-    pub name: String,
-    /// Whether this definition replaces a built-in tool with the same name.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub overrides_built_in_tool: Option<bool>,
-    /// JSON Schema describing the tool's input arguments.
+pub struct PermissionsModifyRulesParams {
+    /// Rules to add to the scope. Applied before `remove`/`removeAll`.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub parameters: Option<HashMap<String, serde_json::Value>>,
-    /// Whether execution bypasses the normal tool permission prompt.
+    pub add: Option<Vec<PermissionRule>>,
+    /// Specific rules to remove from the scope. Ignored when `removeAll` is true.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub skip_permission: Option<bool>,
-    /// Optional human-readable display title.
+    pub remove: Option<Vec<PermissionRule>>,
+    /// When true, removes every rule currently in the scope (after any `add` is applied). Useful for clearing the location scope wholesale.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub title: Option<String>,
+    pub remove_all: Option<bool>,
+    /// Whether the change applies to ephemeral session-scoped rules (cleared at session end) or to location-scoped rules persisted via the location-permissions config file.
+    pub scope: PermissionsModifyRulesScope,
 }
 
-/// A BYOK model definition referencing a named provider.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -11816,35 +11964,12 @@ pub struct ProtocolExternalToolDefinition {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ProviderModelConfig {
-    /// Optional capability overrides (vision, tool_calls, reasoning, etc.).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub capabilities: Option<ModelCapabilitiesOverride>,
-    /// Provider-local model id, unique within its provider. The session-wide selection id (shown in the model list and passed to switchTo) is the provider-qualified `provider/id`.
-    pub id: String,
-    /// Maximum context window tokens for the model.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_context_window_tokens: Option<i64>,
-    /// Maximum output tokens for the model.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_output_tokens: Option<i64>,
-    /// Maximum prompt/input tokens for the model.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_prompt_tokens: Option<i64>,
-    /// Well-known base model id used for behavior/capability/config lookup. Defaults to `id`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub model_id: Option<String>,
-    /// Display name for model pickers. Defaults to the provider-qualified selection id (`provider/id`).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    /// Name of the configured provider that serves this model.
-    pub provider: String,
-    /// The model name sent to the provider API for inference. Defaults to `id`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub wire_model: Option<String>,
+pub struct PermissionsModifyRulesResult {
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// BYOK providers and/or models to add to the session's registry at runtime. Both fields are optional; provide providers, models, or both.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -11854,16 +11979,12 @@ pub struct ProviderModelConfig {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ProviderAddRequest {
-    /// BYOK model definitions to register. Each must reference a provider that is already registered or included in this same call. Selection ids (`provider/id`) must be unique across the registry.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub models: Option<Vec<ProviderModelConfig>>,
-    /// Named BYOK provider connections to register, additive to any providers already in the registry. Each name must be unique across the registry and must not contain '/'.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub providers: Option<Vec<NamedProviderConfig>>,
+pub struct PermissionsNotifyPromptShownResult {
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// The selectable model entries synthesized for the models added by this call.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -11873,12 +11994,12 @@ pub struct ProviderAddRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ProviderAddResult {
-    /// Synthesized selectable model entries for the newly added BYOK models, each under its provider-qualified selection id (`provider/id`). Empty when only providers were added.
-    pub models: Vec<serde_json::Value>,
+pub struct PermissionsPathsAddResult {
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// Custom model-provider configuration (BYOK).
+/// No parameters; returns the session's allow-listed directories.
 ///
 /// <div class="warning">
 ///
@@ -11888,57 +12009,9 @@ pub struct ProviderAddResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ProviderConfig {
-    /// API key. Optional for local providers like Ollama.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub api_key: Option<String>,
-    /// Azure-specific provider options.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub azure: Option<ProviderConfigAzure>,
-    /// API endpoint URL.
-    pub base_url: String,
-    /// Bearer token for authentication. Sets the Authorization header directly. Takes precedence over apiKey when both are set.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub bearer_token: Option<String>,
-    /// When true, the SDK client supplies bearer tokens on demand: the runtime calls the client-session `providerToken.getToken` callback before each request and applies the returned token as an `Authorization: Bearer <token>` header. This is the bearer/OAuth scheme used by Azure AD / managed-identity tokens and provider OAuth access tokens (including Anthropic's), not a provider-specific API-key header such as Anthropic's `x-api-key`. The token-acquiring function itself stays on the SDK side and is never serialized; only this flag crosses the wire. When set alongside `apiKey`/`bearerToken`, the callback takes precedence: the runtime applies the token returned by `providerToken.getToken` as the `Authorization: Bearer` header for each request and does not send the static credential.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub has_bearer_token_provider: Option<bool>,
-    /// Custom HTTP headers to include in all outbound requests to the provider.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub headers: Option<HashMap<String, String>>,
-    /// Maximum context window tokens for the model.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_context_window_tokens: Option<f64>,
-    /// Maximum output tokens for the model.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_output_tokens: Option<f64>,
-    /// Maximum prompt/input tokens for the model.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_prompt_tokens: Option<f64>,
-    /// Overrides for model capabilities when they cannot be inferred from modelId.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub model_capabilities: Option<ModelCapabilitiesOverride>,
-    /// Well-known model ID used for capability lookup. When set, agent behavior config and token limits are inferred from this model.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub model_id: Option<String>,
-    /// Provider name used for model and telemetry attribution.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub provider_name: Option<String>,
-    /// Provider transport. Defaults to "http".
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub transport: Option<ProviderConfigTransport>,
-    /// Provider type. Defaults to "openai" for generic OpenAI-compatible APIs.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub r#type: Option<ProviderConfigType>,
-    /// Wire API format (openai/azure only). Defaults to "completions".
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub wire_api: Option<ProviderConfigWireApi>,
-    /// The model identifier sent to the provider API for inference (the "wire" model), as opposed to modelId which is the well-known base.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub wire_model: Option<String>,
-}
+pub struct PermissionsPathsListRequest {}
 
-/// Short-lived, rotating credential the caller must send on every request, in addition to `apiKey` if one is present. Omitted when the endpoint does not require one.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -11948,20 +12021,12 @@ pub struct ProviderConfig {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ProviderSessionToken {
-    /// When the token expires, if known. Callers should refresh by calling `getEndpoint` again before this time, or reactively on any 401/403 response from `baseUrl`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub expires_at: Option<String>,
-    /// HTTP header name the token must be sent under.
-    pub header: String,
-    /// The model the token is bound to, when applicable. When set, the token is only valid for requests against this model.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub model: Option<String>,
-    /// The short-lived token value.
-    pub token: String,
+pub struct PermissionsPathsUpdatePrimaryResult {
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// A snapshot of the provider endpoint the session is currently configured to talk to.
+/// No parameters; returns currently-pending permission requests for the session.
 ///
 /// <div class="warning">
 ///
@@ -11971,28 +12036,9 @@ pub struct ProviderSessionToken {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ProviderEndpoint {
-    /// A credential the caller should use with this endpoint. Omitted only when the endpoint accepts unauthenticated requests.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub api_key: Option<String>,
-    /// Base URL to pass to the LLM client library.
-    pub base_url: String,
-    /// HTTP headers the caller must include on every outbound request.
-    pub headers: HashMap<String, String>,
-    /// Short-lived, rotating credential the caller must send on every request, in addition to `apiKey` if one is present. Omitted when the endpoint does not require one.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub session_token: Option<ProviderSessionToken>,
-    /// Transport to be used for provider requests.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub transport: Option<ProviderEndpointTransport>,
-    /// Provider family. Matches the `type` field of a BYOK provider config.
-    pub r#type: ProviderEndpointType,
-    /// Wire API to be used, when required for the provider type.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub wire_api: Option<ProviderEndpointWireApi>,
-}
+pub struct PermissionsPendingRequestsRequest {}
 
-/// Optional model identifier to scope the endpoint snapshot to.
+/// Clears session-scoped tool permission approvals, and optionally the location-scoped ones.
 ///
 /// <div class="warning">
 ///
@@ -12002,13 +12048,13 @@ pub struct ProviderEndpoint {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ProviderGetEndpointRequest {
-    /// Model identifier the caller intends to use against the returned endpoint. Used to pick the correct wire shape. Omit to use whichever model the session is currently using.
+pub struct PermissionsResetSessionApprovalsRequest {
+    /// Whether location-scoped approvals are cleared too. Defaults to `true`.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub model_id: Option<String>,
+    pub include_location: Option<bool>,
 }
 
-/// Asks the SDK client to acquire a bearer token for a BYOK provider whose config set `hasBearerTokenProvider: true`. Issued by the runtime before each outbound model request; the runtime does no caching, so this is sent once per request.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -12018,14 +12064,12 @@ pub struct ProviderGetEndpointRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ProviderTokenAcquireRequest {
-    /// Target session identifier
-    pub session_id: SessionId,
-    /// Name of the BYOK provider needing a token. For the legacy whole-session provider this is the implicit provider name; for named providers it is the configured provider name.
-    pub provider_name: String,
+pub struct PermissionsResetSessionApprovalsResult {
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// A bearer token supplied by the SDK client for a BYOK provider. The runtime sets it as `Authorization: Bearer <token>` on the outbound request and does no caching; the SDK consumer owns token caching and refresh.
+/// Allow-all toggle for tool permission requests, with an optional telemetry source.
 ///
 /// <div class="warning">
 ///
@@ -12035,12 +12079,15 @@ pub struct ProviderTokenAcquireRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ProviderTokenAcquireResult {
-    /// The bearer token value (without the `Bearer ` prefix).
-    pub token: String,
+pub struct PermissionsSetApproveAllRequest {
+    /// Whether to auto-approve all tool permission requests
+    pub enabled: bool,
+    /// Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source: Option<PermissionsSetApproveAllSource>,
 }
 
-/// Blob attachment with inline base64-encoded data
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -12050,19 +12097,12 @@ pub struct ProviderTokenAcquireResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PushAttachmentBlob {
-    /// Base64-encoded content
-    pub data: String,
-    /// User-facing display name for the attachment
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub display_name: Option<String>,
-    /// MIME type of the inline data
-    pub mime_type: String,
-    /// Attachment type discriminator
-    pub r#type: PushAttachmentBlobType,
+pub struct PermissionsSetApproveAllResult {
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// Directory attachment
+/// Permission mode to apply for the session.
 ///
 /// <div class="warning">
 ///
@@ -12072,16 +12112,18 @@ pub struct PushAttachmentBlob {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PushAttachmentDirectory {
-    /// User-facing display name for the attachment
-    pub display_name: String,
-    /// Absolute directory path
-    pub path: String,
-    /// Attachment type discriminator
-    pub r#type: PushAttachmentDirectoryType,
+pub struct PermissionsSetModeRequest {
+    /// Optional judge model id for assisted mode. When omitted, the session resolves the provider default: `gpt-5.5` for CAPI sessions and the active session model for BYOK sessions.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub assisted_approval_model: Option<String>,
+    /// Permission mode to apply
+    pub mode: PermissionMode,
+    /// Optional source for permission-mode telemetry. Defaults to `rpc` when omitted for SDK callers.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source: Option<PermissionModeSource>,
 }
 
-/// Optional line range to scope the attachment to a specific section of the file
+/// Indicates whether the requested permission mode was applied and reports the authoritative post-mutation mode.
 ///
 /// <div class="warning">
 ///
@@ -12091,14 +12133,14 @@ pub struct PushAttachmentDirectory {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PushAttachmentFileLineRange {
-    /// End line number (1-based, inclusive)
-    pub end: i64,
-    /// Start line number (1-based)
-    pub start: i64,
+pub struct PermissionsSetModeResult {
+    /// Authoritative permission mode after the mutation
+    pub mode: PermissionMode,
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// File attachment
+/// Toggles whether permission prompts should be bridged into session events for this client.
 ///
 /// <div class="warning">
 ///
@@ -12108,19 +12150,12 @@ pub struct PushAttachmentFileLineRange {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PushAttachmentFile {
-    /// User-facing display name for the attachment
-    pub display_name: String,
-    /// Optional line range to scope the attachment to a specific section of the file
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub line_range: Option<PushAttachmentFileLineRange>,
-    /// Absolute file path
-    pub path: String,
-    /// Attachment type discriminator
-    pub r#type: PushAttachmentFileType,
+pub struct PermissionsSetRequiredRequest {
+    /// Whether the client wants `permission.requested` events bridged from the session-owned permission service. CLI clients that render prompt UI set this to `true` for as long as their listener is mounted; headless callers leave it unset (the default is `false`).
+    pub required: bool,
 }
 
-/// Pointer to a GitHub repository.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -12130,17 +12165,12 @@ pub struct PushAttachmentFile {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PushGitHubRepoRef {
-    /// Numeric GitHub repository id
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub id: Option<i64>,
-    /// Repository name (without owner)
-    pub name: String,
-    /// Repository owner login (user or organization)
-    pub owner: String,
+pub struct PermissionsSetRequiredResult {
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// Pointer to a GitHub Actions job.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -12150,25 +12180,12 @@ pub struct PushGitHubRepoRef {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PushAttachmentGitHubActionsJob {
-    /// Terminal conclusion of the job when finished (e.g., success, failure, cancelled). Absent for in-progress jobs.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub conclusion: Option<String>,
-    /// Job id within the workflow run
-    pub job_id: i64,
-    /// Display name of the job
-    pub job_name: String,
-    /// Repository the workflow run belongs to
-    pub repo: PushGitHubRepoRef,
-    /// Attachment type discriminator
-    pub r#type: PushAttachmentGitHubActionsJobType,
-    /// URL to the job on GitHub
-    pub url: String,
-    /// Display name of the workflow the job ran in
-    pub workflow_name: String,
+pub struct PermissionsUrlsSetUnrestrictedModeResult {
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// Pointer to a GitHub commit.
+/// Whether the URL-permission policy should run in unrestricted mode.
 ///
 /// <div class="warning">
 ///
@@ -12178,20 +12195,12 @@ pub struct PushAttachmentGitHubActionsJob {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PushAttachmentGitHubCommit {
-    /// First line of the commit message
-    pub message: String,
-    /// Full commit SHA
-    pub oid: String,
-    /// Repository the commit belongs to
-    pub repo: PushGitHubRepoRef,
-    /// Attachment type discriminator
-    pub r#type: PushAttachmentGitHubCommitType,
-    /// URL to the commit on GitHub
-    pub url: String,
+pub struct PermissionUrlsSetUnrestrictedModeParams {
+    /// Whether to allow access to all URLs without prompting. Toggles the runtime's URL-permission policy in place.
+    pub enabled: bool,
 }
 
-/// Pointer to a file in a GitHub repository at a specific ref.
+/// Optional message to echo back to the caller.
 ///
 /// <div class="warning">
 ///
@@ -12201,20 +12210,13 @@ pub struct PushAttachmentGitHubCommit {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PushAttachmentGitHubFile {
-    /// Repository-relative path to the file
-    pub path: String,
-    /// Git ref the file is read at (branch, tag, or commit SHA)
-    pub r#ref: String,
-    /// Repository the file lives in
-    pub repo: PushGitHubRepoRef,
-    /// Attachment type discriminator
-    pub r#type: PushAttachmentGitHubFileType,
-    /// URL to the file on GitHub
-    pub url: String,
+pub struct PingRequest {
+    /// Optional message to echo back
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub message: Option<String>,
 }
 
-/// One side of a file diff (head or base)
+/// Server liveness response, including the echoed message, current server timestamp, and protocol version.
 ///
 /// <div class="warning">
 ///
@@ -12224,16 +12226,16 @@ pub struct PushAttachmentGitHubFile {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PushAttachmentGitHubFileDiffSide {
-    /// Repository-relative path to the file
-    pub path: String,
-    /// Git ref (branch, tag, or commit SHA) the file is read at
-    pub r#ref: String,
-    /// Repository the file lives in
-    pub repo: PushGitHubRepoRef,
+pub struct PingResult {
+    /// Echoed message (or default greeting)
+    pub message: String,
+    /// Server protocol version number
+    pub protocol_version: i64,
+    /// ISO 8601 timestamp when the server handled the ping
+    pub timestamp: String,
 }
 
-/// Pointer to a single-file diff. At least one of `head` and `base` must be present.
+/// Existence, contents, and resolved path of the session plan file.
 ///
 /// <div class="warning">
 ///
@@ -12243,20 +12245,16 @@ pub struct PushAttachmentGitHubFileDiffSide {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PushAttachmentGitHubFileDiff {
-    /// File location on the base side of the diff. Absent for additions.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub base: Option<PushAttachmentGitHubFileDiffSide>,
-    /// File location on the head side of the diff. Absent for deletions.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub head: Option<PushAttachmentGitHubFileDiffSide>,
-    /// Attachment type discriminator
-    pub r#type: PushAttachmentGitHubFileDiffType,
-    /// URL to the diff on GitHub (e.g., a commit, compare, or PR-file URL)
-    pub url: String,
+pub struct PlanReadResult {
+    /// The content of the plan file, or null if it does not exist
+    pub content: Option<String>,
+    /// Whether the plan file exists in the workspace
+    pub exists: bool,
+    /// Absolute file path of the plan file, or null if workspace is not enabled
+    pub path: Option<String>,
 }
 
-/// GitHub issue, pull request, or discussion reference
+/// A single todo row read from the session SQL `todos` table. All fields are optional because the SQL schema is best-effort and the agent may not have populated every column.
 ///
 /// <div class="warning">
 ///
@@ -12266,45 +12264,25 @@ pub struct PushAttachmentGitHubFileDiff {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PushAttachmentGitHubReference {
-    /// Issue, pull request, or discussion number
-    pub number: i64,
-    /// Type of GitHub reference
-    pub reference_type: PushAttachmentGitHubReferenceType,
-    /// Current state of the referenced item (e.g., open, closed, merged)
-    pub state: String,
-    /// Title of the referenced item
-    pub title: String,
-    /// Attachment type discriminator
-    pub r#type: PushAttachmentGitHubReferenceType,
-    /// URL to the referenced item on GitHub
-    pub url: String,
-}
-
-/// Pointer to a GitHub release.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct PushAttachmentGitHubRelease {
-    /// Human-readable release name
-    pub name: String,
-    /// Repository the release belongs to
-    pub repo: PushGitHubRepoRef,
-    /// Git tag the release is anchored to
-    pub tag_name: String,
-    /// Attachment type discriminator
-    pub r#type: PushAttachmentGitHubReleaseType,
-    /// URL to the release on GitHub
-    pub url: String,
+pub struct PlanSqlTodosRow {
+    /// Todo creation time, as stored by the session SQL schema's `datetime('now')` default: `YYYY-MM-DD HH:MM:SS` in UTC. Lets clients attribute todos to the work item that created them (e.g. scoping a goal's progress to the todos it produced) rather than to the whole session.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub created_at: Option<String>,
+    /// Todo description.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// Todo identifier.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub id: Option<String>,
+    /// Todo status.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status: Option<String>,
+    /// Todo title.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub title: Option<String>,
 }
 
-/// Pointer to a GitHub repository.
+/// Todo rows read from the session SQL database. Empty when no session database is available.
 ///
 /// <div class="warning">
 ///
@@ -12314,22 +12292,12 @@ pub struct PushAttachmentGitHubRelease {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PushAttachmentGitHubRepository {
-    /// Short description of the repository
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    /// Git ref this attachment is anchored at (branch, tag, or commit). When absent the default branch is implied.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub r#ref: Option<String>,
-    /// Repository pointer
-    pub repo: PushGitHubRepoRef,
-    /// Attachment type discriminator
-    pub r#type: PushAttachmentGitHubRepositoryType,
-    /// URL to the repository on GitHub
-    pub url: String,
+pub struct PlanReadSqlTodosResult {
+    /// Rows from the session SQL todos table, ordered by creation time with insertion order used to break ties when available and id used for WITHOUT ROWID tables.
+    pub rows: Vec<PlanSqlTodosRow>,
 }
 
-/// Pointer to a line range inside a file in a GitHub repository.
+/// A single dependency edge read from the session SQL `todo_deps` table, indicating that one todo must complete before another.
 ///
 /// <div class="warning">
 ///
@@ -12339,22 +12307,14 @@ pub struct PushAttachmentGitHubRepository {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PushAttachmentGitHubSnippet {
-    /// Line range the snippet covers
-    pub line_range: PushAttachmentFileLineRange,
-    /// Repository-relative path to the file
-    pub path: String,
-    /// Git ref the file is read at (branch, tag, or commit SHA)
-    pub r#ref: String,
-    /// Repository the file lives in
-    pub repo: PushGitHubRepoRef,
-    /// Attachment type discriminator
-    pub r#type: PushAttachmentGitHubSnippetType,
-    /// URL to the snippet on GitHub (with line anchor)
-    pub url: String,
+pub struct PlanSqlTodoDependency {
+    /// ID of the todo it depends on.
+    pub depends_on: String,
+    /// ID of the todo that has the dependency.
+    pub todo_id: String,
 }
 
-/// One side of a tree comparison (head or base)
+/// Todo rows + dependency edges read from the session SQL database.
 ///
 /// <div class="warning">
 ///
@@ -12364,14 +12324,14 @@ pub struct PushAttachmentGitHubSnippet {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PushAttachmentGitHubTreeComparisonSide {
-    /// Repository the revision belongs to
-    pub repo: PushGitHubRepoRef,
-    /// Git revision (branch, tag, or commit SHA)
-    pub revision: String,
+pub struct PlanReadSqlTodosWithDependenciesResult {
+    /// Edges from the session SQL todo_deps table. Empty when no database, no todo_deps table, or the SELECT failed. Read independently from `rows`, so a broken todo_deps table does not affect the rows result and vice versa.
+    pub dependencies: Vec<PlanSqlTodoDependency>,
+    /// Rows from the session SQL todos table, ordered by creation time with insertion order used to break ties when available and id used for WITHOUT ROWID tables. Empty when no database, no todos table, or the SELECT failed.
+    pub rows: Vec<PlanSqlTodosRow>,
 }
 
-/// Pointer to a comparison between two git revisions.
+/// Replacement contents to write to the session plan file.
 ///
 /// <div class="warning">
 ///
@@ -12381,18 +12341,12 @@ pub struct PushAttachmentGitHubTreeComparisonSide {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PushAttachmentGitHubTreeComparison {
-    /// Base side of the comparison
-    pub base: PushAttachmentGitHubTreeComparisonSide,
-    /// Head side of the comparison
-    pub head: PushAttachmentGitHubTreeComparisonSide,
-    /// Attachment type discriminator
-    pub r#type: PushAttachmentGitHubTreeComparisonType,
-    /// URL to the comparison on GitHub
-    pub url: String,
+pub struct PlanUpdateRequest {
+    /// The new content for the plan file
+    pub content: String,
 }
 
-/// Generic GitHub URL reference.
+/// Session plugin metadata, with name, marketplace, optional version, and enabled state.
 ///
 /// <div class="warning">
 ///
@@ -12402,14 +12356,19 @@ pub struct PushAttachmentGitHubTreeComparison {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PushAttachmentGitHubUrl {
-    /// Attachment type discriminator
-    pub r#type: PushAttachmentGitHubUrlType,
-    /// URL to the GitHub resource
-    pub url: String,
+pub struct Plugin {
+    /// Whether the plugin is currently enabled
+    pub enabled: bool,
+    /// Marketplace the plugin came from
+    pub marketplace: String,
+    /// Plugin name
+    pub name: String,
+    /// Installed version
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub version: Option<String>,
 }
 
-/// End position of the selection
+/// Result of installing a plugin.
 ///
 /// <div class="warning">
 ///
@@ -12419,14 +12378,20 @@ pub struct PushAttachmentGitHubUrl {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PushAttachmentSelectionDetailsEnd {
-    /// End character offset within the line (0-based)
-    pub character: i64,
-    /// End line number (0-based)
-    pub line: i64,
+pub struct PluginInstallResult {
+    /// Set when the install path is deprecated (e.g. direct repo / URL / local installs). Callers should surface this to end users.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub deprecation_warning: Option<String>,
+    /// The newly installed plugin's metadata
+    pub plugin: InstalledPluginInfo,
+    /// Optional post-install message provided by the plugin (e.g. setup instructions)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub post_install_message: Option<String>,
+    /// Number of skills discovered and installed from the plugin
+    pub skills_installed: i64,
 }
 
-/// Start position of the selection
+/// Plugins installed for the session, with their enabled state and version metadata.
 ///
 /// <div class="warning">
 ///
@@ -12436,14 +12401,12 @@ pub struct PushAttachmentSelectionDetailsEnd {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PushAttachmentSelectionDetailsStart {
-    /// Start character offset within the line (0-based)
-    pub character: i64,
-    /// Start line number (0-based)
-    pub line: i64,
+pub struct PluginList {
+    /// Installed plugins
+    pub plugins: Vec<Plugin>,
 }
 
-/// Position range of the selection within the file
+/// Plugins installed in user/global state.
 ///
 /// <div class="warning">
 ///
@@ -12453,14 +12416,12 @@ pub struct PushAttachmentSelectionDetailsStart {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PushAttachmentSelectionDetails {
-    /// End position of the selection
-    pub end: PushAttachmentSelectionDetailsEnd,
-    /// Start position of the selection
-    pub start: PushAttachmentSelectionDetailsStart,
+pub struct PluginListResult {
+    /// Installed plugins
+    pub plugins: Vec<InstalledPluginInfo>,
 }
 
-/// Code selection attachment from an editor
+/// Trusted built-in plugin directories to use for this runtime process.
 ///
 /// <div class="warning">
 ///
@@ -12470,20 +12431,12 @@ pub struct PushAttachmentSelectionDetails {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PushAttachmentSelection {
-    /// User-facing display name for the selection
-    pub display_name: String,
-    /// Absolute path to the file containing the selection
-    pub file_path: String,
-    /// Position range of the selection within the file
-    pub selection: PushAttachmentSelectionDetails,
-    /// The selected text content
-    pub text: String,
-    /// Attachment type discriminator
-    pub r#type: PushAttachmentSelectionType,
+pub struct PluginsBuiltinSetRequest {
+    /// Complete replacement set of trusted built-in plugin directories. Every entry must be an absolute local filesystem path no longer than 4096 characters.
+    pub paths: Vec<String>,
 }
 
-/// Inputs for starting a deferred-idle drain.
+/// Plugin names (or specs) to disable.
 ///
 /// <div class="warning">
 ///
@@ -12493,12 +12446,12 @@ pub struct PushAttachmentSelection {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueBeginDeferredIdleDrainRequest {
-    /// Whether the host still has active background work.
-    pub active_background_work: bool,
+pub struct PluginsDisableRequest {
+    /// Plugin names or "plugin@marketplace" specs to disable. Unknown names are ignored. Non-marketplace direct installs cannot be disabled via this API; uninstall them instead. Plugin-owned MCP servers are stopped in active sessions immediately; other plugin contributions remain available until each session reloads plugins.
+    pub names: Vec<String>,
 }
 
-/// Whether a deferred-idle drain should run.
+/// Plugin names (or specs) to enable.
 ///
 /// <div class="warning">
 ///
@@ -12508,12 +12461,12 @@ pub struct QueueBeginDeferredIdleDrainRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueBeginDeferredIdleDrainResult {
-    /// True when the host should run finishDeferredIdleDrain asynchronously.
-    pub should_drain: bool,
+pub struct PluginsEnableRequest {
+    /// Plugin names or "plugin@marketplace" specs to enable. Unknown names are ignored. Non-marketplace direct installs are always enabled and cannot be toggled via this API.
+    pub names: Vec<String>,
 }
 
-/// Internal filter for consuming queued system notifications.
+/// Plugin source and optional working directory for relative-path resolution.
 ///
 /// <div class="warning">
 ///
@@ -12523,12 +12476,15 @@ pub struct QueueBeginDeferredIdleDrainResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueConsumeSystemNotificationsRequest {
-    /// Opaque runtime-owned filter object.
-    pub filter: serde_json::Value,
+pub struct PluginsInstallRequest {
+    /// Plugin install spec. Accepts the same forms as the CLI: "plugin@marketplace" (marketplace install), "owner/repo" or "owner/repo:subpath" (GitHub direct), an http/https/ssh URL, or a local path. Direct (non-marketplace) installs are deprecated and will produce a deprecationWarning in the result.
+    pub source: String,
+    /// Working directory used to resolve relative local paths in `source`. Defaults to the server's current working directory.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub working_directory: Option<String>,
 }
 
-/// Queued-command response indicating the host executed the command, with an optional flag to stop queue processing.
+/// Marketplace source and optional working directory for relative-path resolution.
 ///
 /// <div class="warning">
 ///
@@ -12538,15 +12494,15 @@ pub struct QueueConsumeSystemNotificationsRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueuedCommandHandled {
-    /// The host actually executed the queued command.
-    pub handled: bool,
-    /// When true, the runtime will not process subsequent queued commands until a new request comes in.
+pub struct PluginsMarketplacesAddRequest {
+    /// Marketplace source. Accepts the same forms as the CLI: "owner/repo" or "owner/repo#ref" (GitHub), an http/https/ssh URL (optionally with #ref), a git scp-style URL (user@host:path), or a local path. The marketplace's own name (from its manifest) is used as the registration key.
+    pub source: String,
+    /// Working directory used to resolve relative local paths in `source`. Defaults to the server's current working directory.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub stop_processing_queue: Option<bool>,
+    pub working_directory: Option<String>,
 }
 
-/// Queued-command response indicating the host did not execute the command and the queue may continue.
+/// Name of the marketplace whose plugin catalog to fetch.
 ///
 /// <div class="warning">
 ///
@@ -12556,12 +12512,12 @@ pub struct QueuedCommandHandled {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueuedCommandNotHandled {
-    /// The host did not execute the queued command. Unblocks the queue without claiming the command was processed (e.g. when the handler threw before completing).
-    pub handled: bool,
+pub struct PluginsMarketplacesBrowseRequest {
+    /// Marketplace name to browse
+    pub name: String,
 }
 
-/// Inputs for marking session.idle deferred in native state.
+/// Optional marketplace name; omit to refresh all.
 ///
 /// <div class="warning">
 ///
@@ -12571,12 +12527,13 @@ pub struct QueuedCommandNotHandled {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueDeferSessionIdleRequest {
-    /// Whether the deferred idle was caused by an aborted foreground turn.
-    pub aborted: bool,
+pub struct PluginsMarketplacesRefreshRequest {
+    /// Marketplace name to refresh. When omitted, every registered marketplace is refreshed.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
 }
 
-/// Parameters for duplicating a queued item.
+/// Name of the marketplace to remove and an optional force flag.
 ///
 /// <div class="warning">
 ///
@@ -12586,12 +12543,15 @@ pub struct QueueDeferSessionIdleRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueDuplicateAtRequest {
-    /// Stable opaque ID of the queued item to duplicate.
-    pub id: String,
+pub struct PluginsMarketplacesRemoveRequest {
+    /// When true, also uninstall every plugin sourced from this marketplace. When false (default), removal is a no-op if any plugin from this marketplace is installed and the dependent plugin names are returned in the result.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub force: Option<bool>,
+    /// Marketplace name to remove
+    pub name: String,
 }
 
-/// Result of duplicating a queued item.
+/// Optional flags controlling which side effects the reload performs.
 ///
 /// <div class="warning">
 ///
@@ -12601,12 +12561,25 @@ pub struct QueueDuplicateAtRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueDuplicateAtResult {
-    /// Fresh stable opaque id assigned to the duplicate.
-    pub id: String,
+pub struct PluginsReloadRequest {
+    /// When true, skip repo-level hooks during the hook reload. Use before folder trust is confirmed; load them post-trust via `sessions.loadDeferredRepoHooks`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub defer_repo_hooks: Option<bool>,
+    /// Re-run custom-agent discovery after refreshing plugins. Defaults to true.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reload_custom_agents: Option<bool>,
+    /// Re-discover and relaunch subprocess extensions (including plugin-shipped extensions) after refreshing plugins. Defaults to true. Has no effect when the session has no active extension controller (e.g. extensions were not requested for the session).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reload_extensions: Option<bool>,
+    /// Re-load user, plugin, and (subject to `deferRepoHooks`) repo hooks. Defaults to true. Has no effect when the host has not registered a hook reloader (e.g. remote sessions).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reload_hooks: Option<bool>,
+    /// Reload MCP server connections after refreshing plugins. Defaults to true.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reload_mcp: Option<bool>,
 }
 
-/// Result of enqueueing the resume-pending wake item.
+/// Name (or spec) of the plugin to uninstall.
 ///
 /// <div class="warning">
 ///
@@ -12616,12 +12589,15 @@ pub struct QueueDuplicateAtResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueEnqueueResumePendingResult {
-    /// True when a wake item was newly queued.
-    pub queued: bool,
+pub struct PluginsUninstallRequest {
+    /// Stable source identity for a direct (non-marketplace) install. Disambiguates uninstall when multiple installed plugins share the same name.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub direct_source_id: Option<String>,
+    /// Plugin name or "plugin@marketplace" spec to uninstall. When ambiguous, prefer the fully-qualified spec.
+    pub name: String,
 }
 
-/// Inputs for completing a deferred-idle drain.
+/// Name (or spec) of the plugin to update.
 ///
 /// <div class="warning">
 ///
@@ -12631,14 +12607,12 @@ pub struct QueueEnqueueResumePendingResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueFinishDeferredIdleDrainRequest {
-    /// Whether the host still has active background work.
-    pub active_background_work: bool,
-    /// Whether native queued work remains.
-    pub has_pending: bool,
+pub struct PluginsUpdateRequest {
+    /// Plugin name or "plugin@marketplace" spec to update.
+    pub name: String,
 }
 
-/// Action selected by the native deferred-idle drain.
+/// Per-plugin result from updating all plugins, with versions, skills installed, success flag, and optional error.
 ///
 /// <div class="warning">
 ///
@@ -12648,14 +12622,28 @@ pub struct QueueFinishDeferredIdleDrainRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueFinishDeferredIdleDrainResult {
-    /// Whether the deferred idle was caused by an aborted foreground turn.
-    pub aborted: bool,
-    /// One of none, processQueue, or emitSessionIdle.
-    pub action: String,
+pub struct PluginUpdateAllEntry {
+    /// Error message (failure only)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// Marketplace the plugin came from. Empty string ("") for direct installs.
+    pub marketplace: String,
+    /// Plugin name that was updated
+    pub name: String,
+    /// Version after the update, when available
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub new_version: Option<String>,
+    /// Previously installed version, when available
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub previous_version: Option<String>,
+    /// Number of skills installed after the update (success only)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub skills_installed: Option<i64>,
+    /// Whether the update succeeded for this plugin
+    pub success: bool,
 }
 
-/// Whether the native queue has pending work.
+/// Result of updating all installed plugins.
 ///
 /// <div class="warning">
 ///
@@ -12665,12 +12653,12 @@ pub struct QueueFinishDeferredIdleDrainResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueHasPendingResult {
-    /// True when queued or immediate native work is pending.
-    pub has_pending: bool,
+pub struct PluginUpdateAllResult {
+    /// Per-plugin update results in deterministic order.
+    pub results: Vec<PluginUpdateAllEntry>,
 }
 
-/// Serializable message fields accepted by queue.insertAt.
+/// Result of updating a single plugin.
 ///
 /// <div class="warning">
 ///
@@ -12680,45 +12668,56 @@ pub struct QueueHasPendingResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueInsertMessage {
-    /// Optional explicit agent mode. When omitted, the session's current mode is assigned.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub agent_mode: Option<SendAgentMode>,
-    /// Optional attachments for the message.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub attachments: Option<Vec<serde_json::Value>>,
-    /// Whether the message is billable.
+pub struct PluginUpdateResult {
+    /// Version after the update, when reported by the plugin manifest
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub billable: Option<bool>,
-    /// Accepted for internal SendOptions compatibility but ignored; delivery is derived from current session activity.
+    pub new_version: Option<String>,
+    /// Version that was previously installed, when available
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub delivery: Option<String>,
-    /// Optional user-facing display text.
+    pub previous_version: Option<String>,
+    /// Number of skills discovered and installed after the update
+    pub skills_installed: i64,
+}
+
+/// Serializable definition of a caller-implemented tool whose execution is handled over the SDK connection.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ProtocolExternalToolDefinition {
+    /// Tool-loading deferral policy.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub display_prompt: Option<String>,
-    /// Accepted for SendOptions compatibility but ignored; inserted items always use queued delivery semantics.
+    pub defer: Option<ProtocolExternalToolDefer>,
+    /// Model-visible explanation of what the tool does.
+    pub description: String,
+    /// Whether the tool executes commands in a terminal.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub mode: Option<SendMode>,
-    /// Accepted for SendOptions compatibility but ignored; the requested public position controls placement.
+    pub is_terminal: Option<bool>,
+    /// Optional caller-defined metadata associated with the tool.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub prepend: Option<bool>,
-    /// The user message text.
-    pub prompt: String,
-    /// Per-turn request headers.
+    pub metadata: Option<HashMap<String, serde_json::Value>>,
+    /// Unique model-visible tool name.
+    pub name: String,
+    /// Whether this definition replaces a built-in tool with the same name.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub request_headers: Option<HashMap<String, String>>,
-    /// Required tool name for the turn, when any.
+    pub overrides_built_in_tool: Option<bool>,
+    /// JSON Schema describing the tool's input arguments.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub required_tool: Option<String>,
-    /// Optional provenance source. `system` is rejected: it would hide the inserted row from `pendingItems` and make it unaddressable while still executing, so inserted items must stay visible.
+    pub parameters: Option<HashMap<String, serde_json::Value>>,
+    /// Whether execution bypasses the normal tool permission prompt.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub source: Option<String>,
-    /// Accepted for SendOptions compatibility but ignored; insertion scheduling is controlled by the queue drain state.
+    pub skip_permission: Option<bool>,
+    /// Optional human-readable display title.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub wait: Option<bool>,
+    pub title: Option<String>,
 }
 
-/// Parameters for inserting a queued message at a public visible position.
+/// A BYOK model definition referencing a named provider.
 ///
 /// <div class="warning">
 ///
@@ -12728,14 +12727,35 @@ pub struct QueueInsertMessage {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueInsertAtRequest {
-    /// Queued message contents and delivery metadata.
-    pub message: QueueInsertMessage,
-    /// Zero-based position in the public visible queue. Values outside the queue clamp to an end.
-    pub position: i64,
+pub struct ProviderModelConfig {
+    /// Optional capability overrides (vision, tool_calls, reasoning, etc.).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub capabilities: Option<ModelCapabilitiesOverride>,
+    /// Provider-local model id, unique within its provider. The session-wide selection id (shown in the model list and passed to switchTo) is the provider-qualified `provider/id`.
+    pub id: String,
+    /// Maximum context window tokens for the model.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_context_window_tokens: Option<i64>,
+    /// Maximum output tokens for the model.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_output_tokens: Option<i64>,
+    /// Maximum prompt/input tokens for the model.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_prompt_tokens: Option<i64>,
+    /// Well-known base model id used for behavior/capability/config lookup. Defaults to `id`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_id: Option<String>,
+    /// Display name for model pickers. Defaults to the provider-qualified selection id (`provider/id`).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    /// Name of the configured provider that serves this model.
+    pub provider: String,
+    /// The model name sent to the provider API for inference. Defaults to `id`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub wire_model: Option<String>,
 }
 
-/// Result of inserting a queued message.
+/// BYOK providers and/or models to add to the session's registry at runtime. Both fields are optional; provide providers, models, or both.
 ///
 /// <div class="warning">
 ///
@@ -12745,12 +12765,16 @@ pub struct QueueInsertAtRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueInsertAtResult {
-    /// Fresh stable opaque id assigned to the inserted item.
-    pub id: String,
+pub struct ProviderAddRequest {
+    /// BYOK model definitions to register. Each must reference a provider that is already registered or included in this same call. Selection ids (`provider/id`) must be unique across the registry.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub models: Option<Vec<ProviderModelConfig>>,
+    /// Named BYOK provider connections to register, additive to any providers already in the registry. Each name must be unique across the registry and must not contain '/'.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub providers: Option<Vec<NamedProviderConfig>>,
 }
 
-/// Parameters for moving a queued item by stable id.
+/// The selectable model entries synthesized for the models added by this call.
 ///
 /// <div class="warning">
 ///
@@ -12760,14 +12784,12 @@ pub struct QueueInsertAtResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueMoveItemRequest {
-    /// Stable opaque queued-item id.
-    pub id: String,
-    /// Zero-based target position in the public visible queue. Values outside the queue clamp to an end.
-    pub to_position: i64,
+pub struct ProviderAddResult {
+    /// Synthesized selectable model entries for the newly added BYOK models, each under its provider-qualified selection id (`provider/id`). Empty when only providers were added.
+    pub models: Vec<serde_json::Value>,
 }
 
-/// Result of moving a queued item.
+/// Custom model-provider configuration (BYOK).
 ///
 /// <div class="warning">
 ///
@@ -12777,12 +12799,57 @@ pub struct QueueMoveItemRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueMoveItemResult {
-    /// True when the item changed position; false when it was already at the requested position.
-    pub changed: bool,
+pub struct ProviderConfig {
+    /// API key. Optional for local providers like Ollama.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub api_key: Option<String>,
+    /// Azure-specific provider options.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub azure: Option<ProviderConfigAzure>,
+    /// API endpoint URL.
+    pub base_url: String,
+    /// Bearer token for authentication. Sets the Authorization header directly. Takes precedence over apiKey when both are set.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub bearer_token: Option<String>,
+    /// When true, the SDK client supplies bearer tokens on demand: the runtime calls the client-session `providerToken.getToken` callback before each request and applies the returned token as an `Authorization: Bearer <token>` header. This is the bearer/OAuth scheme used by Azure AD / managed-identity tokens and provider OAuth access tokens (including Anthropic's), not a provider-specific API-key header such as Anthropic's `x-api-key`. The token-acquiring function itself stays on the SDK side and is never serialized; only this flag crosses the wire. When set alongside `apiKey`/`bearerToken`, the callback takes precedence: the runtime applies the token returned by `providerToken.getToken` as the `Authorization: Bearer` header for each request and does not send the static credential.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub has_bearer_token_provider: Option<bool>,
+    /// Custom HTTP headers to include in all outbound requests to the provider.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub headers: Option<HashMap<String, String>>,
+    /// Maximum context window tokens for the model.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_context_window_tokens: Option<f64>,
+    /// Maximum output tokens for the model.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_output_tokens: Option<f64>,
+    /// Maximum prompt/input tokens for the model.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_prompt_tokens: Option<f64>,
+    /// Overrides for model capabilities when they cannot be inferred from modelId.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_capabilities: Option<ModelCapabilitiesOverride>,
+    /// Well-known model ID used for capability lookup. When set, agent behavior config and token limits are inferred from this model.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_id: Option<String>,
+    /// Provider name used for model and telemetry attribution.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub provider_name: Option<String>,
+    /// Provider transport. Defaults to "http".
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub transport: Option<ProviderConfigTransport>,
+    /// Provider type. Defaults to "openai" for generic OpenAI-compatible APIs.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub r#type: Option<ProviderConfigType>,
+    /// Wire API format (openai/azure only). Defaults to "completions".
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub wire_api: Option<ProviderConfigWireApi>,
+    /// The model identifier sent to the provider API for inference (the "wire" model), as opposed to modelId which is the well-known base.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub wire_model: Option<String>,
 }
 
-/// User-facing pending queue entry, with kind and display text for a queued message, slash command, or model change.
+/// Short-lived, rotating credential the caller must send on every request, in addition to `apiKey` if one is present. Omitted when the endpoint does not require one.
 ///
 /// <div class="warning">
 ///
@@ -12792,18 +12859,20 @@ pub struct QueueMoveItemResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueuePendingItems {
-    /// Agent mode stored on this queued entry, as stamped when it was enqueued. Items without an explicit mode report interactive. This is not necessarily the mode that will constrain the turn: a plan or autopilot session applies its own write gate, continuation loop and permission posture to every drained item regardless of the mode stored here.
-    pub agent_mode: SendAgentMode,
-    /// Human-readable text to display for this queue entry in the UI
-    pub display_text: String,
-    /// Stable opaque id for the canonical queued item. Batch rows share one id.
-    pub id: String,
-    /// Whether this item is a queued user message or a queued slash command / model change
-    pub kind: QueuePendingItemsKind,
+pub struct ProviderSessionToken {
+    /// When the token expires, if known. Callers should refresh by calling `getEndpoint` again before this time, or reactively on any 401/403 response from `baseUrl`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub expires_at: Option<String>,
+    /// HTTP header name the token must be sent under.
+    pub header: String,
+    /// The model the token is bound to, when applicable. When set, the token is only valid for requests against this model.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model: Option<String>,
+    /// The short-lived token value.
+    pub token: String,
 }
 
-/// Snapshot of the session's pending queued items and immediate-steering messages.
+/// A snapshot of the provider endpoint the session is currently configured to talk to.
 ///
 /// <div class="warning">
 ///
@@ -12813,14 +12882,28 @@ pub struct QueuePendingItems {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueuePendingItemsResult {
-    /// Pending queued items in submission order. Includes user messages, queued slash commands, and queued model changes; omits internal system items.
-    pub items: Vec<QueuePendingItems>,
-    /// Display text for messages currently in the immediate steering queue (interjections sent during a running turn).
-    pub steering_messages: Vec<String>,
+pub struct ProviderEndpoint {
+    /// A credential the caller should use with this endpoint. Omitted only when the endpoint accepts unauthenticated requests.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub api_key: Option<String>,
+    /// Base URL to pass to the LLM client library.
+    pub base_url: String,
+    /// HTTP headers the caller must include on every outbound request.
+    pub headers: HashMap<String, String>,
+    /// Short-lived, rotating credential the caller must send on every request, in addition to `apiKey` if one is present. Omitted when the endpoint does not require one.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub session_token: Option<ProviderSessionToken>,
+    /// Transport to be used for provider requests.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub transport: Option<ProviderEndpointTransport>,
+    /// Provider family. Matches the `type` field of a BYOK provider config.
+    pub r#type: ProviderEndpointType,
+    /// Wire API to be used, when required for the provider type.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub wire_api: Option<ProviderEndpointWireApi>,
 }
 
-/// Parameters for removing a queued item by stable id.
+/// Optional model identifier to scope the endpoint snapshot to.
 ///
 /// <div class="warning">
 ///
@@ -12830,12 +12913,13 @@ pub struct QueuePendingItemsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueRemoveAtRequest {
-    /// Stable opaque ID of the queued item to remove.
-    pub id: String,
+pub struct ProviderGetEndpointRequest {
+    /// Model identifier the caller intends to use against the returned endpoint. Used to pick the correct wire shape. Omit to use whichever model the session is currently using.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_id: Option<String>,
 }
 
-/// Result of removing a queued item.
+/// Asks the SDK client to acquire a bearer token for a BYOK provider whose config set `hasBearerTokenProvider: true`. Issued by the runtime before each outbound model request; the runtime does no caching, so this is sent once per request.
 ///
 /// <div class="warning">
 ///
@@ -12845,12 +12929,14 @@ pub struct QueueRemoveAtRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueRemoveAtResult {
-    /// True when the addressed item was removed.
-    pub removed: bool,
+pub struct ProviderTokenAcquireRequest {
+    /// Target session identifier
+    pub session_id: SessionId,
+    /// Name of the BYOK provider needing a token. For the legacy whole-session provider this is the implicit provider name; for named providers it is the configured provider name.
+    pub provider_name: String,
 }
 
-/// Indicates whether a user-facing pending item was removed.
+/// A bearer token supplied by the SDK client for a BYOK provider. The runtime sets it as `Authorization: Bearer <token>` on the outbound request and does no caching; the SDK consumer owns token caching and refresh.
 ///
 /// <div class="warning">
 ///
@@ -12860,12 +12946,12 @@ pub struct QueueRemoveAtResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueRemoveMostRecentResult {
-    /// True if a user-facing pending item was removed (LIFO across both queues); false when no removable items remained.
-    pub removed: bool,
+pub struct ProviderTokenAcquireResult {
+    /// The bearer token value (without the `Bearer ` prefix).
+    pub token: String,
 }
 
-/// Parameters for steering a queued message into a live turn.
+/// Blob attachment with inline base64-encoded data
 ///
 /// <div class="warning">
 ///
@@ -12875,12 +12961,19 @@ pub struct QueueRemoveMostRecentResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueSendNowRequest {
-    /// Stable opaque ID of the queued item to steer into the live turn.
-    pub id: String,
+pub struct PushAttachmentBlob {
+    /// Base64-encoded content
+    pub data: String,
+    /// User-facing display name for the attachment
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub display_name: Option<String>,
+    /// MIME type of the inline data
+    pub mime_type: String,
+    /// Attachment type discriminator
+    pub r#type: PushAttachmentBlobType,
 }
 
-/// Result of trying to steer a queued message into a live turn.
+/// Directory attachment
 ///
 /// <div class="warning">
 ///
@@ -12890,12 +12983,16 @@ pub struct QueueSendNowRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueSendNowResult {
-    /// True when the item was accepted into the steering lane; false when no main turn was live.
-    pub steered: bool,
+pub struct PushAttachmentDirectory {
+    /// User-facing display name for the attachment
+    pub display_name: String,
+    /// Absolute directory path
+    pub path: String,
+    /// Attachment type discriminator
+    pub r#type: PushAttachmentDirectoryType,
 }
 
-/// Parameters for acquiring or releasing the queued-lane drain pause. Acquisition is exclusive and non-idempotent: `paused: true` against an already-paused session fails with `queue_already_paused`. The pause is never released automatically — it is not tied to the caller's lifetime, so a client that exits without sending `paused: false` leaves the lane frozen. Release is unowned: `paused: false` clears the pause for any caller, including one that never acquired it.
+/// Optional line range to scope the attachment to a specific section of the file
 ///
 /// <div class="warning">
 ///
@@ -12905,12 +13002,14 @@ pub struct QueueSendNowResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueSetDrainPausedRequest {
-    /// Whether queued-lane draining should be paused.
-    pub paused: bool,
+pub struct PushAttachmentFileLineRange {
+    /// End line number (1-based, inclusive)
+    pub end: i64,
+    /// Start line number (1-based)
+    pub start: i64,
 }
 
-/// Internal snapshot of native queue state for local session orchestration.
+/// File attachment
 ///
 /// <div class="warning">
 ///
@@ -12920,20 +13019,19 @@ pub struct QueueSetDrainPausedRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueSnapshotResult {
-    /// Insertion orders for queued items, aligned with `items`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub item_orders: Option<Vec<i64>>,
-    /// User-facing pending items in FIFO order.
-    pub items: Vec<QueuePendingItems>,
-    /// Insertion orders for immediate steering messages, aligned with `steeringMessages`.
+pub struct PushAttachmentFile {
+    /// User-facing display name for the attachment
+    pub display_name: String,
+    /// Optional line range to scope the attachment to a specific section of the file
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub steering_message_orders: Option<Vec<i64>>,
-    /// Immediate steering messages waiting for an active turn.
-    pub steering_messages: Vec<String>,
+    pub line_range: Option<PushAttachmentFileLineRange>,
+    /// Absolute file path
+    pub path: String,
+    /// Attachment type discriminator
+    pub r#type: PushAttachmentFileType,
 }
 
-/// Parameters for editing a single queued message.
+/// Pointer to a GitHub repository.
 ///
 /// <div class="warning">
 ///
@@ -12943,17 +13041,17 @@ pub struct QueueSnapshotResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueUpdateTextRequest {
-    /// Optional replacement prompt displayed to the user.
+pub struct PushGitHubRepoRef {
+    /// Numeric GitHub repository id
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub display_prompt: Option<String>,
-    /// Stable opaque ID of the queued item to edit.
-    pub id: String,
-    /// Replacement prompt sent to the model.
-    pub prompt: String,
+    pub id: Option<i64>,
+    /// Repository name (without owner)
+    pub name: String,
+    /// Repository owner login (user or organization)
+    pub owner: String,
 }
 
-/// Result of editing a queued message.
+/// Pointer to a GitHub Actions job.
 ///
 /// <div class="warning">
 ///
@@ -12963,12 +13061,25 @@ pub struct QueueUpdateTextRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct QueueUpdateTextResult {
-    /// True when the stored text changed.
-    pub updated: bool,
+pub struct PushAttachmentGitHubActionsJob {
+    /// Terminal conclusion of the job when finished (e.g., success, failure, cancelled). Absent for in-progress jobs.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub conclusion: Option<String>,
+    /// Job id within the workflow run
+    pub job_id: i64,
+    /// Display name of the job
+    pub job_name: String,
+    /// Repository the workflow run belongs to
+    pub repo: PushGitHubRepoRef,
+    /// Attachment type discriminator
+    pub r#type: PushAttachmentGitHubActionsJobType,
+    /// URL to the job on GitHub
+    pub url: String,
+    /// Display name of the workflow the job ran in
+    pub workflow_name: String,
 }
 
-/// Event type to register consumer interest for, used by runtime gating logic.
+/// Pointer to a GitHub commit.
 ///
 /// <div class="warning">
 ///
@@ -12978,12 +13089,20 @@ pub struct QueueUpdateTextResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct RegisterEventInterestParams {
-    /// The event type the consumer wants the runtime to treat as 'observed' for behavior-switching gating. Some runtime code paths inspect whether any consumer is interested in a specific event type and choose a different implementation accordingly (e.g. `mcp.oauth_required`: when interest is registered the runtime delegates interactive OAuth token acquisition to the consumer via `mcp.oauth_required` events; when no interest is registered the runtime still attempts non-interactive reconnect from cached or refreshable tokens, and only marks the server `needs-auth` if usable credentials are unavailable — it does not open a browser or start interactive OAuth without a consumer). SDK clients that long-poll events do NOT automatically appear as listeners to these gating checks — they must explicitly call `registerInterest` for each event type they want the runtime to count as having a consumer. Multiple registrations for the same event type from the same or different consumers are tracked independently and must each be released. See: `mcp.oauth_required`, `sampling.requested`, `auto_mode_switch.requested`, `session_limits_exhausted.requested`, `user_input.requested`, `elicitation.requested`, `command.queued`, `exit_plan_mode.requested`.
-    pub event_type: String,
+pub struct PushAttachmentGitHubCommit {
+    /// First line of the commit message
+    pub message: String,
+    /// Full commit SHA
+    pub oid: String,
+    /// Repository the commit belongs to
+    pub repo: PushGitHubRepoRef,
+    /// Attachment type discriminator
+    pub r#type: PushAttachmentGitHubCommitType,
+    /// URL to the commit on GitHub
+    pub url: String,
 }
 
-/// Opaque handle representing an event-type interest registration.
+/// Pointer to a file in a GitHub repository at a specific ref.
 ///
 /// <div class="warning">
 ///
@@ -12993,12 +13112,20 @@ pub struct RegisterEventInterestParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct RegisterEventInterestResult {
-    /// Opaque handle for this registration. Pass to releaseInterest to release. Each call to registerInterest produces a fresh handle, even when the same eventType is registered multiple times.
-    pub handle: String,
+pub struct PushAttachmentGitHubFile {
+    /// Repository-relative path to the file
+    pub path: String,
+    /// Git ref the file is read at (branch, tag, or commit SHA)
+    pub r#ref: String,
+    /// Repository the file lives in
+    pub repo: PushGitHubRepoRef,
+    /// Attachment type discriminator
+    pub r#type: PushAttachmentGitHubFileType,
+    /// URL to the file on GitHub
+    pub url: String,
 }
 
-/// Optional registration options.
+/// One side of a file diff (head or base)
 ///
 /// <div class="warning">
 ///
@@ -13008,14 +13135,16 @@ pub struct RegisterEventInterestResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsRegisterExtensionToolsOnSessionOptions {
-    /// In-process `() => boolean` gating callback (CLI-only optimization). Marked internal: replaced by runtime-side enable/disable RPCs in the SDK migration.
-    #[doc(hidden)]
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub(crate) enabled: Option<serde_json::Value>,
+pub struct PushAttachmentGitHubFileDiffSide {
+    /// Repository-relative path to the file
+    pub path: String,
+    /// Git ref (branch, tag, or commit SHA) the file is read at
+    pub r#ref: String,
+    /// Repository the file lives in
+    pub repo: PushGitHubRepoRef,
 }
 
-/// Params to attach an extension loader's tools to a session.
+/// Pointer to a single-file diff. At least one of `head` and `base` must be present.
 ///
 /// <div class="warning">
 ///
@@ -13025,18 +13154,20 @@ pub struct SessionsRegisterExtensionToolsOnSessionOptions {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub(crate) struct RegisterExtensionToolsParams {
-    /// In-process ExtensionLoader handle (CLI-only optimization). Marked internal: this field is excluded from the public SDK surface. When the CLI migrates to a process-separated SDK, extension discovery/launch moves entirely into the runtime — the CLI passes pure config (search paths, disabled ids) via SessionOptions instead.
-    #[doc(hidden)]
-    pub(crate) loader: serde_json::Value,
-    /// Optional registration options.
+pub struct PushAttachmentGitHubFileDiff {
+    /// File location on the base side of the diff. Absent for additions.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub options: Option<SessionsRegisterExtensionToolsOnSessionOptions>,
-    /// Session to register extension tools on.
-    pub session_id: SessionId,
+    pub base: Option<PushAttachmentGitHubFileDiffSide>,
+    /// File location on the head side of the diff. Absent for deletions.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub head: Option<PushAttachmentGitHubFileDiffSide>,
+    /// Attachment type discriminator
+    pub r#type: PushAttachmentGitHubFileDiffType,
+    /// URL to the diff on GitHub (e.g., a commit, compare, or PR-file URL)
+    pub url: String,
 }
 
-/// Handle for releasing the extension tool registration.
+/// GitHub issue, pull request, or discussion reference
 ///
 /// <div class="warning">
 ///
@@ -13046,13 +13177,22 @@ pub(crate) struct RegisterExtensionToolsParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub(crate) struct RegisterExtensionToolsResult {
-    /// In-process unsubscribe function (CLI-only optimization). Marked internal: replaced by an explicit `extensions.unregister` RPC in the SDK migration.
-    #[doc(hidden)]
-    pub(crate) unsubscribe: serde_json::Value,
+pub struct PushAttachmentGitHubReference {
+    /// Issue, pull request, or discussion number
+    pub number: i64,
+    /// Type of GitHub reference
+    pub reference_type: PushAttachmentGitHubReferenceType,
+    /// Current state of the referenced item (e.g., open, closed, merged)
+    pub state: String,
+    /// Title of the referenced item
+    pub title: String,
+    /// Attachment type discriminator
+    pub r#type: PushAttachmentGitHubReferenceType,
+    /// URL to the referenced item on GitHub
+    pub url: String,
 }
 
-/// Opaque handle previously returned by `registerInterest` to release.
+/// Pointer to a GitHub release.
 ///
 /// <div class="warning">
 ///
@@ -13062,29 +13202,45 @@ pub(crate) struct RegisterExtensionToolsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ReleaseEventInterestParams {
-    /// Handle returned by a previous `registerInterest` call. Idempotent: releasing an unknown or already-released handle is a no-op (returns success). When the last outstanding handle for an event type is released, the runtime reverts to its 'no consumer' code path for that event type.
-    pub handle: String,
-}
-
-/// Reattach to an existing MC session without creating a new one.
-///
-/// <div class="warning">
-///
+pub struct PushAttachmentGitHubRelease {
+    /// Human-readable release name
+    pub name: String,
+    /// Repository the release belongs to
+    pub repo: PushGitHubRepoRef,
+    /// Git tag the release is anchored to
+    pub tag_name: String,
+    /// Attachment type discriminator
+    pub r#type: PushAttachmentGitHubReleaseType,
+    /// URL to the release on GitHub
+    pub url: String,
+}
+
+/// Pointer to a GitHub repository.
+///
+/// <div class="warning">
+///
 /// **Experimental.** This type is part of an experimental wire-protocol surface
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct RemoteControlConfigExistingMcSession {
-    /// Existing MC session ID to reattach to.
-    pub mc_session_id: String,
-    /// Existing MC task ID for the reattached session.
-    pub mc_task_id: String,
+pub struct PushAttachmentGitHubRepository {
+    /// Short description of the repository
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// Git ref this attachment is anchored at (branch, tag, or commit). When absent the default branch is implied.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub r#ref: Option<String>,
+    /// Repository pointer
+    pub repo: PushGitHubRepoRef,
+    /// Attachment type discriminator
+    pub r#type: PushAttachmentGitHubRepositoryType,
+    /// URL to the repository on GitHub
+    pub url: String,
 }
 
-/// Configuration for the runtime-managed remote-control singleton.
+/// Pointer to a line range inside a file in a GitHub repository.
 ///
 /// <div class="warning">
 ///
@@ -13094,24 +13250,22 @@ pub struct RemoteControlConfigExistingMcSession {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct RemoteControlConfig {
-    /// Reattach to an existing MC session without creating a new one.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub existing_mc_session: Option<RemoteControlConfigExistingMcSession>,
-    /// Whether the user explicitly requested remote (vs. implicit session-sync). Controls warning surfacing for missing-repo cases.
-    pub explicit: bool,
-    /// Whether remote export should be enabled.
-    pub remote: bool,
-    /// When true, suppresses timeline messages on successful setup.
-    pub silent: bool,
-    /// Whether the MC session may steer the local session (write mode).
-    pub steerable: bool,
-    /// Existing Mission Control task ID to attach the exported session to.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub task_id: Option<String>,
+pub struct PushAttachmentGitHubSnippet {
+    /// Line range the snippet covers
+    pub line_range: PushAttachmentFileLineRange,
+    /// Repository-relative path to the file
+    pub path: String,
+    /// Git ref the file is read at (branch, tag, or commit SHA)
+    pub r#ref: String,
+    /// Repository the file lives in
+    pub repo: PushGitHubRepoRef,
+    /// Attachment type discriminator
+    pub r#type: PushAttachmentGitHubSnippetType,
+    /// URL to the snippet on GitHub (with line anchor)
+    pub url: String,
 }
 
-/// Remote control is connected to a local session.
+/// One side of a tree comparison (head or base)
 ///
 /// <div class="warning">
 ///
@@ -13121,27 +13275,14 @@ pub struct RemoteControlConfig {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct RemoteControlStatusActive {
-    /// Session id remote control is pointed at.
-    pub attached_session_id: String,
-    /// True while a read-only/session-sync export is deferred, awaiting the first `user.message` before its MC session exists. Marked internal: this field is excluded from the public SDK surface and is populated only on the CLI in-process path.
-    #[doc(hidden)]
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub(crate) awaiting_first_message: Option<bool>,
-    /// MC frontend URL for this session, when known.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub frontend_url: Option<String>,
-    /// Whether the MC session may steer this session.
-    pub is_steerable: bool,
-    /// In-process prompt-manager handle (CLI-only optimization). Marked internal: this field is excluded from the public SDK surface. Retained as an optional compatibility field; native remote control does not populate or consume it.
-    #[doc(hidden)]
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub(crate) prompt_manager: Option<serde_json::Value>,
-    /// Remote control state tag: active.
-    pub state: RemoteControlStatusActiveState,
+pub struct PushAttachmentGitHubTreeComparisonSide {
+    /// Repository the revision belongs to
+    pub repo: PushGitHubRepoRef,
+    /// Git revision (branch, tag, or commit SHA)
+    pub revision: String,
 }
 
-/// Remote control is in the middle of initial setup.
+/// Pointer to a comparison between two git revisions.
 ///
 /// <div class="warning">
 ///
@@ -13151,14 +13292,18 @@ pub struct RemoteControlStatusActive {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct RemoteControlStatusConnecting {
-    /// Session id the connection is attaching to.
-    pub attached_session_id: String,
-    /// Remote control state tag: connecting.
-    pub state: RemoteControlStatusConnectingState,
+pub struct PushAttachmentGitHubTreeComparison {
+    /// Base side of the comparison
+    pub base: PushAttachmentGitHubTreeComparisonSide,
+    /// Head side of the comparison
+    pub head: PushAttachmentGitHubTreeComparisonSide,
+    /// Attachment type discriminator
+    pub r#type: PushAttachmentGitHubTreeComparisonType,
+    /// URL to the comparison on GitHub
+    pub url: String,
 }
 
-/// The last setup attempt failed. The singleton is otherwise off.
+/// Generic GitHub URL reference.
 ///
 /// <div class="warning">
 ///
@@ -13168,17 +13313,14 @@ pub struct RemoteControlStatusConnecting {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct RemoteControlStatusError {
-    /// Session id the failing setup attempt targeted, when known.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub attached_session_id: Option<String>,
-    /// Human-readable error message from the last setup attempt.
-    pub error: String,
-    /// Remote control state tag: setup failed.
-    pub state: RemoteControlStatusErrorState,
+pub struct PushAttachmentGitHubUrl {
+    /// Attachment type discriminator
+    pub r#type: PushAttachmentGitHubUrlType,
+    /// URL to the GitHub resource
+    pub url: String,
 }
 
-/// Remote control is not connected.
+/// End position of the selection
 ///
 /// <div class="warning">
 ///
@@ -13188,12 +13330,14 @@ pub struct RemoteControlStatusError {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct RemoteControlStatusOff {
-    /// Remote control state tag: not connected.
-    pub state: RemoteControlStatusOffState,
+pub struct PushAttachmentSelectionDetailsEnd {
+    /// End character offset within the line (0-based)
+    pub character: i64,
+    /// End line number (0-based)
+    pub line: i64,
 }
 
-/// Wrapper for the singleton's current status.
+/// Start position of the selection
 ///
 /// <div class="warning">
 ///
@@ -13203,12 +13347,14 @@ pub struct RemoteControlStatusOff {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct RemoteControlStatusResult {
-    /// State of the runtime-managed remote-control singleton.
-    pub status: serde_json::Value,
+pub struct PushAttachmentSelectionDetailsStart {
+    /// Start character offset within the line (0-based)
+    pub character: i64,
+    /// Start line number (0-based)
+    pub line: i64,
 }
 
-/// Outcome of a stopRemoteControl call.
+/// Position range of the selection within the file
 ///
 /// <div class="warning">
 ///
@@ -13218,14 +13364,14 @@ pub struct RemoteControlStatusResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct RemoteControlStopResult {
-    /// State of the runtime-managed remote-control singleton.
-    pub status: serde_json::Value,
-    /// Whether the singleton was actually torn down by this call.
-    pub stopped: bool,
+pub struct PushAttachmentSelectionDetails {
+    /// End position of the selection
+    pub end: PushAttachmentSelectionDetailsEnd,
+    /// Start position of the selection
+    pub start: PushAttachmentSelectionDetailsStart,
 }
 
-/// Outcome of a transferRemoteControl call.
+/// Code selection attachment from an editor
 ///
 /// <div class="warning">
 ///
@@ -13235,14 +13381,20 @@ pub struct RemoteControlStopResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct RemoteControlTransferResult {
-    /// State of the runtime-managed remote-control singleton.
-    pub status: serde_json::Value,
-    /// Whether the rebinding actually happened.
-    pub transferred: bool,
+pub struct PushAttachmentSelection {
+    /// User-facing display name for the selection
+    pub display_name: String,
+    /// Absolute path to the file containing the selection
+    pub file_path: String,
+    /// Position range of the selection within the file
+    pub selection: PushAttachmentSelectionDetails,
+    /// The selected text content
+    pub text: String,
+    /// Attachment type discriminator
+    pub r#type: PushAttachmentSelectionType,
 }
 
-/// Optional remote session mode ("off", "export", or "on"); defaults to enabling both export and remote steering.
+/// Inputs for starting a deferred-idle drain.
 ///
 /// <div class="warning">
 ///
@@ -13252,13 +13404,12 @@ pub struct RemoteControlTransferResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct RemoteEnableRequest {
-    /// Per-session remote mode. "off" disables remote, "export" exports session events to GitHub without enabling remote steering, "on" enables both export and remote steering.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mode: Option<RemoteSessionMode>,
+pub struct QueueBeginDeferredIdleDrainRequest {
+    /// Whether the host still has active background work.
+    pub active_background_work: bool,
 }
 
-/// GitHub URL for the session and a flag indicating whether remote steering is enabled.
+/// Whether a deferred-idle drain should run.
 ///
 /// <div class="warning">
 ///
@@ -13268,15 +13419,12 @@ pub struct RemoteEnableRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct RemoteEnableResult {
-    /// Whether remote steering is enabled
-    pub remote_steerable: bool,
-    /// GitHub frontend URL for this session
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub url: Option<String>,
+pub struct QueueBeginDeferredIdleDrainResult {
+    /// True when the host should run finishDeferredIdleDrain asynchronously.
+    pub should_drain: bool,
 }
 
-/// New remote-steerability state to persist as a `session.remote_steerable_changed` event.
+/// Internal filter for consuming queued system notifications.
 ///
 /// <div class="warning">
 ///
@@ -13286,12 +13434,12 @@ pub struct RemoteEnableResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct RemoteNotifySteerableChangedRequest {
-    /// Whether the session now supports remote steering via GitHub. The runtime persists this as a `session.remote_steerable_changed` event so resume/replay sees the up-to-date capability.
-    pub remote_steerable: bool,
+pub struct QueueConsumeSystemNotificationsRequest {
+    /// Opaque runtime-owned filter object.
+    pub filter: serde_json::Value,
 }
 
-/// Persist a steerability change as a `session.remote_steerable_changed` event. Used by the host (CLI / SDK consumer) when it has just finished enabling or disabling steering on a remote exporter that the runtime does not directly own.
+/// Queued-command response indicating the host executed the command, with an optional flag to stop queue processing.
 ///
 /// <div class="warning">
 ///
@@ -13301,9 +13449,15 @@ pub struct RemoteNotifySteerableChangedRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct RemoteNotifySteerableChangedResult {}
+pub struct QueuedCommandHandled {
+    /// The host actually executed the queued command.
+    pub handled: bool,
+    /// When true, the runtime will not process subsequent queued commands until a new request comes in.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub stop_processing_queue: Option<bool>,
+}
 
-/// Remote session connection result.
+/// Queued-command response indicating the host did not execute the command and the queue may continue.
 ///
 /// <div class="warning">
 ///
@@ -13313,14 +13467,12 @@ pub struct RemoteNotifySteerableChangedResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct RemoteSessionConnectionResult {
-    /// Metadata for a connected remote session.
-    pub metadata: ConnectedRemoteSessionMetadata,
-    /// SDK session ID for the connected remote session.
-    pub session_id: SessionId,
+pub struct QueuedCommandNotHandled {
+    /// The host did not execute the queued command. Unblocks the queue without claiming the command was processed (e.g. when the handler threw before completing).
+    pub handled: bool,
 }
 
-/// GitHub repository the remote session belongs to.
+/// Inputs for marking session.idle deferred in native state.
 ///
 /// <div class="warning">
 ///
@@ -13330,16 +13482,12 @@ pub struct RemoteSessionConnectionResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct RemoteSessionMetadataRepository {
-    /// Branch associated with the remote session.
-    pub branch: String,
-    /// Repository name.
-    pub name: String,
-    /// Repository owner.
-    pub owner: String,
+pub struct QueueDeferSessionIdleRequest {
+    /// Whether the deferred idle was caused by an aborted foreground turn.
+    pub aborted: bool,
 }
 
-/// Remote session metadata for the session to hand off (typically obtained from `sessions.list` with `source: "remote"`).
+/// Parameters for duplicating a queued item.
 ///
 /// <div class="warning">
 ///
@@ -13349,52 +13497,12 @@ pub struct RemoteSessionMetadataRepository {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct RemoteSessionMetadataValue {
-    /// Most recent working directory context.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub context: Option<SessionContext>,
-    /// Host-supplied human description of what the session is doing right now ("running tests", "waiting for approval"). Optional in the protocol and absent on hosts that do not publish it, so never rely on it -- it enriches `hostStatus`, it does not replace it.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub host_activity: Option<String>,
-    /// Live status as the owning host reports it in its session listing, so a row for a session running elsewhere can show that it is running. Absent for hosts that publish no such status (the cloud task managers), which read as idle.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub host_status: Option<RemoteSessionHostStatus>,
-    /// Always true for remote sessions.
-    pub is_remote: bool,
-    /// Last-modified time as an ISO 8601 timestamp.
-    pub modified_time: String,
-    /// Optional human-friendly name set via /rename.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    /// Pull request number associated with the session.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub pull_request_number: Option<i64>,
-    /// Backing remote session IDs (most recent first).
-    pub remote_session_ids: Vec<String>,
-    /// GitHub repository the remote session belongs to.
-    pub repository: RemoteSessionMetadataRepository,
-    /// Original remote resource identifier (task ID or PR node ID).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub resource_id: Option<String>,
-    /// Stable session identifier.
-    pub session_id: SessionId,
-    /// Deadline (ISO 8601) at which a CLI remote session becomes stale without further heartbeats.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub stale_at: Option<String>,
-    /// Session creation time as an ISO 8601 timestamp.
-    pub start_time: String,
-    /// Server-side task state returned by GitHub.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub state: Option<String>,
-    /// Short summary of the session, when one has been derived.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub summary: Option<String>,
-    /// Whether the remote task originated from CCA or CLI `--remote`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub task_type: Option<RemoteSessionMetadataTaskType>,
+pub struct QueueDuplicateAtRequest {
+    /// Stable opaque ID of the queued item to duplicate.
+    pub id: String,
 }
 
-/// Repository context for the remote session.
+/// Result of duplicating a queued item.
 ///
 /// <div class="warning">
 ///
@@ -13404,17 +13512,12 @@ pub struct RemoteSessionMetadataValue {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct RemoteSessionRepository {
-    /// Optional branch associated with the remote session.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub branch: Option<String>,
-    /// Repository name.
-    pub name: String,
-    /// Repository owner or organization login.
-    pub owner: String,
+pub struct QueueDuplicateAtResult {
+    /// Fresh stable opaque id assigned to the duplicate.
+    pub id: String,
 }
 
-/// Credential-injection capability flags applied while the sandbox is enabled. For the same capability independent of sandboxing, and matched to the credential's GitHub host, see `shell.credentials`; the two are additive.
+/// Result of enqueueing the resume-pending wake item.
 ///
 /// <div class="warning">
 ///
@@ -13424,16 +13527,12 @@ pub struct RemoteSessionRepository {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SandboxConfigAuth {
-    /// Whether to export `GH_TOKEN` so the `gh` CLI authenticates inside the sandbox without the OS keyring the sandbox blocks. Default: false (opt-in).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub gh: Option<bool>,
-    /// Whether to inject git credentials as an `http.<url>.extraheader` so authenticated HTTPS git works inside the sandbox without the shell-based credential helper the sandbox blocks. github.com is served by the Copilot token; every other forge (Azure DevOps, GitHub Enterprise Server, GitLab, ...) by a credential the host resolves from the user's own helper before the sandbox is applied. Default: false (opt-in).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub git: Option<bool>,
+pub struct QueueEnqueueResumePendingResult {
+    /// True when a wake item was newly queued.
+    pub queued: bool,
 }
 
-/// macOS seatbelt experimental options.
+/// Inputs for completing a deferred-idle drain.
 ///
 /// <div class="warning">
 ///
@@ -13443,13 +13542,14 @@ pub struct SandboxConfigAuth {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SandboxConfigUserPolicyExperimentalSeatbelt {
-    /// Whether the macOS seatbelt profile may access the keychain.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub keychain_access: Option<bool>,
+pub struct QueueFinishDeferredIdleDrainRequest {
+    /// Whether the host still has active background work.
+    pub active_background_work: bool,
+    /// Whether native queued work remains.
+    pub has_pending: bool,
 }
 
-/// Platform-specific experimental policy fields.
+/// Action selected by the native deferred-idle drain.
 ///
 /// <div class="warning">
 ///
@@ -13459,13 +13559,14 @@ pub struct SandboxConfigUserPolicyExperimentalSeatbelt {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SandboxConfigUserPolicyExperimental {
-    /// macOS seatbelt experimental options.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub seatbelt: Option<SandboxConfigUserPolicyExperimentalSeatbelt>,
+pub struct QueueFinishDeferredIdleDrainResult {
+    /// Whether the deferred idle was caused by an aborted foreground turn.
+    pub aborted: bool,
+    /// One of none, processQueue, or emitSessionIdle.
+    pub action: String,
 }
 
-/// Filesystem rules to merge into the base policy.
+/// Whether the native queue has pending work.
 ///
 /// <div class="warning">
 ///
@@ -13475,22 +13576,12 @@ pub struct SandboxConfigUserPolicyExperimental {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SandboxConfigUserPolicyFilesystem {
-    /// Whether to clear the policy when the session exits.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub clear_policy_on_exit: Option<bool>,
-    /// Paths explicitly denied.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub denied_paths: Option<Vec<String>>,
-    /// Paths granted read-only access.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub readonly_paths: Option<Vec<String>>,
-    /// Paths granted read/write access.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub readwrite_paths: Option<Vec<String>>,
+pub struct QueueHasPendingResult {
+    /// True when queued or immediate native work is pending.
+    pub has_pending: bool,
 }
 
-/// HTTP proxy configuration for sandboxed traffic.
+/// Serializable message fields accepted by queue.insertAt.
 ///
 /// <div class="warning">
 ///
@@ -13500,18 +13591,45 @@ pub struct SandboxConfigUserPolicyFilesystem {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SandboxConfigUserPolicyNetworkProxy {
-    /// Optional password for proxy authentication, combined with the URL at spawn time. The persisted value may be a literal password, a `${secret:…}` reference resolved from the OS keychain, or a `${VAR}`/`$VAR` environment reference; it is resolved just before the sandboxed process routes through the proxy. The /sandbox dialog stores a real password in the OS keychain and persists only a `${secret:…}` placeholder (never plaintext in settings.json); the field is masked in the dialog and redacted by /settings show.
+pub struct QueueInsertMessage {
+    /// Optional explicit agent mode. When omitted, the session's current mode is assigned.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub password: Option<String>,
-    /// Proxy URL (e.g. http://proxy.example.com:8080). The port is optional and defaults to the scheme's standard port when omitted. Credentials must not be embedded here — a `user:pass@` authority is rejected; put them in the separate `username`/`password` fields. A credential-free http:// loopback URL is routed through the localhost proxy automatically; loopback covers localhost and any *.localhost subdomain, the whole 127.0.0.0/8 range, ::1, and IPv4-mapped loopback (::ffff:127.0.0.1). An https:// URL, or one with a username/password set, is used as-is.
-    pub url: String,
-    /// Optional username for proxy authentication. Combined with the URL (and `password`) into `user:pass@host` when the sandboxed process routes through the proxy.
+    pub agent_mode: Option<SendAgentMode>,
+    /// Optional attachments for the message.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub username: Option<String>,
+    pub attachments: Option<Vec<serde_json::Value>>,
+    /// Whether the message is billable.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub billable: Option<bool>,
+    /// Accepted for internal SendOptions compatibility but ignored; delivery is derived from current session activity.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub delivery: Option<String>,
+    /// Optional user-facing display text.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub display_prompt: Option<String>,
+    /// Accepted for SendOptions compatibility but ignored; inserted items always use queued delivery semantics.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mode: Option<SendMode>,
+    /// Accepted for SendOptions compatibility but ignored; the requested public position controls placement.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub prepend: Option<bool>,
+    /// The user message text.
+    pub prompt: String,
+    /// Per-turn request headers.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub request_headers: Option<HashMap<String, String>>,
+    /// Required tool name for the turn, when any.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub required_tool: Option<String>,
+    /// Optional provenance source. `system` is rejected: it would hide the inserted row from `pendingItems` and make it unaddressable while still executing, so inserted items must stay visible.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source: Option<String>,
+    /// Accepted for SendOptions compatibility but ignored; insertion scheduling is controlled by the queue drain state.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub wait: Option<bool>,
 }
 
-/// Network rules to merge into the base policy.
+/// Parameters for inserting a queued message at a public visible position.
 ///
 /// <div class="warning">
 ///
@@ -13521,19 +13639,14 @@ pub struct SandboxConfigUserPolicyNetworkProxy {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SandboxConfigUserPolicyNetwork {
-    /// Whether traffic to local/loopback addresses is allowed.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub allow_local_network: Option<bool>,
-    /// Whether outbound network traffic is allowed at all.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub allow_outbound: Option<bool>,
-    /// HTTP proxy the sandboxed process routes traffic through. Enforced on Windows and cooperative (honored by well-behaved tools, not strictly enforced) on Linux and macOS. Credentials go in the separate `username`/`password` fields. A credential-free http:// loopback proxy URL is routed through the localhost proxy automatically; an https:// or authenticated loopback URL is used as-is.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub proxy: Option<SandboxConfigUserPolicyNetworkProxy>,
+pub struct QueueInsertAtRequest {
+    /// Queued message contents and delivery metadata.
+    pub message: QueueInsertMessage,
+    /// Zero-based position in the public visible queue. Values outside the queue clamp to an end.
+    pub position: i64,
 }
 
-/// macOS seatbelt-specific options.
+/// Result of inserting a queued message.
 ///
 /// <div class="warning">
 ///
@@ -13543,13 +13656,12 @@ pub struct SandboxConfigUserPolicyNetwork {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SandboxConfigUserPolicySeatbelt {
-    /// Whether the macOS seatbelt profile may access the keychain.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub keychain_access: Option<bool>,
+pub struct QueueInsertAtResult {
+    /// Fresh stable opaque id assigned to the inserted item.
+    pub id: String,
 }
 
-/// User-managed sandbox policy fragment merged into the auto-discovered base policy.
+/// Parameters for moving a queued item by stable id.
 ///
 /// <div class="warning">
 ///
@@ -13559,22 +13671,14 @@ pub struct SandboxConfigUserPolicySeatbelt {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SandboxConfigUserPolicy {
-    /// Deprecated legacy location for `seatbelt`; read only when the top-level `seatbelt` is absent.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub experimental: Option<SandboxConfigUserPolicyExperimental>,
-    /// Filesystem rules to merge into the base policy.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub filesystem: Option<SandboxConfigUserPolicyFilesystem>,
-    /// Network rules to merge into the base policy.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub network: Option<SandboxConfigUserPolicyNetwork>,
-    /// macOS seatbelt options to merge into the base policy.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub seatbelt: Option<SandboxConfigUserPolicySeatbelt>,
+pub struct QueueMoveItemRequest {
+    /// Stable opaque queued-item id.
+    pub id: String,
+    /// Zero-based target position in the public visible queue. Values outside the queue clamp to an end.
+    pub to_position: i64,
 }
 
-/// Resolved sandbox configuration.
+/// Result of moving a queued item.
 ///
 /// <div class="warning">
 ///
@@ -13584,24 +13688,12 @@ pub struct SandboxConfigUserPolicy {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SandboxConfig {
-    /// Whether to auto-add the current working directory to readwritePaths. Default: true.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub add_current_working_directory: Option<bool>,
-    /// Whether to auto-grant read access to the tool directories discovered on PATH and in toolchain environment variables (GOROOT, CARGO_HOME, JAVA_HOME, VIRTUAL_ENV, and similar), and to common developer-tool caches, registries, and toolchains in their default home locations (cargo, go, npm, Maven, and more), plus read-write access to (and, on Unix, up-front creation of) the scratch caches builds write on every run (go-build, ccache, sccache, Gradle caches, Cargo lock/tracker files), so builds work without extra configuration; a relocated CARGO_HOME additionally gets its Cargo lock files granted read-write. Set to false to disable every grant listed above: user-installed toolchains (rustup, nvm, pyenv, conda, pipx) then need explicit userPolicy.filesystem entries — readonlyPaths to read them, plus readwriteFiles for a relocated CARGO_HOME's .package-cache and .global-cache, which Cargo locks on every build. Only these developer-tool grants are affected: the working directory (see addCurrentWorkingDirectory), temporary storage, session log paths, and system locations follow their own rules and stay granted, so commands still run. Default: true (enabled by default; set to false to opt out).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub allow_dev_tool_access: Option<bool>,
-    /// Credential-injection capability flags.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub auth: Option<SandboxConfigAuth>,
-    /// Whether sandboxing is enabled for the session.
-    pub enabled: bool,
-    /// User-managed sandbox policy fragment merged into the auto-discovered base policy.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub user_policy: Option<SandboxConfigUserPolicy>,
+pub struct QueueMoveItemResult {
+    /// True when the item changed position; false when it was already at the requested position.
+    pub changed: bool,
 }
 
-/// Register an absolute-time scheduled prompt.
+/// User-facing pending queue entry, with kind and display text for a queued message, slash command, or model change.
 ///
 /// <div class="warning">
 ///
@@ -13611,20 +13703,18 @@ pub struct SandboxConfig {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ScheduleAddAtRequest {
-    /// Epoch milliseconds when the prompt should fire.
-    pub at: i64,
-    /// Optional display-only prompt label.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub display_prompt: Option<String>,
-    /// Prompt text to enqueue when the schedule fires.
-    pub prompt: String,
-    /// Whether the schedule should re-arm after each tick. Defaults to false.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub recurring: Option<bool>,
+pub struct QueuePendingItems {
+    /// Agent mode stored on this queued entry, as stamped when it was enqueued. Items without an explicit mode report interactive. This is not necessarily the mode that will constrain the turn: a plan or autopilot session applies its own write gate, continuation loop and permission posture to every drained item regardless of the mode stored here.
+    pub agent_mode: SendAgentMode,
+    /// Human-readable text to display for this queue entry in the UI
+    pub display_text: String,
+    /// Stable opaque id for the canonical queued item. Batch rows share one id.
+    pub id: String,
+    /// Whether this item is a queued user message or a queued slash command / model change
+    pub kind: QueuePendingItemsKind,
 }
 
-/// Register a cron scheduled prompt.
+/// Snapshot of the session's pending queued items and immediate-steering messages.
 ///
 /// <div class="warning">
 ///
@@ -13634,23 +13724,14 @@ pub struct ScheduleAddAtRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ScheduleAddCronRequest {
-    /// 5-field cron expression.
-    pub cron: String,
-    /// Optional display-only prompt label.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub display_prompt: Option<String>,
-    /// Prompt text to enqueue when the schedule fires.
-    pub prompt: String,
-    /// Whether the schedule should re-arm after each tick. Defaults to true.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub recurring: Option<bool>,
-    /// IANA timezone for evaluating the cron expression.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub tz: Option<String>,
+pub struct QueuePendingItemsResult {
+    /// Pending queued items in submission order. Includes user messages, queued slash commands, and queued model changes; omits internal system items.
+    pub items: Vec<QueuePendingItems>,
+    /// Display text for messages currently in the immediate steering queue (interjections sent during a running turn).
+    pub steering_messages: Vec<String>,
 }
 
-/// Register a relative-interval scheduled prompt.
+/// Parameters for removing a queued item by stable id.
 ///
 /// <div class="warning">
 ///
@@ -13660,20 +13741,12 @@ pub struct ScheduleAddCronRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ScheduleAddRequest {
-    /// Optional display-only prompt label.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub display_prompt: Option<String>,
-    /// Human-readable interval such as `30s`, `5m`, or `2h`.
-    pub interval: String,
-    /// Prompt text to enqueue when the schedule fires.
-    pub prompt: String,
-    /// Whether the schedule should re-arm after each tick. Defaults to true.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub recurring: Option<bool>,
+pub struct QueueRemoveAtRequest {
+    /// Stable opaque ID of the queued item to remove.
+    pub id: String,
 }
 
-/// Scheduled prompt entry with ID, timing (`intervalMs`, `cron`, or `at`), prompt text, recurrence, and next run time.
+/// Result of removing a queued item.
 ///
 /// <div class="warning">
 ///
@@ -13683,36 +13756,12 @@ pub struct ScheduleAddRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ScheduleEntry {
-    /// Absolute fire time (epoch milliseconds) for a one-shot calendar schedule.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub at: Option<i64>,
-    /// 5-field cron expression for a recurring calendar schedule, evaluated in `tz`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cron: Option<String>,
-    /// Display-only label for the prompt as shown in the UI (e.g. `/skill-name` for a skill-invocation schedule). The actual enqueued prompt is `prompt`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub display_prompt: Option<String>,
-    /// Sequential id assigned by the runtime within the session. Stable across resumes (rebuilt from the event log).
-    pub id: i64,
-    /// Interval between scheduled ticks, in milliseconds (relative-interval schedules).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub interval_ms: Option<i64>,
-    /// ISO 8601 timestamp when the next tick is scheduled to fire.
-    pub next_run_at: String,
-    /// Prompt text that gets enqueued on every tick.
-    pub prompt: String,
-    /// Whether the schedule re-arms after each tick (`/every`) or fires once (`/after`).
-    pub recurring: bool,
-    /// True for a self-paced (`dynamic`) schedule: no fixed cadence; the model arms each next run via the `manage_schedule` `wakeup` action. `nextRunAt` is model-controlled.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub self_paced: Option<bool>,
-    /// IANA timezone the `cron` expression is evaluated in.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub tz: Option<String>,
+pub struct QueueRemoveAtResult {
+    /// True when the addressed item was removed.
+    pub removed: bool,
 }
 
-/// Result of registering or re-arming a scheduled prompt.
+/// Indicates whether a user-facing pending item was removed.
 ///
 /// <div class="warning">
 ///
@@ -13722,16 +13771,12 @@ pub struct ScheduleEntry {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ScheduleAddResult {
-    /// The registered or updated schedule entry.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub entry: Option<ScheduleEntry>,
-    /// User-facing validation error, when registration failed.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
+pub struct QueueRemoveMostRecentResult {
+    /// True if a user-facing pending item was removed (LIFO across both queues); false when no removable items remained.
+    pub removed: bool,
 }
 
-/// Register a self-paced scheduled prompt.
+/// Parameters for steering a queued message into a live turn.
 ///
 /// <div class="warning">
 ///
@@ -13741,15 +13786,12 @@ pub struct ScheduleAddResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ScheduleAddSelfPacedRequest {
-    /// Optional display-only prompt label.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub display_prompt: Option<String>,
-    /// Prompt text to enqueue when the schedule fires.
-    pub prompt: String,
+pub struct QueueSendNowRequest {
+    /// Stable opaque ID of the queued item to steer into the live turn.
+    pub id: String,
 }
 
-/// Whether the session currently has an active self-paced schedule.
+/// Result of trying to steer a queued message into a live turn.
 ///
 /// <div class="warning">
 ///
@@ -13759,12 +13801,12 @@ pub struct ScheduleAddSelfPacedRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ScheduleHasSelfPacedResult {
-    /// True when at least one active schedule is self-paced.
-    pub has_self_paced: bool,
+pub struct QueueSendNowResult {
+    /// True when the item was accepted into the steering lane; false when no main turn was live.
+    pub steered: bool,
 }
 
-/// Snapshot of the currently active recurring prompts for this session.
+/// Parameters for acquiring or releasing the queued-lane drain pause. Acquisition is exclusive and non-idempotent: `paused: true` against an already-paused session fails with `queue_already_paused`. The pause is never released automatically — it is not tied to the caller's lifetime, so a client that exits without sending `paused: false` leaves the lane frozen. Release is unowned: `paused: false` clears the pause for any caller, including one that never acquired it.
 ///
 /// <div class="warning">
 ///
@@ -13774,12 +13816,12 @@ pub struct ScheduleHasSelfPacedResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ScheduleList {
-    /// Active scheduled prompts, ordered by id.
-    pub entries: Vec<ScheduleEntry>,
+pub struct QueueSetDrainPausedRequest {
+    /// Whether queued-lane draining should be paused.
+    pub paused: bool,
 }
 
-/// Re-arm a self-paced scheduled prompt.
+/// Internal snapshot of native queue state for local session orchestration.
 ///
 /// <div class="warning">
 ///
@@ -13789,14 +13831,20 @@ pub struct ScheduleList {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ScheduleRearmSelfPacedRequest {
-    /// Epoch milliseconds when the prompt should next fire.
-    pub at: i64,
-    /// Id of the self-paced scheduled prompt.
-    pub id: i64,
+pub struct QueueSnapshotResult {
+    /// Insertion orders for queued items, aligned with `items`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub item_orders: Option<Vec<i64>>,
+    /// User-facing pending items in FIFO order.
+    pub items: Vec<QueuePendingItems>,
+    /// Insertion orders for immediate steering messages, aligned with `steeringMessages`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub steering_message_orders: Option<Vec<i64>>,
+    /// Immediate steering messages waiting for an active turn.
+    pub steering_messages: Vec<String>,
 }
 
-/// Identifier of the scheduled prompt to remove.
+/// Parameters for editing a single queued message.
 ///
 /// <div class="warning">
 ///
@@ -13806,12 +13854,17 @@ pub struct ScheduleRearmSelfPacedRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ScheduleStopRequest {
-    /// Id of the scheduled prompt to remove.
-    pub id: i64,
+pub struct QueueUpdateTextRequest {
+    /// Optional replacement prompt displayed to the user.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub display_prompt: Option<String>,
+    /// Stable opaque ID of the queued item to edit.
+    pub id: String,
+    /// Replacement prompt sent to the model.
+    pub prompt: String,
 }
 
-/// Remove a scheduled prompt by id. The result entry is omitted if the id was unknown.
+/// Result of editing a queued message.
 ///
 /// <div class="warning">
 ///
@@ -13821,13 +13874,12 @@ pub struct ScheduleStopRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ScheduleStopResult {
-    /// The removed entry, or omitted if no entry matched.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub entry: Option<ScheduleEntry>,
+pub struct QueueUpdateTextResult {
+    /// True when the stored text changed.
+    pub updated: bool,
 }
 
-/// Secret values to add to the redaction filter.
+/// Event type to register consumer interest for, used by runtime gating logic.
 ///
 /// <div class="warning">
 ///
@@ -13837,12 +13889,12 @@ pub struct ScheduleStopResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SecretsAddFilterValuesRequest {
-    /// Raw secret values to register for redaction
-    pub values: Vec<String>,
+pub struct RegisterEventInterestParams {
+    /// The event type the consumer wants the runtime to treat as 'observed' for behavior-switching gating. Some runtime code paths inspect whether any consumer is interested in a specific event type and choose a different implementation accordingly (e.g. `mcp.oauth_required`: when interest is registered the runtime delegates interactive OAuth token acquisition to the consumer via `mcp.oauth_required` events; when no interest is registered the runtime still attempts non-interactive reconnect from cached or refreshable tokens, and only marks the server `needs-auth` if usable credentials are unavailable — it does not open a browser or start interactive OAuth without a consumer). SDK clients that long-poll events do NOT automatically appear as listeners to these gating checks — they must explicitly call `registerInterest` for each event type they want the runtime to count as having a consumer. Multiple registrations for the same event type from the same or different consumers are tracked independently and must each be released. See: `mcp.oauth_required`, `sampling.requested`, `auto_mode_switch.requested`, `session_limits_exhausted.requested`, `user_input.requested`, `elicitation.requested`, `command.queued`, `exit_plan_mode.requested`.
+    pub event_type: String,
 }
 
-/// Confirmation that the secret values were registered.
+/// Opaque handle representing an event-type interest registration.
 ///
 /// <div class="warning">
 ///
@@ -13852,12 +13904,12 @@ pub struct SecretsAddFilterValuesRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SecretsAddFilterValuesResult {
-    /// Whether the values were successfully registered
-    pub ok: bool,
+pub struct RegisterEventInterestResult {
+    /// Opaque handle for this registration. Pass to releaseInterest to release. Each call to registerInterest produces a fresh handle, even when the same eventType is registered multiple times.
+    pub handle: String,
 }
 
-/// Parameters for session.extensions.sendAttachmentsToMessage.
+/// Optional registration options.
 ///
 /// <div class="warning">
 ///
@@ -13867,15 +13919,14 @@ pub struct SecretsAddFilterValuesResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SendAttachmentsToMessageParams {
-    /// Attachments to push into the next user-message turn. extension_context entries take the slim shape; standard variants take their full AttachmentSchema shape.
-    pub attachments: Vec<serde_json::Value>,
-    /// Optional canvas instance binding the push for provenance. When supplied, the runtime resolves the canvas, verifies it is owned by the calling extension, and stamps canvasId/instanceId onto each extension_context entry. When omitted, no resolution runs and those fields stay unset on the attachment.
+pub struct SessionsRegisterExtensionToolsOnSessionOptions {
+    /// In-process `() => boolean` gating callback (CLI-only optimization). Marked internal: replaced by runtime-side enable/disable RPCs in the SDK migration.
+    #[doc(hidden)]
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub instance_id: Option<String>,
+    pub(crate) enabled: Option<serde_json::Value>,
 }
 
-/// A single user message to append to the session as part of a `session.sendMessages` turn
+/// Params to attach an extension loader's tools to a session.
 ///
 /// <div class="warning">
 ///
@@ -13885,29 +13936,18 @@ pub struct SendAttachmentsToMessageParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SendMessageItem {
-    /// Optional attachments (files, directories, selections, blobs, GitHub references) to include with this message
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub attachments: Option<Vec<serde_json::Value>>,
-    /// If false, this message will not trigger a Premium Request Unit charge. User messages default to billable.
-    #[doc(hidden)]
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub(crate) billable: Option<bool>,
-    /// If provided, this is shown in the timeline instead of `prompt`
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub display_prompt: Option<String>,
-    /// The user message text
-    pub prompt: String,
-    /// If set, the request will fail if the named tool is not available when this message is among the user messages at the start of the current exchange
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub required_tool: Option<String>,
-    /// Optional provenance tag copied to the resulting user.message event. Must be `user`, `system`, `command-<command-id>` for command-originated messages, `schedule-<numeric-id>` for scheduled prompts, or `agent-<agent-id>` for prompts sent by another agent.
+pub(crate) struct RegisterExtensionToolsParams {
+    /// In-process ExtensionLoader handle (CLI-only optimization). Marked internal: this field is excluded from the public SDK surface. When the CLI migrates to a process-separated SDK, extension discovery/launch moves entirely into the runtime — the CLI passes pure config (search paths, disabled ids) via SessionOptions instead.
     #[doc(hidden)]
+    pub(crate) loader: serde_json::Value,
+    /// Optional registration options.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub(crate) source: Option<String>,
+    pub options: Option<SessionsRegisterExtensionToolsOnSessionOptions>,
+    /// Session to register extension tools on.
+    pub session_id: SessionId,
 }
 
-/// Parameters for sending zero or more user messages to the session in a single turn. Remote-backed (Mission Control) sessions do not support this method and will return an error.
+/// Handle for releasing the extension tool registration.
 ///
 /// <div class="warning">
 ///
@@ -13917,33 +13957,13 @@ pub struct SendMessageItem {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SendMessagesRequest {
-    /// The UI mode the agent was in when these messages were sent. Defaults to the session's current mode.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub agent_mode: Option<SendAgentMode>,
-    /// The user messages to append to the conversation, in order. May be empty, in which case a single turn runs over the existing history with no new user message.
-    pub messages: Vec<SendMessageItem>,
-    /// How to deliver the messages. `enqueue` (default) appends to the message queue. `immediate` interjects during an in-progress turn.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mode: Option<SendMode>,
-    /// If true, adds the messages to the front of the queue instead of the end
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub prepend: Option<bool>,
-    /// Custom HTTP headers to include in outbound model requests for this turn. Merged with session-level provider headers; per-turn headers augment and overwrite session-level headers with the same key.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub request_headers: Option<HashMap<String, String>>,
-    /// W3C Trace Context traceparent header for distributed tracing of this agent turn
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub traceparent: Option<String>,
-    /// W3C Trace Context tracestate header for distributed tracing
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub tracestate: Option<String>,
-    /// If true, await completion of the agentic loop for this turn before returning. Defaults to false (fire-and-forget). When true, the result still contains the same `messageIds`; the caller can rely on the agent having processed the messages before the call resolves. Transport-dependent tail semantics: on a LOCAL (in-process) session the wait additionally blocks until the completed turn's event tail has been dispatched to this session's in-process subscribers, so a subsequent read of subscriber state already reflects the turn; on a REMOTE session the wait resolves once the loop completes and mirrored delivery follows over the wire. Callers that need the stronger local guarantee on remote sessions should await the event stream explicitly.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub wait: Option<bool>,
+pub(crate) struct RegisterExtensionToolsResult {
+    /// In-process unsubscribe function (CLI-only optimization). Marked internal: replaced by an explicit `extensions.unregister` RPC in the SDK migration.
+    #[doc(hidden)]
+    pub(crate) unsubscribe: serde_json::Value,
 }
 
-/// Result of sending zero or more user messages
+/// Opaque handle previously returned by `registerInterest` to release.
 ///
 /// <div class="warning">
 ///
@@ -13953,12 +13973,12 @@ pub struct SendMessagesRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SendMessagesResult {
-    /// Unique identifiers assigned to the messages, one per provided message in order. Empty when no messages were provided.
-    pub message_ids: Vec<String>,
+pub struct ReleaseEventInterestParams {
+    /// Handle returned by a previous `registerInterest` call. Idempotent: releasing an unknown or already-released handle is a no-op (returns success). When the last outstanding handle for an event type is released, the runtime reverts to its 'no consumer' code path for that event type.
+    pub handle: String,
 }
 
-/// Parameters for sending a user message to the session
+/// Reattach to an existing MC session without creating a new one.
 ///
 /// <div class="warning">
 ///
@@ -13968,49 +13988,14 @@ pub struct SendMessagesResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SendRequest {
-    /// The UI mode the agent was in when this message was sent. Defaults to the session's current mode.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub agent_mode: Option<SendAgentMode>,
-    /// Optional attachments (files, directories, selections, blobs, GitHub references) to include with the message
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub attachments: Option<Vec<serde_json::Value>>,
-    /// If false, this message will not trigger a Premium Request Unit charge. User messages default to billable.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub billable: Option<bool>,
-    /// If provided, this is shown in the timeline instead of `prompt`
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub display_prompt: Option<String>,
-    /// How to deliver the message. `enqueue` (default) appends to the message queue. `immediate` interjects during an in-progress turn.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mode: Option<SendMode>,
-    /// If true, adds the message to the front of the queue instead of the end
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub prepend: Option<bool>,
-    /// The user message text
-    pub prompt: String,
-    /// Custom HTTP headers to include in outbound model requests for this turn. Merged with session-level provider headers; per-turn headers augment and overwrite session-level headers with the same key.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub request_headers: Option<HashMap<String, String>>,
-    /// If set, the request will fail if the named tool is not available when this message is among the user messages at the start of the current exchange
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub required_tool: Option<String>,
-    /// Optional provenance tag copied to the resulting user.message event. Must be `user`, `system`, `command-<command-id>` for command-originated messages, `schedule-<numeric-id>` for scheduled prompts, or `agent-<agent-id>` for prompts sent by another agent.
-    #[doc(hidden)]
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub(crate) source: Option<String>,
-    /// W3C Trace Context traceparent header for distributed tracing of this agent turn
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub traceparent: Option<String>,
-    /// W3C Trace Context tracestate header for distributed tracing
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub tracestate: Option<String>,
-    /// If true, await completion of the agentic loop for this message before returning. Defaults to false (fire-and-forget). When true, the result still contains the same `messageId`; the caller can rely on the agent having processed the message before the call resolves. Transport-dependent tail semantics: on a LOCAL (in-process) session the wait additionally blocks until the completed turn's event tail has been dispatched to this session's in-process subscribers, so a subsequent read of subscriber state already reflects the turn; on a REMOTE session the wait resolves once the loop completes and mirrored delivery follows over the wire. Callers that need the stronger local guarantee on remote sessions should await the event stream explicitly.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub wait: Option<bool>,
+pub struct RemoteControlConfigExistingMcSession {
+    /// Existing MC session ID to reattach to.
+    pub mc_session_id: String,
+    /// Existing MC task ID for the reattached session.
+    pub mc_task_id: String,
 }
 
-/// Result of sending a user message
+/// Configuration for the runtime-managed remote-control singleton.
 ///
 /// <div class="warning">
 ///
@@ -14020,12 +14005,24 @@ pub struct SendRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SendResult {
-    /// Unique identifier assigned to the message
-    pub message_id: String,
-}
+pub struct RemoteControlConfig {
+    /// Reattach to an existing MC session without creating a new one.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub existing_mc_session: Option<RemoteControlConfigExistingMcSession>,
+    /// Whether the user explicitly requested remote (vs. implicit session-sync). Controls warning surfacing for missing-repo cases.
+    pub explicit: bool,
+    /// Whether remote export should be enabled.
+    pub remote: bool,
+    /// When true, suppresses timeline messages on successful setup.
+    pub silent: bool,
+    /// Whether the MC session may steer the local session (write mode).
+    pub steerable: bool,
+    /// Existing Mission Control task ID to attach the exported session to.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub task_id: Option<String>,
+}
 
-/// Internal request for sending a system notification.
+/// Remote control is connected to a local session.
 ///
 /// <div class="warning">
 ///
@@ -14035,18 +14032,27 @@ pub struct SendResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SendSystemNotificationRequest {
-    /// Optional structured notification kind.
+pub struct RemoteControlStatusActive {
+    /// Session id remote control is pointed at.
+    pub attached_session_id: String,
+    /// True while a read-only/session-sync export is deferred, awaiting the first `user.message` before its MC session exists. Marked internal: this field is excluded from the public SDK surface and is populated only on the CLI in-process path.
+    #[doc(hidden)]
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub kind: Option<serde_json::Value>,
-    /// Notification text to deliver to the model.
-    pub message: String,
-    /// Internal delivery options, including passive policy.
+    pub(crate) awaiting_first_message: Option<bool>,
+    /// MC frontend URL for this session, when known.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub options: Option<serde_json::Value>,
+    pub frontend_url: Option<String>,
+    /// Whether the MC session may steer this session.
+    pub is_steerable: bool,
+    /// In-process prompt-manager handle (CLI-only optimization). Marked internal: this field is excluded from the public SDK surface. Retained as an optional compatibility field; native remote control does not populate or consume it.
+    #[doc(hidden)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(crate) prompt_manager: Option<serde_json::Value>,
+    /// Remote control state tag: active.
+    pub state: RemoteControlStatusActiveState,
 }
 
-/// Agents discovered across user, project, plugin, and remote sources.
+/// Remote control is in the middle of initial setup.
 ///
 /// <div class="warning">
 ///
@@ -14056,12 +14062,14 @@ pub struct SendSystemNotificationRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ServerAgentList {
-    /// All discovered agents across all sources
-    pub agents: Vec<AgentInfo>,
+pub struct RemoteControlStatusConnecting {
+    /// Session id the connection is attaching to.
+    pub attached_session_id: String,
+    /// Remote control state tag: connecting.
+    pub state: RemoteControlStatusConnectingState,
 }
 
-/// Instruction sources discovered across user, repository, and plugin sources.
+/// The last setup attempt failed. The singleton is otherwise off.
 ///
 /// <div class="warning">
 ///
@@ -14071,12 +14079,17 @@ pub struct ServerAgentList {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ServerInstructionSourceList {
-    /// All discovered instruction sources
-    pub sources: Vec<InstructionSource>,
+pub struct RemoteControlStatusError {
+    /// Session id the failing setup attempt targeted, when known.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub attached_session_id: Option<String>,
+    /// Human-readable error message from the last setup attempt.
+    pub error: String,
+    /// Remote control state tag: setup failed.
+    pub state: RemoteControlStatusErrorState,
 }
 
-/// Server-side skill metadata, including name, description, source, enabled/invocable state, path, project path, and argument hint.
+/// Remote control is not connected.
 ///
 /// <div class="warning">
 ///
@@ -14086,32 +14099,12 @@ pub struct ServerInstructionSourceList {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ServerSkill {
-    /// Optional freeform hint describing the skill's expected arguments, from the `argument-hint` frontmatter field
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub argument_hint: Option<String>,
-    /// Canonical slash command name used to invoke the skill, without the leading '/'
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub command_name: Option<String>,
-    /// Description of what the skill does
-    pub description: String,
-    /// Whether the skill is currently enabled (based on global config)
-    pub enabled: bool,
-    /// Unique identifier for the skill
-    pub name: String,
-    /// Absolute path to the skill file
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub path: Option<String>,
-    /// The project path this skill belongs to (only for project/inherited skills)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub project_path: Option<String>,
-    /// Source location type (e.g., project, personal-copilot, plugin, builtin)
-    pub source: SkillSource,
-    /// Whether the skill can be invoked by the user as a slash command
-    pub user_invocable: bool,
+pub struct RemoteControlStatusOff {
+    /// Remote control state tag: not connected.
+    pub state: RemoteControlStatusOffState,
 }
 
-/// Skills discovered across global and project sources.
+/// Wrapper for the singleton's current status.
 ///
 /// <div class="warning">
 ///
@@ -14121,15 +14114,12 @@ pub struct ServerSkill {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ServerSkillList {
-    /// Messages for skills that failed to load (e.g. malformed SKILL.md). Empty when host skills are excluded so host-local paths are not disclosed to multitenant callers.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub errors: Option<Vec<String>>,
-    /// All discovered skills across all sources
-    pub skills: Vec<ServerSkill>,
+pub struct RemoteControlStatusResult {
+    /// State of the runtime-managed remote-control singleton.
+    pub status: serde_json::Value,
 }
 
-/// Current activity flags for the session.
+/// Outcome of a stopRemoteControl call.
 ///
 /// <div class="warning">
 ///
@@ -14139,14 +14129,14 @@ pub struct ServerSkillList {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionActivity {
-    /// Whether an in-flight operation can currently be aborted.
-    pub abortable: bool,
-    /// Whether the session currently has active work, including running turns or tasks.
-    pub has_active_work: bool,
+pub struct RemoteControlStopResult {
+    /// State of the runtime-managed remote-control singleton.
+    pub status: serde_json::Value,
+    /// Whether the singleton was actually torn down by this call.
+    pub stopped: bool,
 }
 
-/// Current authentication information, or null when no authentication is active.
+/// Outcome of a transferRemoteControl call.
 ///
 /// <div class="warning">
 ///
@@ -14156,23 +14146,14 @@ pub struct SessionActivity {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionAuthInfoResult {
-    /// Snapshot of the authenticated user's Copilot subscription info, if known
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub copilot_user: Option<CopilotUserResponse>,
-    /// Name of the environment variable that supplied the credential, when applicable
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub env_var: Option<String>,
-    /// Authentication host
-    pub host: String,
-    /// Authenticated login, when available
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub login: Option<String>,
-    /// Authentication type
-    pub r#type: AuthInfoType,
+pub struct RemoteControlTransferResult {
+    /// State of the runtime-managed remote-control singleton.
+    pub status: serde_json::Value,
+    /// Whether the rebinding actually happened.
+    pub transferred: bool,
 }
 
-/// Internal GitHub login parameters.
+/// Optional remote session mode ("off", "export", or "on"); defaults to enabling both export and remote steering.
 ///
 /// <div class="warning">
 ///
@@ -14182,19 +14163,13 @@ pub struct SessionAuthInfoResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionAuthLoginRequest {
-    /// GitHub host URL
-    pub host: String,
-    /// GitHub login
-    pub login: String,
-    /// Whether to persist the token after login
+pub struct RemoteEnableRequest {
+    /// Per-session remote mode. "off" disables remote, "export" exports session events to GitHub without enabling remote steering, "on" enables both export and remote steering.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub persist: Option<bool>,
-    /// GitHub authentication token
-    pub token: String,
+    pub mode: Option<RemoteSessionMode>,
 }
 
-/// Parameters identifying a GitHub authentication to log out.
+/// GitHub URL for the session and a flag indicating whether remote steering is enabled.
 ///
 /// <div class="warning">
 ///
@@ -14202,14 +14177,17 @@ pub struct SessionAuthLoginRequest {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionAuthLogoutUserRequest {
-    /// Authentication information to log out
-    pub auth_info: AuthInfo,
+pub struct RemoteEnableResult {
+    /// Whether remote steering is enabled
+    pub remote_steerable: bool,
+    /// GitHub frontend URL for this session
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub url: Option<String>,
 }
 
-/// Authentication status and account metadata for the session.
+/// New remote-steerability state to persist as a `session.remote_steerable_changed` event.
 ///
 /// <div class="warning">
 ///
@@ -14219,27 +14197,12 @@ pub struct SessionAuthLogoutUserRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionAuthStatus {
-    /// Authentication type
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub auth_type: Option<AuthInfoType>,
-    /// Copilot plan tier (e.g., individual_pro, business)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub copilot_plan: Option<String>,
-    /// Authentication host URL
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub host: Option<String>,
-    /// Whether the session has resolved authentication
-    pub is_authenticated: bool,
-    /// Authenticated login/username, if available
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub login: Option<String>,
-    /// Human-readable authentication status description
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub status_message: Option<String>,
+pub struct RemoteNotifySteerableChangedRequest {
+    /// Whether the session now supports remote steering via GitHub. The runtime persists this as a `session.remote_steerable_changed` event so resume/replay sees the up-to-date capability.
+    pub remote_steerable: bool,
 }
 
-/// Parameters for switching the session's active authentication.
+/// Persist a steerability change as a `session.remote_steerable_changed` event. Used by the host (CLI / SDK consumer) when it has just finished enabling or disabling steering on a remote exporter that the runtime does not directly own.
 ///
 /// <div class="warning">
 ///
@@ -14247,17 +14210,11 @@ pub struct SessionAuthStatus {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionAuthSwitchRequest {
-    /// Authentication information to activate
-    pub auth_info: AuthInfo,
-    /// Optional token paired with the authentication information
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub token: Option<String>,
-}
+pub struct RemoteNotifySteerableChangedResult {}
 
-/// Map of sessionId -> bytes freed by removing the session's workspace directory.
+/// Remote session connection result.
 ///
 /// <div class="warning">
 ///
@@ -14267,59 +14224,88 @@ pub struct SessionAuthSwitchRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionBulkDeleteResult {
-    /// Map of sessionId -> bytes freed by removing the session's workspace directory. Sessions whose deletion failed are omitted from this map (failures are logged on the server but not surfaced per-id; check the map for absent IDs to detect them).
-    pub freed_bytes: HashMap<String, i64>,
-}
-
-/// The six normalized `/context` header buckets, computed from the same tokenization as `entries` so the two never disagree. Convenience rollups: `freeSpace` and `buffer` describe window capacity rather than occupied context, so the values do not sum to `totalTokens`.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionContextAttributionCategories {
-    /// Output reserve plus post-blocking-threshold buffer.
-    pub buffer: i64,
-    /// Custom-instructions tokens (0 when none are configured).
-    pub custom_instructions: i64,
-    /// Remaining unused window capacity (clamped at 0).
-    pub free_space: i64,
-    /// MCP tool-definition tokens.
-    pub mcp_tools: i64,
-    /// Conversation (user/assistant/tool) message tokens.
-    pub messages: i64,
-    /// System prompt tokens, excluding custom instructions.
-    pub system_prompt: i64,
-    /// Non-MCP tool-definition tokens.
-    pub system_tools: i64,
+pub struct RemoteSessionConnectionResult {
+    /// Metadata for a connected remote session.
+    pub metadata: ConnectedRemoteSessionMetadata,
+    /// SDK session ID for the connected remote session.
+    pub session_id: SessionId,
 }
 
-/// Successful compaction history for the session.
+/// GitHub repository the remote session belongs to.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionContextAttributionCompactions {
-    /// Number of successful compactions in this session.
-    pub count: i64,
+pub struct RemoteSessionMetadataRepository {
+    /// Branch associated with the remote session.
+    pub branch: String,
+    /// Repository name.
+    pub name: String,
+    /// Repository owner.
+    pub owner: String,
 }
 
+/// Remote session metadata for the session to hand off (typically obtained from `sessions.list` with `source: "remote"`).
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionContextAttributionEntriesItem {
-    /// Supplementary per-entry metadata (e.g. `messageCount`, `role`, `evictable`, `pluginSource`). Values are stringified; parse as needed and ignore unrecognized keys.
+pub struct RemoteSessionMetadataValue {
+    /// Most recent working directory context.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub attributes: Option<HashMap<String, String>>,
-    /// Identifier for this entry, formed by joining its `kind` and source name (e.g. `tool:bash`, `skill:tmux`, `toolDefinition:bash`); unique within the snapshot. Use it to match the same entry across snapshots, to correlate with other APIs (skill/agent/MCP registries), and as the `parentId` target for nesting. Distinct from the human-facing `label`.
-    pub id: String,
-    /// Source category for this entry. Not a closed set — tolerate unknown values. Known values today: `skill`, `subagent`, `mcpServer`, `tool`, `system`, `toolDefinition`, `plugin`.
-    pub kind: String,
-    /// Human-readable display label, e.g. `bash` or `skill: tmux`. Presentation-only; may be localized/reformatted without notice — do not key off it.
-    pub label: String,
-    /// Optional `id` of the parent entry: e.g. a `plugin` entry parenting its `skill`/`mcpServer` entries, or the `system` entry parenting `toolDefinition` entries. Omitted for top-level entries.
+    pub context: Option<SessionContext>,
+    /// Host-supplied human description of what the session is doing right now ("running tests", "waiting for approval"). Optional in the protocol and absent on hosts that do not publish it, so never rely on it -- it enriches `hostStatus`, it does not replace it.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub parent_id: Option<String>,
-    /// Token count currently in context attributable to this entry.
-    pub tokens: i64,
+    pub host_activity: Option<String>,
+    /// Live status as the owning host reports it in its session listing, so a row for a session running elsewhere can show that it is running. Absent for hosts that publish no such status (the cloud task managers), which read as idle.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub host_status: Option<RemoteSessionHostStatus>,
+    /// Always true for remote sessions.
+    pub is_remote: bool,
+    /// Last-modified time as an ISO 8601 timestamp.
+    pub modified_time: String,
+    /// Optional human-friendly name set via /rename.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    /// Pull request number associated with the session.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub pull_request_number: Option<i64>,
+    /// Backing remote session IDs (most recent first).
+    pub remote_session_ids: Vec<String>,
+    /// GitHub repository the remote session belongs to.
+    pub repository: RemoteSessionMetadataRepository,
+    /// Original remote resource identifier (task ID or PR node ID).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub resource_id: Option<String>,
+    /// Stable session identifier.
+    pub session_id: SessionId,
+    /// Deadline (ISO 8601) at which a CLI remote session becomes stale without further heartbeats.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub stale_at: Option<String>,
+    /// Session creation time as an ISO 8601 timestamp.
+    pub start_time: String,
+    /// Server-side task state returned by GitHub.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub state: Option<String>,
+    /// Short summary of the session, when one has been derived.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub summary: Option<String>,
+    /// Whether the remote task originated from CCA or CLI `--remote`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub task_type: Option<RemoteSessionMetadataTaskType>,
 }
 
-/// Per-source context-window attribution, or null if the session has not yet been initialized (no system prompt or tool metadata cached).
+/// Repository context for the remote session.
 ///
 /// <div class="warning">
 ///
@@ -14329,30 +14315,17 @@ pub struct SessionContextAttributionEntriesItem {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionContextAttribution {
-    /// Output reserve plus the tokens past the buffer-exhaustion blocking threshold. Mirrors `SessionContextInfo.bufferTokens`.
-    pub buffer_tokens: i64,
-    /// The six normalized `/context` header buckets, computed from the same tokenization as `entries` so the two never disagree. Convenience rollups: `freeSpace` and `buffer` describe window capacity rather than occupied context, so the values do not sum to `totalTokens`.
-    pub categories: SessionContextAttributionCategories,
-    /// Successful compaction history for the session.
-    pub compactions: SessionContextAttributionCompactions,
-    /// Token count at which background compaction starts. Mirrors `SessionContextInfo.compactionThreshold`.
-    pub compaction_threshold: i64,
-    /// Flat list of per-source attribution entries. Group by `kind` and render unrecognized kinds generically. Nesting and rollups are expressed via `parentId`.
-    pub entries: Vec<SessionContextAttributionEntriesItem>,
-    /// Prompt limit plus the model's output reserve: the full context window `categories.freeSpace` and `categories.buffer` are measured against. Mirrors `SessionContextInfo.limit`.
-    pub limit: i64,
-    /// The concrete model id the entire breakdown was tokenized against (feeds the per-model token multiplier). Under `Auto` (Free/Student) this is the resolved model, not the literal `auto` sentinel, so totals are not undercounted. A single-model approximation of a potentially multi-model Auto session.
-    pub model_id: String,
-    /// How `modelId` was chosen. Not a closed set — tolerate unknown values. Known values today: `autoResolved` (the model Auto resolved to), `selected` (the user's explicitly selected model), `default` (a fallback before any model is known).
-    pub model_source: String,
-    /// Maximum prompt tokens the resolved model accepts — the denominator for a `##k/###k` context-usage display. Mirrors `SessionContextInfo.promptTokenLimit`.
-    pub prompt_token_limit: i64,
-    /// Total token count of the current context window the entries are measured against (system message + conversation messages + tool definitions — the same total reported by /context). Divide an entry's `tokens` by this to derive its share.
-    pub total_tokens: i64,
+pub struct RemoteSessionRepository {
+    /// Optional branch associated with the remote session.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub branch: Option<String>,
+    /// Repository name.
+    pub name: String,
+    /// Repository owner or organization login.
+    pub owner: String,
 }
 
-/// Token breakdown for the current context window, or null if the session has not yet been initialized (no system prompt or tool metadata cached).
+/// Credential-injection capability flags applied while the sandbox is enabled. For the same capability independent of sandboxing, and matched to the credential's GitHub host, see `shell.credentials`; the two are additive.
 ///
 /// <div class="warning">
 ///
@@ -14362,30 +14335,16 @@ pub struct SessionContextAttribution {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionContextInfo {
-    /// Output reserve plus tokens after the buffer-exhaustion blocking threshold (default 95%)
-    pub buffer_tokens: i64,
-    /// Token count at which background compaction starts (configurable percentage of promptTokenLimit)
-    pub compaction_threshold: i64,
-    /// Tokens consumed by user/assistant/tool messages
-    pub conversation_tokens: i64,
-    /// Prompt token limit plus the model's full output token limit.
-    pub limit: i64,
-    /// Tokens consumed by MCP tool definitions (subset of toolDefinitionsTokens, excludes deferred tools)
-    pub mcp_tools_tokens: i64,
-    /// The model used for token counting
-    pub model_name: String,
-    /// Maximum prompt tokens allowed by the model (or DEFAULT_TOKEN_LIMIT if unspecified)
-    pub prompt_token_limit: i64,
-    /// Tokens consumed by the system prompt
-    pub system_tokens: i64,
-    /// Tokens consumed by tool definitions sent to the model (excludes deferred tools)
-    pub tool_definitions_tokens: i64,
-    /// Sum of system, conversation and tool-definition tokens
-    pub total_tokens: i64,
+pub struct SandboxConfigAuth {
+    /// Whether to export `GH_TOKEN` so the `gh` CLI authenticates inside the sandbox without the OS keyring the sandbox blocks. Default: false (opt-in).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub gh: Option<bool>,
+    /// Whether to inject git credentials as an `http.<url>.extraheader` so authenticated HTTPS git works inside the sandbox without the shell-based credential helper the sandbox blocks. github.com is served by the Copilot token; every other forge (Azure DevOps, GitHub Enterprise Server, GitLab, ...) by a credential the host resolves from the user's own helper before the sandbox is applied. Default: false (opt-in).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub git: Option<bool>,
 }
 
-/// The enriched metadata records, with summary and context fields backfilled where available. Sessions confirmed empty and unnamed are omitted.
+/// macOS seatbelt experimental options.
 ///
 /// <div class="warning">
 ///
@@ -14395,12 +14354,13 @@ pub struct SessionContextInfo {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionEnrichMetadataResult {
-    /// Enriched records, with summary and context backfilled. Sessions confirmed empty and unnamed may be omitted.
-    pub sessions: Vec<LocalSessionMetadataValue>,
+pub struct SandboxConfigUserPolicyExperimentalSeatbelt {
+    /// Whether the macOS seatbelt profile may access the keychain.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub keychain_access: Option<bool>,
 }
 
-/// File path, content to append, and optional mode for the client-provided session filesystem.
+/// Platform-specific experimental policy fields.
 ///
 /// <div class="warning">
 ///
@@ -14410,19 +14370,13 @@ pub struct SessionEnrichMetadataResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsAppendFileRequest {
-    /// Target session identifier
-    pub session_id: SessionId,
-    /// Path using SessionFs conventions
-    pub path: String,
-    /// Content to append
-    pub content: String,
-    /// Optional POSIX-style mode for newly created files
+pub struct SandboxConfigUserPolicyExperimental {
+    /// macOS seatbelt experimental options.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub mode: Option<i64>,
+    pub seatbelt: Option<SandboxConfigUserPolicyExperimentalSeatbelt>,
 }
 
-/// Describes a filesystem error.
+/// Filesystem rules to merge into the base policy.
 ///
 /// <div class="warning">
 ///
@@ -14432,15 +14386,22 @@ pub struct SessionFsAppendFileRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsError {
-    /// Error classification
-    pub code: SessionFsErrorCode,
-    /// Free-form detail about the error, for logging/diagnostics
+pub struct SandboxConfigUserPolicyFilesystem {
+    /// Whether to clear the policy when the session exits.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub message: Option<String>,
+    pub clear_policy_on_exit: Option<bool>,
+    /// Paths explicitly denied.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub denied_paths: Option<Vec<String>>,
+    /// Paths granted read-only access.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub readonly_paths: Option<Vec<String>>,
+    /// Paths granted read/write access.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub readwrite_paths: Option<Vec<String>>,
 }
 
-/// Path to test for existence in the client-provided session filesystem.
+/// HTTP proxy configuration for sandboxed traffic.
 ///
 /// <div class="warning">
 ///
@@ -14450,14 +14411,18 @@ pub struct SessionFsError {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsExistsRequest {
-    /// Target session identifier
-    pub session_id: SessionId,
-    /// Path using SessionFs conventions
-    pub path: String,
+pub struct SandboxConfigUserPolicyNetworkProxy {
+    /// Optional password for proxy authentication, combined with the URL at spawn time. The persisted value may be a literal password, a `${secret:…}` reference resolved from the OS keychain, or a `${VAR}`/`$VAR` environment reference; it is resolved just before the sandboxed process routes through the proxy. The /sandbox dialog stores a real password in the OS keychain and persists only a `${secret:…}` placeholder (never plaintext in settings.json); the field is masked in the dialog and redacted by /settings show.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub password: Option<String>,
+    /// Proxy URL (e.g. http://proxy.example.com:8080). The port is optional and defaults to the scheme's standard port when omitted. Credentials must not be embedded here — a `user:pass@` authority is rejected; put them in the separate `username`/`password` fields. A credential-free http:// loopback URL is routed through the localhost proxy automatically; loopback covers localhost and any *.localhost subdomain, the whole 127.0.0.0/8 range, ::1, and IPv4-mapped loopback (::ffff:127.0.0.1). An https:// URL, or one with a username/password set, is used as-is.
+    pub url: String,
+    /// Optional username for proxy authentication. Combined with the URL (and `password`) into `user:pass@host` when the sandboxed process routes through the proxy.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub username: Option<String>,
 }
 
-/// Indicates whether the requested path exists in the client-provided session filesystem.
+/// Network rules to merge into the base policy.
 ///
 /// <div class="warning">
 ///
@@ -14467,12 +14432,19 @@ pub struct SessionFsExistsRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsExistsResult {
-    /// Whether the path exists
-    pub exists: bool,
+pub struct SandboxConfigUserPolicyNetwork {
+    /// Whether traffic to local/loopback addresses is allowed.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub allow_local_network: Option<bool>,
+    /// Whether outbound network traffic is allowed at all.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub allow_outbound: Option<bool>,
+    /// HTTP proxy the sandboxed process routes traffic through. Enforced on Windows and cooperative (honored by well-behaved tools, not strictly enforced) on Linux and macOS. Credentials go in the separate `username`/`password` fields. A credential-free http:// loopback proxy URL is routed through the localhost proxy automatically; an https:// or authenticated loopback URL is used as-is.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub proxy: Option<SandboxConfigUserPolicyNetworkProxy>,
 }
 
-/// Directory path to create in the client-provided session filesystem, with options for recursive creation and POSIX mode.
+/// macOS seatbelt-specific options.
 ///
 /// <div class="warning">
 ///
@@ -14482,20 +14454,13 @@ pub struct SessionFsExistsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsMkdirRequest {
-    /// Target session identifier
-    pub session_id: SessionId,
-    /// Path using SessionFs conventions
-    pub path: String,
-    /// Create parent directories as needed
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub recursive: Option<bool>,
-    /// Optional POSIX-style mode for newly created directories
+pub struct SandboxConfigUserPolicySeatbelt {
+    /// Whether the macOS seatbelt profile may access the keychain.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub mode: Option<i64>,
+    pub keychain_access: Option<bool>,
 }
 
-/// Directory path whose entries should be listed from the client-provided session filesystem.
+/// User-managed sandbox policy fragment merged into the auto-discovered base policy.
 ///
 /// <div class="warning">
 ///
@@ -14505,14 +14470,22 @@ pub struct SessionFsMkdirRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsReaddirRequest {
-    /// Target session identifier
-    pub session_id: SessionId,
-    /// Path using SessionFs conventions
-    pub path: String,
+pub struct SandboxConfigUserPolicy {
+    /// Deprecated legacy location for `seatbelt`; read only when the top-level `seatbelt` is absent.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub experimental: Option<SandboxConfigUserPolicyExperimental>,
+    /// Filesystem rules to merge into the base policy.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub filesystem: Option<SandboxConfigUserPolicyFilesystem>,
+    /// Network rules to merge into the base policy.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub network: Option<SandboxConfigUserPolicyNetwork>,
+    /// macOS seatbelt options to merge into the base policy.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub seatbelt: Option<SandboxConfigUserPolicySeatbelt>,
 }
 
-/// Names of entries in the requested directory, or a filesystem error if the read failed.
+/// Resolved sandbox configuration.
 ///
 /// <div class="warning">
 ///
@@ -14522,15 +14495,24 @@ pub struct SessionFsReaddirRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsReaddirResult {
-    /// Entry names in the directory
-    pub entries: Vec<String>,
-    /// Describes a filesystem error.
+pub struct SandboxConfig {
+    /// Whether to auto-add the current working directory to readwritePaths. Default: true.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<SessionFsError>,
+    pub add_current_working_directory: Option<bool>,
+    /// Whether to auto-grant read access to the tool directories discovered on PATH and in toolchain environment variables (GOROOT, CARGO_HOME, JAVA_HOME, VIRTUAL_ENV, and similar), and to common developer-tool caches, registries, and toolchains in their default home locations (cargo, go, npm, Maven, and more), plus read-write access to (and, on Unix, up-front creation of) the scratch caches builds write on every run (go-build, ccache, sccache, Gradle caches, Cargo lock/tracker files), so builds work without extra configuration; a relocated CARGO_HOME additionally gets its Cargo lock files granted read-write. Set to false to disable every grant listed above: user-installed toolchains (rustup, nvm, pyenv, conda, pipx) then need explicit userPolicy.filesystem entries — readonlyPaths to read them, plus readwriteFiles for a relocated CARGO_HOME's .package-cache and .global-cache, which Cargo locks on every build. Only these developer-tool grants are affected: the working directory (see addCurrentWorkingDirectory), temporary storage, session log paths, and system locations follow their own rules and stay granted, so commands still run. Default: true (enabled by default; set to false to opt out).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub allow_dev_tool_access: Option<bool>,
+    /// Credential-injection capability flags.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub auth: Option<SandboxConfigAuth>,
+    /// Whether sandboxing is enabled for the session.
+    pub enabled: bool,
+    /// User-managed sandbox policy fragment merged into the auto-discovered base policy.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub user_policy: Option<SandboxConfigUserPolicy>,
 }
 
-/// Directory entry returned by session filesystem `readdirWithTypes`, with name and entry type.
+/// Register an absolute-time scheduled prompt.
 ///
 /// <div class="warning">
 ///
@@ -14540,31 +14522,20 @@ pub struct SessionFsReaddirResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsReaddirWithTypesEntry {
-    /// Entry name
-    pub name: String,
-    /// Entry type
-    pub r#type: SessionFsReaddirWithTypesEntryType,
-}
-
-/// Directory path whose entries (with type information) should be listed from the client-provided session filesystem.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionFsReaddirWithTypesRequest {
-    /// Target session identifier
-    pub session_id: SessionId,
-    /// Path using SessionFs conventions
-    pub path: String,
+pub struct ScheduleAddAtRequest {
+    /// Epoch milliseconds when the prompt should fire.
+    pub at: i64,
+    /// Optional display-only prompt label.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub display_prompt: Option<String>,
+    /// Prompt text to enqueue when the schedule fires.
+    pub prompt: String,
+    /// Whether the schedule should re-arm after each tick. Defaults to false.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub recurring: Option<bool>,
 }
 
-/// Entries in the requested directory paired with file/directory type information, or a filesystem error if the read failed.
+/// Register a cron scheduled prompt.
 ///
 /// <div class="warning">
 ///
@@ -14574,15 +14545,23 @@ pub struct SessionFsReaddirWithTypesRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsReaddirWithTypesResult {
-    /// Directory entries with type information
-    pub entries: Vec<SessionFsReaddirWithTypesEntry>,
-    /// Describes a filesystem error.
+pub struct ScheduleAddCronRequest {
+    /// 5-field cron expression.
+    pub cron: String,
+    /// Optional display-only prompt label.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<SessionFsError>,
+    pub display_prompt: Option<String>,
+    /// Prompt text to enqueue when the schedule fires.
+    pub prompt: String,
+    /// Whether the schedule should re-arm after each tick. Defaults to true.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub recurring: Option<bool>,
+    /// IANA timezone for evaluating the cron expression.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tz: Option<String>,
 }
 
-/// Path of the file to read from the client-provided session filesystem.
+/// Register a relative-interval scheduled prompt.
 ///
 /// <div class="warning">
 ///
@@ -14592,14 +14571,20 @@ pub struct SessionFsReaddirWithTypesResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsReadFileRequest {
-    /// Target session identifier
-    pub session_id: SessionId,
-    /// Path using SessionFs conventions
-    pub path: String,
+pub struct ScheduleAddRequest {
+    /// Optional display-only prompt label.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub display_prompt: Option<String>,
+    /// Human-readable interval such as `30s`, `5m`, or `2h`.
+    pub interval: String,
+    /// Prompt text to enqueue when the schedule fires.
+    pub prompt: String,
+    /// Whether the schedule should re-arm after each tick. Defaults to true.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub recurring: Option<bool>,
 }
 
-/// File content as a UTF-8 string, or a filesystem error if the read failed.
+/// Scheduled prompt entry with ID, timing (`intervalMs`, `cron`, or `at`), prompt text, recurrence, and next run time.
 ///
 /// <div class="warning">
 ///
@@ -14609,15 +14594,36 @@ pub struct SessionFsReadFileRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsReadFileResult {
-    /// File content as UTF-8 string
-    pub content: String,
-    /// Describes a filesystem error.
+pub struct ScheduleEntry {
+    /// Absolute fire time (epoch milliseconds) for a one-shot calendar schedule.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<SessionFsError>,
+    pub at: Option<i64>,
+    /// 5-field cron expression for a recurring calendar schedule, evaluated in `tz`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cron: Option<String>,
+    /// Display-only label for the prompt as shown in the UI (e.g. `/skill-name` for a skill-invocation schedule). The actual enqueued prompt is `prompt`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub display_prompt: Option<String>,
+    /// Sequential id assigned by the runtime within the session. Stable across resumes (rebuilt from the event log).
+    pub id: i64,
+    /// Interval between scheduled ticks, in milliseconds (relative-interval schedules).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub interval_ms: Option<i64>,
+    /// ISO 8601 timestamp when the next tick is scheduled to fire.
+    pub next_run_at: String,
+    /// Prompt text that gets enqueued on every tick.
+    pub prompt: String,
+    /// Whether the schedule re-arms after each tick (`/every`) or fires once (`/after`).
+    pub recurring: bool,
+    /// True for a self-paced (`dynamic`) schedule: no fixed cadence; the model arms each next run via the `manage_schedule` `wakeup` action. `nextRunAt` is model-controlled.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub self_paced: Option<bool>,
+    /// IANA timezone the `cron` expression is evaluated in.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tz: Option<String>,
 }
 
-/// Source and destination paths for renaming or moving an entry in the client-provided session filesystem.
+/// Result of registering or re-arming a scheduled prompt.
 ///
 /// <div class="warning">
 ///
@@ -14627,16 +14633,16 @@ pub struct SessionFsReadFileResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsRenameRequest {
-    /// Target session identifier
-    pub session_id: SessionId,
-    /// Source path using SessionFs conventions
-    pub src: String,
-    /// Destination path using SessionFs conventions
-    pub dest: String,
+pub struct ScheduleAddResult {
+    /// The registered or updated schedule entry.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub entry: Option<ScheduleEntry>,
+    /// User-facing validation error, when registration failed.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
 }
 
-/// Path to remove from the client-provided session filesystem, with options for recursive removal and force.
+/// Register a self-paced scheduled prompt.
 ///
 /// <div class="warning">
 ///
@@ -14646,20 +14652,15 @@ pub struct SessionFsRenameRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsRmRequest {
-    /// Target session identifier
-    pub session_id: SessionId,
-    /// Path using SessionFs conventions
-    pub path: String,
-    /// Remove directories and their contents recursively
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub recursive: Option<bool>,
-    /// Ignore errors if the path does not exist
+pub struct ScheduleAddSelfPacedRequest {
+    /// Optional display-only prompt label.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub force: Option<bool>,
+    pub display_prompt: Option<String>,
+    /// Prompt text to enqueue when the schedule fires.
+    pub prompt: String,
 }
 
-/// Optional capabilities declared by the provider
+/// Whether the session currently has an active self-paced schedule.
 ///
 /// <div class="warning">
 ///
@@ -14669,13 +14670,12 @@ pub struct SessionFsRmRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsSetProviderCapabilities {
-    /// Whether the provider supports SQLite query/exists operations
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub sqlite: Option<bool>,
+pub struct ScheduleHasSelfPacedResult {
+    /// True when at least one active schedule is self-paced.
+    pub has_self_paced: bool,
 }
 
-/// Initial working directory, session-state path layout, and path conventions used to register the calling SDK client as the session filesystem provider.
+/// Snapshot of the currently active recurring prompts for this session.
 ///
 /// <div class="warning">
 ///
@@ -14685,19 +14685,12 @@ pub struct SessionFsSetProviderCapabilities {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsSetProviderRequest {
-    /// Optional capabilities declared by the provider
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub capabilities: Option<SessionFsSetProviderCapabilities>,
-    /// Path conventions used by this filesystem
-    pub conventions: SessionFsSetProviderConventions,
-    /// Initial working directory for sessions
-    pub initial_cwd: String,
-    /// Path within each session's SessionFs where the runtime stores files for that session
-    pub session_state_path: String,
+pub struct ScheduleList {
+    /// Active scheduled prompts, ordered by id.
+    pub entries: Vec<ScheduleEntry>,
 }
 
-/// Indicates whether the calling client was registered as the session filesystem provider.
+/// Re-arm a self-paced scheduled prompt.
 ///
 /// <div class="warning">
 ///
@@ -14707,12 +14700,14 @@ pub struct SessionFsSetProviderRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsSetProviderResult {
-    /// Whether the provider was set successfully
-    pub success: bool,
+pub struct ScheduleRearmSelfPacedRequest {
+    /// Epoch milliseconds when the prompt should next fire.
+    pub at: i64,
+    /// Id of the self-paced scheduled prompt.
+    pub id: i64,
 }
 
-/// Indicates whether the per-session SQLite database already exists.
+/// Identifier of the scheduled prompt to remove.
 ///
 /// <div class="warning">
 ///
@@ -14722,12 +14717,12 @@ pub struct SessionFsSetProviderResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsSqliteExistsResult {
-    /// Whether the session database already exists
-    pub exists: bool,
+pub struct ScheduleStopRequest {
+    /// Id of the scheduled prompt to remove.
+    pub id: i64,
 }
 
-/// SQL query, query type, and optional bind parameters for executing a SQLite query against the per-session database. The provider applies its SQLite busy timeout for every call.
+/// Remove a scheduled prompt by id. The result entry is omitted if the id was unknown.
 ///
 /// <div class="warning">
 ///
@@ -14737,19 +14732,13 @@ pub struct SessionFsSqliteExistsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsSqliteQueryRequest {
-    /// Target session identifier
-    pub session_id: SessionId,
-    /// SQL query to execute
-    pub query: String,
-    /// How to execute the query: 'exec' for DDL/multi-statement (no results), 'query' for SELECT (returns rows), 'run' for INSERT/UPDATE/DELETE (returns rowsAffected)
-    pub query_type: SessionFsSqliteQueryType,
-    /// Optional named bind parameters
+pub struct ScheduleStopResult {
+    /// The removed entry, or omitted if no entry matched.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub params: Option<HashMap<String, serde_json::Value>>,
+    pub entry: Option<ScheduleEntry>,
 }
 
-/// Query results including rows, columns, and rows affected, or a filesystem error if execution failed.
+/// Secret values to add to the redaction filter.
 ///
 /// <div class="warning">
 ///
@@ -14759,22 +14748,12 @@ pub struct SessionFsSqliteQueryRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsSqliteQueryResult {
-    /// Column names from the result set
-    pub columns: Vec<String>,
-    /// Describes a filesystem error.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<SessionFsError>,
-    /// SQLite last_insert_rowid() value for INSERT.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub last_insert_rowid: Option<i64>,
-    /// For SELECT: array of row objects. For others: empty array.
-    pub rows: Vec<HashMap<String, serde_json::Value>>,
-    /// Number of rows affected (for INSERT/UPDATE/DELETE)
-    pub rows_affected: i64,
+pub struct SecretsAddFilterValuesRequest {
+    /// Raw secret values to register for redaction
+    pub values: Vec<String>,
 }
 
-/// Classified SQLite transaction failure. busyOrLocked guarantees rollback; postCommitAmbiguous must never be retried.
+/// Confirmation that the secret values were registered.
 ///
 /// <div class="warning">
 ///
@@ -14784,14 +14763,12 @@ pub struct SessionFsSqliteQueryResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsSqliteTransactionError {
-    /// Machine-readable classification of the transaction failure.
-    pub error_class: SessionFsSqliteTransactionErrorClass,
-    /// Human-readable transaction failure message.
-    pub message: String,
+pub struct SecretsAddFilterValuesResult {
+    /// Whether the values were successfully registered
+    pub ok: bool,
 }
 
-/// One statement in an atomic SQLite transaction.
+/// Parameters for session.extensions.sendAttachmentsToMessage.
 ///
 /// <div class="warning">
 ///
@@ -14801,17 +14778,15 @@ pub struct SessionFsSqliteTransactionError {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsSqliteTransactionStatement {
-    /// Optional named bind parameters.
+pub struct SendAttachmentsToMessageParams {
+    /// Attachments to push into the next user-message turn. extension_context entries take the slim shape; standard variants take their full AttachmentSchema shape.
+    pub attachments: Vec<serde_json::Value>,
+    /// Optional canvas instance binding the push for provenance. When supplied, the runtime resolves the canvas, verifies it is owned by the calling extension, and stamps canvasId/instanceId onto each extension_context entry. When omitted, no resolution runs and those fields stay unset on the attachment.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub params: Option<HashMap<String, serde_json::Value>>,
-    /// SQL statement to execute.
-    pub query: String,
-    /// How to execute the statement.
-    pub query_type: SessionFsSqliteQueryType,
+    pub instance_id: Option<String>,
 }
 
-/// Statements to execute atomically. Providers apply busy handling for every call.
+/// A single user message to append to the session as part of a `session.sendMessages` turn
 ///
 /// <div class="warning">
 ///
@@ -14821,14 +14796,29 @@ pub struct SessionFsSqliteTransactionStatement {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsSqliteTransactionRequest {
-    /// Target session identifier
-    pub session_id: SessionId,
-    /// Ordered SQL statements to execute in one transaction.
-    pub statements: Vec<SessionFsSqliteTransactionStatement>,
+pub struct SendMessageItem {
+    /// Optional attachments (files, directories, selections, blobs, GitHub references) to include with this message
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub attachments: Option<Vec<serde_json::Value>>,
+    /// If false, this message will not trigger a Premium Request Unit charge. User messages default to billable.
+    #[doc(hidden)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(crate) billable: Option<bool>,
+    /// If provided, this is shown in the timeline instead of `prompt`
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub display_prompt: Option<String>,
+    /// The user message text
+    pub prompt: String,
+    /// If set, the request will fail if the named tool is not available when this message is among the user messages at the start of the current exchange
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub required_tool: Option<String>,
+    /// Optional provenance tag copied to the resulting user.message event. Must be `user`, `system`, `command-<command-id>` for command-originated messages, `schedule-<numeric-id>` for scheduled prompts, or `agent-<agent-id>` for prompts sent by another agent.
+    #[doc(hidden)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(crate) source: Option<String>,
 }
 
-/// Per-statement results, or a classified transaction error.
+/// Parameters for sending zero or more user messages to the session in a single turn. Remote-backed (Mission Control) sessions do not support this method and will return an error.
 ///
 /// <div class="warning">
 ///
@@ -14838,15 +14828,33 @@ pub struct SessionFsSqliteTransactionRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsSqliteTransactionResult {
-    /// Classified transaction failure, when execution did not succeed.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<SessionFsSqliteTransactionError>,
-    /// Per-statement query results in input order.
-    pub results: Vec<SessionFsSqliteQueryResult>,
+pub struct SendMessagesRequest {
+    /// The UI mode the agent was in when these messages were sent. Defaults to the session's current mode.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub agent_mode: Option<SendAgentMode>,
+    /// The user messages to append to the conversation, in order. May be empty, in which case a single turn runs over the existing history with no new user message.
+    pub messages: Vec<SendMessageItem>,
+    /// How to deliver the messages. `enqueue` (default) appends to the message queue. `immediate` interjects during an in-progress turn.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mode: Option<SendMode>,
+    /// If true, adds the messages to the front of the queue instead of the end
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub prepend: Option<bool>,
+    /// Custom HTTP headers to include in outbound model requests for this turn. Merged with session-level provider headers; per-turn headers augment and overwrite session-level headers with the same key.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub request_headers: Option<HashMap<String, String>>,
+    /// W3C Trace Context traceparent header for distributed tracing of this agent turn
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub traceparent: Option<String>,
+    /// W3C Trace Context tracestate header for distributed tracing
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tracestate: Option<String>,
+    /// If true, await completion of the agentic loop for this turn before returning. Defaults to false (fire-and-forget). When true, the result still contains the same `messageIds`; the caller can rely on the agent having processed the messages before the call resolves. Transport-dependent tail semantics: on a LOCAL (in-process) session the wait additionally blocks until the completed turn's event tail has been dispatched to this session's in-process subscribers, so a subsequent read of subscriber state already reflects the turn; on a REMOTE session the wait resolves once the loop completes and mirrored delivery follows over the wire. Callers that need the stronger local guarantee on remote sessions should await the event stream explicitly.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub wait: Option<bool>,
 }
 
-/// Path whose metadata should be returned from the client-provided session filesystem.
+/// Result of sending zero or more user messages
 ///
 /// <div class="warning">
 ///
@@ -14856,14 +14864,12 @@ pub struct SessionFsSqliteTransactionResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsStatRequest {
-    /// Target session identifier
-    pub session_id: SessionId,
-    /// Path using SessionFs conventions
-    pub path: String,
+pub struct SendMessagesResult {
+    /// Unique identifiers assigned to the messages, one per provided message in order. Empty when no messages were provided.
+    pub message_ids: Vec<String>,
 }
 
-/// Filesystem metadata for the requested path, or a filesystem error if the stat failed.
+/// Parameters for sending a user message to the session
 ///
 /// <div class="warning">
 ///
@@ -14873,23 +14879,49 @@ pub struct SessionFsStatRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsStatResult {
-    /// ISO 8601 timestamp of creation
-    pub birthtime: String,
-    /// Describes a filesystem error.
+pub struct SendRequest {
+    /// The UI mode the agent was in when this message was sent. Defaults to the session's current mode.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<SessionFsError>,
-    /// Whether the path is a directory
-    pub is_directory: bool,
-    /// Whether the path is a file
-    pub is_file: bool,
-    /// ISO 8601 timestamp of last modification
-    pub mtime: String,
-    /// File size in bytes
-    pub size: i64,
+    pub agent_mode: Option<SendAgentMode>,
+    /// Optional attachments (files, directories, selections, blobs, GitHub references) to include with the message
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub attachments: Option<Vec<serde_json::Value>>,
+    /// If false, this message will not trigger a Premium Request Unit charge. User messages default to billable.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub billable: Option<bool>,
+    /// If provided, this is shown in the timeline instead of `prompt`
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub display_prompt: Option<String>,
+    /// How to deliver the message. `enqueue` (default) appends to the message queue. `immediate` interjects during an in-progress turn.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mode: Option<SendMode>,
+    /// If true, adds the message to the front of the queue instead of the end
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub prepend: Option<bool>,
+    /// The user message text
+    pub prompt: String,
+    /// Custom HTTP headers to include in outbound model requests for this turn. Merged with session-level provider headers; per-turn headers augment and overwrite session-level headers with the same key.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub request_headers: Option<HashMap<String, String>>,
+    /// If set, the request will fail if the named tool is not available when this message is among the user messages at the start of the current exchange
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub required_tool: Option<String>,
+    /// Optional provenance tag copied to the resulting user.message event. Must be `user`, `system`, `command-<command-id>` for command-originated messages, `schedule-<numeric-id>` for scheduled prompts, or `agent-<agent-id>` for prompts sent by another agent.
+    #[doc(hidden)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(crate) source: Option<String>,
+    /// W3C Trace Context traceparent header for distributed tracing of this agent turn
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub traceparent: Option<String>,
+    /// W3C Trace Context tracestate header for distributed tracing
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tracestate: Option<String>,
+    /// If true, await completion of the agentic loop for this message before returning. Defaults to false (fire-and-forget). When true, the result still contains the same `messageId`; the caller can rely on the agent having processed the message before the call resolves. Transport-dependent tail semantics: on a LOCAL (in-process) session the wait additionally blocks until the completed turn's event tail has been dispatched to this session's in-process subscribers, so a subsequent read of subscriber state already reflects the turn; on a REMOTE session the wait resolves once the loop completes and mirrored delivery follows over the wire. Callers that need the stronger local guarantee on remote sessions should await the event stream explicitly.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub wait: Option<bool>,
 }
 
-/// File path, content to write, and optional mode for the client-provided session filesystem.
+/// Result of sending a user message
 ///
 /// <div class="warning">
 ///
@@ -14899,19 +14931,12 @@ pub struct SessionFsStatResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFsWriteFileRequest {
-    /// Target session identifier
-    pub session_id: SessionId,
-    /// Path using SessionFs conventions
-    pub path: String,
-    /// Content to write
-    pub content: String,
-    /// Optional POSIX-style mode for newly created files
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mode: Option<i64>,
+pub struct SendResult {
+    /// Unique identifier assigned to the message
+    pub message_id: String,
 }
 
-/// Installed plugin record for a session, with marketplace, version, install time, enabled state, cache path, and source.
+/// Internal request for sending a system notification.
 ///
 /// <div class="warning">
 ///
@@ -14921,31 +14946,18 @@ pub struct SessionFsWriteFileRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionInstalledPlugin {
-    /// Path where the plugin is cached locally
-    #[serde(rename = "cache_path", skip_serializing_if = "Option::is_none")]
-    pub cache_path: Option<String>,
-    /// Whether the plugin is currently enabled
-    pub enabled: bool,
-    /// Installation timestamp (ISO-8601)
-    #[serde(rename = "installed_at")]
-    pub installed_at: String,
-    /// Marketplace the plugin came from (empty string for direct repo installs)
-    pub marketplace: String,
-    /// Plugin name
-    pub name: String,
-    /// Source descriptor for direct repo installs (when marketplace is empty)
+pub struct SendSystemNotificationRequest {
+    /// Optional structured notification kind.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub source: Option<serde_json::Value>,
-    /// Per-plugin source fingerprint (a SHA-256 hash of the plugin's catalog source spec plus its resolved source subtree — NOT a Git commit SHA) captured at marketplace install/update time. Auto-update compares it against the freshly recomputed fingerprint to detect a content change that does not bump the version. Absent for pre-existing installs and for direct (non-marketplace) installs.
-    #[serde(rename = "source_sha", skip_serializing_if = "Option::is_none")]
-    pub source_sha: Option<String>,
-    /// Installed version, if known
+    pub kind: Option<serde_json::Value>,
+    /// Notification text to deliver to the model.
+    pub message: String,
+    /// Internal delivery options, including passive policy.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub version: Option<String>,
+    pub options: Option<serde_json::Value>,
 }
 
-/// Source descriptor for a direct GitHub plugin install, with `owner/repo`, optional ref or full commit SHA, and optional subpath.
+/// Agents discovered across user, project, plugin, and remote sources.
 ///
 /// <div class="warning">
 ///
@@ -14955,23 +14967,12 @@ pub struct SessionInstalledPlugin {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionInstalledPluginSourceGitHub {
-    /// Optional repository-relative path to the plugin.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub path: Option<String>,
-    /// Optional Git ref to resolve.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub r#ref: Option<String>,
-    /// GitHub repository in `owner/repo` form.
-    pub repo: String,
-    /// Optional full 40-character hexadecimal commit SHA.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub sha: Option<String>,
-    /// Constant value. Always "github".
-    pub source: SessionInstalledPluginSourceGitHubSource,
+pub struct ServerAgentList {
+    /// All discovered agents across all sources
+    pub agents: Vec<AgentInfo>,
 }
 
-/// Source descriptor for a direct local plugin install, with a local filesystem path.
+/// Instruction sources discovered across user, repository, and plugin sources.
 ///
 /// <div class="warning">
 ///
@@ -14981,14 +14982,12 @@ pub struct SessionInstalledPluginSourceGitHub {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionInstalledPluginSourceLocal {
-    /// Local filesystem path to the plugin.
-    pub path: String,
-    /// Constant value. Always "local".
-    pub source: SessionInstalledPluginSourceLocalSource,
+pub struct ServerInstructionSourceList {
+    /// All discovered instruction sources
+    pub sources: Vec<InstructionSource>,
 }
 
-/// Source descriptor for a direct URL plugin install, with URL, optional ref or full commit SHA, and optional subpath.
+/// Server-side skill metadata, including name, description, source, enabled/invocable state, path, project path, and argument hint.
 ///
 /// <div class="warning">
 ///
@@ -14998,23 +14997,32 @@ pub struct SessionInstalledPluginSourceLocal {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionInstalledPluginSourceUrl {
-    /// Optional source-relative path to the plugin.
+pub struct ServerSkill {
+    /// Optional freeform hint describing the skill's expected arguments, from the `argument-hint` frontmatter field
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub path: Option<String>,
-    /// Optional Git ref to resolve.
+    pub argument_hint: Option<String>,
+    /// Canonical slash command name used to invoke the skill, without the leading '/'
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub r#ref: Option<String>,
-    /// Optional full 40-character hexadecimal commit SHA.
+    pub command_name: Option<String>,
+    /// Description of what the skill does
+    pub description: String,
+    /// Whether the skill is currently enabled (based on global config)
+    pub enabled: bool,
+    /// Unique identifier for the skill
+    pub name: String,
+    /// Absolute path to the skill file
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub sha: Option<String>,
-    /// Constant value. Always "url".
-    pub source: SessionInstalledPluginSourceUrlSource,
-    /// URL of the plugin source.
-    pub url: String,
+    pub path: Option<String>,
+    /// The project path this skill belongs to (only for project/inherited skills)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub project_path: Option<String>,
+    /// Source location type (e.g., project, personal-copilot, plugin, builtin)
+    pub source: SkillSource,
+    /// Whether the skill can be invoked by the user as a slash command
+    pub user_invocable: bool,
 }
 
-/// Baseline data provenance for a prediction.
+/// Skills discovered across global and project sources.
 ///
 /// <div class="warning">
 ///
@@ -15024,14 +15032,15 @@ pub struct SessionInstalledPluginSourceUrl {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionLimitPredictionBaselineData {
-    /// End of the baseline data slice.
-    pub window_end: String,
-    /// Start of the baseline data slice.
-    pub window_start: String,
+pub struct ServerSkillList {
+    /// Messages for skills that failed to load (e.g. malformed SKILL.md). Empty when host skills are excluded so host-local paths are not disclosed to multitenant callers.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub errors: Option<Vec<String>>,
+    /// All discovered skills across all sources
+    pub skills: Vec<ServerSkill>,
 }
 
-/// Semantic usage tier and its AI-credit cap.
+/// Current activity flags for the session.
 ///
 /// <div class="warning">
 ///
@@ -15041,14 +15050,14 @@ pub struct SessionLimitPredictionBaselineData {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionLimitPredictionTierOption {
-    /// AI-credit cap for this tier.
-    pub cap: f64,
-    /// Semantic usage tier.
-    pub tier: SessionLimitPredictionTier,
+pub struct SessionActivity {
+    /// Whether an in-flight operation can currently be aborted.
+    pub abortable: bool,
+    /// Whether the session currently has active work, including running turns or tasks.
+    pub has_active_work: bool,
 }
 
-/// Explainable AI-credit session-limit prediction.
+/// Current authentication information, or null when no authentication is active.
 ///
 /// <div class="warning">
 ///
@@ -15058,29 +15067,23 @@ pub struct SessionLimitPredictionTierOption {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionLimitPredictionDetails {
-    /// Baseline data provenance.
-    pub baseline_data: SessionLimitPredictionBaselineData,
-    /// Client population used for the prediction.
-    pub client_type: SessionLimitPredictionClientType,
-    /// Resolved model family when known.
+pub struct SessionAuthInfoResult {
+    /// Snapshot of the authenticated user's Copilot subscription info, if known
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub family: Option<String>,
-    /// Model identifier used for lookup.
-    pub model_id: String,
-    /// Recommended maximum AI credits for this session.
-    pub recommended_cap: f64,
-    /// Tier chosen as the recommended cap.
-    pub recommended_tier: SessionLimitPredictionTier,
-    /// Baseline fallback level used to create the prediction.
-    pub source: SessionLimitPredictionSource,
-    /// Key matched at the source level, such as a model id, family id, or `global`.
-    pub source_key: String,
-    /// Ordered usage tiers and their AI-credit caps.
-    pub tiers: Vec<SessionLimitPredictionTierOption>,
+    pub copilot_user: Option<CopilotUserResponse>,
+    /// Name of the environment variable that supplied the credential, when applicable
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub env_var: Option<String>,
+    /// Authentication host
+    pub host: String,
+    /// Authenticated login, when available
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub login: Option<String>,
+    /// Authentication type
+    pub r#type: AuthInfoType,
 }
 
-/// Parameters for predicting an AI-credit session limit. Omitting `modelId` uses the session's currently selected model.
+/// Internal GitHub login parameters.
 ///
 /// <div class="warning">
 ///
@@ -15090,34 +15093,19 @@ pub struct SessionLimitPredictionDetails {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionLimitPredictionRequest {
-    /// Client type to size for. Defaults to `cli-interactive`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub client_type: Option<SessionLimitPredictionClientType>,
-    /// Optional model identifier override. If omitted, the session's current model is used.
+pub struct SessionAuthLoginRequest {
+    /// GitHub host URL
+    pub host: String,
+    /// GitHub login
+    pub login: String,
+    /// Whether to persist the token after login
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub model_id: Option<String>,
-}
-
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionLimitPredictionResultAvailable {
-    /// Prediction result variant discriminator.
-    pub kind: SessionLimitPredictionResultAvailableKind,
-    /// Predicted session limit details.
-    pub prediction: SessionLimitPredictionDetails,
-}
-
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionLimitPredictionResultUnavailable {
-    /// Prediction result variant discriminator.
-    pub kind: SessionLimitPredictionResultUnavailableKind,
-    /// Reason no prediction is available.
-    pub reason: SessionLimitPredictionUnavailableReason,
+    pub persist: Option<bool>,
+    /// GitHub authentication token
+    pub token: String,
 }
 
-/// Sessions matching the filter, ordered most-recently-modified first.
+/// Parameters identifying a GitHub authentication to log out.
 ///
 /// <div class="warning">
 ///
@@ -15125,14 +15113,14 @@ pub struct SessionLimitPredictionResultUnavailable {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionList {
-    /// Sessions ordered most-recently-modified first. Discriminated by `isRemote`.
-    pub sessions: Vec<serde_json::Value>,
+pub struct SessionAuthLogoutUserRequest {
+    /// Authentication information to log out
+    pub auth_info: AuthInfo,
 }
 
-/// Optional filter applied to the returned sessions
+/// Authentication status and account metadata for the session.
 ///
 /// <div class="warning">
 ///
@@ -15142,22 +15130,27 @@ pub struct SessionList {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionListFilter {
-    /// Match sessions whose context.branch equals this value
+pub struct SessionAuthStatus {
+    /// Authentication type
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub branch: Option<String>,
-    /// Match sessions whose context.cwd equals this value
+    pub auth_type: Option<AuthInfoType>,
+    /// Copilot plan tier (e.g., individual_pro, business)
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub cwd: Option<String>,
-    /// Match sessions whose context.gitRoot equals this value
+    pub copilot_plan: Option<String>,
+    /// Authentication host URL
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub git_root: Option<String>,
-    /// Match sessions whose context.repository equals this value
+    pub host: Option<String>,
+    /// Whether the session has resolved authentication
+    pub is_authenticated: bool,
+    /// Authenticated login/username, if available
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub repository: Option<String>,
+    pub login: Option<String>,
+    /// Human-readable authentication status description
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status_message: Option<String>,
 }
 
-/// Queued repo-level startup prompts and the total hook command count after loading.
+/// Parameters for switching the session's active authentication.
 ///
 /// <div class="warning">
 ///
@@ -15165,16 +15158,17 @@ pub struct SessionListFilter {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionLoadDeferredRepoHooksResult {
-    /// Total hook command count (user + plugin + repo) loaded for the session by this call. Captured atomically with startupPrompts so callers don't need to read a separate counter.
-    pub hook_count: i64,
-    /// Repo-level startup prompts queued from repo hook configs. Empty on resume, when no repo configs were pending, or when disableAllHooks is set.
-    pub startup_prompts: Vec<String>,
+pub struct SessionAuthSwitchRequest {
+    /// Authentication information to activate
+    pub auth_info: AuthInfo,
+    /// Optional token paired with the authentication information
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub token: Option<String>,
 }
 
-/// Enterprise permission policy expressed with the runtime's managed permission-rule syntax.
+/// Map of sessionId -> bytes freed by removing the session's workspace directory.
 ///
 /// <div class="warning">
 ///
@@ -15184,121 +15178,59 @@ pub struct SessionLoadDeferredRepoHooksResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionManagedPermissions {
-    /// Permission rules that allow matching operations unless another managed source, deny, or ask rule restricts them.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub allow: Option<Vec<String>>,
-    /// Permission rules that require explicit human approval.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub ask: Option<Vec<String>>,
-    /// Permission rules that block matching operations. Deny has highest precedence.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub deny: Option<Vec<String>>,
-    /// When set to `disable`, prevents bypass/allow-all permission modes.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub disable_bypass_permissions_mode: Option<DisableBypassPermissionsMode>,
+pub struct SessionBulkDeleteResult {
+    /// Map of sessionId -> bytes freed by removing the session's workspace directory. Sessions whose deletion failed are omitted from this map (failures are logged on the server but not surfaced per-id; check the map for absent IDs to detect them).
+    pub freed_bytes: HashMap<String, i64>,
 }
 
-/// Managed settings an SDK host may inject at session startup. Only permissions are accepted in this initial contract.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
+/// The six normalized `/context` header buckets, computed from the same tokenization as `entries` so the two never disagree. Convenience rollups: `freeSpace` and `buffer` describe window capacity rather than occupied context, so the values do not sum to `totalTokens`.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionManagedSettings {
-    /// Managed permission policy injected by the SDK host.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub permissions: Option<SessionManagedPermissions>,
+pub struct SessionContextAttributionCategories {
+    /// Output reserve plus post-blocking-threshold buffer.
+    pub buffer: i64,
+    /// Custom-instructions tokens (0 when none are configured).
+    pub custom_instructions: i64,
+    /// Remaining unused window capacity (clamped at 0).
+    pub free_space: i64,
+    /// MCP tool-definition tokens.
+    pub mcp_tools: i64,
+    /// Conversation (user/assistant/tool) message tokens.
+    pub messages: i64,
+    /// System prompt tokens, excluding custom instructions.
+    pub system_prompt: i64,
+    /// Non-MCP tool-definition tokens.
+    pub system_tools: i64,
 }
 
-/// Public-facing projection of workspace metadata for SDK / TUI consumers
+/// Successful compaction history for the session.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMetadataSnapshotWorkspace {
-    /// Branch checked out at session start, if any
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub branch: Option<String>,
-    /// ISO 8601 timestamp when the workspace was created
-    #[serde(rename = "created_at", skip_serializing_if = "Option::is_none")]
-    pub created_at: Option<String>,
-    /// Current working directory at session start
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cwd: Option<String>,
-    /// Resolved git root for cwd, if any
-    #[serde(rename = "git_root", skip_serializing_if = "Option::is_none")]
-    pub git_root: Option<String>,
-    /// Repository host type, if known
-    #[serde(rename = "host_type", skip_serializing_if = "Option::is_none")]
-    pub host_type: Option<WorkspaceSummaryHostType>,
-    /// Workspace identifier (1:1 with sessionId)
-    pub id: String,
-    /// Display name for the session, if set
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    /// Repository identifier in 'owner/repo' or 'org/project/repo' format, if any
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub repository: Option<String>,
-    /// ISO 8601 timestamp when the workspace was last updated
-    #[serde(rename = "updated_at", skip_serializing_if = "Option::is_none")]
-    pub updated_at: Option<String>,
-    /// Whether the display name was explicitly set by the user
-    #[serde(rename = "user_named", skip_serializing_if = "Option::is_none")]
-    pub user_named: Option<bool>,
+pub struct SessionContextAttributionCompactions {
+    /// Number of successful compactions in this session.
+    pub count: i64,
 }
 
-/// Point-in-time snapshot of slow-changing session identifier and state fields
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMetadataSnapshot {
-    /// True when the session was detected to be in use by another process at construction time. Local consumers may surface a confirmation prompt before fully attaching. Always false for new sessions.
-    pub already_in_use: bool,
-    /// Runtime client name associated with the session (telemetry identifier).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub client_name: Option<String>,
-    /// The current agent mode for this session (e.g., 'interactive', 'plan', 'autopilot')
-    pub current_mode: MetadataSnapshotCurrentMode,
-    /// User-provided name supplied at session construction (via `--name`), if any. Immutable after construction.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub initial_name: Option<String>,
-    /// Whether this is a remote session (i.e., one whose runtime executes elsewhere and is steered through this process)
-    pub is_remote: bool,
-    /// ISO 8601 timestamp of when the session's persisted state was last modified on disk. For new sessions, equals startTime. For resumed sessions, reflects the previous modification time at construction.
-    pub modified_time: String,
-    /// Remote-session-specific metadata. Populated only when `isRemote` is true. Fields are immutable for the lifetime of the session.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub remote_metadata: Option<MetadataSnapshotRemoteMetadata>,
-    /// Currently selected model identifier, if any
+pub struct SessionContextAttributionEntriesItem {
+    /// Supplementary per-entry metadata (e.g. `messageCount`, `role`, `evictable`, `pluginSource`). Values are stringified; parse as needed and ignore unrecognized keys.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub selected_model: Option<String>,
-    /// The unique identifier of the session
-    pub session_id: SessionId,
-    /// Current session limits, or null when no limits are active
-    pub session_limits: Option<SessionLimitsConfig>,
-    /// ISO 8601 timestamp of when the session started
-    pub start_time: String,
-    /// Short human-readable summary of the session, if known. Omitted when no summary has been generated.
+    pub attributes: Option<HashMap<String, String>>,
+    /// Identifier for this entry, formed by joining its `kind` and source name (e.g. `tool:bash`, `skill:tmux`, `toolDefinition:bash`); unique within the snapshot. Use it to match the same entry across snapshots, to correlate with other APIs (skill/agent/MCP registries), and as the `parentId` target for nesting. Distinct from the human-facing `label`.
+    pub id: String,
+    /// Source category for this entry. Not a closed set — tolerate unknown values. Known values today: `skill`, `subagent`, `mcpServer`, `tool`, `system`, `toolDefinition`, `plugin`.
+    pub kind: String,
+    /// Human-readable display label, e.g. `bash` or `skill: tmux`. Presentation-only; may be localized/reformatted without notice — do not key off it.
+    pub label: String,
+    /// Optional `id` of the parent entry: e.g. a `plugin` entry parenting its `skill`/`mcpServer` entries, or the `system` entry parenting `toolDefinition` entries. Omitted for top-level entries.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub summary: Option<String>,
-    /// Absolute path to the session's current working directory
-    pub working_directory: String,
-    /// Public-facing workspace metadata for this session, or null if the session has no associated workspace. Excludes runtime-internal fields (GitHub IDs, summary count, internal flags).
-    pub workspace: Option<SessionMetadataSnapshotWorkspace>,
-    /// Absolute path to the session's workspace directory on disk, or null if the session has no associated workspace
-    pub workspace_path: Option<String>,
+    pub parent_id: Option<String>,
+    /// Token count currently in context attributable to this entry.
+    pub tokens: i64,
 }
 
-/// Cost-category metadata for a CAPI model.
+/// Per-source context-window attribution, or null if the session has not yet been initialized (no system prompt or tool metadata cached).
 ///
 /// <div class="warning">
 ///
@@ -15308,14 +15240,30 @@ pub struct SessionMetadataSnapshot {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionModelPriceCategory {
-    /// CAPI model identifier.
-    pub id: String,
-    /// Cost category assigned to the model.
-    pub price_category: ModelPickerPriceCategory,
+pub struct SessionContextAttribution {
+    /// Output reserve plus the tokens past the buffer-exhaustion blocking threshold. Mirrors `SessionContextInfo.bufferTokens`.
+    pub buffer_tokens: i64,
+    /// The six normalized `/context` header buckets, computed from the same tokenization as `entries` so the two never disagree. Convenience rollups: `freeSpace` and `buffer` describe window capacity rather than occupied context, so the values do not sum to `totalTokens`.
+    pub categories: SessionContextAttributionCategories,
+    /// Successful compaction history for the session.
+    pub compactions: SessionContextAttributionCompactions,
+    /// Token count at which background compaction starts. Mirrors `SessionContextInfo.compactionThreshold`.
+    pub compaction_threshold: i64,
+    /// Flat list of per-source attribution entries. Group by `kind` and render unrecognized kinds generically. Nesting and rollups are expressed via `parentId`.
+    pub entries: Vec<SessionContextAttributionEntriesItem>,
+    /// Prompt limit plus the model's output reserve: the full context window `categories.freeSpace` and `categories.buffer` are measured against. Mirrors `SessionContextInfo.limit`.
+    pub limit: i64,
+    /// The concrete model id the entire breakdown was tokenized against (feeds the per-model token multiplier). Under `Auto` (Free/Student) this is the resolved model, not the literal `auto` sentinel, so totals are not undercounted. A single-model approximation of a potentially multi-model Auto session.
+    pub model_id: String,
+    /// How `modelId` was chosen. Not a closed set — tolerate unknown values. Known values today: `autoResolved` (the model Auto resolved to), `selected` (the user's explicitly selected model), `default` (a fallback before any model is known).
+    pub model_source: String,
+    /// Maximum prompt tokens the resolved model accepts — the denominator for a `##k/###k` context-usage display. Mirrors `SessionContextInfo.promptTokenLimit`.
+    pub prompt_token_limit: i64,
+    /// Total token count of the current context window the entries are measured against (system message + conversation messages + tool definitions — the same total reported by /context). Divide an entry's `tokens` by this to derive its share.
+    pub total_tokens: i64,
 }
 
-/// The list of models available to this session.
+/// Token breakdown for the current context window, or null if the session has not yet been initialized (no system prompt or tool metadata cached).
 ///
 /// <div class="warning">
 ///
@@ -15325,18 +15273,30 @@ pub struct SessionModelPriceCategory {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionModelList {
-    /// Available models, ordered with the most preferred default first. Includes both Copilot (CAPI) models and any registry BYOK models; a BYOK model appears under its provider-qualified selection id (`provider/id`).
-    pub list: Vec<serde_json::Value>,
-    /// Cost categories for the full CAPI catalog, including picker-disabled models that Auto may select. Metadata only; entries absent from `list` are not manually selectable.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub model_price_categories: Option<Vec<SessionModelPriceCategory>>,
-    /// Per-quota snapshots returned alongside the model list, keyed by quota type.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub quota_snapshots: Option<HashMap<String, serde_json::Value>>,
+pub struct SessionContextInfo {
+    /// Output reserve plus tokens after the buffer-exhaustion blocking threshold (default 95%)
+    pub buffer_tokens: i64,
+    /// Token count at which background compaction starts (configurable percentage of promptTokenLimit)
+    pub compaction_threshold: i64,
+    /// Tokens consumed by user/assistant/tool messages
+    pub conversation_tokens: i64,
+    /// Prompt token limit plus the model's full output token limit.
+    pub limit: i64,
+    /// Tokens consumed by MCP tool definitions (subset of toolDefinitionsTokens, excludes deferred tools)
+    pub mcp_tools_tokens: i64,
+    /// The model used for token counting
+    pub model_name: String,
+    /// Maximum prompt tokens allowed by the model (or DEFAULT_TOKEN_LIMIT if unspecified)
+    pub prompt_token_limit: i64,
+    /// Tokens consumed by the system prompt
+    pub system_tokens: i64,
+    /// Tokens consumed by tool definitions sent to the model (excludes deferred tools)
+    pub tool_definitions_tokens: i64,
+    /// Sum of system, conversation and tool-definition tokens
+    pub total_tokens: i64,
 }
 
-/// Source descriptor for a `sessions.open` content-exclusion rule, with source name and type.
+/// The enriched metadata records, with summary and context fields backfilled where available. Sessions confirmed empty and unnamed are omitted.
 ///
 /// <div class="warning">
 ///
@@ -15346,14 +15306,12 @@ pub struct SessionModelList {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionOpenOptionsAdditionalContentExclusionPolicyRuleSource {
-    /// Name of the policy source.
-    pub name: String,
-    /// Type of the policy source.
-    pub r#type: String,
+pub struct SessionEnrichMetadataResult {
+    /// Enriched records, with summary and context backfilled. Sessions confirmed empty and unnamed may be omitted.
+    pub sessions: Vec<LocalSessionMetadataValue>,
 }
 
-/// Single content-exclusion rule supplied to `sessions.open` options, with paths, match conditions, and source.
+/// File path, content to append, and optional mode for the client-provided session filesystem.
 ///
 /// <div class="warning">
 ///
@@ -15363,20 +15321,37 @@ pub struct SessionOpenOptionsAdditionalContentExclusionPolicyRuleSource {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionOpenOptionsAdditionalContentExclusionPolicyRule {
-    /// Conditions of which at least one must match.
+pub struct SessionFsAppendFileRequest {
+    /// Target session identifier
+    pub session_id: SessionId,
+    /// Path using SessionFs conventions
+    pub path: String,
+    /// Content to append
+    pub content: String,
+    /// Optional POSIX-style mode for newly created files
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub if_any_match: Option<Vec<String>>,
-    /// Conditions none of which may match.
+    pub mode: Option<i64>,
+}
+
+/// Describes a filesystem error.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsError {
+    /// Error classification
+    pub code: SessionFsErrorCode,
+    /// Free-form detail about the error, for logging/diagnostics
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub if_none_match: Option<Vec<String>>,
-    /// Path patterns covered by this rule.
-    pub paths: Vec<String>,
-    /// Source descriptor for a `sessions.open` content-exclusion rule, with source name and type.
-    pub source: SessionOpenOptionsAdditionalContentExclusionPolicyRuleSource,
+    pub message: Option<String>,
 }
 
-/// Content-exclusion policy supplied to `sessions.open` options, with rules, last-updated data, and scope.
+/// Path to test for existence in the client-provided session filesystem.
 ///
 /// <div class="warning">
 ///
@@ -15386,33 +15361,29 @@ pub struct SessionOpenOptionsAdditionalContentExclusionPolicyRule {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionOpenOptionsAdditionalContentExclusionPolicy {
-    /// Opaque policy update timestamp supplied by the host.
-    #[serde(rename = "last_updated_at")]
-    pub last_updated_at: serde_json::Value,
-    /// Content-exclusion rules to apply.
-    pub rules: Vec<SessionOpenOptionsAdditionalContentExclusionPolicyRule>,
-    /// Allowed values for the `SessionOpenOptionsAdditionalContentExclusionPolicyScope` enumeration.
-    pub scope: SessionOpenOptionsAdditionalContentExclusionPolicyScope,
+pub struct SessionFsExistsRequest {
+    /// Target session identifier
+    pub session_id: SessionId,
+    /// Path using SessionFs conventions
+    pub path: String,
 }
 
-/// Command-scoped GitHub credential injection for the shell commands an agent runs.
+/// Indicates whether the requested path exists in the client-provided session filesystem.
 ///
-/// Each channel is opt-in and independent, and injection is scoped to the individual command
-/// spawn: the credential is resolved from the session's *current* authentication at every spawn
-/// and reaches only spawns whose script actually invokes `git` or `gh`. Because nothing is
-/// retained between spawns, replacing the session credential (`session.gitHubAuth.setCredentials`)
-/// changes what the next spawned command presents — which seeding a credential into the runtime
-/// process's own environment cannot do, since a child's environment is fixed at `exec`.
+/// <div class="warning">
 ///
-/// The credential is matched to the host it authenticates to, so a github.com credential is never
-/// presented to a GitHub Enterprise host and vice versa. Where a channel cannot express that
-/// boundary it injects nothing rather than crossing it -- see `gh` below.
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
 ///
-/// This is independent of `sandboxConfig`: it is a decision about which identity the agent
-/// presents, not about what the agent may touch, and it works on every platform whether or not
-/// an OS sandboxing backend is available. `sandboxConfig.auth` remains the sandbox-scoped
-/// spelling and is additive with this one.
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsExistsResult {
+    /// Whether the path exists
+    pub exists: bool,
+}
+
+/// Directory path to create in the client-provided session filesystem, with options for recursive creation and POSIX mode.
 ///
 /// <div class="warning">
 ///
@@ -15422,28 +15393,20 @@ pub struct SessionOpenOptionsAdditionalContentExclusionPolicy {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ShellCredentials {
-    /// Whether to authenticate the agent's `gh` commands as the session's GitHub credential, by
-    /// exporting `GH_TOKEN` to a spawn that runs `gh`. Any inherited `gh` credential is removed from
-    /// spawns that do not, so the credential stays command-scoped.
-    ///
-    /// Applies to a github.com credential only. `gh` picks its credential variable from the host a
-    /// command targets rather than the one the credential belongs to, and the command can choose that
-    /// target, so `GH_ENTERPRISE_TOKEN` would offer a single-tenant enterprise credential to every
-    /// other enterprise host. A session whose credential is enterprise-scoped therefore runs `gh`
-    /// unauthenticated; its `git` commands are unaffected, because `http.<host>.extraheader` is scoped
-    /// to one host by construction. Default: false (opt-in).
+pub struct SessionFsMkdirRequest {
+    /// Target session identifier
+    pub session_id: SessionId,
+    /// Path using SessionFs conventions
+    pub path: String,
+    /// Create parent directories as needed
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub gh: Option<bool>,
-    /// Whether to authenticate the agent's `git` commands as the session's GitHub credential, by
-    /// injecting an `http.<host>.extraheader` (plus `insteadOf` rewrites so SSH-spelled remotes for
-    /// that host use the authenticated HTTPS transport). Applied only to a spawn that runs a
-    /// remote-contacting `git` subcommand. Default: false (opt-in).
+    pub recursive: Option<bool>,
+    /// Optional POSIX-style mode for newly created directories
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub git: Option<bool>,
+    pub mode: Option<i64>,
 }
 
-/// A host-provided script sourced before each built-in shell command when its shell target matches the active shell.
+/// Directory path whose entries should be listed from the client-provided session filesystem.
 ///
 /// <div class="warning">
 ///
@@ -15453,14 +15416,14 @@ pub struct ShellCredentials {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ShellInitScript {
-    /// Path to the script to source.
+pub struct SessionFsReaddirRequest {
+    /// Target session identifier
+    pub session_id: SessionId,
+    /// Path using SessionFs conventions
     pub path: String,
-    /// Built-in shell that may source this script.
-    pub shell: ShellInitScriptShell,
 }
 
-/// Per-session settings for built-in shell tools.
+/// Names of entries in the requested directory, or a filesystem error if the read failed.
 ///
 /// <div class="warning">
 ///
@@ -15470,32 +15433,15 @@ pub struct ShellInitScript {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ShellOptions {
-    /// Command-scoped GitHub credential injection for shell commands.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub credentials: Option<ShellCredentials>,
-    /// Controls automatic non-interactive profile loading where supported. Explicit initScripts are unaffected.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub init_profile: Option<ShellInitProfile>,
-    /// Ordered host-provided script paths sourced before each built-in shell command when the
-    /// entry's shell target matches the active shell. Use these for rc files, environment setup scripts,
-    /// or other custom scripts. A script that returns a nonzero status is reported, and later scripts
-    /// and the user command continue while the shell remains running. Because scripts are sourced into
-    /// the command shell, `exit`, `exec`, failures under `set -e`, or other shell-terminating behavior
-    /// can prevent continuation. Script standard output is preserved; Bash script stderr is discarded,
-    /// PowerShell exception messages are replaced, and runtime-generated failure notices omit
-    /// configured script paths. When sandboxing is enabled, each script must already be readable under
-    /// the active sandbox filesystem policy. Pass an empty array to clear the list.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub init_scripts: Option<Vec<ShellInitScript>>,
-    /// Flags passed to the active built-in shell process on startup, replacing its default flags.
-    /// When omitted, the built-in Bash shell uses `--norc --noprofile`,
-    /// and the built-in PowerShell shell uses `-NoProfile -NoLogo`.
+pub struct SessionFsReaddirResult {
+    /// Entry names in the directory
+    pub entries: Vec<String>,
+    /// Describes a filesystem error.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub process_flags: Option<Vec<String>>,
+    pub error: Option<SessionFsError>,
 }
 
-/// Session construction options.
+/// Directory entry returned by session filesystem `readdirWithTypes`, with name and entry type.
 ///
 /// <div class="warning">
 ///
@@ -15505,43 +15451,1008 @@ pub struct ShellOptions {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionOpenOptions {
-    /// Additional content-exclusion policies to merge into the session policy set.
-    ///
-    /// <div class="warning">
-    ///
-    /// **Experimental.** This type is part of an experimental wire-protocol surface
-    /// and may change or be removed in future SDK or CLI releases.
-    ///
-    /// </div>
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub additional_content_exclusion_policies:
-        Option<Vec<SessionOpenOptionsAdditionalContentExclusionPolicy>>,
-    /// Additional directories the agent may access beyond the working directory. Each entry is granted to the session's file-access allow-list and surfaced to the model (system prompt context and `@`-mention completion). Absolute paths are recommended; a relative path is resolved against the session's working directory. Nonexistent or unresolvable entries are skipped with a warning. This is applied on both session creation and resume, and is not persisted: a resumed session that omits this option does not retain previously supplied directories (re-supply them, exactly as the CLI re-passes `--add-dir`).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub additional_directories: Option<Vec<String>>,
-    /// Runtime context discriminator for agent filtering.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub agent_context: Option<String>,
-    /// Whether to include instructions from every MCP server in the system prompt instead of only allowlisted servers.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub allow_all_mcp_server_instructions: Option<bool>,
-    /// Whether ask_user is explicitly disabled.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub ask_user_disabled: Option<bool>,
-    /// Initial authentication info for the session.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub auth_info: Option<AuthInfo>,
-    /// Allowlist of available tool names.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub available_tools: Option<Vec<String>>,
-    /// Options scoped to the built-in CAPI (Copilot API) provider.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub capi: Option<CapiSessionOptions>,
-    /// Structured client kind used for runtime behavior gates.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub client_kind: Option<String>,
-    /// Identifier of the client driving the session.
+pub struct SessionFsReaddirWithTypesEntry {
+    /// Entry name
+    pub name: String,
+    /// Entry type
+    pub r#type: SessionFsReaddirWithTypesEntryType,
+}
+
+/// Directory path whose entries (with type information) should be listed from the client-provided session filesystem.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsReaddirWithTypesRequest {
+    /// Target session identifier
+    pub session_id: SessionId,
+    /// Path using SessionFs conventions
+    pub path: String,
+}
+
+/// Entries in the requested directory paired with file/directory type information, or a filesystem error if the read failed.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsReaddirWithTypesResult {
+    /// Directory entries with type information
+    pub entries: Vec<SessionFsReaddirWithTypesEntry>,
+    /// Describes a filesystem error.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<SessionFsError>,
+}
+
+/// Path of the file to read from the client-provided session filesystem.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsReadFileRequest {
+    /// Target session identifier
+    pub session_id: SessionId,
+    /// Path using SessionFs conventions
+    pub path: String,
+}
+
+/// File content as a UTF-8 string, or a filesystem error if the read failed.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsReadFileResult {
+    /// File content as UTF-8 string
+    pub content: String,
+    /// Describes a filesystem error.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<SessionFsError>,
+}
+
+/// Source and destination paths for renaming or moving an entry in the client-provided session filesystem.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsRenameRequest {
+    /// Target session identifier
+    pub session_id: SessionId,
+    /// Source path using SessionFs conventions
+    pub src: String,
+    /// Destination path using SessionFs conventions
+    pub dest: String,
+}
+
+/// Path to remove from the client-provided session filesystem, with options for recursive removal and force.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsRmRequest {
+    /// Target session identifier
+    pub session_id: SessionId,
+    /// Path using SessionFs conventions
+    pub path: String,
+    /// Remove directories and their contents recursively
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub recursive: Option<bool>,
+    /// Ignore errors if the path does not exist
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub force: Option<bool>,
+}
+
+/// Optional capabilities declared by the provider
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsSetProviderCapabilities {
+    /// Whether the provider supports SQLite query/exists operations
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub sqlite: Option<bool>,
+}
+
+/// Initial working directory, session-state path layout, and path conventions used to register the calling SDK client as the session filesystem provider.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsSetProviderRequest {
+    /// Optional capabilities declared by the provider
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub capabilities: Option<SessionFsSetProviderCapabilities>,
+    /// Path conventions used by this filesystem
+    pub conventions: SessionFsSetProviderConventions,
+    /// Initial working directory for sessions
+    pub initial_cwd: String,
+    /// Path within each session's SessionFs where the runtime stores files for that session
+    pub session_state_path: String,
+}
+
+/// Indicates whether the calling client was registered as the session filesystem provider.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsSetProviderResult {
+    /// Whether the provider was set successfully
+    pub success: bool,
+}
+
+/// Indicates whether the per-session SQLite database already exists.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsSqliteExistsResult {
+    /// Whether the session database already exists
+    pub exists: bool,
+}
+
+/// SQL query, query type, and optional bind parameters for executing a SQLite query against the per-session database. The provider applies its SQLite busy timeout for every call.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsSqliteQueryRequest {
+    /// Target session identifier
+    pub session_id: SessionId,
+    /// SQL query to execute
+    pub query: String,
+    /// How to execute the query: 'exec' for DDL/multi-statement (no results), 'query' for SELECT (returns rows), 'run' for INSERT/UPDATE/DELETE (returns rowsAffected)
+    pub query_type: SessionFsSqliteQueryType,
+    /// Optional named bind parameters
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub params: Option<HashMap<String, serde_json::Value>>,
+}
+
+/// Query results including rows, columns, and rows affected, or a filesystem error if execution failed.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsSqliteQueryResult {
+    /// Column names from the result set
+    pub columns: Vec<String>,
+    /// Describes a filesystem error.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<SessionFsError>,
+    /// SQLite last_insert_rowid() value for INSERT.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub last_insert_rowid: Option<i64>,
+    /// For SELECT: array of row objects. For others: empty array.
+    pub rows: Vec<HashMap<String, serde_json::Value>>,
+    /// Number of rows affected (for INSERT/UPDATE/DELETE)
+    pub rows_affected: i64,
+}
+
+/// Classified SQLite transaction failure. busyOrLocked guarantees rollback; postCommitAmbiguous must never be retried.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsSqliteTransactionError {
+    /// Machine-readable classification of the transaction failure.
+    pub error_class: SessionFsSqliteTransactionErrorClass,
+    /// Human-readable transaction failure message.
+    pub message: String,
+}
+
+/// One statement in an atomic SQLite transaction.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsSqliteTransactionStatement {
+    /// Optional named bind parameters.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub params: Option<HashMap<String, serde_json::Value>>,
+    /// SQL statement to execute.
+    pub query: String,
+    /// How to execute the statement.
+    pub query_type: SessionFsSqliteQueryType,
+}
+
+/// Statements to execute atomically. Providers apply busy handling for every call.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsSqliteTransactionRequest {
+    /// Target session identifier
+    pub session_id: SessionId,
+    /// Ordered SQL statements to execute in one transaction.
+    pub statements: Vec<SessionFsSqliteTransactionStatement>,
+}
+
+/// Per-statement results, or a classified transaction error.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsSqliteTransactionResult {
+    /// Classified transaction failure, when execution did not succeed.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<SessionFsSqliteTransactionError>,
+    /// Per-statement query results in input order.
+    pub results: Vec<SessionFsSqliteQueryResult>,
+}
+
+/// Path whose metadata should be returned from the client-provided session filesystem.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsStatRequest {
+    /// Target session identifier
+    pub session_id: SessionId,
+    /// Path using SessionFs conventions
+    pub path: String,
+}
+
+/// Filesystem metadata for the requested path, or a filesystem error if the stat failed.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsStatResult {
+    /// ISO 8601 timestamp of creation
+    pub birthtime: String,
+    /// Describes a filesystem error.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<SessionFsError>,
+    /// Whether the path is a directory
+    pub is_directory: bool,
+    /// Whether the path is a file
+    pub is_file: bool,
+    /// ISO 8601 timestamp of last modification
+    pub mtime: String,
+    /// File size in bytes
+    pub size: i64,
+}
+
+/// File path, content to write, and optional mode for the client-provided session filesystem.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionFsWriteFileRequest {
+    /// Target session identifier
+    pub session_id: SessionId,
+    /// Path using SessionFs conventions
+    pub path: String,
+    /// Content to write
+    pub content: String,
+    /// Optional POSIX-style mode for newly created files
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mode: Option<i64>,
+}
+
+/// Installed plugin record for a session, with marketplace, version, install time, enabled state, cache path, and source.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionInstalledPlugin {
+    /// Path where the plugin is cached locally
+    #[serde(rename = "cache_path", skip_serializing_if = "Option::is_none")]
+    pub cache_path: Option<String>,
+    /// Whether the plugin is currently enabled
+    pub enabled: bool,
+    /// Installation timestamp (ISO-8601)
+    #[serde(rename = "installed_at")]
+    pub installed_at: String,
+    /// Marketplace the plugin came from (empty string for direct repo installs)
+    pub marketplace: String,
+    /// Plugin name
+    pub name: String,
+    /// Source descriptor for direct repo installs (when marketplace is empty)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source: Option<serde_json::Value>,
+    /// Per-plugin source fingerprint (a SHA-256 hash of the plugin's catalog source spec plus its resolved source subtree — NOT a Git commit SHA) captured at marketplace install/update time. Auto-update compares it against the freshly recomputed fingerprint to detect a content change that does not bump the version. Absent for pre-existing installs and for direct (non-marketplace) installs.
+    #[serde(rename = "source_sha", skip_serializing_if = "Option::is_none")]
+    pub source_sha: Option<String>,
+    /// Installed version, if known
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub version: Option<String>,
+}
+
+/// Source descriptor for a direct GitHub plugin install, with `owner/repo`, optional ref or full commit SHA, and optional subpath.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionInstalledPluginSourceGitHub {
+    /// Optional repository-relative path to the plugin.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub path: Option<String>,
+    /// Optional Git ref to resolve.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub r#ref: Option<String>,
+    /// GitHub repository in `owner/repo` form.
+    pub repo: String,
+    /// Optional full 40-character hexadecimal commit SHA.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub sha: Option<String>,
+    /// Constant value. Always "github".
+    pub source: SessionInstalledPluginSourceGitHubSource,
+}
+
+/// Source descriptor for a direct local plugin install, with a local filesystem path.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionInstalledPluginSourceLocal {
+    /// Local filesystem path to the plugin.
+    pub path: String,
+    /// Constant value. Always "local".
+    pub source: SessionInstalledPluginSourceLocalSource,
+}
+
+/// Source descriptor for a direct URL plugin install, with URL, optional ref or full commit SHA, and optional subpath.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionInstalledPluginSourceUrl {
+    /// Optional source-relative path to the plugin.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub path: Option<String>,
+    /// Optional Git ref to resolve.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub r#ref: Option<String>,
+    /// Optional full 40-character hexadecimal commit SHA.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub sha: Option<String>,
+    /// Constant value. Always "url".
+    pub source: SessionInstalledPluginSourceUrlSource,
+    /// URL of the plugin source.
+    pub url: String,
+}
+
+/// Baseline data provenance for a prediction.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionLimitPredictionBaselineData {
+    /// End of the baseline data slice.
+    pub window_end: String,
+    /// Start of the baseline data slice.
+    pub window_start: String,
+}
+
+/// Semantic usage tier and its AI-credit cap.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionLimitPredictionTierOption {
+    /// AI-credit cap for this tier.
+    pub cap: f64,
+    /// Semantic usage tier.
+    pub tier: SessionLimitPredictionTier,
+}
+
+/// Explainable AI-credit session-limit prediction.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionLimitPredictionDetails {
+    /// Baseline data provenance.
+    pub baseline_data: SessionLimitPredictionBaselineData,
+    /// Client population used for the prediction.
+    pub client_type: SessionLimitPredictionClientType,
+    /// Resolved model family when known.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub family: Option<String>,
+    /// Model identifier used for lookup.
+    pub model_id: String,
+    /// Recommended maximum AI credits for this session.
+    pub recommended_cap: f64,
+    /// Tier chosen as the recommended cap.
+    pub recommended_tier: SessionLimitPredictionTier,
+    /// Baseline fallback level used to create the prediction.
+    pub source: SessionLimitPredictionSource,
+    /// Key matched at the source level, such as a model id, family id, or `global`.
+    pub source_key: String,
+    /// Ordered usage tiers and their AI-credit caps.
+    pub tiers: Vec<SessionLimitPredictionTierOption>,
+}
+
+/// Parameters for predicting an AI-credit session limit. Omitting `modelId` uses the session's currently selected model.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionLimitPredictionRequest {
+    /// Client type to size for. Defaults to `cli-interactive`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub client_type: Option<SessionLimitPredictionClientType>,
+    /// Optional model identifier override. If omitted, the session's current model is used.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_id: Option<String>,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionLimitPredictionResultAvailable {
+    /// Prediction result variant discriminator.
+    pub kind: SessionLimitPredictionResultAvailableKind,
+    /// Predicted session limit details.
+    pub prediction: SessionLimitPredictionDetails,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionLimitPredictionResultUnavailable {
+    /// Prediction result variant discriminator.
+    pub kind: SessionLimitPredictionResultUnavailableKind,
+    /// Reason no prediction is available.
+    pub reason: SessionLimitPredictionUnavailableReason,
+}
+
+/// Sessions matching the filter, ordered most-recently-modified first.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionList {
+    /// Sessions ordered most-recently-modified first. Discriminated by `isRemote`.
+    pub sessions: Vec<serde_json::Value>,
+}
+
+/// Optional filter applied to the returned sessions
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionListFilter {
+    /// Match sessions whose context.branch equals this value
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub branch: Option<String>,
+    /// Match sessions whose context.cwd equals this value
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cwd: Option<String>,
+    /// Match sessions whose context.gitRoot equals this value
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub git_root: Option<String>,
+    /// Match sessions whose context.repository equals this value
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub repository: Option<String>,
+}
+
+/// Queued repo-level startup prompts and the total hook command count after loading.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionLoadDeferredRepoHooksResult {
+    /// Total hook command count (user + plugin + repo) loaded for the session by this call. Captured atomically with startupPrompts so callers don't need to read a separate counter.
+    pub hook_count: i64,
+    /// Repo-level startup prompts queued from repo hook configs. Empty on resume, when no repo configs were pending, or when disableAllHooks is set.
+    pub startup_prompts: Vec<String>,
+}
+
+/// Enterprise permission policy expressed with the runtime's managed permission-rule syntax.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionManagedPermissions {
+    /// Permission rules that allow matching operations unless another managed source, deny, or ask rule restricts them.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub allow: Option<Vec<String>>,
+    /// Permission rules that require explicit human approval.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub ask: Option<Vec<String>>,
+    /// Permission rules that block matching operations. Deny has highest precedence.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub deny: Option<Vec<String>>,
+    /// When set to `disable`, prevents bypass/allow-all permission modes.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub disable_bypass_permissions_mode: Option<DisableBypassPermissionsMode>,
+}
+
+/// Managed settings an SDK host may inject at session startup. Only permissions are accepted in this initial contract.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionManagedSettings {
+    /// Managed permission policy injected by the SDK host.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub permissions: Option<SessionManagedPermissions>,
+}
+
+/// Public-facing projection of workspace metadata for SDK / TUI consumers
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionMetadataSnapshotWorkspace {
+    /// Branch checked out at session start, if any
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub branch: Option<String>,
+    /// ISO 8601 timestamp when the workspace was created
+    #[serde(rename = "created_at", skip_serializing_if = "Option::is_none")]
+    pub created_at: Option<String>,
+    /// Current working directory at session start
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cwd: Option<String>,
+    /// Resolved git root for cwd, if any
+    #[serde(rename = "git_root", skip_serializing_if = "Option::is_none")]
+    pub git_root: Option<String>,
+    /// Repository host type, if known
+    #[serde(rename = "host_type", skip_serializing_if = "Option::is_none")]
+    pub host_type: Option<WorkspaceSummaryHostType>,
+    /// Workspace identifier (1:1 with sessionId)
+    pub id: String,
+    /// Display name for the session, if set
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    /// Repository identifier in 'owner/repo' or 'org/project/repo' format, if any
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub repository: Option<String>,
+    /// ISO 8601 timestamp when the workspace was last updated
+    #[serde(rename = "updated_at", skip_serializing_if = "Option::is_none")]
+    pub updated_at: Option<String>,
+    /// Whether the display name was explicitly set by the user
+    #[serde(rename = "user_named", skip_serializing_if = "Option::is_none")]
+    pub user_named: Option<bool>,
+}
+
+/// Point-in-time snapshot of slow-changing session identifier and state fields
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionMetadataSnapshot {
+    /// True when the session was detected to be in use by another process at construction time. Local consumers may surface a confirmation prompt before fully attaching. Always false for new sessions.
+    pub already_in_use: bool,
+    /// Runtime client name associated with the session (telemetry identifier).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub client_name: Option<String>,
+    /// The current agent mode for this session (e.g., 'interactive', 'plan', 'autopilot')
+    pub current_mode: MetadataSnapshotCurrentMode,
+    /// User-provided name supplied at session construction (via `--name`), if any. Immutable after construction.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub initial_name: Option<String>,
+    /// Whether this is a remote session (i.e., one whose runtime executes elsewhere and is steered through this process)
+    pub is_remote: bool,
+    /// ISO 8601 timestamp of when the session's persisted state was last modified on disk. For new sessions, equals startTime. For resumed sessions, reflects the previous modification time at construction.
+    pub modified_time: String,
+    /// Remote-session-specific metadata. Populated only when `isRemote` is true. Fields are immutable for the lifetime of the session.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub remote_metadata: Option<MetadataSnapshotRemoteMetadata>,
+    /// Currently selected model identifier, if any
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub selected_model: Option<String>,
+    /// The unique identifier of the session
+    pub session_id: SessionId,
+    /// Current session limits, or null when no limits are active
+    pub session_limits: Option<SessionLimitsConfig>,
+    /// ISO 8601 timestamp of when the session started
+    pub start_time: String,
+    /// Short human-readable summary of the session, if known. Omitted when no summary has been generated.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub summary: Option<String>,
+    /// Absolute path to the session's current working directory
+    pub working_directory: String,
+    /// Public-facing workspace metadata for this session, or null if the session has no associated workspace. Excludes runtime-internal fields (GitHub IDs, summary count, internal flags).
+    pub workspace: Option<SessionMetadataSnapshotWorkspace>,
+    /// Absolute path to the session's workspace directory on disk, or null if the session has no associated workspace
+    pub workspace_path: Option<String>,
+}
+
+/// Cost-category metadata for a CAPI model.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionModelPriceCategory {
+    /// CAPI model identifier.
+    pub id: String,
+    /// Cost category assigned to the model.
+    pub price_category: ModelPickerPriceCategory,
+}
+
+/// The list of models available to this session.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionModelList {
+    /// Available models, ordered with the most preferred default first. Includes both Copilot (CAPI) models and any registry BYOK models; a BYOK model appears under its provider-qualified selection id (`provider/id`).
+    pub list: Vec<serde_json::Value>,
+    /// Cost categories for the full CAPI catalog, including picker-disabled models that Auto may select. Metadata only; entries absent from `list` are not manually selectable.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_price_categories: Option<Vec<SessionModelPriceCategory>>,
+    /// Per-quota snapshots returned alongside the model list, keyed by quota type.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub quota_snapshots: Option<HashMap<String, serde_json::Value>>,
+}
+
+/// Source descriptor for a `sessions.open` content-exclusion rule, with source name and type.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionOpenOptionsAdditionalContentExclusionPolicyRuleSource {
+    /// Name of the policy source.
+    pub name: String,
+    /// Type of the policy source.
+    pub r#type: String,
+}
+
+/// Single content-exclusion rule supplied to `sessions.open` options, with paths, match conditions, and source.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionOpenOptionsAdditionalContentExclusionPolicyRule {
+    /// Conditions of which at least one must match.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub if_any_match: Option<Vec<String>>,
+    /// Conditions none of which may match.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub if_none_match: Option<Vec<String>>,
+    /// Path patterns covered by this rule.
+    pub paths: Vec<String>,
+    /// Source descriptor for a `sessions.open` content-exclusion rule, with source name and type.
+    pub source: SessionOpenOptionsAdditionalContentExclusionPolicyRuleSource,
+}
+
+/// Content-exclusion policy supplied to `sessions.open` options, with rules, last-updated data, and scope.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionOpenOptionsAdditionalContentExclusionPolicy {
+    /// Opaque policy update timestamp supplied by the host.
+    #[serde(rename = "last_updated_at")]
+    pub last_updated_at: serde_json::Value,
+    /// Content-exclusion rules to apply.
+    pub rules: Vec<SessionOpenOptionsAdditionalContentExclusionPolicyRule>,
+    /// Allowed values for the `SessionOpenOptionsAdditionalContentExclusionPolicyScope` enumeration.
+    pub scope: SessionOpenOptionsAdditionalContentExclusionPolicyScope,
+}
+
+/// Command-scoped GitHub credential injection for the shell commands an agent runs.
+///
+/// Each channel is opt-in and independent, and injection is scoped to the individual command
+/// spawn: the credential is resolved from the session's *current* authentication at every spawn
+/// and reaches only spawns whose script actually invokes `git` or `gh`. Because nothing is
+/// retained between spawns, replacing the session credential (`session.gitHubAuth.setCredentials`)
+/// changes what the next spawned command presents — which seeding a credential into the runtime
+/// process's own environment cannot do, since a child's environment is fixed at `exec`.
+///
+/// The credential is matched to the host it authenticates to, so a github.com credential is never
+/// presented to a GitHub Enterprise host and vice versa. Where a channel cannot express that
+/// boundary it injects nothing rather than crossing it -- see `gh` below.
+///
+/// This is independent of `sandboxConfig`: it is a decision about which identity the agent
+/// presents, not about what the agent may touch, and it works on every platform whether or not
+/// an OS sandboxing backend is available. `sandboxConfig.auth` remains the sandbox-scoped
+/// spelling and is additive with this one.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ShellCredentials {
+    /// Whether to authenticate the agent's `gh` commands as the session's GitHub credential, by
+    /// exporting `GH_TOKEN` to a spawn that runs `gh`. Any inherited `gh` credential is removed from
+    /// spawns that do not, so the credential stays command-scoped.
+    ///
+    /// Applies to a github.com credential only. `gh` picks its credential variable from the host a
+    /// command targets rather than the one the credential belongs to, and the command can choose that
+    /// target, so `GH_ENTERPRISE_TOKEN` would offer a single-tenant enterprise credential to every
+    /// other enterprise host. A session whose credential is enterprise-scoped therefore runs `gh`
+    /// unauthenticated; its `git` commands are unaffected, because `http.<host>.extraheader` is scoped
+    /// to one host by construction. Default: false (opt-in).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub gh: Option<bool>,
+    /// Whether to authenticate the agent's `git` commands as the session's GitHub credential, by
+    /// injecting an `http.<host>.extraheader` (plus `insteadOf` rewrites so SSH-spelled remotes for
+    /// that host use the authenticated HTTPS transport). Applied only to a spawn that runs a
+    /// remote-contacting `git` subcommand. Default: false (opt-in).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub git: Option<bool>,
+}
+
+/// A host-provided script sourced before each built-in shell command when its shell target matches the active shell.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ShellInitScript {
+    /// Path to the script to source.
+    pub path: String,
+    /// Built-in shell that may source this script.
+    pub shell: ShellInitScriptShell,
+}
+
+/// Per-session settings for built-in shell tools.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ShellOptions {
+    /// Command-scoped GitHub credential injection for shell commands.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub credentials: Option<ShellCredentials>,
+    /// Controls automatic non-interactive profile loading where supported. Explicit initScripts are unaffected.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub init_profile: Option<ShellInitProfile>,
+    /// Ordered host-provided script paths sourced before each built-in shell command when the
+    /// entry's shell target matches the active shell. Use these for rc files, environment setup scripts,
+    /// or other custom scripts. A script that returns a nonzero status is reported, and later scripts
+    /// and the user command continue while the shell remains running. Because scripts are sourced into
+    /// the command shell, `exit`, `exec`, failures under `set -e`, or other shell-terminating behavior
+    /// can prevent continuation. Script standard output is preserved; Bash script stderr is discarded,
+    /// PowerShell exception messages are replaced, and runtime-generated failure notices omit
+    /// configured script paths. When sandboxing is enabled, each script must already be readable under
+    /// the active sandbox filesystem policy. Pass an empty array to clear the list.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub init_scripts: Option<Vec<ShellInitScript>>,
+    /// Flags passed to the active built-in shell process on startup, replacing its default flags.
+    /// When omitted, the built-in Bash shell uses `--norc --noprofile`,
+    /// and the built-in PowerShell shell uses `-NoProfile -NoLogo`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub process_flags: Option<Vec<String>>,
+}
+
+/// Session construction options.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionOpenOptions {
+    /// Additional content-exclusion policies to merge into the session policy set.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub additional_content_exclusion_policies:
+        Option<Vec<SessionOpenOptionsAdditionalContentExclusionPolicy>>,
+    /// Additional directories the agent may access beyond the working directory. Each entry is granted to the session's file-access allow-list and surfaced to the model (system prompt context and `@`-mention completion). Absolute paths are recommended; a relative path is resolved against the session's working directory. Nonexistent or unresolvable entries are skipped with a warning. This is applied on both session creation and resume, and is not persisted: a resumed session that omits this option does not retain previously supplied directories (re-supply them, exactly as the CLI re-passes `--add-dir`).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub additional_directories: Option<Vec<String>>,
+    /// Runtime context discriminator for agent filtering.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub agent_context: Option<String>,
+    /// Whether to include instructions from every MCP server in the system prompt instead of only allowlisted servers.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub allow_all_mcp_server_instructions: Option<bool>,
+    /// Whether ask_user is explicitly disabled.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub ask_user_disabled: Option<bool>,
+    /// Initial authentication info for the session.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub auth_info: Option<AuthInfo>,
+    /// Allowlist of available tool names.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub available_tools: Option<Vec<String>>,
+    /// Options scoped to the built-in CAPI (Copilot API) provider.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub capi: Option<CapiSessionOptions>,
+    /// Structured client kind used for runtime behavior gates.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub client_kind: Option<String>,
+    /// Identifier of the client driving the session.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub client_name: Option<String>,
     /// Whether commit-message coauthor trailers are enabled.
@@ -15617,131 +16528,635 @@ pub struct SessionOpenOptions {
     /// ExP assignment ('flight') data injected by an SDK integrator, in the same JSON shape the Copilot CLI fetches from the experimentation service (CopilotExpAssignmentResponse). When supplied this is fed into the FeatureFlagService exactly like CLI-fetched assignments and ExP-backed flags wait for it. When absent the session does not block on ExP.
     #[doc(hidden)]
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub(crate) exp_assignments: Option<serde_json::Value>,
-    /// Feature-flag values resolved by the host.
+    pub(crate) exp_assignments: Option<serde_json::Value>,
+    /// Feature-flag values resolved by the host.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub feature_flags: Option<HashMap<String, bool>>,
+    /// Built-in subagent names to include in this session. When specified, only these built-ins are available, subject to runtime availability and exclusions. Custom agents with the same name remain available.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub included_builtin_agents: Option<Vec<String>>,
+    /// Installed plugins visible to the session.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub installed_plugins: Option<Vec<InstalledPlugin>>,
+    /// Stable integration identifier for analytics.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub integration_id: Option<String>,
+    /// Whether experimental behavior is enabled.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub is_experimental_mode: Option<bool>,
+    /// Whether interactive shell sessions are logged.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub log_interactive_shells: Option<bool>,
+    /// Identifier sent to LSP-style integrations.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub lsp_client_name: Option<String>,
+    /// Permissions-only enterprise policy injected by the SDK host at session create or resume. Composes restrictively with self-fetched and device policy and is not persisted.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub managed_settings: Option<SessionManagedSettings>,
+    /// Maximum decoded byte size of a single inline model-facing binary tool result persisted in session events (default 10 MB).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_inline_binary_bytes: Option<i64>,
+    /// Memory configuration for this session.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub memory: Option<MemoryConfiguration>,
+    /// Initial model identifier.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model: Option<String>,
+    /// Initial model capability overrides.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_capabilities_overrides: Option<ModelCapabilitiesOverride>,
+    /// BYOK model definitions added to the selectable model list, each referencing a provider name.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub models: Option<Vec<ProviderModelConfig>>,
+    /// Optional human-friendly session name.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    /// Custom model-provider configuration (BYOK).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub provider: Option<ProviderConfig>,
+    /// Named BYOK provider connections, additive to CAPI auth. Combining with `provider` is rejected.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub providers: Option<Vec<NamedProviderConfig>>,
+    /// Initial reasoning effort level. CAPI values are model-defined and validated against the selected model; BYOK providers may define additional values. When omitted, no effort override is applied.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reasoning_effort: Option<String>,
+    /// Initial reasoning summary mode for supported model clients.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reasoning_summary: Option<SessionOpenOptionsReasoningSummary>,
+    /// Telemetry-only remote-defaulted flag.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub remote_defaulted_on: Option<bool>,
+    /// Telemetry-only remote exporting flag.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub remote_exporting: Option<bool>,
+    /// Whether this session supports remote steering.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub remote_steerable: Option<bool>,
+    /// Whether the host is an interactive UI.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub running_in_interactive_mode: Option<bool>,
+    /// Resolved sandbox configuration.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub sandbox_config: Option<SandboxConfig>,
+    /// Capabilities enabled for this session.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub session_capabilities: Option<Vec<SessionCapability>>,
+    /// Optional stable session identifier to use for a new session.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub session_id: Option<SessionId>,
+    /// Initial session limits.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub session_limits: Option<SessionLimitsConfig>,
+    /// Per-session settings for built-in shell tools.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub shell: Option<ShellOptions>,
+    /// Use shell.initProfile instead. Shell init profile.
+    #[doc(hidden)]
+    #[deprecated]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub shell_init_profile: Option<String>,
+    /// PowerShell process flags applied to built-in and user-requested shell commands.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub shell_process_flags: Option<Vec<String>>,
+    /// Additional directories to search for skills.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub skill_directories: Option<Vec<String>>,
+    /// Whether to skip custom instruction sources.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub skip_custom_instructions: Option<bool>,
+    /// Optional trajectory output file path.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub trajectory_file: Option<String>,
+    /// Initial output verbosity level for supported models.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub verbosity: Option<Verbosity>,
+    /// Working directory to anchor the session.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub working_directory: Option<String>,
+    /// Pre-resolved working-directory context for session startup.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub working_directory_context: Option<SessionContext>,
+}
+
+/// Parameters for creating a new local session.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionsOpenCreate {
+    /// Whether to emit session.start during creation. Defaults to true.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub emit_start: Option<bool>,
+    /// Create a new local session.
+    pub kind: SessionsOpenCreateKind,
+    /// Session construction options.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub options: Option<SessionOpenOptions>,
+}
+
+/// Parameters for resuming a specific local session.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionsOpenResume {
+    /// Resume a specific local session by ID or prefix.
+    pub kind: SessionsOpenResumeKind,
+    /// Session resume options.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub options: Option<SessionOpenOptions>,
+    /// Whether to emit session.resume after loading. Defaults to true.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub resume: Option<bool>,
+    /// Session ID or unique prefix to resume.
+    pub session_id: SessionId,
+    /// Suppress workspace.yaml metadata writeback when resuming from an incidental cwd.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub suppress_resume_workspace_metadata_writeback: Option<bool>,
+}
+
+/// Parameters for resuming the most relevant local session.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionsOpenResumeLast {
+    /// Working-directory context used to choose the most relevant session.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub feature_flags: Option<HashMap<String, bool>>,
-    /// Built-in subagent names to include in this session. When specified, only these built-ins are available, subject to runtime availability and exclusions. Custom agents with the same name remain available.
+    pub context: Option<SessionContext>,
+    /// Resume the most relevant existing local session.
+    pub kind: SessionsOpenResumeLastKind,
+    /// Session resume options.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub included_builtin_agents: Option<Vec<String>>,
-    /// Installed plugins visible to the session.
+    pub options: Option<SessionOpenOptions>,
+    /// Suppress workspace.yaml metadata writeback when resuming from an incidental cwd.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub installed_plugins: Option<Vec<InstalledPlugin>>,
-    /// Stable integration identifier for analytics.
+    pub suppress_resume_workspace_metadata_writeback: Option<bool>,
+}
+
+/// Parameters for attaching to an already-active session by ID.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionsOpenAttach {
+    /// Attach to an already-active in-process session by ID. Unlike `resume`, this does NOT re-load from disk; the session must already be loaded by an earlier `create`/`resume` call. Returns `status: 'not_found'` when no active session matches the id. Useful for in-process consumers that need a fresh API handle to a session opened elsewhere (e.g., a peer foreground-session switch).
+    pub kind: SessionsOpenAttachKind,
+    /// Session ID to attach to.
+    pub session_id: SessionId,
+}
+
+/// Parameters for connecting to a live remote session.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionsOpenRemote {
+    /// Connect to a live remote session.
+    pub kind: SessionsOpenRemoteKind,
+    /// Session options for the connection.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub integration_id: Option<String>,
-    /// Whether experimental behavior is enabled.
+    pub options: Option<SessionOpenOptions>,
+    /// Remote session identifier to connect to.
+    pub remote_session_id: SessionId,
+    /// Repository context for the remote session.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub is_experimental_mode: Option<bool>,
-    /// Whether interactive shell sessions are logged.
+    pub repository: Option<RemoteSessionRepository>,
+}
+
+/// Parameters for creating a new cloud session.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionsOpenCloud {
+    /// Create a new cloud (coding-agent) session.
+    pub kind: SessionsOpenCloudKind,
+    /// In-process callback invoked when the cloud task is created (before connection). Marked internal because a function reference cannot cross the JSON-RPC boundary. Disappears in the SDK migration: the field is purely cosmetic (it flips a single CLI phase label from 'creating' to 'connecting') and the wire-clean version just drops the intermediate phase.
+    #[doc(hidden)]
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub log_interactive_shells: Option<bool>,
-    /// Identifier sent to LSP-style integrations.
+    pub(crate) on_task_created: Option<serde_json::Value>,
+    /// Session options for cloud session creation.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub lsp_client_name: Option<String>,
-    /// Permissions-only enterprise policy injected by the SDK host at session create or resume. Composes restrictively with self-fetched and device policy and is not persisted.
+    pub options: Option<SessionOpenOptions>,
+    /// Optional owner (user or organization login) to associate with the cloud session when no repository is provided. Ignored when `repository` is set (the repo's owner takes precedence).
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub managed_settings: Option<SessionManagedSettings>,
-    /// Maximum decoded byte size of a single inline model-facing binary tool result persisted in session events (default 10 MB).
+    pub owner: Option<String>,
+    /// Repository for the cloud session.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_inline_binary_bytes: Option<i64>,
-    /// Memory configuration for this session.
+    pub repository: Option<RemoteSessionRepository>,
+}
+
+/// Parameters for fetching a remote session and handing it off to a new local session.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionsOpenHandoff {
+    /// Fetch a remote session and hand it off to a new local session.
+    pub kind: SessionsOpenHandoffKind,
+    /// Remote session metadata for the session to hand off (typically obtained from `sessions.list` with `source: "remote"`).
+    pub metadata: RemoteSessionMetadataValue,
+    /// In-process confirmation callback `(request) => boolean | Promise<boolean>` invoked when the handoff needs the caller to confirm a non-fatal blocker (e.g. a repository mismatch between the current working directory and the remote session). Returning `true` proceeds with the handoff; returning `false` (or omitting the callback) aborts it. Marked internal because a function reference cannot cross the JSON-RPC boundary, for the same reasons as `onProgress`.
+    #[doc(hidden)]
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub memory: Option<MemoryConfiguration>,
-    /// Initial model identifier.
+    pub(crate) on_confirm: Option<serde_json::Value>,
+    /// In-process progress callback `(update) => void` invoked for each handoff step. Marked internal because a function reference cannot cross the JSON-RPC boundary. The host-side `handoffSession` is already declared as `AsyncGenerator<HandoffProgress, HandoffResult>`; the schema layer flattens it because it does not yet support streaming methods. The wire-clean replacement is to expose the AsyncGenerator directly (or use vscode-jsonrpc `$/progress` notifications) once the schema/transport layer supports it.
+    #[doc(hidden)]
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub model: Option<String>,
-    /// Initial model capability overrides.
+    pub(crate) on_progress: Option<serde_json::Value>,
+    /// Session construction options for the new local session.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub model_capabilities_overrides: Option<ModelCapabilitiesOverride>,
-    /// BYOK model definitions added to the selectable model list, each referencing a provider name.
-    ///
-    /// <div class="warning">
-    ///
-    /// **Experimental.** This type is part of an experimental wire-protocol surface
-    /// and may change or be removed in future SDK or CLI releases.
-    ///
-    /// </div>
+    pub options: Option<SessionOpenOptions>,
+    /// Task type determines the handoff strategy (CCA fetches events; CLI prepares a transient session).
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub models: Option<Vec<ProviderModelConfig>>,
-    /// Optional human-friendly session name.
+    pub task_type: Option<SessionsOpenHandoffTaskType>,
+}
+
+/// `sessions.open` handoff progress update with step, status, and optional message.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionsOpenProgress {
+    /// Optional step message.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    /// Custom model-provider configuration (BYOK).
+    pub message: Option<String>,
+    /// Step status.
+    pub status: SessionsOpenProgressStatus,
+    /// Handoff step.
+    pub step: SessionsOpenProgressStep,
+}
+
+/// Result of opening a session.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionOpenResult {
+    /// Remote session metadata, present when status is `connected`.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub provider: Option<ProviderConfig>,
-    /// Named BYOK provider connections, additive to CAPI auth. Combining with `provider` is rejected.
-    ///
-    /// <div class="warning">
-    ///
-    /// **Experimental.** This type is part of an experimental wire-protocol surface
-    /// and may change or be removed in future SDK or CLI releases.
-    ///
-    /// </div>
+    pub metadata: Option<RemoteSessionMetadataValue>,
+    /// Handoff progress steps, present when status is `handed_off`.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub providers: Option<Vec<NamedProviderConfig>>,
-    /// Initial reasoning effort level. CAPI values are model-defined and validated against the selected model; BYOK providers may define additional values. When omitted, no effort override is applied.
+    pub progress: Option<Vec<SessionsOpenProgress>>,
+    /// Remote session ID, present when status is `connected`.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub reasoning_effort: Option<String>,
-    /// Initial reasoning summary mode for supported model clients.
+    pub remote_session_id: Option<SessionId>,
+    /// In-process SessionClientApi handle for the opened session, returned to CLI callers as a transitional shortcut. Marked internal so the public SDK surface does not expose it; SDK consumers should construct per-session clients from `sessionId` instead.
+    #[doc(hidden)]
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub reasoning_summary: Option<SessionOpenOptionsReasoningSummary>,
-    /// Telemetry-only remote-defaulted flag.
+    pub(crate) session_api: Option<serde_json::Value>,
+    /// Opened session ID. Omitted when status is `not_found`.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub remote_defaulted_on: Option<bool>,
-    /// Telemetry-only remote exporting flag.
+    pub session_id: Option<SessionId>,
+    /// Startup prompts queued by user-level hook configs at session creation. Only populated when status is `created`; resumed sessions return an empty array.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub remote_exporting: Option<bool>,
-    /// Whether this session supports remote steering.
+    pub startup_prompts: Option<Vec<String>>,
+    /// Outcome of the open request.
+    pub status: SessionsOpenStatus,
+}
+
+/// Outcome of the prune operation: deleted IDs, dry-run candidates, skipped IDs, total bytes freed, and the dry-run flag.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionPruneResult {
+    /// Session IDs that would be deleted in dry-run mode (always empty otherwise)
+    pub candidates: Vec<String>,
+    /// Session IDs that were deleted (always empty in dry-run mode)
+    pub deleted: Vec<String>,
+    /// True when no deletions were actually performed
+    pub dry_run: bool,
+    /// Total bytes freed (actual when not dry-run, projected when dry-run)
+    pub freed_bytes: i64,
+    /// Session IDs that were skipped (e.g., named sessions)
+    pub skipped: Vec<String>,
+}
+
+/// Session IDs to close, deactivate, and delete from disk.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionsBulkDeleteRequest {
+    /// Session IDs to close, deactivate, and delete from disk
+    pub session_ids: Vec<String>,
+}
+
+/// Session IDs to test for live in-use locks.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionsCheckInUseRequest {
+    /// Session IDs to test for live in-use locks
+    pub session_ids: Vec<String>,
+}
+
+/// Session IDs from the input set that are currently in use by another process.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionsCheckInUseResult {
+    /// Session IDs from the input set that are currently held by another running process via an alive lock file
+    pub in_use: Vec<String>,
+}
+
+/// Session ID to close.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionsCloseRequest {
+    /// Session ID to close
+    pub session_id: SessionId,
+}
+
+/// Closes a session: emits shutdown, flushes pending events to disk, releases the in-use lock, disposes the active session. Idempotent: succeeds even if the session is not currently active.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionsCloseResult {}
+
+/// Session ID to delete from disk.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionsDeleteRequest {
+    /// Session ID to delete
+    pub session_id: SessionId,
+    /// Internal resolved session directory path to delete
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub remote_steerable: Option<bool>,
-    /// Whether the host is an interactive UI.
+    pub session_path: Option<String>,
+}
+
+/// Session metadata records to enrich with summary and context information.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionsEnrichMetadataRequest {
+    /// Session metadata records to enrich. Records that already have summary and context are returned unchanged.
+    pub sessions: Vec<LocalSessionMetadataValue>,
+}
+
+/// New auth credentials to install on the session. Omit to leave credentials unchanged.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionSetCredentialsParams {
+    /// The new auth credentials to install on the session. When omitted or `undefined`, the call is a no-op and the session's existing credentials are preserved. The runtime installs the supplied value immediately for outbound model/API requests. When the credential carries a raw token (`token`, `env`, or `gh-cli`) but no `copilotUser`, the runtime additionally re-resolves `copilotUser` server-side (best-effort, asynchronously, after the synchronous install) so plan/quota/billing metadata regains fidelity; on resolution failure the verbatim credential remains installed. It does NOT otherwise validate the credential. Several variants carry secret material; treat this method's params as containing secrets at rest and in transit.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub running_in_interactive_mode: Option<bool>,
-    /// Resolved sandbox configuration.
+    pub credentials: Option<AuthInfo>,
+}
+
+/// Indicates whether the credential update succeeded.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionSetCredentialsResult {
+    /// Whether the session ended up with a populated `copilotUser` for the installed credentials. `true` when the supplied credential already carried `copilotUser` or it was successfully re-resolved server-side. `false` when the credential is installed without `copilotUser` — either re-resolution failed, or the variant cannot be re-resolved from the credential alone (only the raw-token variants `token`, `env`, and `gh-cli` can). In both `false` cases the token swap still applied, but plan/quota/billing metadata is degraded. Present whenever a credential was supplied; omitted only when no credential was supplied (no-op call).
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub sandbox_config: Option<SandboxConfig>,
-    /// Capabilities enabled for this session.
+    pub copilot_user_resolved: Option<bool>,
+    /// Whether the operation succeeded
+    pub success: bool,
+}
+
+/// Availability of built-in job tools surfaced to boundary consumers.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionSettingsBuiltInToolAvailabilitySnapshot {
+    /// Whether the create-pull-request tool is available.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub session_capabilities: Option<Vec<SessionCapability>>,
-    /// Optional stable session identifier to use for a new session.
+    pub create_pull_request: Option<bool>,
+    /// Whether the report-progress tool is available.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub session_id: Option<SessionId>,
-    /// Initial session limits.
+    pub report_progress: Option<bool>,
+}
+
+/// Named Rust-owned settings predicate to evaluate for this session.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionSettingsEvaluatePredicateRequest {
+    /// Predicate name. The runtime owns the raw feature-flag names and composition logic.
+    pub name: SessionSettingsPredicateName,
+    /// Tool name for tool-scoped predicates such as trivial-change handling.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub session_limits: Option<SessionLimitsConfig>,
-    /// Per-session settings for built-in shell tools.
+    pub tool_name: Option<String>,
+}
+
+/// Result of evaluating a Rust-owned settings predicate.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionSettingsEvaluatePredicateResult {
+    /// Whether the named settings predicate evaluated to enabled.
+    pub enabled: bool,
+}
+
+/// Redacted job settings for a session. The job nonce is excluded.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionSettingsJobSnapshot {
+    /// Availability of job-specific built-in tools.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub shell: Option<ShellOptions>,
-    /// Use shell.initProfile instead. Shell init profile.
-    #[doc(hidden)]
-    #[deprecated]
+    pub built_in_tool_availability: Option<SessionSettingsBuiltInToolAvailabilitySnapshot>,
+    /// GitHub Actions event type for the job.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub shell_init_profile: Option<String>,
-    /// PowerShell process flags applied to built-in and user-requested shell commands.
+    pub event_type: Option<String>,
+    /// Whether this is the workflow's trigger job.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub shell_process_flags: Option<Vec<String>>,
-    /// Additional directories to search for skills.
+    pub is_trigger_job: Option<bool>,
+}
+
+/// Redacted model routing settings for a session.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionSettingsModelSnapshot {
+    /// Agent service callback URL for job and progress updates.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub skill_directories: Option<Vec<String>>,
-    /// Whether to skip custom instruction sources.
+    pub callback_url: Option<String>,
+    /// Default reasoning effort for the selected model.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub skip_custom_instructions: Option<bool>,
-    /// Optional trajectory output file path.
+    pub default_reasoning_effort: Option<String>,
+    /// Agent job identifier for the session.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub trajectory_file: Option<String>,
-    /// Initial output verbosity level for supported models.
+    pub instance_id: Option<String>,
+    /// Selected model identifier.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub verbosity: Option<Verbosity>,
-    /// Working directory to anchor the session.
+    pub model: Option<String>,
+}
+
+/// Online-evaluation settings safe to expose across the SDK boundary.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionSettingsOnlineEvaluationSnapshot {
+    /// Whether online evaluation is disabled.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub working_directory: Option<String>,
-    /// Pre-resolved working-directory context for session startup.
+    pub disable_online_evaluation: Option<bool>,
+    /// Whether online-evaluation output-file generation is enabled.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub working_directory_context: Option<SessionContext>,
+    pub enable_online_evaluation_output_file: Option<bool>,
 }
 
-/// Parameters for creating a new local session.
+/// Redacted repository and GitHub host settings for a session.
 ///
 /// <div class="warning">
 ///
@@ -15751,18 +17166,46 @@ pub struct SessionOpenOptions {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsOpenCreate {
-    /// Whether to emit session.start during creation. Defaults to true.
+pub struct SessionSettingsRepoSnapshot {
+    /// Checked-out repository branch.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub emit_start: Option<bool>,
-    /// Create a new local session.
-    pub kind: SessionsOpenCreateKind,
-    /// Session construction options.
+    pub branch: Option<String>,
+    /// Checked-out commit SHA.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub options: Option<SessionOpenOptions>,
+    pub commit: Option<String>,
+    /// GitHub server host name.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub host: Option<String>,
+    /// Protocol used to access the GitHub host.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub host_protocol: Option<String>,
+    /// GitHub repository database ID.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub id: Option<f64>,
+    /// Repository name.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    /// GitHub repository owner database ID.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub owner_id: Option<f64>,
+    /// Repository owner login.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub owner_name: Option<String>,
+    /// Number of commits in the pull request.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub pr_commit_count: Option<f64>,
+    /// Whether the repository is writable.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub read_write: Option<bool>,
+    /// GitHub secret-scanning service URL.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub secret_scanning_url: Option<String>,
+    /// GitHub server base URL.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub server_url: Option<String>,
 }
 
-/// Parameters for resuming a specific local session.
+/// Redacted validation and memory-tool settings for a session.
 ///
 /// <div class="warning">
 ///
@@ -15772,23 +17215,37 @@ pub struct SessionsOpenCreate {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsOpenResume {
-    /// Resume a specific local session by ID or prefix.
-    pub kind: SessionsOpenResumeKind,
-    /// Session resume options.
+pub struct SessionSettingsValidationSnapshot {
+    /// Whether advisory validation is enabled.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub options: Option<SessionOpenOptions>,
-    /// Whether to emit session.resume after loading. Defaults to true.
+    pub advisory_enabled: Option<bool>,
+    /// Whether CodeQL validation is enabled.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub resume: Option<bool>,
-    /// Session ID or unique prefix to resume.
-    pub session_id: SessionId,
-    /// Suppress workspace.yaml metadata writeback when resuming from an incidental cwd.
+    pub codeql_enabled: Option<bool>,
+    /// Whether code-review validation is enabled.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub suppress_resume_workspace_metadata_writeback: Option<bool>,
+    pub code_review_enabled: Option<bool>,
+    /// Model used for code-review validation.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub code_review_model: Option<String>,
+    /// Dependabot validation timeout budget in seconds.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub dependabot_timeout: Option<f64>,
+    /// Whether the memory-store tool is enabled.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub memory_store_enabled: Option<bool>,
+    /// Whether the memory-vote tool is enabled.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub memory_vote_enabled: Option<bool>,
+    /// Whether secret-scanning validation is enabled.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub secret_scanning_enabled: Option<bool>,
+    /// General validation timeout budget in seconds.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub timeout: Option<f64>,
 }
 
-/// Parameters for resuming the most relevant local session.
+/// Redacted, serializable view of session runtime settings for SDK boundary consumers. Secrets and raw feature flags are intentionally excluded.
 ///
 /// <div class="warning">
 ///
@@ -15798,21 +17255,32 @@ pub struct SessionsOpenResume {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsOpenResumeLast {
-    /// Working-directory context used to choose the most relevant session.
+pub struct SessionSettingsSnapshot {
+    /// Name of the SDK client that created the session.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub context: Option<SessionContext>,
-    /// Resume the most relevant existing local session.
-    pub kind: SessionsOpenResumeLastKind,
-    /// Session resume options.
+    pub client_name: Option<String>,
+    /// Redacted job settings.
+    pub job: SessionSettingsJobSnapshot,
+    /// Redacted model routing settings.
+    pub model: SessionSettingsModelSnapshot,
+    /// Online-evaluation settings safe for SDK consumers.
+    pub online_evaluation: SessionSettingsOnlineEvaluationSnapshot,
+    /// Redacted repository and host settings.
+    pub repo: SessionSettingsRepoSnapshot,
+    /// Session start time as Unix epoch milliseconds.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub options: Option<SessionOpenOptions>,
-    /// Suppress workspace.yaml metadata writeback when resuming from an incidental cwd.
+    pub start_time_ms: Option<f64>,
+    /// Session timeout in milliseconds.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub suppress_resume_workspace_metadata_writeback: Option<bool>,
+    pub timeout_ms: Option<f64>,
+    /// Redacted validation and memory-tool settings.
+    pub validation: SessionSettingsValidationSnapshot,
+    /// Agent runtime version selector copied from the session settings, such as `latest` or a runtime release identifier.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub version: Option<String>,
 }
 
-/// Parameters for attaching to an already-active session by ID.
+/// UUID prefix to resolve to a unique session ID.
 ///
 /// <div class="warning">
 ///
@@ -15822,14 +17290,12 @@ pub struct SessionsOpenResumeLast {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsOpenAttach {
-    /// Attach to an already-active in-process session by ID. Unlike `resume`, this does NOT re-load from disk; the session must already be loaded by an earlier `create`/`resume` call. Returns `status: 'not_found'` when no active session matches the id. Useful for in-process consumers that need a fresh API handle to a session opened elsewhere (e.g., a peer foreground-session switch).
-    pub kind: SessionsOpenAttachKind,
-    /// Session ID to attach to.
-    pub session_id: SessionId,
+pub struct SessionsFindByPrefixRequest {
+    /// UUID prefix (>=7 hex chars, <36 chars). Returns the unique session ID, or undefined when there is no match or the prefix matches multiple sessions.
+    pub prefix: String,
 }
 
-/// Parameters for connecting to a live remote session.
+/// Session ID matching the prefix, omitted when no unique match exists.
 ///
 /// <div class="warning">
 ///
@@ -15839,20 +17305,13 @@ pub struct SessionsOpenAttach {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsOpenRemote {
-    /// Connect to a live remote session.
-    pub kind: SessionsOpenRemoteKind,
-    /// Session options for the connection.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub options: Option<SessionOpenOptions>,
-    /// Remote session identifier to connect to.
-    pub remote_session_id: SessionId,
-    /// Repository context for the remote session.
+pub struct SessionsFindByPrefixResult {
+    /// Omitted when no unique session matches the prefix (no match or ambiguous)
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub repository: Option<RemoteSessionRepository>,
+    pub session_id: Option<SessionId>,
 }
 
-/// Parameters for creating a new cloud session.
+/// GitHub task ID to look up.
 ///
 /// <div class="warning">
 ///
@@ -15862,25 +17321,12 @@ pub struct SessionsOpenRemote {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsOpenCloud {
-    /// Create a new cloud (coding-agent) session.
-    pub kind: SessionsOpenCloudKind,
-    /// In-process callback invoked when the cloud task is created (before connection). Marked internal because a function reference cannot cross the JSON-RPC boundary. Disappears in the SDK migration: the field is purely cosmetic (it flips a single CLI phase label from 'creating' to 'connecting') and the wire-clean version just drops the intermediate phase.
-    #[doc(hidden)]
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub(crate) on_task_created: Option<serde_json::Value>,
-    /// Session options for cloud session creation.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub options: Option<SessionOpenOptions>,
-    /// Optional owner (user or organization login) to associate with the cloud session when no repository is provided. Ignored when `repository` is set (the repo's owner takes precedence).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub owner: Option<String>,
-    /// Repository for the cloud session.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub repository: Option<RemoteSessionRepository>,
+pub struct SessionsFindByTaskIDRequest {
+    /// GitHub task ID to look up
+    pub task_id: String,
 }
 
-/// Parameters for fetching a remote session and handing it off to a new local session.
+/// ID of the local session bound to the given GitHub task, or omitted when none.
 ///
 /// <div class="warning">
 ///
@@ -15890,28 +17336,13 @@ pub struct SessionsOpenCloud {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsOpenHandoff {
-    /// Fetch a remote session and hand it off to a new local session.
-    pub kind: SessionsOpenHandoffKind,
-    /// Remote session metadata for the session to hand off (typically obtained from `sessions.list` with `source: "remote"`).
-    pub metadata: RemoteSessionMetadataValue,
-    /// In-process confirmation callback `(request) => boolean | Promise<boolean>` invoked when the handoff needs the caller to confirm a non-fatal blocker (e.g. a repository mismatch between the current working directory and the remote session). Returning `true` proceeds with the handoff; returning `false` (or omitting the callback) aborts it. Marked internal because a function reference cannot cross the JSON-RPC boundary, for the same reasons as `onProgress`.
-    #[doc(hidden)]
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub(crate) on_confirm: Option<serde_json::Value>,
-    /// In-process progress callback `(update) => void` invoked for each handoff step. Marked internal because a function reference cannot cross the JSON-RPC boundary. The host-side `handoffSession` is already declared as `AsyncGenerator<HandoffProgress, HandoffResult>`; the schema layer flattens it because it does not yet support streaming methods. The wire-clean replacement is to expose the AsyncGenerator directly (or use vscode-jsonrpc `$/progress` notifications) once the schema/transport layer supports it.
-    #[doc(hidden)]
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub(crate) on_progress: Option<serde_json::Value>,
-    /// Session construction options for the new local session.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub options: Option<SessionOpenOptions>,
-    /// Task type determines the handoff strategy (CCA fetches events; CLI prepares a transient session).
+pub struct SessionsFindByTaskIDResult {
+    /// Omitted when no local session is bound to that GitHub task
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub task_type: Option<SessionsOpenHandoffTaskType>,
+    pub session_id: Option<SessionId>,
 }
 
-/// `sessions.open` handoff progress update with step, status, and optional message.
+/// Source session identifier to fork from, optional event-ID boundary, and optional friendly name for the new session.
 ///
 /// <div class="warning">
 ///
@@ -15921,17 +17352,18 @@ pub struct SessionsOpenHandoff {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsOpenProgress {
-    /// Optional step message.
+pub struct SessionsForkRequest {
+    /// Optional friendly name to assign to the forked session.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub message: Option<String>,
-    /// Step status.
-    pub status: SessionsOpenProgressStatus,
-    /// Handoff step.
-    pub step: SessionsOpenProgressStep,
+    pub name: Option<String>,
+    /// Source session ID to fork from
+    pub session_id: SessionId,
+    /// Optional event ID boundary. When provided, the fork includes only events before this ID (exclusive). When omitted, all events are included.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub to_event_id: Option<String>,
 }
 
-/// Result of opening a session.
+/// Identifier and optional friendly name assigned to the newly forked session.
 ///
 /// <div class="warning">
 ///
@@ -15941,31 +17373,15 @@ pub struct SessionsOpenProgress {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionOpenResult {
-    /// Remote session metadata, present when status is `connected`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub metadata: Option<RemoteSessionMetadataValue>,
-    /// Handoff progress steps, present when status is `handed_off`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub progress: Option<Vec<SessionsOpenProgress>>,
-    /// Remote session ID, present when status is `connected`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub remote_session_id: Option<SessionId>,
-    /// In-process SessionClientApi handle for the opened session, returned to CLI callers as a transitional shortcut. Marked internal so the public SDK surface does not expose it; SDK consumers should construct per-session clients from `sessionId` instead.
-    #[doc(hidden)]
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub(crate) session_api: Option<serde_json::Value>,
-    /// Opened session ID. Omitted when status is `not_found`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub session_id: Option<SessionId>,
-    /// Startup prompts queued by user-level hook configs at session creation. Only populated when status is `created`; resumed sessions return an empty array.
+pub struct SessionsForkResult {
+    /// Friendly name assigned to the forked session, if any.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub startup_prompts: Option<Vec<String>>,
-    /// Outcome of the open request.
-    pub status: SessionsOpenStatus,
+    pub name: Option<String>,
+    /// The new forked session's ID
+    pub session_id: SessionId,
 }
 
-/// Outcome of the prune operation: deleted IDs, dry-run candidates, skipped IDs, total bytes freed, and the dry-run flag.
+/// Session ID whose board entry count should be returned.
 ///
 /// <div class="warning">
 ///
@@ -15975,20 +17391,12 @@ pub struct SessionOpenResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPruneResult {
-    /// Session IDs that would be deleted in dry-run mode (always empty otherwise)
-    pub candidates: Vec<String>,
-    /// Session IDs that were deleted (always empty in dry-run mode)
-    pub deleted: Vec<String>,
-    /// True when no deletions were actually performed
-    pub dry_run: bool,
-    /// Total bytes freed (actual when not dry-run, projected when dry-run)
-    pub freed_bytes: i64,
-    /// Session IDs that were skipped (e.g., named sessions)
-    pub skipped: Vec<String>,
+pub struct SessionsGetBoardEntryCountRequest {
+    /// Session ID whose board entry count should be returned.
+    pub session_id: SessionId,
 }
 
-/// Session IDs to close, deactivate, and delete from disk.
+/// Dynamic-context board entry count, when available.
 ///
 /// <div class="warning">
 ///
@@ -15998,12 +17406,13 @@ pub struct SessionPruneResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsBulkDeleteRequest {
-    /// Session IDs to close, deactivate, and delete from disk
-    pub session_ids: Vec<String>,
+pub struct SessionsGetBoardEntryCountResult {
+    /// Board entry count, when available.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub count: Option<i64>,
 }
 
-/// Session IDs to test for live in-use locks.
+/// Session ID whose event-log file path to compute.
 ///
 /// <div class="warning">
 ///
@@ -16013,12 +17422,12 @@ pub struct SessionsBulkDeleteRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsCheckInUseRequest {
-    /// Session IDs to test for live in-use locks
-    pub session_ids: Vec<String>,
+pub struct SessionsGetEventFilePathRequest {
+    /// Session ID whose event-log file path to compute
+    pub session_id: SessionId,
 }
 
-/// Session IDs from the input set that are currently in use by another process.
+/// Absolute path to the session's events.jsonl file on disk.
 ///
 /// <div class="warning">
 ///
@@ -16028,12 +17437,12 @@ pub struct SessionsCheckInUseRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsCheckInUseResult {
-    /// Session IDs from the input set that are currently held by another running process via an alive lock file
-    pub in_use: Vec<String>,
+pub struct SessionsGetEventFilePathResult {
+    /// Absolute path to the session's events.jsonl file
+    pub file_path: String,
 }
 
-/// Session ID to close.
+/// Optional working-directory context used to score session relevance.
 ///
 /// <div class="warning">
 ///
@@ -16043,12 +17452,13 @@ pub struct SessionsCheckInUseResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsCloseRequest {
-    /// Session ID to close
-    pub session_id: SessionId,
+pub struct SessionsGetLastForContextRequest {
+    /// Optional working-directory context used to score session relevance. When omitted the most-recently-modified session wins.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub context: Option<SessionContext>,
 }
 
-/// Closes a session: emits shutdown, flushes pending events to disk, releases the in-use lock, disposes the active session. Idempotent: succeeds even if the session is not currently active.
+/// Most-relevant session ID for the supplied context, or omitted when no sessions exist.
 ///
 /// <div class="warning">
 ///
@@ -16058,9 +17468,13 @@ pub struct SessionsCloseRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsCloseResult {}
+pub struct SessionsGetLastForContextResult {
+    /// Most-relevant session ID for the supplied context, or omitted when no sessions exist
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub session_id: Option<SessionId>,
+}
 
-/// Session ID to delete from disk.
+/// Session ID whose persisted metadata should be read.
 ///
 /// <div class="warning">
 ///
@@ -16070,15 +17484,12 @@ pub struct SessionsCloseResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsDeleteRequest {
-    /// Session ID to delete
+pub struct SessionsGetMetadataRequest {
+    /// Session ID to inspect
     pub session_id: SessionId,
-    /// Internal resolved session directory path to delete
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub session_path: Option<String>,
 }
 
-/// Session metadata records to enrich with summary and context information.
+/// Persisted local session metadata when the session exists.
 ///
 /// <div class="warning">
 ///
@@ -16088,12 +17499,13 @@ pub struct SessionsDeleteRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsEnrichMetadataRequest {
-    /// Session metadata records to enrich. Records that already have summary and context are returned unchanged.
-    pub sessions: Vec<LocalSessionMetadataValue>,
+pub struct SessionsGetMetadataResult {
+    /// Local session metadata, omitted when the session does not exist.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub session: Option<LocalSessionMetadataValue>,
 }
 
-/// New auth credentials to install on the session. Omit to leave credentials unchanged.
+/// Session ID to look up the persisted remote-steerable flag for.
 ///
 /// <div class="warning">
 ///
@@ -16103,13 +17515,12 @@ pub struct SessionsEnrichMetadataRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSetCredentialsParams {
-    /// The new auth credentials to install on the session. When omitted or `undefined`, the call is a no-op and the session's existing credentials are preserved. The runtime installs the supplied value immediately for outbound model/API requests. When the credential carries a raw token (`token`, `env`, or `gh-cli`) but no `copilotUser`, the runtime additionally re-resolves `copilotUser` server-side (best-effort, asynchronously, after the synchronous install) so plan/quota/billing metadata regains fidelity; on resolution failure the verbatim credential remains installed. It does NOT otherwise validate the credential. Several variants carry secret material; treat this method's params as containing secrets at rest and in transit.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub credentials: Option<AuthInfo>,
+pub struct SessionsGetPersistedRemoteSteerableRequest {
+    /// Session ID to look up the persisted remote-steerable flag for
+    pub session_id: SessionId,
 }
 
-/// Indicates whether the credential update succeeded.
+/// The session's persisted remote-steerable flag, or omitted when no value has been persisted.
 ///
 /// <div class="warning">
 ///
@@ -16119,15 +17530,13 @@ pub struct SessionSetCredentialsParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSetCredentialsResult {
-    /// Whether the session ended up with a populated `copilotUser` for the installed credentials. `true` when the supplied credential already carried `copilotUser` or it was successfully re-resolved server-side. `false` when the credential is installed without `copilotUser` — either re-resolution failed, or the variant cannot be re-resolved from the credential alone (only the raw-token variants `token`, `env`, and `gh-cli` can). In both `false` cases the token swap still applied, but plan/quota/billing metadata is degraded. Present whenever a credential was supplied; omitted only when no credential was supplied (no-op call).
+pub struct SessionsGetPersistedRemoteSteerableResult {
+    /// The session's persisted remote-steerable flag if recorded; omitted when no value has been persisted
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub copilot_user_resolved: Option<bool>,
-    /// Whether the operation succeeded
-    pub success: bool,
+    pub remote_steerable: Option<bool>,
 }
 
-/// Availability of built-in job tools surfaced to boundary consumers.
+/// Map of sessionId -> on-disk size in bytes for each session's workspace directory.
 ///
 /// <div class="warning">
 ///
@@ -16137,16 +17546,12 @@ pub struct SessionSetCredentialsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSettingsBuiltInToolAvailabilitySnapshot {
-    /// Whether the create-pull-request tool is available.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub create_pull_request: Option<bool>,
-    /// Whether the report-progress tool is available.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub report_progress: Option<bool>,
+pub struct SessionSizes {
+    /// Map of sessionId -> on-disk size in bytes for the session's workspace directory
+    pub sizes: HashMap<String, i64>,
 }
 
-/// Named Rust-owned settings predicate to evaluate for this session.
+/// Limit for non-empty local session IDs.
 ///
 /// <div class="warning">
 ///
@@ -16156,15 +17561,13 @@ pub struct SessionSettingsBuiltInToolAvailabilitySnapshot {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSettingsEvaluatePredicateRequest {
-    /// Predicate name. The runtime owns the raw feature-flag names and composition logic.
-    pub name: SessionSettingsPredicateName,
-    /// Tool name for tool-scoped predicates such as trivial-change handling.
+pub struct SessionsListNonEmptySessionIdsRequest {
+    /// Maximum number of session IDs to return.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub tool_name: Option<String>,
+    pub limit: Option<i64>,
 }
 
-/// Result of evaluating a Rust-owned settings predicate.
+/// Recent local session IDs that contain user-visible history.
 ///
 /// <div class="warning">
 ///
@@ -16174,12 +17577,12 @@ pub struct SessionSettingsEvaluatePredicateRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSettingsEvaluatePredicateResult {
-    /// Whether the named settings predicate evaluated to enabled.
-    pub enabled: bool,
+pub struct SessionsListNonEmptySessionIdsResult {
+    /// Session IDs ordered newest-first.
+    pub session_ids: Vec<String>,
 }
 
-/// Redacted job settings for a session. The job nonce is excluded.
+/// Optional source filter, metadata-load limit, and context filter applied to the returned sessions.
 ///
 /// <div class="warning">
 ///
@@ -16189,19 +17592,25 @@ pub struct SessionSettingsEvaluatePredicateResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSettingsJobSnapshot {
-    /// Availability of job-specific built-in tools.
+pub struct SessionsListRequest {
+    /// Optional filter applied to the returned sessions
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub built_in_tool_availability: Option<SessionSettingsBuiltInToolAvailabilitySnapshot>,
-    /// GitHub Actions event type for the job.
+    pub filter: Option<SessionListFilter>,
+    /// When true, include detached maintenance sessions. Defaults to false for user-facing session lists.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub event_type: Option<String>,
-    /// Whether this is the workflow's trigger job.
+    pub include_detached: Option<bool>,
+    /// When provided, only the first N local sessions (sorted by modification time, newest first) load full metadata; remaining sessions return basic info only. Use 0 to return only basic info for every local session. Has no effect on remote entries (which always carry their full shape).
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub is_trigger_job: Option<bool>,
+    pub metadata_limit: Option<i64>,
+    /// Which session sources to include. Defaults to `local` for backward compatibility.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source: Option<SessionSource>,
+    /// Only meaningful when `source` includes remote. When true, propagates errors from the remote service instead of silently returning an empty remote list. Defaults to false.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub throw_on_error: Option<bool>,
 }
 
-/// Redacted model routing settings for a session.
+/// Active session ID whose deferred repo-level hooks should be loaded.
 ///
 /// <div class="warning">
 ///
@@ -16211,22 +17620,12 @@ pub struct SessionSettingsJobSnapshot {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSettingsModelSnapshot {
-    /// Agent service callback URL for job and progress updates.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub callback_url: Option<String>,
-    /// Default reasoning effort for the selected model.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub default_reasoning_effort: Option<String>,
-    /// Agent job identifier for the session.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub instance_id: Option<String>,
-    /// Selected model identifier.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub model: Option<String>,
+pub struct SessionsLoadDeferredRepoHooksRequest {
+    /// Active session ID whose deferred repo-level hooks should be loaded
+    pub session_id: SessionId,
 }
 
-/// Online-evaluation settings safe to expose across the SDK boundary.
+/// Age threshold and optional flags controlling which old sessions are pruned (or simulated when dryRun is true).
 ///
 /// <div class="warning">
 ///
@@ -16236,16 +17635,21 @@ pub struct SessionSettingsModelSnapshot {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSettingsOnlineEvaluationSnapshot {
-    /// Whether online evaluation is disabled.
+pub struct SessionsPruneOldRequest {
+    /// When true, only report what would be deleted without performing any deletion
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub disable_online_evaluation: Option<bool>,
-    /// Whether online-evaluation output-file generation is enabled.
+    pub dry_run: Option<bool>,
+    /// Session IDs that should never be considered for pruning
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub enable_online_evaluation_output_file: Option<bool>,
+    pub exclude_session_ids: Option<Vec<String>>,
+    /// When true, named sessions (set via /rename) are also eligible for pruning
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub include_named: Option<bool>,
+    /// Delete sessions whose modifiedTime is at least this many days old
+    pub older_than_days: i64,
 }
 
-/// Redacted repository and GitHub host settings for a session.
+/// Session ID whose in-use lock should be released.
 ///
 /// <div class="warning">
 ///
@@ -16255,46 +17659,12 @@ pub struct SessionSettingsOnlineEvaluationSnapshot {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSettingsRepoSnapshot {
-    /// Checked-out repository branch.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub branch: Option<String>,
-    /// Checked-out commit SHA.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub commit: Option<String>,
-    /// GitHub server host name.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub host: Option<String>,
-    /// Protocol used to access the GitHub host.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub host_protocol: Option<String>,
-    /// GitHub repository database ID.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub id: Option<f64>,
-    /// Repository name.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    /// GitHub repository owner database ID.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub owner_id: Option<f64>,
-    /// Repository owner login.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub owner_name: Option<String>,
-    /// Number of commits in the pull request.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub pr_commit_count: Option<f64>,
-    /// Whether the repository is writable.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub read_write: Option<bool>,
-    /// GitHub secret-scanning service URL.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub secret_scanning_url: Option<String>,
-    /// GitHub server base URL.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub server_url: Option<String>,
+pub struct SessionsReleaseLockRequest {
+    /// Session ID whose in-use lock should be released
+    pub session_id: SessionId,
 }
 
-/// Redacted validation and memory-tool settings for a session.
+/// Release the in-use lock held by this process for the given session. No-op when this process does not currently hold a lock for the session.
 ///
 /// <div class="warning">
 ///
@@ -16304,37 +17674,9 @@ pub struct SessionSettingsRepoSnapshot {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSettingsValidationSnapshot {
-    /// Whether advisory validation is enabled.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub advisory_enabled: Option<bool>,
-    /// Whether CodeQL validation is enabled.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub codeql_enabled: Option<bool>,
-    /// Whether code-review validation is enabled.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub code_review_enabled: Option<bool>,
-    /// Model used for code-review validation.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub code_review_model: Option<String>,
-    /// Dependabot validation timeout budget in seconds.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub dependabot_timeout: Option<f64>,
-    /// Whether the memory-store tool is enabled.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub memory_store_enabled: Option<bool>,
-    /// Whether the memory-vote tool is enabled.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub memory_vote_enabled: Option<bool>,
-    /// Whether secret-scanning validation is enabled.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub secret_scanning_enabled: Option<bool>,
-    /// General validation timeout budget in seconds.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub timeout: Option<f64>,
-}
+pub struct SessionsReleaseLockResult {}
 
-/// Redacted, serializable view of session runtime settings for SDK boundary consumers. Secrets and raw feature flags are intentionally excluded.
+/// Active session ID and an optional flag for deferring repo-level hooks until folder trust.
 ///
 /// <div class="warning">
 ///
@@ -16344,32 +17686,15 @@ pub struct SessionSettingsValidationSnapshot {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSettingsSnapshot {
-    /// Name of the SDK client that created the session.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub client_name: Option<String>,
-    /// Redacted job settings.
-    pub job: SessionSettingsJobSnapshot,
-    /// Redacted model routing settings.
-    pub model: SessionSettingsModelSnapshot,
-    /// Online-evaluation settings safe for SDK consumers.
-    pub online_evaluation: SessionSettingsOnlineEvaluationSnapshot,
-    /// Redacted repository and host settings.
-    pub repo: SessionSettingsRepoSnapshot,
-    /// Session start time as Unix epoch milliseconds.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub start_time_ms: Option<f64>,
-    /// Session timeout in milliseconds.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub timeout_ms: Option<f64>,
-    /// Redacted validation and memory-tool settings.
-    pub validation: SessionSettingsValidationSnapshot,
-    /// Agent runtime version selector copied from the session settings, such as `latest` or a runtime release identifier.
+pub struct SessionsReloadPluginHooksRequest {
+    /// When true, skip repo-level hooks. Use before folder trust is confirmed; loadDeferredRepoHooks loads them post-trust.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub version: Option<String>,
+    pub defer_repo_hooks: Option<bool>,
+    /// Active session ID to reload hooks for
+    pub session_id: SessionId,
 }
 
-/// UUID prefix to resolve to a unique session ID.
+/// Reload all hooks (user, plugin, optionally repo) and apply them to the active session. Call after installing or removing plugins so their hooks take effect immediately. No-op when no active session matches the given sessionId.
 ///
 /// <div class="warning">
 ///
@@ -16379,12 +17704,9 @@ pub struct SessionSettingsSnapshot {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsFindByPrefixRequest {
-    /// UUID prefix (>=7 hex chars, <36 chars). Returns the unique session ID, or undefined when there is no match or the prefix matches multiple sessions.
-    pub prefix: String,
-}
+pub struct SessionsReloadPluginHooksResult {}
 
-/// Session ID matching the prefix, omitted when no unique match exists.
+/// Session ID whose pending events should be flushed to disk.
 ///
 /// <div class="warning">
 ///
@@ -16394,13 +17716,12 @@ pub struct SessionsFindByPrefixRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsFindByPrefixResult {
-    /// Omitted when no unique session matches the prefix (no match or ambiguous)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub session_id: Option<SessionId>,
+pub struct SessionsSaveRequest {
+    /// Session ID whose pending events should be flushed to disk
+    pub session_id: SessionId,
 }
 
-/// GitHub task ID to look up.
+/// Flush a session's pending events to disk. No-op when no writer exists for the session (e.g., already closed).
 ///
 /// <div class="warning">
 ///
@@ -16410,12 +17731,9 @@ pub struct SessionsFindByPrefixResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsFindByTaskIDRequest {
-    /// GitHub task ID to look up
-    pub task_id: String,
-}
+pub struct SessionsSaveResult {}
 
-/// ID of the local session bound to the given GitHub task, or omitted when none.
+/// Manager-wide additional plugins to register; replaces any previously-configured set.
 ///
 /// <div class="warning">
 ///
@@ -16425,13 +17743,12 @@ pub struct SessionsFindByTaskIDRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsFindByTaskIDResult {
-    /// Omitted when no local session is bound to that GitHub task
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub session_id: Option<SessionId>,
+pub struct SessionsSetAdditionalPluginsRequest {
+    /// Manager-wide additional plugins to register. Replaces any previously-configured set. Pass an empty array to clear.
+    pub plugins: Vec<InstalledPlugin>,
 }
 
-/// Source session identifier to fork from, optional event-ID boundary, and optional friendly name for the new session.
+/// Replace the manager-wide additional plugins. New session creations and subsequent hook reloads see the new set; already-running sessions keep their existing hook installation until the next reload.
 ///
 /// <div class="warning">
 ///
@@ -16441,18 +17758,9 @@ pub struct SessionsFindByTaskIDResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsForkRequest {
-    /// Optional friendly name to assign to the forked session.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    /// Source session ID to fork from
-    pub session_id: SessionId,
-    /// Optional event ID boundary. When provided, the fork includes only events before this ID (exclusive). When omitted, all events are included.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub to_event_id: Option<String>,
-}
+pub struct SessionsSetAdditionalPluginsResult {}
 
-/// Identifier and optional friendly name assigned to the newly forked session.
+/// Patch for the singleton's steering state.
 ///
 /// <div class="warning">
 ///
@@ -16462,15 +17770,12 @@ pub struct SessionsForkRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsForkResult {
-    /// Friendly name assigned to the forked session, if any.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    /// The new forked session's ID
-    pub session_id: SessionId,
+pub struct SessionsSetRemoteControlSteeringRequest {
+    /// Target steering state. Today only `true` is actionable on the underlying exporter; `false` is reserved for future use.
+    pub enabled: bool,
 }
 
-/// Session ID whose board entry count should be returned.
+/// Parameters for attaching the remote-control singleton to a session.
 ///
 /// <div class="warning">
 ///
@@ -16480,12 +17785,14 @@ pub struct SessionsForkResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsGetBoardEntryCountRequest {
-    /// Session ID whose board entry count should be returned.
+pub struct SessionsStartRemoteControlRequest {
+    /// Configuration for the runtime-managed remote-control singleton.
+    pub config: RemoteControlConfig,
+    /// Local session id to attach remote control to.
     pub session_id: SessionId,
 }
 
-/// Dynamic-context board entry count, when available.
+/// Parameters for stopping the remote-control singleton.
 ///
 /// <div class="warning">
 ///
@@ -16495,13 +17802,16 @@ pub struct SessionsGetBoardEntryCountRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsGetBoardEntryCountResult {
-    /// Board entry count, when available.
+pub struct SessionsStopRemoteControlRequest {
+    /// When provided, the stop is rejected unless the singleton currently points at this session id (compare-and-swap semantics).
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub count: Option<i64>,
+    pub expected_session_id: Option<String>,
+    /// When true, the singleton is unconditionally torn down regardless of `expectedSessionId`. Use during shutdown or explicit `/remote off`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub force: Option<bool>,
 }
 
-/// Session ID whose event-log file path to compute.
+/// Parameters for atomically rebinding the remote-control singleton.
 ///
 /// <div class="warning">
 ///
@@ -16511,12 +17821,15 @@ pub struct SessionsGetBoardEntryCountResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsGetEventFilePathRequest {
-    /// Session ID whose event-log file path to compute
-    pub session_id: SessionId,
+pub struct SessionsTransferRemoteControlRequest {
+    /// When provided, the transfer is rejected unless the singleton currently points at this session id (compare-and-swap semantics to avoid clobbering newer state).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub expected_from_session_id: Option<String>,
+    /// Local session id to point remote control at.
+    pub to_session_id: String,
 }
 
-/// Absolute path to the session's events.jsonl file on disk.
+/// Telemetry engagement ID for the session, when available.
 ///
 /// <div class="warning">
 ///
@@ -16526,12 +17839,13 @@ pub struct SessionsGetEventFilePathRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsGetEventFilePathResult {
-    /// Absolute path to the session's events.jsonl file
-    pub file_path: String,
+pub struct SessionTelemetryEngagement {
+    /// Current telemetry engagement ID, when available.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub engagement_id: Option<String>,
 }
 
-/// Optional working-directory context used to score session relevance.
+/// Patch of mutable session options to apply to the running session.
 ///
 /// <div class="warning">
 ///
@@ -16541,13 +17855,191 @@ pub struct SessionsGetEventFilePathResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsGetLastForContextRequest {
-    /// Optional working-directory context used to score session relevance. When omitted the most-recently-modified session wins.
+pub struct SessionUpdateOptionsParams {
+    /// Additional content-exclusion policies to merge into the session's policy set.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub additional_content_exclusion_policies:
+        Option<Vec<OptionsUpdateAdditionalContentExclusionPolicy>>,
+    /// Runtime context discriminator (e.g., `cli`, `actions`).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub agent_context: Option<String>,
+    /// Whether to include instructions from every MCP server in the system prompt instead of only allowlisted servers.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub allow_all_mcp_server_instructions: Option<bool>,
+    /// Whether to disable the `ask_user` tool (encourages autonomous behavior).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub ask_user_disabled: Option<bool>,
+    /// Allowlist of tool names available to this session.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub available_tools: Option<Vec<String>>,
+    /// Options scoped to the built-in CAPI (Copilot API) provider.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub capi: Option<CapiSessionOptions>,
+    /// Identifier of the client driving the session.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub client_name: Option<String>,
+    /// Whether to include the `Co-authored-by` trailer in commit messages.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub coauthor_enabled: Option<bool>,
+    /// Context tier for models with tiered pricing. The session uses this to derive effective `modelCapabilitiesOverrides` so compaction, truncation, token display, and request limits honor the selected tier.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub context_tier: Option<OptionsUpdateContextTier>,
+    /// Whether to allow auto-mode continuation across turns.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub continue_on_auto_mode: Option<bool>,
+    /// Override URL for the Copilot API endpoint.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub copilot_url: Option<String>,
+    /// Whether to default custom agents to local-only execution.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub custom_agents_local_only: Option<bool>,
+    /// Instruction source IDs to exclude from the system prompt.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub disabled_instruction_sources: Option<Vec<String>>,
+    /// Skill IDs that should be excluded from this session.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub disabled_skills: Option<Vec<String>>,
+    /// Whether to enable loading of `.github/hooks/` filesystem hooks. Separate from the SDK callback hook mechanism.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enable_file_hooks: Option<bool>,
+    /// Whether to enable host git operations (context resolution, child repo scanning, git info in system prompt).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enable_host_git_operations: Option<bool>,
+    /// Whether to discover custom instructions on demand after successful file views (AGENTS.md / CLAUDE.md / .github/copilot-instructions.md surfacing). Combined with `skipCustomInstructions`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enable_on_demand_instruction_discovery: Option<bool>,
+    /// Whether to surface reasoning-summary events from the model.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enable_reasoning_summaries: Option<bool>,
+    /// Whether shell-script safety heuristics are enabled.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enable_script_safety: Option<bool>,
+    /// Whether to enable cross-session store writes and reads.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enable_session_store: Option<bool>,
+    /// Whether to enable skill directory scanning and loading. Falls back to enableConfigDiscovery when unset.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enable_skills: Option<bool>,
+    /// Whether to stream model responses.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enable_streaming: Option<bool>,
+    /// How env values are passed to MCP servers (`direct` inlines literal values; `indirect` resolves at launch).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub env_value_mode: Option<OptionsUpdateEnvValueMode>,
+    /// Override directory for the session-events log. When unset, the runtime's default events log directory is used.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub events_log_directory: Option<String>,
+    /// Whether subagent callback events should be forwarded into the session event log sink.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub events_log_includes_subagents: Option<bool>,
+    /// Built-in subagent names to exclude from this session. Excluded built-ins are hidden from agent discovery and cannot be dispatched unless a custom agent with the same name is available.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub excluded_builtin_agents: Option<Vec<String>>,
+    /// Denylist of tool names for this session.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub excluded_tools: Option<Vec<String>>,
+    /// Map of feature-flag IDs to their boolean enabled state.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub feature_flags: Option<HashMap<String, bool>>,
+    /// Built-in subagent names to include in this session. When specified, only these built-ins are available, subject to runtime availability and exclusions. Custom agents with the same name remain available. Set to null to remove the allowlist restriction.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub included_builtin_agents: Option<Vec<String>>,
+    /// Full set of installed plugins for the session. Replaces the existing list; the runtime invalidates the skills cache only when the list materially changes.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub installed_plugins: Option<Vec<SessionInstalledPlugin>>,
+    /// Stable integration identifier used for analytics and rate-limit attribution.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub integration_id: Option<String>,
+    /// Whether experimental capabilities are enabled.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub is_experimental_mode: Option<bool>,
+    /// Whether interactive shell sessions are logged.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub log_interactive_shells: Option<bool>,
+    /// Identifier sent to LSP-style integrations.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub lsp_client_name: Option<String>,
+    /// Whether to expose the `manage_schedule` tool to the agent. The runtime always owns the per-session schedule registry; this flag only controls tool exposure (typically gated to staff users).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub manage_schedule_enabled: Option<bool>,
+    /// Maximum decoded byte size of a single model-facing binary tool result (e.g. an image) persisted inline in session events and re-presented to the model on later turns / resume. Larger results are persisted as a metadata-only marker and shown to the model as a short text note. Defaults to 10 MB.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_inline_binary_bytes: Option<i64>,
+    /// The model ID to use for assistant turns.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model: Option<String>,
+    /// Per-property model capability overrides for the selected model.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_capabilities_overrides: Option<ModelCapabilitiesOverride>,
+    /// Organization-level custom instructions to inject into the system prompt.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub organization_custom_instructions: Option<String>,
+    /// Custom model-provider configuration (BYOK).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub provider: Option<ProviderConfig>,
+    /// Reasoning effort for the selected model. CAPI values are model-defined and validated against the selected model; BYOK providers may define additional values. When omitted, no effort override is applied.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reasoning_effort: Option<String>,
+    /// Reasoning summary mode for supported model clients.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reasoning_summary: Option<OptionsUpdateReasoningSummary>,
+    /// Whether the session is running in an interactive UI.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub running_in_interactive_mode: Option<bool>,
+    /// Resolved sandbox configuration.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub sandbox_config: Option<SandboxConfig>,
+    /// Replaces the session's capability set with the given list. Use to enable or disable capabilities mid-session (e.g., remove `memory` for reproducible scripted runs). Omit the field to leave the existing capability set unchanged.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub session_capabilities: Option<Vec<SessionCapability>>,
+    /// Optional session limits. Pass null to clear the session limits.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub session_limits: Option<SessionLimitsConfig>,
+    /// Per-session settings for built-in shell tools.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub shell: Option<ShellOptions>,
+    /// Use shell.initProfile instead. Shell init profile (`None` or `NonInteractive`).
+    #[doc(hidden)]
+    #[deprecated]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub shell_init_profile: Option<String>,
+    /// PowerShell process flags applied to built-in and user-requested shell commands.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub shell_process_flags: Option<Vec<String>>,
+    /// Additional directories to search for skills.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub context: Option<SessionContext>,
+    pub skill_directories: Option<Vec<String>>,
+    /// Whether to skip loading custom instruction sources.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub skip_custom_instructions: Option<bool>,
+    /// Whether to skip embedding retrieval pipeline initialization and execution.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub skip_embedding_retrieval: Option<bool>,
+    /// When true, the selected custom agent's prompt is not injected into the user message (skill context is still injected). Used by automation triggers where the agent prompt is already in the problem statement.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub suppress_custom_agent_prompt: Option<bool>,
+    /// Controls how availableTools (allowlist) and excludedTools (denylist) combine when both are set.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tool_filter_precedence: Option<OptionsUpdateToolFilterPrecedence>,
+    /// Optional path for trajectory output.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub trajectory_file: Option<String>,
+    /// Output verbosity level for supported models.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub verbosity: Option<Verbosity>,
+    /// Absolute working-directory path for shell tools.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub working_directory: Option<String>,
 }
 
-/// Most-relevant session ID for the supplied context, or omitted when no sessions exist.
+/// Indicates whether the session options patch was applied successfully.
 ///
 /// <div class="warning">
 ///
@@ -16557,13 +18049,15 @@ pub struct SessionsGetLastForContextRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsGetLastForContextResult {
-    /// Most-relevant session ID for the supplied context, or omitted when no sessions exist
+pub struct SessionUpdateOptionsResult {
+    /// Number of hooks loaded from installed plugins, returned when installedPlugins is updated
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub session_id: Option<SessionId>,
+    pub plugin_hook_count: Option<i64>,
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// Session ID whose persisted metadata should be read.
+/// User-requested shell execution cancellation handle.
 ///
 /// <div class="warning">
 ///
@@ -16573,12 +18067,12 @@ pub struct SessionsGetLastForContextResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsGetMetadataRequest {
-    /// Session ID to inspect
-    pub session_id: SessionId,
+pub struct ShellCancelUserRequestedRequest {
+    /// Request ID previously passed to executeUserRequested
+    pub request_id: RequestId,
 }
 
-/// Persisted local session metadata when the session exists.
+/// Shell command to run, with optional working directory and timeout in milliseconds.
 ///
 /// <div class="warning">
 ///
@@ -16588,28 +18082,18 @@ pub struct SessionsGetMetadataRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsGetMetadataResult {
-    /// Local session metadata, omitted when the session does not exist.
+pub struct ShellExecRequest {
+    /// Shell command to execute
+    pub command: String,
+    /// Working directory (defaults to session working directory)
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub session: Option<LocalSessionMetadataValue>,
-}
-
-/// Session ID to look up the persisted remote-steerable flag for.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionsGetPersistedRemoteSteerableRequest {
-    /// Session ID to look up the persisted remote-steerable flag for
-    pub session_id: SessionId,
+    pub cwd: Option<String>,
+    /// Timeout in milliseconds (default: 30000)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub timeout: Option<i64>,
 }
 
-/// The session's persisted remote-steerable flag, or omitted when no value has been persisted.
+/// Identifier of the spawned process, used to correlate streamed output and exit notifications.
 ///
 /// <div class="warning">
 ///
@@ -16619,13 +18103,12 @@ pub struct SessionsGetPersistedRemoteSteerableRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsGetPersistedRemoteSteerableResult {
-    /// The session's persisted remote-steerable flag if recorded; omitted when no value has been persisted
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub remote_steerable: Option<bool>,
+pub struct ShellExecResult {
+    /// Unique identifier for tracking streamed output
+    pub process_id: String,
 }
 
-/// Map of sessionId -> on-disk size in bytes for each session's workspace directory.
+/// User-requested shell command and cancellation handle.
 ///
 /// <div class="warning">
 ///
@@ -16635,12 +18118,14 @@ pub struct SessionsGetPersistedRemoteSteerableResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSizes {
-    /// Map of sessionId -> on-disk size in bytes for the session's workspace directory
-    pub sizes: HashMap<String, i64>,
+pub struct ShellExecuteUserRequestedRequest {
+    /// Shell command to execute
+    pub command: String,
+    /// Caller-provided cancellation handle for this execution
+    pub request_id: RequestId,
 }
 
-/// Limit for non-empty local session IDs.
+/// Identifier of a process previously returned by "shell.exec" and the signal to send.
 ///
 /// <div class="warning">
 ///
@@ -16650,13 +18135,15 @@ pub struct SessionSizes {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsListNonEmptySessionIdsRequest {
-    /// Maximum number of session IDs to return.
+pub struct ShellKillRequest {
+    /// Process identifier returned by shell.exec
+    pub process_id: String,
+    /// Signal to send (default: SIGTERM)
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub limit: Option<i64>,
+    pub signal: Option<ShellKillSignal>,
 }
 
-/// Recent local session IDs that contain user-visible history.
+/// Indicates whether the signal was delivered; false if the process was unknown or already exited.
 ///
 /// <div class="warning">
 ///
@@ -16666,12 +18153,12 @@ pub struct SessionsListNonEmptySessionIdsRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsListNonEmptySessionIdsResult {
-    /// Session IDs ordered newest-first.
-    pub session_ids: Vec<String>,
+pub struct ShellKillResult {
+    /// Whether the signal was sent successfully
+    pub killed: bool,
 }
 
-/// Optional source filter, metadata-load limit, and context filter applied to the returned sessions.
+/// Parameters for shutting down the session
 ///
 /// <div class="warning">
 ///
@@ -16681,40 +18168,16 @@ pub struct SessionsListNonEmptySessionIdsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsListRequest {
-    /// Optional filter applied to the returned sessions
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub filter: Option<SessionListFilter>,
-    /// When true, include detached maintenance sessions. Defaults to false for user-facing session lists.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub include_detached: Option<bool>,
-    /// When provided, only the first N local sessions (sorted by modification time, newest first) load full metadata; remaining sessions return basic info only. Use 0 to return only basic info for every local session. Has no effect on remote entries (which always carry their full shape).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub metadata_limit: Option<i64>,
-    /// Which session sources to include. Defaults to `local` for backward compatibility.
+pub struct ShutdownRequest {
+    /// Optional human-readable reason. Typically the message of the error that triggered shutdown when type is 'error'.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub source: Option<SessionSource>,
-    /// Only meaningful when `source` includes remote. When true, propagates errors from the remote service instead of silently returning an empty remote list. Defaults to false.
+    pub reason: Option<String>,
+    /// Why the session is being shut down. Defaults to "routine" when omitted.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub throw_on_error: Option<bool>,
-}
-
-/// Active session ID whose deferred repo-level hooks should be loaded.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionsLoadDeferredRepoHooksRequest {
-    /// Active session ID whose deferred repo-level hooks should be loaded
-    pub session_id: SessionId,
+    pub r#type: Option<ShutdownType>,
 }
 
-/// Age threshold and optional flags controlling which old sessions are pruned (or simulated when dryRun is true).
+/// Skill metadata available to a session, with name, description, source, enabled/invocable state, path, plugin, and argument hint.
 ///
 /// <div class="warning">
 ///
@@ -16724,48 +18187,32 @@ pub struct SessionsLoadDeferredRepoHooksRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsPruneOldRequest {
-    /// When true, only report what would be deleted without performing any deletion
+pub struct Skill {
+    /// Optional freeform hint describing the skill's expected arguments, from the `argument-hint` frontmatter field
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub dry_run: Option<bool>,
-    /// Session IDs that should never be considered for pruning
+    pub argument_hint: Option<String>,
+    /// Canonical slash command name used to invoke the skill, without the leading '/'
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub exclude_session_ids: Option<Vec<String>>,
-    /// When true, named sessions (set via /rename) are also eligible for pruning
+    pub command_name: Option<String>,
+    /// Description of what the skill does
+    pub description: String,
+    /// Whether the skill is currently enabled
+    pub enabled: bool,
+    /// Unique identifier for the skill
+    pub name: String,
+    /// Absolute path to the skill file
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub include_named: Option<bool>,
-    /// Delete sessions whose modifiedTime is at least this many days old
-    pub older_than_days: i64,
-}
-
-/// Session ID whose in-use lock should be released.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionsReleaseLockRequest {
-    /// Session ID whose in-use lock should be released
-    pub session_id: SessionId,
+    pub path: Option<String>,
+    /// Name of the plugin that provides the skill, when source is 'plugin'
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub plugin_name: Option<String>,
+    /// Source location type (e.g., project, personal-copilot, plugin, builtin)
+    pub source: SkillSource,
+    /// Whether the skill can be invoked by the user as a slash command
+    pub user_invocable: bool,
 }
 
-/// Release the in-use lock held by this process for the given session. No-op when this process does not currently hold a lock for the session.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionsReleaseLockResult {}
-
-/// Active session ID and an optional flag for deferring repo-level hooks until folder trust.
+/// Canonical directory where skills can be discovered or created, with scope, preference, and optional project path.
 ///
 /// <div class="warning">
 ///
@@ -16775,27 +18222,19 @@ pub struct SessionsReleaseLockResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsReloadPluginHooksRequest {
-    /// When true, skip repo-level hooks. Use before folder trust is confirmed; loadDeferredRepoHooks loads them post-trust.
+pub struct SkillDiscoveryPath {
+    /// Absolute path of the create/discovery target (may not exist on disk yet)
+    pub path: String,
+    /// Whether this is the canonical directory to create a new skill in its tier. At most one entry per tier is preferred; the `personal-agents` and `custom` scopes are never preferred.
+    pub preferred_for_creation: bool,
+    /// The input project path this directory was derived from (only for project scope)
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub defer_repo_hooks: Option<bool>,
-    /// Active session ID to reload hooks for
-    pub session_id: SessionId,
+    pub project_path: Option<String>,
+    /// Which tier this directory belongs to
+    pub scope: SkillDiscoveryScope,
 }
 
-/// Reload all hooks (user, plugin, optionally repo) and apply them to the active session. Call after installing or removing plugins so their hooks take effect immediately. No-op when no active session matches the given sessionId.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionsReloadPluginHooksResult {}
-
-/// Session ID whose pending events should be flushed to disk.
+/// Canonical locations where skills can be created so the runtime will recognize them.
 ///
 /// <div class="warning">
 ///
@@ -16805,12 +18244,12 @@ pub struct SessionsReloadPluginHooksResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsSaveRequest {
-    /// Session ID whose pending events should be flushed to disk
-    pub session_id: SessionId,
+pub struct SkillDiscoveryPathList {
+    /// Canonical skill create/discovery directories, in priority order
+    pub paths: Vec<SkillDiscoveryPath>,
 }
 
-/// Flush a session's pending events to disk. No-op when no writer exists for the session (e.g., already closed).
+/// Skills available to the session, with their enabled state.
 ///
 /// <div class="warning">
 ///
@@ -16820,9 +18259,12 @@ pub struct SessionsSaveRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsSaveResult {}
+pub struct SkillList {
+    /// Available skills
+    pub skills: Vec<Skill>,
+}
 
-/// Manager-wide additional plugins to register; replaces any previously-configured set.
+/// Skill names to mark as disabled in global configuration, replacing any previous list.
 ///
 /// <div class="warning">
 ///
@@ -16832,12 +18274,12 @@ pub struct SessionsSaveResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsSetAdditionalPluginsRequest {
-    /// Manager-wide additional plugins to register. Replaces any previously-configured set. Pass an empty array to clear.
-    pub plugins: Vec<InstalledPlugin>,
+pub struct SkillsConfigSetDisabledSkillsRequest {
+    /// List of skill names to disable
+    pub disabled_skills: Vec<String>,
 }
 
-/// Replace the manager-wide additional plugins. New session creations and subsequent hook reloads see the new set; already-running sessions keep their existing hook installation until the next reload.
+/// Adds or removes a single skill from the global disabled list, leaving every other entry untouched.
 ///
 /// <div class="warning">
 ///
@@ -16847,9 +18289,14 @@ pub struct SessionsSetAdditionalPluginsRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsSetAdditionalPluginsResult {}
+pub struct SkillsConfigSetSkillDisabledRequest {
+    /// True to disable the skill, false to enable it
+    pub disabled: bool,
+    /// Name of the skill to add to or remove from the disabled list
+    pub name: String,
+}
 
-/// Patch for the singleton's steering state.
+/// Name of the skill to disable for the session.
 ///
 /// <div class="warning">
 ///
@@ -16859,12 +18306,12 @@ pub struct SessionsSetAdditionalPluginsResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsSetRemoteControlSteeringRequest {
-    /// Target steering state. Today only `true` is actionable on the underlying exporter; `false` is reserved for future use.
-    pub enabled: bool,
+pub struct SkillsDisableRequest {
+    /// Name of the skill to disable
+    pub name: String,
 }
 
-/// Parameters for attaching the remote-control singleton to a session.
+/// Optional project paths and additional skill directories to include in discovery.
 ///
 /// <div class="warning">
 ///
@@ -16874,14 +18321,19 @@ pub struct SessionsSetRemoteControlSteeringRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsStartRemoteControlRequest {
-    /// Configuration for the runtime-managed remote-control singleton.
-    pub config: RemoteControlConfig,
-    /// Local session id to attach remote control to.
-    pub session_id: SessionId,
+pub struct SkillsDiscoverRequest {
+    /// When true, omit skills from the host's global sources (personal, custom, plugin, and built-in), returning only project-scoped skills. For multitenant deployments.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub exclude_host_skills: Option<bool>,
+    /// Optional list of project directory paths to scan for project-scoped skills
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub project_paths: Option<Vec<String>>,
+    /// Optional list of additional skill directory paths to include
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub skill_directories: Option<Vec<String>>,
 }
 
-/// Parameters for stopping the remote-control singleton.
+/// Name of the skill to enable for the session.
 ///
 /// <div class="warning">
 ///
@@ -16891,16 +18343,12 @@ pub struct SessionsStartRemoteControlRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsStopRemoteControlRequest {
-    /// When provided, the stop is rejected unless the singleton currently points at this session id (compare-and-swap semantics).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub expected_session_id: Option<String>,
-    /// When true, the singleton is unconditionally torn down regardless of `expectedSessionId`. Use during shutdown or explicit `/remote off`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub force: Option<bool>,
+pub struct SkillsEnableRequest {
+    /// Name of the skill to enable
+    pub name: String,
 }
 
-/// Parameters for atomically rebinding the remote-control singleton.
+/// Optional project paths to enumerate.
 ///
 /// <div class="warning">
 ///
@@ -16910,15 +18358,16 @@ pub struct SessionsStopRemoteControlRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsTransferRemoteControlRequest {
-    /// When provided, the transfer is rejected unless the singleton currently points at this session id (compare-and-swap semantics to avoid clobbering newer state).
+pub struct SkillsGetDiscoveryPathsRequest {
+    /// When true, omit the host's personal and custom skill directories, leaving only project directories. For multitenant deployments.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub expected_from_session_id: Option<String>,
-    /// Local session id to point remote control at.
-    pub to_session_id: String,
+    pub exclude_host_skills: Option<bool>,
+    /// Optional list of project directory paths. When omitted or empty, only personal and custom directories are returned.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub project_paths: Option<Vec<String>>,
 }
 
-/// Telemetry engagement ID for the session, when available.
+/// Skill invocation record with name, path, content, allowed tools, and turn number.
 ///
 /// <div class="warning">
 ///
@@ -16928,13 +18377,21 @@ pub struct SessionsTransferRemoteControlRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionTelemetryEngagement {
-    /// Current telemetry engagement ID, when available.
+pub struct SkillsInvokedSkill {
+    /// Tools that should be auto-approved when this skill is active, captured at invocation time
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub engagement_id: Option<String>,
+    pub allowed_tools: Option<Vec<String>>,
+    /// Full content of the skill file
+    pub content: String,
+    /// Turn number when the skill was invoked
+    pub invoked_at_turn: i64,
+    /// Unique identifier for the skill
+    pub name: String,
+    /// Path to the SKILL.md file
+    pub path: String,
 }
 
-/// Patch of mutable session options to apply to the running session.
+/// Skills invoked during this session, ordered by invocation time (most recent last).
 ///
 /// <div class="warning">
 ///
@@ -16944,191 +18401,12 @@ pub struct SessionTelemetryEngagement {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionUpdateOptionsParams {
-    /// Additional content-exclusion policies to merge into the session's policy set.
-    ///
-    /// <div class="warning">
-    ///
-    /// **Experimental.** This type is part of an experimental wire-protocol surface
-    /// and may change or be removed in future SDK or CLI releases.
-    ///
-    /// </div>
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub additional_content_exclusion_policies:
-        Option<Vec<OptionsUpdateAdditionalContentExclusionPolicy>>,
-    /// Runtime context discriminator (e.g., `cli`, `actions`).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub agent_context: Option<String>,
-    /// Whether to include instructions from every MCP server in the system prompt instead of only allowlisted servers.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub allow_all_mcp_server_instructions: Option<bool>,
-    /// Whether to disable the `ask_user` tool (encourages autonomous behavior).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub ask_user_disabled: Option<bool>,
-    /// Allowlist of tool names available to this session.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub available_tools: Option<Vec<String>>,
-    /// Options scoped to the built-in CAPI (Copilot API) provider.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub capi: Option<CapiSessionOptions>,
-    /// Identifier of the client driving the session.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub client_name: Option<String>,
-    /// Whether to include the `Co-authored-by` trailer in commit messages.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub coauthor_enabled: Option<bool>,
-    /// Context tier for models with tiered pricing. The session uses this to derive effective `modelCapabilitiesOverrides` so compaction, truncation, token display, and request limits honor the selected tier.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub context_tier: Option<OptionsUpdateContextTier>,
-    /// Whether to allow auto-mode continuation across turns.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub continue_on_auto_mode: Option<bool>,
-    /// Override URL for the Copilot API endpoint.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub copilot_url: Option<String>,
-    /// Whether to default custom agents to local-only execution.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub custom_agents_local_only: Option<bool>,
-    /// Instruction source IDs to exclude from the system prompt.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub disabled_instruction_sources: Option<Vec<String>>,
-    /// Skill IDs that should be excluded from this session.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub disabled_skills: Option<Vec<String>>,
-    /// Whether to enable loading of `.github/hooks/` filesystem hooks. Separate from the SDK callback hook mechanism.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub enable_file_hooks: Option<bool>,
-    /// Whether to enable host git operations (context resolution, child repo scanning, git info in system prompt).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub enable_host_git_operations: Option<bool>,
-    /// Whether to discover custom instructions on demand after successful file views (AGENTS.md / CLAUDE.md / .github/copilot-instructions.md surfacing). Combined with `skipCustomInstructions`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub enable_on_demand_instruction_discovery: Option<bool>,
-    /// Whether to surface reasoning-summary events from the model.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub enable_reasoning_summaries: Option<bool>,
-    /// Whether shell-script safety heuristics are enabled.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub enable_script_safety: Option<bool>,
-    /// Whether to enable cross-session store writes and reads.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub enable_session_store: Option<bool>,
-    /// Whether to enable skill directory scanning and loading. Falls back to enableConfigDiscovery when unset.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub enable_skills: Option<bool>,
-    /// Whether to stream model responses.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub enable_streaming: Option<bool>,
-    /// How env values are passed to MCP servers (`direct` inlines literal values; `indirect` resolves at launch).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub env_value_mode: Option<OptionsUpdateEnvValueMode>,
-    /// Override directory for the session-events log. When unset, the runtime's default events log directory is used.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub events_log_directory: Option<String>,
-    /// Whether subagent callback events should be forwarded into the session event log sink.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub events_log_includes_subagents: Option<bool>,
-    /// Built-in subagent names to exclude from this session. Excluded built-ins are hidden from agent discovery and cannot be dispatched unless a custom agent with the same name is available.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub excluded_builtin_agents: Option<Vec<String>>,
-    /// Denylist of tool names for this session.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub excluded_tools: Option<Vec<String>>,
-    /// Map of feature-flag IDs to their boolean enabled state.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub feature_flags: Option<HashMap<String, bool>>,
-    /// Built-in subagent names to include in this session. When specified, only these built-ins are available, subject to runtime availability and exclusions. Custom agents with the same name remain available. Set to null to remove the allowlist restriction.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub included_builtin_agents: Option<Vec<String>>,
-    /// Full set of installed plugins for the session. Replaces the existing list; the runtime invalidates the skills cache only when the list materially changes.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub installed_plugins: Option<Vec<SessionInstalledPlugin>>,
-    /// Stable integration identifier used for analytics and rate-limit attribution.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub integration_id: Option<String>,
-    /// Whether experimental capabilities are enabled.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub is_experimental_mode: Option<bool>,
-    /// Whether interactive shell sessions are logged.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub log_interactive_shells: Option<bool>,
-    /// Identifier sent to LSP-style integrations.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub lsp_client_name: Option<String>,
-    /// Whether to expose the `manage_schedule` tool to the agent. The runtime always owns the per-session schedule registry; this flag only controls tool exposure (typically gated to staff users).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub manage_schedule_enabled: Option<bool>,
-    /// Maximum decoded byte size of a single model-facing binary tool result (e.g. an image) persisted inline in session events and re-presented to the model on later turns / resume. Larger results are persisted as a metadata-only marker and shown to the model as a short text note. Defaults to 10 MB.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_inline_binary_bytes: Option<i64>,
-    /// The model ID to use for assistant turns.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub model: Option<String>,
-    /// Per-property model capability overrides for the selected model.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub model_capabilities_overrides: Option<ModelCapabilitiesOverride>,
-    /// Organization-level custom instructions to inject into the system prompt.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub organization_custom_instructions: Option<String>,
-    /// Custom model-provider configuration (BYOK).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub provider: Option<ProviderConfig>,
-    /// Reasoning effort for the selected model. CAPI values are model-defined and validated against the selected model; BYOK providers may define additional values. When omitted, no effort override is applied.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub reasoning_effort: Option<String>,
-    /// Reasoning summary mode for supported model clients.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub reasoning_summary: Option<OptionsUpdateReasoningSummary>,
-    /// Whether the session is running in an interactive UI.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub running_in_interactive_mode: Option<bool>,
-    /// Resolved sandbox configuration.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub sandbox_config: Option<SandboxConfig>,
-    /// Replaces the session's capability set with the given list. Use to enable or disable capabilities mid-session (e.g., remove `memory` for reproducible scripted runs). Omit the field to leave the existing capability set unchanged.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub session_capabilities: Option<Vec<SessionCapability>>,
-    /// Optional session limits. Pass null to clear the session limits.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub session_limits: Option<SessionLimitsConfig>,
-    /// Per-session settings for built-in shell tools.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub shell: Option<ShellOptions>,
-    /// Use shell.initProfile instead. Shell init profile (`None` or `NonInteractive`).
-    #[doc(hidden)]
-    #[deprecated]
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub shell_init_profile: Option<String>,
-    /// PowerShell process flags applied to built-in and user-requested shell commands.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub shell_process_flags: Option<Vec<String>>,
-    /// Additional directories to search for skills.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub skill_directories: Option<Vec<String>>,
-    /// Whether to skip loading custom instruction sources.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub skip_custom_instructions: Option<bool>,
-    /// Whether to skip embedding retrieval pipeline initialization and execution.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub skip_embedding_retrieval: Option<bool>,
-    /// When true, the selected custom agent's prompt is not injected into the user message (skill context is still injected). Used by automation triggers where the agent prompt is already in the problem statement.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub suppress_custom_agent_prompt: Option<bool>,
-    /// Controls how availableTools (allowlist) and excludedTools (denylist) combine when both are set.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub tool_filter_precedence: Option<OptionsUpdateToolFilterPrecedence>,
-    /// Optional path for trajectory output.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub trajectory_file: Option<String>,
-    /// Output verbosity level for supported models.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub verbosity: Option<Verbosity>,
-    /// Absolute working-directory path for shell tools.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub working_directory: Option<String>,
+pub struct SkillsGetInvokedResult {
+    /// Skills invoked during this session, ordered by invocation time (most recent last)
+    pub skills: Vec<SkillsInvokedSkill>,
 }
 
-/// Indicates whether the session options patch was applied successfully.
+/// Diagnostics from reloading skill definitions, with warnings and errors as separate lists.
 ///
 /// <div class="warning">
 ///
@@ -17138,15 +18416,13 @@ pub struct SessionUpdateOptionsParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionUpdateOptionsResult {
-    /// Number of hooks loaded from installed plugins, returned when installedPlugins is updated
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub plugin_hook_count: Option<i64>,
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct SkillsLoadDiagnostics {
+    /// Errors emitted while loading skills (e.g. skills that failed to load entirely)
+    pub errors: Vec<String>,
+    /// Warnings emitted while loading skills (e.g. skills that loaded but had issues)
+    pub warnings: Vec<String>,
 }
 
-/// User-requested shell execution cancellation handle.
 ///
 /// <div class="warning">
 ///
@@ -17156,12 +18432,16 @@ pub struct SessionUpdateOptionsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ShellCancelUserRequestedRequest {
-    /// Request ID previously passed to executeUserRequested
-    pub request_id: RequestId,
+pub struct SlashCommandTimelineEntry {
+    /// Text displayed for the timeline entry.
+    pub text: String,
+    /// Timeline entry presentation type.
+    pub r#type: String,
+    /// Optional URL associated with the timeline entry.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub url: Option<String>,
 }
 
-/// Shell command to run, with optional working directory and timeout in milliseconds.
 ///
 /// <div class="warning">
 ///
@@ -17171,18 +18451,20 @@ pub struct ShellCancelUserRequestedRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ShellExecRequest {
-    /// Shell command to execute
-    pub command: String,
-    /// Working directory (defaults to session working directory)
+pub struct SlashCommandAddTimelineEntryResult {
+    /// Timeline entry the host should append.
+    pub entry: SlashCommandTimelineEntry,
+    /// Discriminator for an add-timeline-entry result.
+    pub kind: SlashCommandAddTimelineEntryResultKind,
+    /// Optional text the host should prefill into the input editor.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub cwd: Option<String>,
-    /// Timeout in milliseconds (default: 30000)
+    pub prefill_input: Option<String>,
+    /// Whether command execution changed persisted runtime settings.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub timeout: Option<i64>,
+    pub runtime_settings_changed: Option<bool>,
 }
 
-/// Identifier of the spawned process, used to correlate streamed output and exit notifications.
+/// Slash-command invocation result that submits an agent prompt, with display prompt, optional mode, optional user-facing notice, and settings-change flag.
 ///
 /// <div class="warning">
 ///
@@ -17192,12 +18474,25 @@ pub struct ShellExecRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ShellExecResult {
-    /// Unique identifier for tracking streamed output
-    pub process_id: String,
+pub struct SlashCommandAgentPromptResult {
+    /// Prompt text to display to the user
+    pub display_prompt: String,
+    /// Agent prompt result discriminator
+    pub kind: SlashCommandAgentPromptResultKind,
+    /// Optional target session mode for the agent prompt
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mode: Option<SessionMode>,
+    /// Optional user-facing notice to show before the prompt is submitted
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub notice: Option<String>,
+    /// Prompt to submit to the agent
+    pub prompt: String,
+    /// True when the invocation mutated user runtime settings; consumers caching settings should refresh
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub runtime_settings_changed: Option<bool>,
 }
 
-/// User-requested shell command and cancellation handle.
+/// Slash-command invocation result indicating completion, with optional message and settings-change flag.
 ///
 /// <div class="warning">
 ///
@@ -17207,14 +18502,18 @@ pub struct ShellExecResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ShellExecuteUserRequestedRequest {
-    /// Shell command to execute
-    pub command: String,
-    /// Caller-provided cancellation handle for this execution
-    pub request_id: RequestId,
+pub struct SlashCommandCompletedResult {
+    /// Completed result discriminator
+    pub kind: SlashCommandCompletedResultKind,
+    /// Optional user-facing message describing the completed command
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub message: Option<String>,
+    /// True when the invocation mutated user runtime settings; consumers caching settings should refresh
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub runtime_settings_changed: Option<bool>,
 }
 
-/// Identifier of a process previously returned by "shell.exec" and the signal to send.
+/// Slash-command invocation result containing text output plus Markdown/ANSI rendering flags.
 ///
 /// <div class="warning">
 ///
@@ -17224,15 +18523,23 @@ pub struct ShellExecuteUserRequestedRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ShellKillRequest {
-    /// Process identifier returned by shell.exec
-    pub process_id: String,
-    /// Signal to send (default: SIGTERM)
+pub struct SlashCommandTextResult {
+    /// Text result discriminator
+    pub kind: SlashCommandTextResultKind,
+    /// Whether text contains Markdown
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub signal: Option<ShellKillSignal>,
+    pub markdown: Option<bool>,
+    /// Whether ANSI sequences should be preserved
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub preserve_ansi: Option<bool>,
+    /// True when the invocation mutated user runtime settings; consumers caching settings should refresh
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub runtime_settings_changed: Option<bool>,
+    /// Text output for the client to render
+    pub text: String,
 }
 
-/// Indicates whether the signal was delivered; false if the process was unknown or already exited.
+/// Selectable slash-command subcommand option with name, description, and optional group label.
 ///
 /// <div class="warning">
 ///
@@ -17242,12 +18549,17 @@ pub struct ShellKillRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ShellKillResult {
-    /// Whether the signal was sent successfully
-    pub killed: bool,
+pub struct SlashCommandSelectSubcommandOption {
+    /// Human-readable description of the subcommand
+    pub description: String,
+    /// Optional group label for organizing options
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub group: Option<String>,
+    /// Subcommand name to invoke
+    pub name: String,
 }
 
-/// Parameters for shutting down the session
+/// Slash-command invocation result asking the client to present subcommand options for a parent command.
 ///
 /// <div class="warning">
 ///
@@ -17257,16 +18569,20 @@ pub struct ShellKillResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ShutdownRequest {
-    /// Optional human-readable reason. Typically the message of the error that triggered shutdown when type is 'error'.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub reason: Option<String>,
-    /// Why the session is being shut down. Defaults to "routine" when omitted.
+pub struct SlashCommandSelectSubcommandResult {
+    /// Parent command name that requires subcommand selection
+    pub command: String,
+    /// Select subcommand result discriminator
+    pub kind: SlashCommandSelectSubcommandResultKind,
+    /// Available subcommand options for the client to present
+    pub options: Vec<SlashCommandSelectSubcommandOption>,
+    /// True when the invocation mutated user runtime settings; consumers caching settings should refresh
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub r#type: Option<ShutdownType>,
+    pub runtime_settings_changed: Option<bool>,
+    /// Human-readable title for the selection UI
+    pub title: String,
 }
 
-/// Skill metadata available to a session, with name, description, source, enabled/invocable state, path, plugin, and argument hint.
 ///
 /// <div class="warning">
 ///
@@ -17276,32 +18592,39 @@ pub struct ShutdownRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct Skill {
-    /// Optional freeform hint describing the skill's expected arguments, from the `argument-hint` frontmatter field
+pub struct SlashCommandModelPickerDialog {
+    /// Discriminator for a model-picker dialog.
+    pub kind: SlashCommandModelPickerDialogKind,
+    /// Model that should be enabled before it can be selected.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub argument_hint: Option<String>,
-    /// Canonical slash command name used to invoke the skill, without the leading '/'
+    pub model_to_enable: Option<String>,
+    /// Settings scope the picker should modify.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub command_name: Option<String>,
-    /// Description of what the skill does
-    pub description: String,
-    /// Whether the skill is currently enabled
-    pub enabled: bool,
-    /// Unique identifier for the skill
-    pub name: String,
-    /// Absolute path to the skill file
+    pub scope: Option<String>,
+    /// Model-selection target represented by the picker.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub path: Option<String>,
-    /// Name of the plugin that provides the skill, when source is 'plugin'
+    pub target: Option<String>,
+}
+
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SlashCommandShowDialogResult {
+    /// Dialog the host should display.
+    pub dialog: SlashCommandModelPickerDialog,
+    /// Discriminator for a show-dialog result.
+    pub kind: SlashCommandShowDialogResultKind,
+    /// Whether command execution changed persisted runtime settings.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub plugin_name: Option<String>,
-    /// Source location type (e.g., project, personal-copilot, plugin, builtin)
-    pub source: SkillSource,
-    /// Whether the skill can be invoked by the user as a slash command
-    pub user_invocable: bool,
+    pub runtime_settings_changed: Option<bool>,
 }
 
-/// Canonical directory where skills can be discovered or created, with scope, preference, and optional project path.
 ///
 /// <div class="warning">
 ///
@@ -17311,19 +18634,31 @@ pub struct Skill {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SkillDiscoveryPath {
-    /// Absolute path of the create/discovery target (may not exist on disk yet)
-    pub path: String,
-    /// Whether this is the canonical directory to create a new skill in its tier. At most one entry per tier is preferred; the `personal-agents` and `custom` scopes are never preferred.
-    pub preferred_for_creation: bool,
-    /// The input project path this directory was derived from (only for project scope)
+pub struct SlashCommandSetModelResult {
+    /// Discriminator for a set-model result.
+    pub kind: SlashCommandSetModelResultKind,
+    /// Model selected by the command.
+    pub model: String,
+    /// Reasoning effort selected for the model.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub project_path: Option<String>,
-    /// Which tier this directory belongs to
-    pub scope: SkillDiscoveryScope,
+    pub reasoning_effort: Option<String>,
+    /// Repository settings scope modified by the command.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub repo_scope: Option<String>,
+    /// User-settings snapshot to restore if the host cancels the model switch.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub revert_on_cancel: Option<serde_json::Value>,
+    /// Whether command execution changed persisted runtime settings.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub runtime_settings_changed: Option<bool>,
+    /// Settings scope modified by the command.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub scope: Option<String>,
+    /// User-facing warning produced while selecting the model.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub warning: Option<String>,
 }
 
-/// Canonical locations where skills can be created so the runtime will recognize them.
 ///
 /// <div class="warning">
 ///
@@ -17333,12 +18668,20 @@ pub struct SkillDiscoveryPath {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SkillDiscoveryPathList {
-    /// Canonical skill create/discovery directories, in priority order
-    pub paths: Vec<SkillDiscoveryPath>,
+pub struct SlashCommandSetPlanModelResult {
+    /// Discriminator for a set-plan-model result.
+    pub kind: SlashCommandSetPlanModelResultKind,
+    /// User-facing confirmation message for the plan-model selection.
+    pub message: String,
+    /// Dedicated model selected for plan mode.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub plan_model: Option<String>,
+    /// Whether command execution changed persisted runtime settings.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub runtime_settings_changed: Option<bool>,
 }
 
-/// Skills available to the session, with their enabled state.
+/// Subagent model, reasoning effort, and context tier settings
 ///
 /// <div class="warning">
 ///
@@ -17348,12 +18691,19 @@ pub struct SkillDiscoveryPathList {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SkillList {
-    /// Available skills
-    pub skills: Vec<Skill>,
+pub struct SubagentSettingsEntry {
+    /// Context tier override for matching subagents
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub context_tier: Option<SubagentSettingsEntryContextTier>,
+    /// Reasoning effort override for matching subagents
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub effort_level: Option<String>,
+    /// Model override for matching subagents
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model: Option<String>,
 }
 
-/// Skill names to mark as disabled in global configuration, replacing any previous list.
+/// Subagent settings to apply, or null to clear the live session override
 ///
 /// <div class="warning">
 ///
@@ -17363,12 +18713,22 @@ pub struct SkillList {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SkillsConfigSetDisabledSkillsRequest {
-    /// List of skill names to disable
-    pub disabled_skills: Vec<String>,
+pub struct SubagentSettings {
+    /// Per-agent settings keyed by subagent agent_type
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub agents: Option<HashMap<String, SubagentSettingsEntry>>,
+    /// Names of subagents the user has turned off; they cannot be dispatched
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub disabled_subagents: Option<Vec<String>>,
+    /// Maximum number of subagents that can run concurrently; applies to usage-based billing users only
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_concurrency: Option<i32>,
+    /// Maximum subagent nesting depth; applies to usage-based billing users only
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_depth: Option<i32>,
 }
 
-/// Adds or removes a single skill from the global disabled list, leaving every other entry untouched.
+/// Tracked background agent task metadata, including IDs, status, timing, agent type, prompt, model, result, and latest response.
 ///
 /// <div class="warning">
 ///
@@ -17378,14 +18738,62 @@ pub struct SkillsConfigSetDisabledSkillsRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SkillsConfigSetSkillDisabledRequest {
-    /// True to disable the skill, false to enable it
-    pub disabled: bool,
-    /// Name of the skill to add to or remove from the disabled list
-    pub name: String,
+pub struct TaskAgentInfo {
+    /// ISO 8601 timestamp when the current active period began
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub active_started_at: Option<String>,
+    /// Accumulated active execution time in milliseconds
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub active_time_ms: Option<i64>,
+    /// Type of agent running this task
+    pub agent_type: String,
+    /// Whether the task is currently in the original sync wait and can be moved to background mode. False once it is already backgrounded, idle, finished, or no longer has a promotable sync waiter.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub can_promote_to_background: Option<bool>,
+    /// ISO 8601 timestamp when the task finished
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub completed_at: Option<String>,
+    /// Short description of the task
+    pub description: String,
+    /// Friendly, non-unique name intended for display
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub display_name: Option<String>,
+    /// Error message when the task failed
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// Whether task execution is synchronously awaited or managed in the background
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub execution_mode: Option<TaskExecutionMode>,
+    /// Unique task identifier
+    pub id: String,
+    /// ISO 8601 timestamp when the agent entered idle state
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub idle_since: Option<String>,
+    /// Most recent response text from the agent
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub latest_response: Option<String>,
+    /// Requested model override for the task when specified
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model: Option<String>,
+    /// Most recent prompt delivered to the agent. Updated whenever the agent receives a follow-up message.
+    pub prompt: String,
+    /// Runtime model resolved for the task when available
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub resolved_model: Option<String>,
+    /// Result text from the task when available
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub result: Option<String>,
+    /// ISO 8601 timestamp when the task was started
+    pub started_at: String,
+    /// Current lifecycle status of the task
+    pub status: TaskStatus,
+    /// Tool call ID associated with this agent task
+    pub tool_call_id: String,
+    /// Task kind
+    pub r#type: TaskAgentInfoType,
 }
 
-/// Name of the skill to disable for the session.
+/// Timestamped display line for task progress output or recent agent activity.
 ///
 /// <div class="warning">
 ///
@@ -17395,12 +18803,14 @@ pub struct SkillsConfigSetSkillDisabledRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SkillsDisableRequest {
-    /// Name of the skill to disable
-    pub name: String,
+pub struct TaskProgressLine {
+    /// Display message, e.g., "▸ bash", "✓ edit src/foo.ts"
+    pub message: String,
+    /// ISO 8601 timestamp when this event occurred
+    pub timestamp: String,
 }
 
-/// Optional project paths and additional skill directories to include in discovery.
+/// Progress snapshot for an agent task, with recent activity lines and optional latest intent.
 ///
 /// <div class="warning">
 ///
@@ -17410,19 +18820,17 @@ pub struct SkillsDisableRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SkillsDiscoverRequest {
-    /// When true, omit skills from the host's global sources (personal, custom, plugin, and built-in), returning only project-scoped skills. For multitenant deployments.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub exclude_host_skills: Option<bool>,
-    /// Optional list of project directory paths to scan for project-scoped skills
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub project_paths: Option<Vec<String>>,
-    /// Optional list of additional skill directory paths to include
+pub struct TaskAgentProgress {
+    /// The most recent intent reported by the agent
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub skill_directories: Option<Vec<String>>,
+    pub latest_intent: Option<String>,
+    /// Recent tool execution events converted to display lines
+    pub recent_activity: Vec<TaskProgressLine>,
+    /// Progress kind
+    pub r#type: TaskAgentProgressType,
 }
 
-/// Name of the skill to enable for the session.
+/// Task completion notification with summary from the agent
 ///
 /// <div class="warning">
 ///
@@ -17432,12 +18840,24 @@ pub struct SkillsDiscoverRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SkillsEnableRequest {
-    /// Name of the skill to enable
-    pub name: String,
+pub struct TaskCompleteData {
+    /// Active autopilot objective ID evaluated by the completion reviewer
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub objective_id: Option<i64>,
+    /// Semantic completion decision. Absent on legacy events and invalid tool calls
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub outcome: Option<TaskCompletionOutcome>,
+    /// Label-safe runtime rationale for the completion decision (e.g. a cancellation or pause/resume downgrade), when one applies. Reviewer-authored rationale is intentionally omitted here because this event has no IFC label channel; the reviewer's findings remain available through its own labeled sub-agent events
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reason: Option<String>,
+    /// Whether the task was accepted as complete. False when validation failed or completion was rejected or blocked by the reviewer
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub success: Option<bool>,
+    /// Summary of the completed task, provided by the agent
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub summary: Option<String>,
 }
 
-/// Optional project paths to enumerate.
 ///
 /// <div class="warning">
 ///
@@ -17447,16 +18867,30 @@ pub struct SkillsEnableRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SkillsGetDiscoveryPathsRequest {
-    /// When true, omit the host's personal and custom skill directories, leaving only project directories. For multitenant deployments.
+pub struct TaskCompletionDecision {
+    /// Objective eligibility token captured when the decision was evaluated.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub exclude_host_skills: Option<bool>,
-    /// Optional list of project directory paths. When omitted or empty, only personal and custom directories are returned.
+    pub completion_eligibility_token: Option<i64>,
+    /// Whether completion was accepted after the reviewer-rejection budget was exhausted.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub project_paths: Option<Vec<String>>,
+    pub completion_rejection_budget_exhausted: Option<bool>,
+    /// Active autopilot objective evaluated by the completion reviewer.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub objective_id: Option<i64>,
+    /// Semantic result of evaluating the task completion request.
+    pub outcome: TaskCompletionOutcome,
+    /// Rationale for the completion decision, when one is available.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reason: Option<String>,
+    /// Whether the rationale was derived from completion-reviewer output.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reviewer_derived: Option<bool>,
+    /// Information-flow metadata captured from the completion reviewer.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reviewer_result_meta: Option<serde_json::Value>,
 }
 
-/// Skill invocation record with name, path, content, allowed tools, and turn number.
+/// Background tasks currently tracked by the session.
 ///
 /// <div class="warning">
 ///
@@ -17466,21 +18900,12 @@ pub struct SkillsGetDiscoveryPathsRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SkillsInvokedSkill {
-    /// Tools that should be auto-approved when this skill is active, captured at invocation time
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub allowed_tools: Option<Vec<String>>,
-    /// Full content of the skill file
-    pub content: String,
-    /// Turn number when the skill was invoked
-    pub invoked_at_turn: i64,
-    /// Unique identifier for the skill
-    pub name: String,
-    /// Path to the SKILL.md file
-    pub path: String,
+pub struct TaskList {
+    /// Currently tracked tasks
+    pub tasks: Vec<serde_json::Value>,
 }
 
-/// Skills invoked during this session, ordered by invocation time (most recent last).
+/// Identifier of the background task to cancel.
 ///
 /// <div class="warning">
 ///
@@ -17490,12 +18915,12 @@ pub struct SkillsInvokedSkill {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SkillsGetInvokedResult {
-    /// Skills invoked during this session, ordered by invocation time (most recent last)
-    pub skills: Vec<SkillsInvokedSkill>,
+pub struct TasksCancelRequest {
+    /// Task identifier
+    pub id: String,
 }
 
-/// Diagnostics from reloading skill definitions, with warnings and errors as separate lists.
+/// Indicates whether the background task was successfully cancelled.
 ///
 /// <div class="warning">
 ///
@@ -17505,13 +18930,12 @@ pub struct SkillsGetInvokedResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SkillsLoadDiagnostics {
-    /// Errors emitted while loading skills (e.g. skills that failed to load entirely)
-    pub errors: Vec<String>,
-    /// Warnings emitted while loading skills (e.g. skills that loaded but had issues)
-    pub warnings: Vec<String>,
+pub struct TasksCancelResult {
+    /// Whether the task was successfully cancelled
+    pub cancelled: bool,
 }
 
+/// The first sync-waiting task that can currently be promoted to background mode.
 ///
 /// <div class="warning">
 ///
@@ -17521,16 +18945,13 @@ pub struct SkillsLoadDiagnostics {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SlashCommandTimelineEntry {
-    /// Text displayed for the timeline entry.
-    pub text: String,
-    /// Timeline entry presentation type.
-    pub r#type: String,
-    /// Optional URL associated with the timeline entry.
+pub struct TasksGetCurrentPromotableResult {
+    /// The first sync-waiting task (agent first, then shell) that can currently be promoted to background mode. Omitted if no such task exists. The returned task is guaranteed to have executionMode='sync' and canPromoteToBackground=true at the time of the call.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub url: Option<String>,
+    pub task: Option<serde_json::Value>,
 }
 
+/// Identifier of the background task to fetch progress for.
 ///
 /// <div class="warning">
 ///
@@ -17540,20 +18961,12 @@ pub struct SlashCommandTimelineEntry {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SlashCommandAddTimelineEntryResult {
-    /// Timeline entry the host should append.
-    pub entry: SlashCommandTimelineEntry,
-    /// Discriminator for an add-timeline-entry result.
-    pub kind: SlashCommandAddTimelineEntryResultKind,
-    /// Optional text the host should prefill into the input editor.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub prefill_input: Option<String>,
-    /// Whether command execution changed persisted runtime settings.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub runtime_settings_changed: Option<bool>,
+pub struct TasksGetProgressRequest {
+    /// Task identifier (agent ID or shell ID)
+    pub id: String,
 }
 
-/// Slash-command invocation result that submits an agent prompt, with display prompt, optional mode, optional user-facing notice, and settings-change flag.
+/// Progress information for the task, or null when no task with that ID is tracked.
 ///
 /// <div class="warning">
 ///
@@ -17563,25 +18976,12 @@ pub struct SlashCommandAddTimelineEntryResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SlashCommandAgentPromptResult {
-    /// Prompt text to display to the user
-    pub display_prompt: String,
-    /// Agent prompt result discriminator
-    pub kind: SlashCommandAgentPromptResultKind,
-    /// Optional target session mode for the agent prompt
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mode: Option<SessionMode>,
-    /// Optional user-facing notice to show before the prompt is submitted
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub notice: Option<String>,
-    /// Prompt to submit to the agent
-    pub prompt: String,
-    /// True when the invocation mutated user runtime settings; consumers caching settings should refresh
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub runtime_settings_changed: Option<bool>,
+pub struct TasksGetProgressResult {
+    /// Progress information for the task, discriminated by type. Returns null when no task with this ID is currently tracked.
+    pub progress: Option<serde_json::Value>,
 }
 
-/// Slash-command invocation result indicating completion, with optional message and settings-change flag.
+/// Tracked shell task metadata, including ID, command, status, timing, attachment/execution mode, log path, and PID.
 ///
 /// <div class="warning">
 ///
@@ -17591,18 +18991,39 @@ pub struct SlashCommandAgentPromptResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SlashCommandCompletedResult {
-    /// Completed result discriminator
-    pub kind: SlashCommandCompletedResultKind,
-    /// Optional user-facing message describing the completed command
+pub struct TaskShellInfo {
+    /// Whether the shell runs inside a managed PTY session or as an independent background process
+    pub attachment_mode: TaskShellInfoAttachmentMode,
+    /// Whether this shell task can be promoted to background mode
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub message: Option<String>,
-    /// True when the invocation mutated user runtime settings; consumers caching settings should refresh
+    pub can_promote_to_background: Option<bool>,
+    /// Command being executed
+    pub command: String,
+    /// ISO 8601 timestamp when the task finished
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub runtime_settings_changed: Option<bool>,
+    pub completed_at: Option<String>,
+    /// Short description of the task
+    pub description: String,
+    /// Whether task execution is synchronously awaited or managed in the background
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub execution_mode: Option<TaskExecutionMode>,
+    /// Unique task identifier
+    pub id: String,
+    /// Path to the detached shell log, when available
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub log_path: Option<String>,
+    /// Process ID when available
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub pid: Option<i64>,
+    /// ISO 8601 timestamp when the task was started
+    pub started_at: String,
+    /// Current lifecycle status of the task
+    pub status: TaskStatus,
+    /// Task kind
+    pub r#type: TaskShellInfoType,
 }
 
-/// Slash-command invocation result containing text output plus Markdown/ANSI rendering flags.
+/// Progress snapshot for a shell task, with recent stdout/stderr output and optional process ID.
 ///
 /// <div class="warning">
 ///
@@ -17612,23 +19033,17 @@ pub struct SlashCommandCompletedResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SlashCommandTextResult {
-    /// Text result discriminator
-    pub kind: SlashCommandTextResultKind,
-    /// Whether text contains Markdown
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub markdown: Option<bool>,
-    /// Whether ANSI sequences should be preserved
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub preserve_ansi: Option<bool>,
-    /// True when the invocation mutated user runtime settings; consumers caching settings should refresh
+pub struct TaskShellProgress {
+    /// Process ID when available
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub runtime_settings_changed: Option<bool>,
-    /// Text output for the client to render
-    pub text: String,
+    pub pid: Option<i64>,
+    /// Recent stdout/stderr lines from the running shell command
+    pub recent_output: String,
+    /// Progress kind
+    pub r#type: TaskShellProgressType,
 }
 
-/// Selectable slash-command subcommand option with name, description, and optional group label.
+/// The promoted task as it now exists in background mode, omitted if no promotable task was waiting.
 ///
 /// <div class="warning">
 ///
@@ -17638,17 +19053,13 @@ pub struct SlashCommandTextResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SlashCommandSelectSubcommandOption {
-    /// Human-readable description of the subcommand
-    pub description: String,
-    /// Optional group label for organizing options
+pub struct TasksPromoteCurrentToBackgroundResult {
+    /// The promoted task as it now exists in background mode, omitted if no promotable task was waiting. Atomic operation: avoids the race window of getCurrentPromotable + promoteToBackground.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub group: Option<String>,
-    /// Subcommand name to invoke
-    pub name: String,
+    pub task: Option<serde_json::Value>,
 }
 
-/// Slash-command invocation result asking the client to present subcommand options for a parent command.
+/// Identifier of the task to promote to background mode.
 ///
 /// <div class="warning">
 ///
@@ -17658,20 +19069,12 @@ pub struct SlashCommandSelectSubcommandOption {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SlashCommandSelectSubcommandResult {
-    /// Parent command name that requires subcommand selection
-    pub command: String,
-    /// Select subcommand result discriminator
-    pub kind: SlashCommandSelectSubcommandResultKind,
-    /// Available subcommand options for the client to present
-    pub options: Vec<SlashCommandSelectSubcommandOption>,
-    /// True when the invocation mutated user runtime settings; consumers caching settings should refresh
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub runtime_settings_changed: Option<bool>,
-    /// Human-readable title for the selection UI
-    pub title: String,
+pub struct TasksPromoteToBackgroundRequest {
+    /// Task identifier
+    pub id: String,
 }
 
+/// Indicates whether the task was successfully promoted to background mode.
 ///
 /// <div class="warning">
 ///
@@ -17681,20 +19084,12 @@ pub struct SlashCommandSelectSubcommandResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SlashCommandModelPickerDialog {
-    /// Discriminator for a model-picker dialog.
-    pub kind: SlashCommandModelPickerDialogKind,
-    /// Model that should be enabled before it can be selected.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub model_to_enable: Option<String>,
-    /// Settings scope the picker should modify.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub scope: Option<String>,
-    /// Model-selection target represented by the picker.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub target: Option<String>,
+pub struct TasksPromoteToBackgroundResult {
+    /// Whether the task was successfully promoted to background mode
+    pub promoted: bool,
 }
 
+/// Refresh metadata for any detached background shells the runtime knows about. Use after a long pause to pick up exit/output state for shells running outside the agent loop.
 ///
 /// <div class="warning">
 ///
@@ -17704,16 +19099,9 @@ pub struct SlashCommandModelPickerDialog {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SlashCommandShowDialogResult {
-    /// Dialog the host should display.
-    pub dialog: SlashCommandModelPickerDialog,
-    /// Discriminator for a show-dialog result.
-    pub kind: SlashCommandShowDialogResultKind,
-    /// Whether command execution changed persisted runtime settings.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub runtime_settings_changed: Option<bool>,
-}
+pub struct TasksRefreshResult {}
 
+/// Identifier of the completed or cancelled task to remove from tracking.
 ///
 /// <div class="warning">
 ///
@@ -17723,31 +19111,12 @@ pub struct SlashCommandShowDialogResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SlashCommandSetModelResult {
-    /// Discriminator for a set-model result.
-    pub kind: SlashCommandSetModelResultKind,
-    /// Model selected by the command.
-    pub model: String,
-    /// Reasoning effort selected for the model.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub reasoning_effort: Option<String>,
-    /// Repository settings scope modified by the command.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub repo_scope: Option<String>,
-    /// User-settings snapshot to restore if the host cancels the model switch.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub revert_on_cancel: Option<serde_json::Value>,
-    /// Whether command execution changed persisted runtime settings.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub runtime_settings_changed: Option<bool>,
-    /// Settings scope modified by the command.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub scope: Option<String>,
-    /// User-facing warning produced while selecting the model.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub warning: Option<String>,
+pub struct TasksRemoveRequest {
+    /// Task identifier
+    pub id: String,
 }
 
+/// Indicates whether the task was removed. False when the task does not exist or is still running/idle.
 ///
 /// <div class="warning">
 ///
@@ -17757,20 +19126,12 @@ pub struct SlashCommandSetModelResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SlashCommandSetPlanModelResult {
-    /// Discriminator for a set-plan-model result.
-    pub kind: SlashCommandSetPlanModelResultKind,
-    /// User-facing confirmation message for the plan-model selection.
-    pub message: String,
-    /// Dedicated model selected for plan mode.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub plan_model: Option<String>,
-    /// Whether command execution changed persisted runtime settings.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub runtime_settings_changed: Option<bool>,
+pub struct TasksRemoveResult {
+    /// Whether the task was removed. Returns false if the task does not exist or is still running/idle (cancel it first).
+    pub removed: bool,
 }
 
-/// Subagent model, reasoning effort, and context tier settings
+/// Identifier of the target agent task, message content, and optional sender agent ID.
 ///
 /// <div class="warning">
 ///
@@ -17780,19 +19141,17 @@ pub struct SlashCommandSetPlanModelResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SubagentSettingsEntry {
-    /// Context tier override for matching subagents
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub context_tier: Option<SubagentSettingsEntryContextTier>,
-    /// Reasoning effort override for matching subagents
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub effort_level: Option<String>,
-    /// Model override for matching subagents
+pub struct TasksSendMessageRequest {
+    /// Agent ID of the sender, if sent on behalf of another agent
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub model: Option<String>,
+    pub from_agent_id: Option<String>,
+    /// Agent task identifier
+    pub id: String,
+    /// Message content to send to the agent
+    pub message: String,
 }
 
-/// Subagent settings to apply, or null to clear the live session override
+/// Indicates whether the message was delivered, with an error message when delivery failed.
 ///
 /// <div class="warning">
 ///
@@ -17802,22 +19161,15 @@ pub struct SubagentSettingsEntry {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SubagentSettings {
-    /// Per-agent settings keyed by subagent agent_type
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub agents: Option<HashMap<String, SubagentSettingsEntry>>,
-    /// Names of subagents the user has turned off; they cannot be dispatched
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub disabled_subagents: Option<Vec<String>>,
-    /// Maximum number of subagents that can run concurrently; applies to usage-based billing users only
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_concurrency: Option<i32>,
-    /// Maximum subagent nesting depth; applies to usage-based billing users only
+pub struct TasksSendMessageResult {
+    /// Error message if delivery failed
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_depth: Option<i32>,
+    pub error: Option<String>,
+    /// Whether the message was successfully delivered or steered
+    pub sent: bool,
 }
 
-/// Tracked background agent task metadata, including IDs, status, timing, agent type, prompt, model, result, and latest response.
+/// Agent type, prompt, name, and optional description and model override for the new task.
 ///
 /// <div class="warning">
 ///
@@ -17827,62 +19179,22 @@ pub struct SubagentSettings {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TaskAgentInfo {
-    /// ISO 8601 timestamp when the current active period began
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub active_started_at: Option<String>,
-    /// Accumulated active execution time in milliseconds
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub active_time_ms: Option<i64>,
-    /// Type of agent running this task
+pub struct TasksStartAgentRequest {
+    /// Type of agent to start (e.g., 'explore', 'task', 'general-purpose')
     pub agent_type: String,
-    /// Whether the task is currently in the original sync wait and can be moved to background mode. False once it is already backgrounded, idle, finished, or no longer has a promotable sync waiter.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub can_promote_to_background: Option<bool>,
-    /// ISO 8601 timestamp when the task finished
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub completed_at: Option<String>,
     /// Short description of the task
-    pub description: String,
-    /// Friendly, non-unique name intended for display
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub display_name: Option<String>,
-    /// Error message when the task failed
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Whether task execution is synchronously awaited or managed in the background
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub execution_mode: Option<TaskExecutionMode>,
-    /// Unique task identifier
-    pub id: String,
-    /// ISO 8601 timestamp when the agent entered idle state
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub idle_since: Option<String>,
-    /// Most recent response text from the agent
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub latest_response: Option<String>,
-    /// Requested model override for the task when specified
+    pub description: Option<String>,
+    /// Optional model override
     #[serde(skip_serializing_if = "Option::is_none")]
     pub model: Option<String>,
-    /// Most recent prompt delivered to the agent. Updated whenever the agent receives a follow-up message.
+    /// Friendly, non-unique name used when displaying the agent
+    pub name: String,
+    /// Task prompt for the agent
     pub prompt: String,
-    /// Runtime model resolved for the task when available
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub resolved_model: Option<String>,
-    /// Result text from the task when available
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub result: Option<String>,
-    /// ISO 8601 timestamp when the task was started
-    pub started_at: String,
-    /// Current lifecycle status of the task
-    pub status: TaskStatus,
-    /// Tool call ID associated with this agent task
-    pub tool_call_id: String,
-    /// Task kind
-    pub r#type: TaskAgentInfoType,
 }
 
-/// Timestamped display line for task progress output or recent agent activity.
+/// Identifier assigned to the newly started background agent task.
 ///
 /// <div class="warning">
 ///
@@ -17892,14 +19204,12 @@ pub struct TaskAgentInfo {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TaskProgressLine {
-    /// Display message, e.g., "▸ bash", "✓ edit src/foo.ts"
-    pub message: String,
-    /// ISO 8601 timestamp when this event occurred
-    pub timestamp: String,
+pub struct TasksStartAgentResult {
+    /// Generated agent ID for the background task
+    pub agent_id: String,
 }
 
-/// Progress snapshot for an agent task, with recent activity lines and optional latest intent.
+/// Wait until all in-flight background tasks (agents + shells) and any follow-up turns scheduled by their completions have settled. Returns when the runtime is fully drained or after an internal timeout (default 10 minutes; configurable via COPILOT_TASK_WAIT_TIMEOUT_SECONDS).
 ///
 /// <div class="warning">
 ///
@@ -17909,17 +19219,9 @@ pub struct TaskProgressLine {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TaskAgentProgress {
-    /// The most recent intent reported by the agent
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub latest_intent: Option<String>,
-    /// Recent tool execution events converted to display lines
-    pub recent_activity: Vec<TaskProgressLine>,
-    /// Progress kind
-    pub r#type: TaskAgentProgressType,
-}
+pub struct TasksWaitForPendingResult {}
 
-/// Task completion notification with summary from the agent
+/// Feature override key/value pairs to attach to subsequent telemetry events from this session.
 ///
 /// <div class="warning">
 ///
@@ -17929,24 +19231,12 @@ pub struct TaskAgentProgress {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TaskCompleteData {
-    /// Active autopilot objective ID evaluated by the completion reviewer
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub objective_id: Option<i64>,
-    /// Semantic completion decision. Absent on legacy events and invalid tool calls
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub outcome: Option<TaskCompletionOutcome>,
-    /// Label-safe runtime rationale for the completion decision (e.g. a cancellation or pause/resume downgrade), when one applies. Reviewer-authored rationale is intentionally omitted here because this event has no IFC label channel; the reviewer's findings remain available through its own labeled sub-agent events
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub reason: Option<String>,
-    /// Whether the task was accepted as complete. False when validation failed or completion was rejected or blocked by the reviewer
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub success: Option<bool>,
-    /// Summary of the completed task, provided by the agent
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub summary: Option<String>,
+pub struct TelemetrySetFeatureOverridesRequest {
+    /// Override key/value pairs to attach to subsequent telemetry events from this session. Replaces any previously-set overrides.
+    pub features: HashMap<String, String>,
 }
 
+/// Built-in tool metadata with identifier, optional namespaced name, description, input-parameter schema, and usage instructions.
 ///
 /// <div class="warning">
 ///
@@ -17956,30 +19246,23 @@ pub struct TaskCompleteData {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TaskCompletionDecision {
-    /// Objective eligibility token captured when the decision was evaluated.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub completion_eligibility_token: Option<i64>,
-    /// Whether completion was accepted after the reviewer-rejection budget was exhausted.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub completion_rejection_budget_exhausted: Option<bool>,
-    /// Active autopilot objective evaluated by the completion reviewer.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub objective_id: Option<i64>,
-    /// Semantic result of evaluating the task completion request.
-    pub outcome: TaskCompletionOutcome,
-    /// Rationale for the completion decision, when one is available.
+pub struct Tool {
+    /// Description of what the tool does
+    pub description: String,
+    /// Optional instructions for how to use this tool effectively
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub reason: Option<String>,
-    /// Whether the rationale was derived from completion-reviewer output.
+    pub instructions: Option<String>,
+    /// Tool identifier (e.g., "bash", "grep", "str_replace_editor")
+    pub name: String,
+    /// Optional namespaced name for declarative filtering (e.g., "playwright/navigate" for MCP tools)
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub reviewer_derived: Option<bool>,
-    /// Information-flow metadata captured from the completion reviewer.
+    pub namespaced_name: Option<String>,
+    /// JSON Schema for the tool's input parameters
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub reviewer_result_meta: Option<serde_json::Value>,
+    pub parameters: Option<HashMap<String, serde_json::Value>>,
 }
 
-/// Background tasks currently tracked by the session.
+/// Built-in tools available for the requested model, with their parameters and instructions.
 ///
 /// <div class="warning">
 ///
@@ -17989,12 +19272,12 @@ pub struct TaskCompletionDecision {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TaskList {
-    /// Currently tracked tasks
-    pub tasks: Vec<serde_json::Value>,
+pub struct ToolList {
+    /// List of available built-in tools with metadata
+    pub tools: Vec<Tool>,
 }
 
-/// Identifier of the background task to cancel.
+/// A message injected by a tool result.
 ///
 /// <div class="warning">
 ///
@@ -18004,12 +19287,14 @@ pub struct TaskList {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TasksCancelRequest {
-    /// Task identifier
-    pub id: String,
+pub struct ToolResultNewMessage {
+    /// Message content to inject after the tool result.
+    pub content: String,
+    /// Source attributed to the injected message.
+    pub source: String,
 }
 
-/// Indicates whether the background task was successfully cancelled.
+/// Expanded canonical result returned by a session tool.
 ///
 /// <div class="warning">
 ///
@@ -18019,12 +19304,59 @@ pub struct TasksCancelRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TasksCancelResult {
-    /// Whether the task was successfully cancelled
-    pub cancelled: bool,
+pub struct ToolResultExpanded {
+    /// Base64-encoded binary results returned to the model.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub binary_results_for_llm: Option<Vec<ExternalToolTextResultForLlmBinaryResultsForLlm>>,
+    /// Sources returned by the tool that the model may cite.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub citable_sources: Option<Vec<serde_json::Value>>,
+    /// Structured content blocks returned to the model.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub contents: Option<Vec<serde_json::Value>>,
+    /// Error message for an unsuccessful execution.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// Metadata propagated with the tool result, including information-flow labels.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mcp_meta: Option<HashMap<String, serde_json::Value>>,
+    /// Messages to inject after the tool result.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub new_messages: Option<Vec<ToolResultNewMessage>>,
+    /// Whether post-tool-use failure hooks have already processed this result.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub post_tool_use_failure_hooks_processed: Option<bool>,
+    /// Execution outcome classification.
+    pub result_type: ToolResultType,
+    /// Detailed log content available for session display.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub session_log: Option<String>,
+    /// Skill invocation metadata produced by the tool.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub skill_invocation: Option<serde_json::Value>,
+    /// Whether large-output post-processing should be skipped.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub skip_large_output_processing: Option<bool>,
+    /// Structured result content in addition to the model-facing text.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub structured_content: Option<serde_json::Value>,
+    /// Completion-review decision produced by the task-completion tool.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub task_completion_decision: Option<TaskCompletionDecision>,
+    /// Text result returned to the model.
+    pub text_result_for_llm: String,
+    /// Deferred tool names made available by this result.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tool_references: Option<Vec<String>>,
+    /// Tool-specific telemetry payload.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tool_telemetry: Option<serde_json::Value>,
+    /// Optional UI resource produced by the tool.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub ui_resource: Option<serde_json::Value>,
 }
 
-/// The first sync-waiting task that can currently be promoted to background mode.
+/// A tool name and arguments to execute through the session's native invocation pipeline.
 ///
 /// <div class="warning">
 ///
@@ -18034,13 +19366,17 @@ pub struct TasksCancelResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TasksGetCurrentPromotableResult {
-    /// The first sync-waiting task (agent first, then shell) that can currently be promoted to background mode. Omitted if no such task exists. The returned task is guaranteed to have executionMode='sync' and canPromoteToBackground=true at the time of the call.
+pub struct ToolsExecuteRequest {
+    /// Arguments supplied to the tool.
+    pub arguments: serde_json::Value,
+    /// Name of the currently offered tool to execute.
+    pub name: String,
+    /// Optional identifier used to correlate this invocation with its tool call.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub task: Option<serde_json::Value>,
+    pub tool_call_id: Option<String>,
 }
 
-/// Identifier of the background task to fetch progress for.
+/// Shell-specific names and description lines used to materialize built-in shell tool descriptors.
 ///
 /// <div class="warning">
 ///
@@ -18050,12 +19386,24 @@ pub struct TasksGetCurrentPromotableResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TasksGetProgressRequest {
-    /// Task identifier (agent ID or shell ID)
-    pub id: String,
+pub struct ToolsShellDescriptorConfig {
+    /// Additional model-facing shell description lines.
+    pub description_lines: Vec<String>,
+    /// Human-readable shell name.
+    pub display_name: String,
+    /// Tool name used to list active shells.
+    pub list_shells_tool_name: String,
+    /// Tool name used to read shell output.
+    pub read_shell_tool_name: String,
+    /// Tool name used to start shell commands.
+    pub shell_tool_name: String,
+    /// Stable shell type identifier.
+    pub shell_type: String,
+    /// Tool name used to stop shell commands.
+    pub stop_shell_tool_name: String,
 }
 
-/// Progress information for the task, or null when no task with that ID is tracked.
+/// Options controlling how Rust-owned built-in tool descriptors are materialized.
 ///
 /// <div class="warning">
 ///
@@ -18065,12 +19413,37 @@ pub struct TasksGetProgressRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TasksGetProgressResult {
-    /// Progress information for the task, discriminated by type. Returns null when no task with this ID is currently tracked.
-    pub progress: Option<serde_json::Value>,
+pub struct ToolsGetBuiltinDescriptorsRequest {
+    /// Whether background task completion notifications are enabled.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub background_task_notifications_enabled: Option<bool>,
+    /// Whether tool descriptors should include authoring metadata.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub include_author: Option<bool>,
+    /// Whether line numbers should be omitted from the view tool descriptor.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub no_view_line_numbers: Option<bool>,
+    /// Whether descriptors should favor fewer user-intervention prompts.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reduce_user_intervention: Option<bool>,
+    /// Whether shell commands may only run asynchronously.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub shell_async_only_enabled: Option<bool>,
+    /// Shell-specific names and description lines for shell tools.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub shell_config: Option<ToolsShellDescriptorConfig>,
+    /// Whether the configured shell supports PowerShell 7 syntax.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub shell_supports_power_shell7_syntax: Option<bool>,
+    /// Default shell timeout in milliseconds.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub shell_timeout_ms: Option<f64>,
+    /// Whether semantic skill lookup is available.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub skill_embedding_enabled: Option<bool>,
 }
 
-/// Tracked shell task metadata, including ID, command, status, timing, attachment/execution mode, log path, and PID.
+/// Rust-owned built-in tool descriptors for the session.
 ///
 /// <div class="warning">
 ///
@@ -18080,39 +19453,12 @@ pub struct TasksGetProgressResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TaskShellInfo {
-    /// Whether the shell runs inside a managed PTY session or as an independent background process
-    pub attachment_mode: TaskShellInfoAttachmentMode,
-    /// Whether this shell task can be promoted to background mode
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub can_promote_to_background: Option<bool>,
-    /// Command being executed
-    pub command: String,
-    /// ISO 8601 timestamp when the task finished
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub completed_at: Option<String>,
-    /// Short description of the task
-    pub description: String,
-    /// Whether task execution is synchronously awaited or managed in the background
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub execution_mode: Option<TaskExecutionMode>,
-    /// Unique task identifier
-    pub id: String,
-    /// Path to the detached shell log, when available
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub log_path: Option<String>,
-    /// Process ID when available
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub pid: Option<i64>,
-    /// ISO 8601 timestamp when the task was started
-    pub started_at: String,
-    /// Current lifecycle status of the task
-    pub status: TaskStatus,
-    /// Task kind
-    pub r#type: TaskShellInfoType,
+pub struct ToolsGetBuiltinDescriptorsResult {
+    /// Built-in tool descriptors materialized for the session.
+    pub tools: Vec<BuiltinToolDescriptor>,
 }
 
-/// Progress snapshot for a shell task, with recent stdout/stderr output and optional process ID.
+/// Current lightweight tool metadata snapshot for the session.
 ///
 /// <div class="warning">
 ///
@@ -18122,17 +19468,12 @@ pub struct TaskShellInfo {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TaskShellProgress {
-    /// Process ID when available
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub pid: Option<i64>,
-    /// Recent stdout/stderr lines from the running shell command
-    pub recent_output: String,
-    /// Progress kind
-    pub r#type: TaskShellProgressType,
+pub struct ToolsGetCurrentMetadataResult {
+    /// Current tool metadata, or null when tools have not been initialized yet
+    pub tools: Option<Vec<CurrentToolMetadata>>,
 }
 
-/// The promoted task as it now exists in background mode, omitted if no promotable task was waiting.
+/// Resolve, build, and validate the runtime tool list for this session. Subagent sessions and consumer flows that need an initialized tool set before `send` invoke this. Default base-class implementation is a no-op for sessions that don't support tool validation.
 ///
 /// <div class="warning">
 ///
@@ -18142,13 +19483,9 @@ pub struct TaskShellProgress {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TasksPromoteCurrentToBackgroundResult {
-    /// The promoted task as it now exists in background mode, omitted if no promotable task was waiting. Atomic operation: avoids the race window of getCurrentPromotable + promoteToBackground.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub task: Option<serde_json::Value>,
-}
+pub struct ToolsInitializeAndValidateResult {}
 
-/// Identifier of the task to promote to background mode.
+/// Optional model identifier whose tool overrides should be applied to the listing.
 ///
 /// <div class="warning">
 ///
@@ -18158,12 +19495,13 @@ pub struct TasksPromoteCurrentToBackgroundResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TasksPromoteToBackgroundRequest {
-    /// Task identifier
-    pub id: String,
+pub struct ToolsListRequest {
+    /// Optional model ID — when provided, the returned tool list reflects model-specific overrides
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model: Option<String>,
 }
 
-/// Indicates whether the task was successfully promoted to background mode.
+/// Complete externally implemented tool list for the calling connection. An empty list removes every tool previously supplied by that connection.
 ///
 /// <div class="warning">
 ///
@@ -18173,12 +19511,12 @@ pub struct TasksPromoteToBackgroundRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TasksPromoteToBackgroundResult {
-    /// Whether the task was successfully promoted to background mode
-    pub promoted: bool,
+pub struct ToolsSetRequest {
+    /// Complete replacement list for the calling connection.
+    pub tools: Vec<ProtocolExternalToolDefinition>,
 }
 
-/// Refresh metadata for any detached background shells the runtime knows about. Use after a long pause to pick up exit/output state for shells running outside the agent loop.
+/// Empty result after replacing the calling connection's externally implemented tools.
 ///
 /// <div class="warning">
 ///
@@ -18188,9 +19526,9 @@ pub struct TasksPromoteToBackgroundResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TasksRefreshResult {}
+pub struct ToolsSetResult {}
 
-/// Identifier of the completed or cancelled task to remove from tracking.
+/// Task-completion tool arguments and final result used to build a label-safe session event payload.
 ///
 /// <div class="warning">
 ///
@@ -18200,12 +19538,14 @@ pub struct TasksRefreshResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TasksRemoveRequest {
-    /// Task identifier
-    pub id: String,
+pub struct ToolsTaskCompleteEventDataRequest {
+    /// Final expanded result returned by the task_complete tool.
+    pub final_result: ToolResultExpanded,
+    /// Arguments supplied to the completed task_complete tool call.
+    pub tool_args: serde_json::Value,
 }
 
-/// Indicates whether the task was removed. False when the task does not exist or is still running/idle.
+/// Empty result after applying subagent settings
 ///
 /// <div class="warning">
 ///
@@ -18215,12 +19555,9 @@ pub struct TasksRemoveRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TasksRemoveResult {
-    /// Whether the task was removed. Returns false if the task does not exist or is still running/idle (cancel it first).
-    pub removed: bool,
-}
+pub struct ToolsUpdateSubagentSettingsResult {}
 
-/// Identifier of the target agent task, message content, and optional sender agent ID.
+/// Selectable option for a UI elicitation multi-select array item, with submitted value and display label.
 ///
 /// <div class="warning">
 ///
@@ -18230,17 +19567,14 @@ pub struct TasksRemoveResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TasksSendMessageRequest {
-    /// Agent ID of the sender, if sent on behalf of another agent
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub from_agent_id: Option<String>,
-    /// Agent task identifier
-    pub id: String,
-    /// Message content to send to the agent
-    pub message: String,
+pub struct UIElicitationArrayAnyOfFieldItemsAnyOf {
+    /// Value submitted when this option is selected.
+    pub r#const: String,
+    /// Display label for this option.
+    pub title: String,
 }
 
-/// Indicates whether the message was delivered, with an error message when delivery failed.
+/// Schema applied to each item in the array.
 ///
 /// <div class="warning">
 ///
@@ -18250,15 +19584,12 @@ pub struct TasksSendMessageRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TasksSendMessageResult {
-    /// Error message if delivery failed
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Whether the message was successfully delivered or steered
-    pub sent: bool,
+pub struct UIElicitationArrayAnyOfFieldItems {
+    /// Selectable options, each with a value and a display label.
+    pub any_of: Vec<UIElicitationArrayAnyOfFieldItemsAnyOf>,
 }
 
-/// Agent type, prompt, name, and optional description and model override for the new task.
+/// Multi-select string field where each option pairs a value with a display label.
 ///
 /// <div class="warning">
 ///
@@ -18268,22 +19599,29 @@ pub struct TasksSendMessageResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TasksStartAgentRequest {
-    /// Type of agent to start (e.g., 'explore', 'task', 'general-purpose')
-    pub agent_type: String,
-    /// Short description of the task
+pub struct UIElicitationArrayAnyOfField {
+    /// Default values selected when the form is first shown.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub default: Option<Vec<String>>,
+    /// Help text describing the field.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub description: Option<String>,
-    /// Optional model override
+    /// Schema applied to each item in the array.
+    pub items: UIElicitationArrayAnyOfFieldItems,
+    /// Maximum number of items the user may select.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub model: Option<String>,
-    /// Friendly, non-unique name used when displaying the agent
-    pub name: String,
-    /// Task prompt for the agent
-    pub prompt: String,
+    pub max_items: Option<i64>,
+    /// Minimum number of items the user must select.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub min_items: Option<i64>,
+    /// Human-readable label for the field.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub title: Option<String>,
+    /// Type discriminator. Always "array".
+    pub r#type: UIElicitationArrayAnyOfFieldType,
 }
 
-/// Identifier assigned to the newly started background agent task.
+/// Schema applied to each item in the array.
 ///
 /// <div class="warning">
 ///
@@ -18293,12 +19631,14 @@ pub struct TasksStartAgentRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TasksStartAgentResult {
-    /// Generated agent ID for the background task
-    pub agent_id: String,
+pub struct UIElicitationArrayEnumFieldItems {
+    /// Allowed string values for each selected item.
+    pub r#enum: Vec<String>,
+    /// Type discriminator. Always "string".
+    pub r#type: UIElicitationArrayEnumFieldItemsType,
 }
 
-/// Wait until all in-flight background tasks (agents + shells) and any follow-up turns scheduled by their completions have settled. Returns when the runtime is fully drained or after an internal timeout (default 10 minutes; configurable via COPILOT_TASK_WAIT_TIMEOUT_SECONDS).
+/// Multi-select string field whose allowed values are defined inline.
 ///
 /// <div class="warning">
 ///
@@ -18308,9 +19648,29 @@ pub struct TasksStartAgentResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TasksWaitForPendingResult {}
+pub struct UIElicitationArrayEnumField {
+    /// Default values selected when the form is first shown.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub default: Option<Vec<String>>,
+    /// Help text describing the field.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// Schema applied to each item in the array.
+    pub items: UIElicitationArrayEnumFieldItems,
+    /// Maximum number of items the user may select.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_items: Option<i64>,
+    /// Minimum number of items the user must select.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub min_items: Option<i64>,
+    /// Human-readable label for the field.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub title: Option<String>,
+    /// Type discriminator. Always "array".
+    pub r#type: UIElicitationArrayEnumFieldType,
+}
 
-/// Feature override key/value pairs to attach to subsequent telemetry events from this session.
+/// JSON Schema describing the form fields to present to the user
 ///
 /// <div class="warning">
 ///
@@ -18320,12 +19680,17 @@ pub struct TasksWaitForPendingResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct TelemetrySetFeatureOverridesRequest {
-    /// Override key/value pairs to attach to subsequent telemetry events from this session. Replaces any previously-set overrides.
-    pub features: HashMap<String, String>,
+pub struct UIElicitationSchema {
+    /// Form field definitions, keyed by field name
+    pub properties: HashMap<String, serde_json::Value>,
+    /// List of required field names
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub required: Option<Vec<String>>,
+    /// Schema type indicator (always 'object')
+    pub r#type: UIElicitationSchemaType,
 }
 
-/// Built-in tool metadata with identifier, optional namespaced name, description, input-parameter schema, and usage instructions.
+/// Prompt message and JSON schema describing the form fields to elicit from the user.
 ///
 /// <div class="warning">
 ///
@@ -18335,23 +19700,23 @@ pub struct TelemetrySetFeatureOverridesRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct Tool {
-    /// Description of what the tool does
-    pub description: String,
-    /// Optional instructions for how to use this tool effectively
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub instructions: Option<String>,
-    /// Tool identifier (e.g., "bash", "grep", "str_replace_editor")
-    pub name: String,
-    /// Optional namespaced name for declarative filtering (e.g., "playwright/navigate" for MCP tools)
+pub struct UIElicitationRequest {
+    /// MCP request metadata.
+    #[serde(rename = "_meta", skip_serializing_if = "Option::is_none")]
+    pub meta: Option<HashMap<String, serde_json::Value>>,
+    /// Message describing what information is needed from the user
+    pub message: String,
+    /// Elicitation mode. Omitted and form are equivalent for structured elicitation.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub namespaced_name: Option<String>,
-    /// JSON Schema for the tool's input parameters
+    pub mode: Option<McpElicitationFormMode>,
+    /// JSON Schema describing the form fields to present to the user
+    pub requested_schema: UIElicitationSchema,
+    /// MCP task metadata.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub parameters: Option<HashMap<String, serde_json::Value>>,
+    pub task: Option<McpTaskMetadata>,
 }
 
-/// Built-in tools available for the requested model, with their parameters and instructions.
+/// The elicitation response (accept with form values, decline, or cancel)
 ///
 /// <div class="warning">
 ///
@@ -18361,12 +19726,18 @@ pub struct Tool {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ToolList {
-    /// List of available built-in tools with metadata
-    pub tools: Vec<Tool>,
+pub struct UIElicitationResponse {
+    /// MCP response metadata.
+    #[serde(rename = "_meta", skip_serializing_if = "Option::is_none")]
+    pub meta: Option<HashMap<String, serde_json::Value>>,
+    /// The user's response: accept (submitted), decline (rejected), or cancel (dismissed)
+    pub action: UIElicitationResponseAction,
+    /// The form values submitted by the user (present when action is 'accept')
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub content: Option<HashMap<String, serde_json::Value>>,
 }
 
-/// A message injected by a tool result.
+/// Indicates whether the elicitation response was accepted; false if it was already resolved by another client.
 ///
 /// <div class="warning">
 ///
@@ -18376,14 +19747,12 @@ pub struct ToolList {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ToolResultNewMessage {
-    /// Message content to inject after the tool result.
-    pub content: String,
-    /// Source attributed to the injected message.
-    pub source: String,
+pub struct UIElicitationResult {
+    /// Whether the response was accepted. False if the request was already resolved by another client.
+    pub success: bool,
 }
 
-/// Expanded canonical result returned by a session tool.
+/// Boolean field rendered as a yes/no toggle.
 ///
 /// <div class="warning">
 ///
@@ -18393,79 +19762,21 @@ pub struct ToolResultNewMessage {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ToolResultExpanded {
-    /// Base64-encoded binary results returned to the model.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub binary_results_for_llm: Option<Vec<ExternalToolTextResultForLlmBinaryResultsForLlm>>,
-    /// Sources returned by the tool that the model may cite.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub citable_sources: Option<Vec<serde_json::Value>>,
-    /// Structured content blocks returned to the model.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub contents: Option<Vec<serde_json::Value>>,
-    /// Error message for an unsuccessful execution.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Metadata propagated with the tool result, including information-flow labels.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mcp_meta: Option<HashMap<String, serde_json::Value>>,
-    /// Messages to inject after the tool result.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub new_messages: Option<Vec<ToolResultNewMessage>>,
-    /// Whether post-tool-use failure hooks have already processed this result.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub post_tool_use_failure_hooks_processed: Option<bool>,
-    /// Execution outcome classification.
-    pub result_type: ToolResultType,
-    /// Detailed log content available for session display.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub session_log: Option<String>,
-    /// Skill invocation metadata produced by the tool.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub skill_invocation: Option<serde_json::Value>,
-    /// Whether large-output post-processing should be skipped.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub skip_large_output_processing: Option<bool>,
-    /// Structured result content in addition to the model-facing text.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub structured_content: Option<serde_json::Value>,
-    /// Completion-review decision produced by the task-completion tool.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub task_completion_decision: Option<TaskCompletionDecision>,
-    /// Text result returned to the model.
-    pub text_result_for_llm: String,
-    /// Deferred tool names made available by this result.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub tool_references: Option<Vec<String>>,
-    /// Tool-specific telemetry payload.
+pub struct UIElicitationSchemaPropertyBoolean {
+    /// Default value selected when the form is first shown.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub tool_telemetry: Option<serde_json::Value>,
-    /// Optional UI resource produced by the tool.
+    pub default: Option<bool>,
+    /// Help text describing the field.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub ui_resource: Option<serde_json::Value>,
-}
-
-/// A tool name and arguments to execute through the session's native invocation pipeline.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ToolsExecuteRequest {
-    /// Arguments supplied to the tool.
-    pub arguments: serde_json::Value,
-    /// Name of the currently offered tool to execute.
-    pub name: String,
-    /// Optional identifier used to correlate this invocation with its tool call.
+    pub description: Option<String>,
+    /// Human-readable label for the field.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub tool_call_id: Option<String>,
+    pub title: Option<String>,
+    /// Type discriminator. Always "boolean".
+    pub r#type: UIElicitationSchemaPropertyBooleanType,
 }
 
-/// Shell-specific names and description lines used to materialize built-in shell tool descriptors.
+/// Numeric field accepting either a number or an integer.
 ///
 /// <div class="warning">
 ///
@@ -18475,24 +19786,27 @@ pub struct ToolsExecuteRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ToolsShellDescriptorConfig {
-    /// Additional model-facing shell description lines.
-    pub description_lines: Vec<String>,
-    /// Human-readable shell name.
-    pub display_name: String,
-    /// Tool name used to list active shells.
-    pub list_shells_tool_name: String,
-    /// Tool name used to read shell output.
-    pub read_shell_tool_name: String,
-    /// Tool name used to start shell commands.
-    pub shell_tool_name: String,
-    /// Stable shell type identifier.
-    pub shell_type: String,
-    /// Tool name used to stop shell commands.
-    pub stop_shell_tool_name: String,
+pub struct UIElicitationSchemaPropertyNumber {
+    /// Default value populated in the input when the form is first shown.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub default: Option<f64>,
+    /// Help text describing the field.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// Maximum allowed value (inclusive).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub maximum: Option<f64>,
+    /// Minimum allowed value (inclusive).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub minimum: Option<f64>,
+    /// Human-readable label for the field.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub title: Option<String>,
+    /// Numeric type accepted by the field.
+    pub r#type: UIElicitationSchemaPropertyNumberType,
 }
 
-/// Options controlling how Rust-owned built-in tool descriptors are materialized.
+/// Free-text string field with optional length and format constraints.
 ///
 /// <div class="warning">
 ///
@@ -18502,37 +19816,30 @@ pub struct ToolsShellDescriptorConfig {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ToolsGetBuiltinDescriptorsRequest {
-    /// Whether background task completion notifications are enabled.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub background_task_notifications_enabled: Option<bool>,
-    /// Whether tool descriptors should include authoring metadata.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub include_author: Option<bool>,
-    /// Whether line numbers should be omitted from the view tool descriptor.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub no_view_line_numbers: Option<bool>,
-    /// Whether descriptors should favor fewer user-intervention prompts.
+pub struct UIElicitationSchemaPropertyString {
+    /// Default value populated in the input when the form is first shown.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub reduce_user_intervention: Option<bool>,
-    /// Whether shell commands may only run asynchronously.
+    pub default: Option<String>,
+    /// Help text describing the field.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub shell_async_only_enabled: Option<bool>,
-    /// Shell-specific names and description lines for shell tools.
+    pub description: Option<String>,
+    /// Optional format hint that constrains the accepted input.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub shell_config: Option<ToolsShellDescriptorConfig>,
-    /// Whether the configured shell supports PowerShell 7 syntax.
+    pub format: Option<UIElicitationSchemaPropertyStringFormat>,
+    /// Maximum number of characters allowed.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub shell_supports_power_shell7_syntax: Option<bool>,
-    /// Default shell timeout in milliseconds.
+    pub max_length: Option<i64>,
+    /// Minimum number of characters required.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub shell_timeout_ms: Option<f64>,
-    /// Whether semantic skill lookup is available.
+    pub min_length: Option<i64>,
+    /// Human-readable label for the field.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub skill_embedding_enabled: Option<bool>,
+    pub title: Option<String>,
+    /// Type discriminator. Always "string".
+    pub r#type: UIElicitationSchemaPropertyStringType,
 }
 
-/// Rust-owned built-in tool descriptors for the session.
+/// Single-select string field whose allowed values are defined inline.
 ///
 /// <div class="warning">
 ///
@@ -18542,12 +19849,26 @@ pub struct ToolsGetBuiltinDescriptorsRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ToolsGetBuiltinDescriptorsResult {
-    /// Built-in tool descriptors materialized for the session.
-    pub tools: Vec<BuiltinToolDescriptor>,
+pub struct UIElicitationStringEnumField {
+    /// Default value selected when the form is first shown.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub default: Option<String>,
+    /// Help text describing the field.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// Allowed string values.
+    pub r#enum: Vec<String>,
+    /// Optional display labels for each enum value, in the same order as `enum`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enum_names: Option<Vec<String>>,
+    /// Human-readable label for the field.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub title: Option<String>,
+    /// Type discriminator. Always "string".
+    pub r#type: UIElicitationStringEnumFieldType,
 }
 
-/// Current lightweight tool metadata snapshot for the session.
+/// Selectable option for a UI elicitation single-select string field, with submitted value and display label.
 ///
 /// <div class="warning">
 ///
@@ -18557,12 +19878,14 @@ pub struct ToolsGetBuiltinDescriptorsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ToolsGetCurrentMetadataResult {
-    /// Current tool metadata, or null when tools have not been initialized yet
-    pub tools: Option<Vec<CurrentToolMetadata>>,
+pub struct UIElicitationStringOneOfFieldOneOf {
+    /// Value submitted when this option is selected.
+    pub r#const: String,
+    /// Display label for this option.
+    pub title: String,
 }
 
-/// Resolve, build, and validate the runtime tool list for this session. Subagent sessions and consumer flows that need an initialized tool set before `send` invoke this. Default base-class implementation is a no-op for sessions that don't support tool validation.
+/// Single-select string field where each option pairs a value with a display label.
 ///
 /// <div class="warning">
 ///
@@ -18572,9 +19895,23 @@ pub struct ToolsGetCurrentMetadataResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ToolsInitializeAndValidateResult {}
+pub struct UIElicitationStringOneOfField {
+    /// Default value selected when the form is first shown.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub default: Option<String>,
+    /// Help text describing the field.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// Selectable options, each with a value and a display label.
+    pub one_of: Vec<UIElicitationStringOneOfFieldOneOf>,
+    /// Human-readable label for the field.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub title: Option<String>,
+    /// Type discriminator. Always "string".
+    pub r#type: UIElicitationStringOneOfFieldType,
+}
 
-/// Optional model identifier whose tool overrides should be applied to the listing.
+/// Transient question to answer without adding it to conversation history.
 ///
 /// <div class="warning">
 ///
@@ -18584,13 +19921,20 @@ pub struct ToolsInitializeAndValidateResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ToolsListRequest {
-    /// Optional model ID — when provided, the returned tool list reflects model-specific overrides
+pub struct UIEphemeralQueryRequest {
+    /// In-process `AbortSignal` forwarded to the model client to cancel an in-flight request. Marked internal: excluded from the public SDK surface. Replaced by an explicit cancellation token + cancel RPC in the SDK migration.
+    #[doc(hidden)]
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub model: Option<String>,
+    pub(crate) abort_signal: Option<serde_json::Value>,
+    /// In-process streaming callback `(text) => void` invoked with each token as the model emits it. Marked internal: excluded from the public SDK surface. In a process-separated SDK this is replaced by a streaming RPC that yields chunks and a final answer.
+    #[doc(hidden)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(crate) on_chunk: Option<serde_json::Value>,
+    /// Question to answer from the current conversation context.
+    pub question: String,
 }
 
-/// Complete externally implemented tool list for the calling connection. An empty list removes every tool previously supplied by that connection.
+/// Completed transient query. Ordered chunks and the terminal outcome are also delivered through `ui.ephemeral_query` session events while it runs.
 ///
 /// <div class="warning">
 ///
@@ -18600,12 +19944,12 @@ pub struct ToolsListRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ToolsSetRequest {
-    /// Complete replacement list for the calling connection.
-    pub tools: Vec<ProtocolExternalToolDefinition>,
+pub struct UIEphemeralQueryResult {
+    /// Answer returned by the model
+    pub answer: String,
 }
 
-/// Empty result after replacing the calling connection's externally implemented tools.
+/// User response for a pending exit-plan-mode request, with approval state, selected action, auto-approve flag, and feedback.
 ///
 /// <div class="warning">
 ///
@@ -18615,9 +19959,24 @@ pub struct ToolsSetRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ToolsSetResult {}
+pub struct UIExitPlanModeResponse {
+    /// Whether the plan was approved.
+    pub approved: bool,
+    /// Whether subsequent edits should be auto-approved without confirmation.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub auto_approve_edits: Option<bool>,
+    /// When true, the agent is instructed to end its turn without starting implementation so the client can restore the session model and auto-submit a fresh implementation turn on it. Set only when a distinct plan configuration (a different model, reasoning effort, or context tier) actually ran the planning turn.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub defer_implementation: Option<bool>,
+    /// Feedback from the user when they declined the plan or requested changes.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub feedback: Option<String>,
+    /// The action the user selected. Defaults to 'autopilot' when autoApproveEdits is true, otherwise 'interactive'.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub selected_action: Option<UIExitPlanModeAction>,
+}
 
-/// Task-completion tool arguments and final result used to build a label-safe session event payload.
+/// Request ID of a pending `auto_mode_switch.requested` event and the user's response.
 ///
 /// <div class="warning">
 ///
@@ -18627,14 +19986,14 @@ pub struct ToolsSetResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ToolsTaskCompleteEventDataRequest {
-    /// Final expanded result returned by the task_complete tool.
-    pub final_result: ToolResultExpanded,
-    /// Arguments supplied to the completed task_complete tool call.
-    pub tool_args: serde_json::Value,
+pub struct UIHandlePendingAutoModeSwitchRequest {
+    /// The unique request ID from the auto_mode_switch.requested event
+    pub request_id: RequestId,
+    /// User's choice for auto-mode switching: yes (allow this turn), yes_always (allow + persist as setting), or no (decline).
+    pub response: UIAutoModeSwitchResponse,
 }
 
-/// Empty result after applying subagent settings
+/// Pending elicitation request ID and the user's response (accept/decline/cancel + form values).
 ///
 /// <div class="warning">
 ///
@@ -18644,9 +20003,14 @@ pub struct ToolsTaskCompleteEventDataRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ToolsUpdateSubagentSettingsResult {}
+pub struct UIHandlePendingElicitationRequest {
+    /// The unique request ID from the elicitation.requested event
+    pub request_id: RequestId,
+    /// The elicitation response (accept with form values, decline, or cancel)
+    pub result: UIElicitationResponse,
+}
 
-/// Selectable option for a UI elicitation multi-select array item, with submitted value and display label.
+/// Request ID of a pending `exit_plan_mode.requested` event and the user's response.
 ///
 /// <div class="warning">
 ///
@@ -18656,14 +20020,14 @@ pub struct ToolsUpdateSubagentSettingsResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIElicitationArrayAnyOfFieldItemsAnyOf {
-    /// Value submitted when this option is selected.
-    pub r#const: String,
-    /// Display label for this option.
-    pub title: String,
+pub struct UIHandlePendingExitPlanModeRequest {
+    /// The unique request ID from the exit_plan_mode.requested event
+    pub request_id: RequestId,
+    /// User response for a pending exit-plan-mode request, with approval state, selected action, auto-approve flag, and feedback.
+    pub response: UIExitPlanModeResponse,
 }
 
-/// Schema applied to each item in the array.
+/// Indicates whether the pending UI request was resolved by this call.
 ///
 /// <div class="warning">
 ///
@@ -18673,12 +20037,12 @@ pub struct UIElicitationArrayAnyOfFieldItemsAnyOf {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIElicitationArrayAnyOfFieldItems {
-    /// Selectable options, each with a value and a display label.
-    pub any_of: Vec<UIElicitationArrayAnyOfFieldItemsAnyOf>,
+pub struct UIHandlePendingResult {
+    /// True if the request was still pending and was resolved by this call. False if the request ID was unknown, already resolved by another client (e.g. GitHub), expired, or otherwise no longer pending.
+    pub success: bool,
 }
 
-/// Multi-select string field where each option pairs a value with a display label.
+/// Optional sampling result payload. Omit to reject/cancel the sampling request without providing a result.
 ///
 /// <div class="warning">
 ///
@@ -18688,29 +20052,9 @@ pub struct UIElicitationArrayAnyOfFieldItems {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIElicitationArrayAnyOfField {
-    /// Default values selected when the form is first shown.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub default: Option<Vec<String>>,
-    /// Help text describing the field.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    /// Schema applied to each item in the array.
-    pub items: UIElicitationArrayAnyOfFieldItems,
-    /// Maximum number of items the user may select.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_items: Option<i64>,
-    /// Minimum number of items the user must select.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub min_items: Option<i64>,
-    /// Human-readable label for the field.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub title: Option<String>,
-    /// Type discriminator. Always "array".
-    pub r#type: UIElicitationArrayAnyOfFieldType,
-}
+pub struct UIHandlePendingSamplingResponse {}
 
-/// Schema applied to each item in the array.
+/// Request ID of a pending `sampling.requested` event and an optional sampling result payload (omit to reject).
 ///
 /// <div class="warning">
 ///
@@ -18720,14 +20064,15 @@ pub struct UIElicitationArrayAnyOfField {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIElicitationArrayEnumFieldItems {
-    /// Allowed string values for each selected item.
-    pub r#enum: Vec<String>,
-    /// Type discriminator. Always "string".
-    pub r#type: UIElicitationArrayEnumFieldItemsType,
+pub struct UIHandlePendingSamplingRequest {
+    /// The unique request ID from the sampling.requested event
+    pub request_id: RequestId,
+    /// Optional sampling result payload. Omit to reject/cancel the sampling request without providing a result.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub response: Option<UIHandlePendingSamplingResponse>,
 }
 
-/// Multi-select string field whose allowed values are defined inline.
+/// The user's selected action for an exhausted session limit.
 ///
 /// <div class="warning">
 ///
@@ -18737,29 +20082,35 @@ pub struct UIElicitationArrayEnumFieldItems {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIElicitationArrayEnumField {
-    /// Default values selected when the form is first shown.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub default: Option<Vec<String>>,
-    /// Help text describing the field.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    /// Schema applied to each item in the array.
-    pub items: UIElicitationArrayEnumFieldItems,
-    /// Maximum number of items the user may select.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_items: Option<i64>,
-    /// Minimum number of items the user must select.
+pub struct UISessionLimitsExhaustedResponse {
+    /// Action selected by the user.
+    pub action: UISessionLimitsExhaustedResponseAction,
+    /// AI Credits to add to the current max when action is 'add'.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub min_items: Option<i64>,
-    /// Human-readable label for the field.
+    pub additional_ai_credits: Option<f64>,
+    /// New absolute max AI Credits when action is 'set'.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub title: Option<String>,
-    /// Type discriminator. Always "array".
-    pub r#type: UIElicitationArrayEnumFieldType,
+    pub max_ai_credits: Option<f64>,
+}
+
+/// Request ID of a pending `session_limits_exhausted.requested` event and the user's selected limit action.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct UIHandlePendingSessionLimitsExhaustedRequest {
+    /// The unique request ID from the session_limits_exhausted.requested event
+    pub request_id: RequestId,
+    /// The selected session-limit action.
+    pub response: UISessionLimitsExhaustedResponse,
 }
 
-/// JSON Schema describing the form fields to present to the user
+/// User response for a pending user-input request, with answer text and whether it was typed freeform.
 ///
 /// <div class="warning">
 ///
@@ -18769,17 +20120,14 @@ pub struct UIElicitationArrayEnumField {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIElicitationSchema {
-    /// Form field definitions, keyed by field name
-    pub properties: HashMap<String, serde_json::Value>,
-    /// List of required field names
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub required: Option<Vec<String>>,
-    /// Schema type indicator (always 'object')
-    pub r#type: UIElicitationSchemaType,
+pub struct UIUserInputResponse {
+    /// The user's answer text
+    pub answer: String,
+    /// True if the user typed a freeform response, false if they selected a presented choice. Used by telemetry to differentiate between free text input and choice selection.
+    pub was_freeform: bool,
 }
 
-/// Prompt message and JSON schema describing the form fields to elicit from the user.
+/// Request ID of a pending `user_input.requested` event and the user's response.
 ///
 /// <div class="warning">
 ///
@@ -18789,23 +20137,14 @@ pub struct UIElicitationSchema {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIElicitationRequest {
-    /// MCP request metadata.
-    #[serde(rename = "_meta", skip_serializing_if = "Option::is_none")]
-    pub meta: Option<HashMap<String, serde_json::Value>>,
-    /// Message describing what information is needed from the user
-    pub message: String,
-    /// Elicitation mode. Omitted and form are equivalent for structured elicitation.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mode: Option<McpElicitationFormMode>,
-    /// JSON Schema describing the form fields to present to the user
-    pub requested_schema: UIElicitationSchema,
-    /// MCP task metadata.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub task: Option<McpTaskMetadata>,
+pub struct UIHandlePendingUserInputRequest {
+    /// The unique request ID from the user_input.requested event
+    pub request_id: RequestId,
+    /// User response for a pending user-input request, with answer text and whether it was typed freeform.
+    pub response: UIUserInputResponse,
 }
 
-/// The elicitation response (accept with form values, decline, or cancel)
+/// Register an in-process handler for `auto_mode_switch.requested` events. The caller still attaches the actual listener via the standard event-subscription mechanism; this registration solely tells the server bridge to skip its own dispatch (so a remote client doesn't race the in-process handler for the same requestId).
 ///
 /// <div class="warning">
 ///
@@ -18815,18 +20154,12 @@ pub struct UIElicitationRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIElicitationResponse {
-    /// MCP response metadata.
-    #[serde(rename = "_meta", skip_serializing_if = "Option::is_none")]
-    pub meta: Option<HashMap<String, serde_json::Value>>,
-    /// The user's response: accept (submitted), decline (rejected), or cancel (dismissed)
-    pub action: UIElicitationResponseAction,
-    /// The form values submitted by the user (present when action is 'accept')
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub content: Option<HashMap<String, serde_json::Value>>,
+pub struct UIRegisterDirectAutoModeSwitchHandlerResult {
+    /// Opaque handle representing the registration. Pass this same handle to `unregisterDirectAutoModeSwitchHandler` when the in-process handler is no longer active. Multiple registrations are reference-counted; the server bridge will only dispatch auto-mode-switch requests when no handles are active.
+    pub handle: String,
 }
 
-/// Indicates whether the elicitation response was accepted; false if it was already resolved by another client.
+/// Opaque handle previously returned by `registerDirectAutoModeSwitchHandler` to release.
 ///
 /// <div class="warning">
 ///
@@ -18836,12 +20169,12 @@ pub struct UIElicitationResponse {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIElicitationResult {
-    /// Whether the response was accepted. False if the request was already resolved by another client.
-    pub success: bool,
+pub struct UIUnregisterDirectAutoModeSwitchHandlerRequest {
+    /// Handle previously returned by `registerDirectAutoModeSwitchHandler`
+    pub handle: String,
 }
 
-/// Boolean field rendered as a yes/no toggle.
+/// Indicates whether the handle was active and the registration count was decremented.
 ///
 /// <div class="warning">
 ///
@@ -18851,21 +20184,30 @@ pub struct UIElicitationResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIElicitationSchemaPropertyBoolean {
-    /// Default value selected when the form is first shown.
+pub struct UIUnregisterDirectAutoModeSwitchHandlerResult {
+    /// True if the handle was active and decremented the counter; false if the handle was unknown.
+    pub unregistered: bool,
+}
+
+/// Configured per-agent subagent overrides
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct UpdateSubagentSettingsRequestSubagents {
+    /// Per-agent settings keyed by subagent agent_type
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub default: Option<bool>,
-    /// Help text describing the field.
+    pub agents: Option<HashMap<String, SubagentSettingsEntry>>,
+    /// Names of subagents the user has turned off; they cannot be dispatched
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    /// Human-readable label for the field.
+    pub disabled_subagents: Option<Vec<String>>,
+    /// Maximum number of subagents that can run concurrently; applies to usage-based billing users only
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub title: Option<String>,
-    /// Type discriminator. Always "boolean".
-    pub r#type: UIElicitationSchemaPropertyBooleanType,
+    pub max_concurrency: Option<i32>,
+    /// Maximum subagent nesting depth; applies to usage-based billing users only
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_depth: Option<i32>,
 }
 
-/// Numeric field accepting either a number or an integer.
+/// Subagent settings to apply to the current session
 ///
 /// <div class="warning">
 ///
@@ -18875,27 +20217,12 @@ pub struct UIElicitationSchemaPropertyBoolean {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIElicitationSchemaPropertyNumber {
-    /// Default value populated in the input when the form is first shown.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub default: Option<f64>,
-    /// Help text describing the field.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    /// Maximum allowed value (inclusive).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub maximum: Option<f64>,
-    /// Minimum allowed value (inclusive).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub minimum: Option<f64>,
-    /// Human-readable label for the field.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub title: Option<String>,
-    /// Numeric type accepted by the field.
-    pub r#type: UIElicitationSchemaPropertyNumberType,
+pub struct UpdateSubagentSettingsRequest {
+    /// Subagent settings to apply, or null to clear the live session override
+    pub subagents: Option<UpdateSubagentSettingsRequestSubagents>,
 }
 
-/// Free-text string field with optional length and format constraints.
+/// Request count and cost metrics for this model
 ///
 /// <div class="warning">
 ///
@@ -18905,30 +20232,14 @@ pub struct UIElicitationSchemaPropertyNumber {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIElicitationSchemaPropertyString {
-    /// Default value populated in the input when the form is first shown.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub default: Option<String>,
-    /// Help text describing the field.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    /// Optional format hint that constrains the accepted input.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub format: Option<UIElicitationSchemaPropertyStringFormat>,
-    /// Maximum number of characters allowed.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_length: Option<i64>,
-    /// Minimum number of characters required.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub min_length: Option<i64>,
-    /// Human-readable label for the field.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub title: Option<String>,
-    /// Type discriminator. Always "string".
-    pub r#type: UIElicitationSchemaPropertyStringType,
+pub struct UsageMetricsModelMetricRequests {
+    /// User-initiated premium request cost (with multiplier applied)
+    pub cost: f64,
+    /// Number of API requests made with this model
+    pub count: i64,
 }
 
-/// Single-select string field whose allowed values are defined inline.
+/// Per-model token-detail entry containing the accumulated token count for one token type.
 ///
 /// <div class="warning">
 ///
@@ -18938,26 +20249,12 @@ pub struct UIElicitationSchemaPropertyString {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIElicitationStringEnumField {
-    /// Default value selected when the form is first shown.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub default: Option<String>,
-    /// Help text describing the field.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    /// Allowed string values.
-    pub r#enum: Vec<String>,
-    /// Optional display labels for each enum value, in the same order as `enum`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub enum_names: Option<Vec<String>>,
-    /// Human-readable label for the field.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub title: Option<String>,
-    /// Type discriminator. Always "string".
-    pub r#type: UIElicitationStringEnumFieldType,
+pub struct UsageMetricsModelMetricTokenDetail {
+    /// Accumulated token count for this token type
+    pub token_count: i64,
 }
 
-/// Selectable option for a UI elicitation single-select string field, with submitted value and display label.
+/// Token usage metrics for this model
 ///
 /// <div class="warning">
 ///
@@ -18967,14 +20264,21 @@ pub struct UIElicitationStringEnumField {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIElicitationStringOneOfFieldOneOf {
-    /// Value submitted when this option is selected.
-    pub r#const: String,
-    /// Display label for this option.
-    pub title: String,
+pub struct UsageMetricsModelMetricUsage {
+    /// Total tokens read from prompt cache
+    pub cache_read_tokens: i64,
+    /// Total tokens written to prompt cache
+    pub cache_write_tokens: i64,
+    /// Total input tokens consumed
+    pub input_tokens: i64,
+    /// Total output tokens produced
+    pub output_tokens: i64,
+    /// Total output tokens used for reasoning
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reasoning_tokens: Option<i64>,
 }
 
-/// Single-select string field where each option pairs a value with a display label.
+/// Per-model usage metrics, including request counts/costs, token usage, nano-AI units, and per-token-type details.
 ///
 /// <div class="warning">
 ///
@@ -18984,23 +20288,23 @@ pub struct UIElicitationStringOneOfFieldOneOf {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIElicitationStringOneOfField {
-    /// Default value selected when the form is first shown.
+pub struct UsageMetricsModelMetric {
+    /// Latest known prompt-cache expiration for this model. A timestamp in the past indicates that the observed cache has expired.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub default: Option<String>,
-    /// Help text describing the field.
+    pub cache_expires_at: Option<String>,
+    /// Request count and cost metrics for this model
+    pub requests: UsageMetricsModelMetricRequests,
+    /// Token count details per type
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    /// Selectable options, each with a value and a display label.
-    pub one_of: Vec<UIElicitationStringOneOfFieldOneOf>,
-    /// Human-readable label for the field.
+    pub token_details: Option<HashMap<String, UsageMetricsModelMetricTokenDetail>>,
+    /// Accumulated nano-AI units cost for this model
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub title: Option<String>,
-    /// Type discriminator. Always "string".
-    pub r#type: UIElicitationStringOneOfFieldType,
+    pub total_nano_aiu: Option<f64>,
+    /// Token usage metrics for this model
+    pub usage: UsageMetricsModelMetricUsage,
 }
 
-/// Transient question to answer without adding it to conversation history.
+/// Usage attributed to one agent instance, including its identity, API duration, AI units, and per-model breakdown.
 ///
 /// <div class="warning">
 ///
@@ -19010,20 +20314,43 @@ pub struct UIElicitationStringOneOfField {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIEphemeralQueryRequest {
-    /// In-process `AbortSignal` forwarded to the model client to cancel an in-flight request. Marked internal: excluded from the public SDK surface. Replaced by an explicit cancellation token + cancel RPC in the SDK migration.
-    #[doc(hidden)]
+pub struct UsageMetricsAgentMetric {
+    /// Human-readable label for this subagent invocation, copied from the originating `subagent.started` event. For task-tool subagents this is the invocation's task description rather than the agent's configured display name, so group by `agentName` for stable per-agent labels.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub(crate) abort_signal: Option<serde_json::Value>,
-    /// In-process streaming callback `(text) => void` invoked with each token as the model emits it. Marked internal: excluded from the public SDK surface. In a process-separated SDK this is replaced by a streaming RPC that yields chunks and a final answer.
-    #[doc(hidden)]
+    pub agent_display_name: Option<String>,
+    /// Configured agent name, when this is a subagent
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub(crate) on_chunk: Option<serde_json::Value>,
-    /// Question to answer from the current conversation context.
-    pub question: String,
+    pub agent_name: Option<String>,
+    /// Per-model usage for this agent, keyed by model identifier
+    pub model_metrics: HashMap<String, UsageMetricsModelMetric>,
+    /// Time spent in model API calls by this agent, in milliseconds
+    pub total_api_duration_ms: i64,
+    /// Accumulated nano-AI units cost for this agent
+    pub total_nano_aiu: f64,
+}
+
+/// Aggregated code change metrics
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct UsageMetricsCodeChanges {
+    /// Distinct file paths modified during the session
+    pub files_modified: Vec<String>,
+    /// Number of distinct files modified
+    pub files_modified_count: i64,
+    /// Total lines of code added
+    pub lines_added: i64,
+    /// Total lines of code removed
+    pub lines_removed: i64,
 }
 
-/// Completed transient query. Ordered chunks and the terminal outcome are also delivered through `ui.ephemeral_query` session events while it runs.
+/// Session-wide token-detail entry containing the accumulated token count for one token type.
 ///
 /// <div class="warning">
 ///
@@ -19033,12 +20360,12 @@ pub struct UIEphemeralQueryRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIEphemeralQueryResult {
-    /// Answer returned by the model
-    pub answer: String,
+pub struct UsageMetricsTokenDetail {
+    /// Accumulated token count for this token type
+    pub token_count: i64,
 }
 
-/// User response for a pending exit-plan-mode request, with approval state, selected action, auto-approve flag, and feedback.
+/// Accumulated session usage metrics, including premium request cost, token counts, model breakdown, and code-change totals.
 ///
 /// <div class="warning">
 ///
@@ -19048,24 +20375,38 @@ pub struct UIEphemeralQueryResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIExitPlanModeResponse {
-    /// Whether the plan was approved.
-    pub approved: bool,
-    /// Whether subsequent edits should be auto-approved without confirmation.
+pub struct UsageGetMetricsResult {
+    /// Per-agent usage metrics, keyed by agent instance identifier. The main conversation uses the stable key `main`.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub auto_approve_edits: Option<bool>,
-    /// When true, the agent is instructed to end its turn without starting implementation so the client can restore the session model and auto-submit a fresh implementation turn on it. Set only when a distinct plan configuration (a different model, reasoning effort, or context tier) actually ran the planning turn.
+    pub agent_metrics: Option<HashMap<String, UsageMetricsAgentMetric>>,
+    /// Aggregated code change metrics
+    pub code_changes: UsageMetricsCodeChanges,
+    /// Currently active model identifier
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub defer_implementation: Option<bool>,
-    /// Feedback from the user when they declined the plan or requested changes.
+    pub current_model: Option<String>,
+    /// Input tokens from the most recent main-agent API call
+    pub last_call_input_tokens: i64,
+    /// Output tokens from the most recent main-agent API call
+    pub last_call_output_tokens: i64,
+    /// Per-model token and request metrics, keyed by model identifier
+    pub model_metrics: HashMap<String, UsageMetricsModelMetric>,
+    /// ISO 8601 timestamp when the session started
+    pub session_start_time: String,
+    /// Session-wide per-token-type accumulated token counts
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub feedback: Option<String>,
-    /// The action the user selected. Defaults to 'autopilot' when autoApproveEdits is true, otherwise 'interactive'.
+    pub token_details: Option<HashMap<String, UsageMetricsTokenDetail>>,
+    /// Total time spent in model API calls (milliseconds)
+    pub total_api_duration_ms: i64,
+    /// Session-wide accumulated nano-AI units cost
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub selected_action: Option<UIExitPlanModeAction>,
+    pub total_nano_aiu: Option<f64>,
+    /// Total user-initiated premium request cost across all models (may be fractional due to multipliers)
+    pub total_premium_request_cost: f64,
+    /// Raw count of user-initiated API requests
+    pub total_user_requests: i64,
 }
 
-/// Request ID of a pending `auto_mode_switch.requested` event and the user's response.
+/// Result of a user-requested shell command.
 ///
 /// <div class="warning">
 ///
@@ -19075,14 +20416,22 @@ pub struct UIExitPlanModeResponse {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIHandlePendingAutoModeSwitchRequest {
-    /// The unique request ID from the auto_mode_switch.requested event
-    pub request_id: RequestId,
-    /// User's choice for auto-mode switching: yes (allow this turn), yes_always (allow + persist as setting), or no (decline).
-    pub response: UIAutoModeSwitchResponse,
+pub struct UserRequestedShellCommandResult {
+    /// Error output when the execution failed
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// Process exit code, when available
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub exit_code: Option<i64>,
+    /// Captured command output
+    pub output: String,
+    /// Whether the command completed successfully
+    pub success: bool,
+    /// Tool call id emitted for the shell execution
+    pub tool_call_id: String,
 }
 
-/// Pending elicitation request ID and the user's response (accept/decline/cancel + form values).
+/// A single user setting's effective value alongside its default, so consumers can render settings left at their default.
 ///
 /// <div class="warning">
 ///
@@ -19092,14 +20441,16 @@ pub struct UIHandlePendingAutoModeSwitchRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIHandlePendingElicitationRequest {
-    /// The unique request ID from the elicitation.requested event
-    pub request_id: RequestId,
-    /// The elicitation response (accept with form values, decline, or cancel)
-    pub result: UIElicitationResponse,
+pub struct UserSettingMetadata {
+    /// The centrally-known default for this setting (null when no default is registered).
+    pub default: serde_json::Value,
+    /// True when the user has not set an explicit value for this setting (i.e. it is left at its default). Reflects whether the user has overridden the key, not whether the effective value happens to equal the default — a key explicitly set to a value identical to the default still reports false.
+    pub is_default: bool,
+    /// The effective value: the user's value if set, otherwise the default.
+    pub value: serde_json::Value,
 }
 
-/// Request ID of a pending `exit_plan_mode.requested` event and the user's response.
+/// Per-key metadata for every known user setting (settings.json overlaid with the legacy config.json, config.json wins), including settings left at their default. Excludes repository- and enterprise-managed overrides.
 ///
 /// <div class="warning">
 ///
@@ -19109,14 +20460,12 @@ pub struct UIHandlePendingElicitationRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIHandlePendingExitPlanModeRequest {
-    /// The unique request ID from the exit_plan_mode.requested event
-    pub request_id: RequestId,
-    /// User response for a pending exit-plan-mode request, with approval state, selected action, auto-approve flag, and feedback.
-    pub response: UIExitPlanModeResponse,
+pub struct UserSettingsGetResult {
+    /// Every known user setting keyed by setting name, each with its effective value, default, and whether it is at the default.
+    pub settings: HashMap<String, UserSettingMetadata>,
 }
 
-/// Indicates whether the pending UI request was resolved by this call.
+/// Partial user settings to write to settings.json. Each top-level key is written individually, replacing the existing value; a key whose value is null is removed.
 ///
 /// <div class="warning">
 ///
@@ -19126,12 +20475,12 @@ pub struct UIHandlePendingExitPlanModeRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIHandlePendingResult {
-    /// True if the request was still pending and was resolved by this call. False if the request ID was unknown, already resolved by another client (e.g. GitHub), expired, or otherwise no longer pending.
-    pub success: bool,
+pub struct UserSettingsSetRequest {
+    /// Partial user settings to write, as a free-form object keyed by setting name
+    pub settings: serde_json::Value,
 }
 
-/// Optional sampling result payload. Omit to reject/cancel the sampling request without providing a result.
+/// Outcome of writing user settings.
 ///
 /// <div class="warning">
 ///
@@ -19141,9 +20490,12 @@ pub struct UIHandlePendingResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIHandlePendingSamplingResponse {}
+pub struct UserSettingsSetResult {
+    /// Top-level keys whose write landed in settings.json but is shadowed by a value still present in the legacy config.json (config.json wins on read). The write does not take effect until the legacy value is removed.
+    pub shadowed_keys: Vec<String>,
+}
 
-/// Request ID of a pending `sampling.requested` event and an optional sampling result payload (omit to reject).
+/// Current sharing status and shareable GitHub URL for a session.
 ///
 /// <div class="warning">
 ///
@@ -19153,15 +20505,18 @@ pub struct UIHandlePendingSamplingResponse {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIHandlePendingSamplingRequest {
-    /// The unique request ID from the sampling.requested event
-    pub request_id: RequestId,
-    /// Optional sampling result payload. Omit to reject/cancel the sampling request without providing a result.
+pub struct VisibilityGetResult {
+    /// Shareable GitHub URL for the session. Present when the session is synced and the URL can be resolved.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub response: Option<UIHandlePendingSamplingResponse>,
+    pub share_url: Option<String>,
+    /// Current sharing status. Absent when the session is not synced or the status could not be retrieved (e.g. the user is not authenticated).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status: Option<SessionVisibilityStatus>,
+    /// Whether the session has been synced to Mission Control (i.e. has a GitHub task). When false, the session cannot be shared and `status`/`shareUrl` are absent.
+    pub synced: bool,
 }
 
-/// The user's selected action for an exhausted session limit.
+/// Desired sharing status for the session.
 ///
 /// <div class="warning">
 ///
@@ -19171,18 +20526,12 @@ pub struct UIHandlePendingSamplingRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UISessionLimitsExhaustedResponse {
-    /// Action selected by the user.
-    pub action: UISessionLimitsExhaustedResponseAction,
-    /// AI Credits to add to the current max when action is 'add'.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub additional_ai_credits: Option<f64>,
-    /// New absolute max AI Credits when action is 'set'.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_ai_credits: Option<f64>,
+pub struct VisibilitySetRequest {
+    /// Sharing status to apply. "repo" makes the session visible to repository readers; "unshared" restricts it to the creator and collaborators.
+    pub status: SessionVisibilityStatus,
 }
 
-/// Request ID of a pending `session_limits_exhausted.requested` event and the user's selected limit action.
+/// Effective sharing status and shareable GitHub URL after updating session visibility.
 ///
 /// <div class="warning">
 ///
@@ -19192,14 +20541,18 @@ pub struct UISessionLimitsExhaustedResponse {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIHandlePendingSessionLimitsExhaustedRequest {
-    /// The unique request ID from the session_limits_exhausted.requested event
-    pub request_id: RequestId,
-    /// The selected session-limit action.
-    pub response: UISessionLimitsExhaustedResponse,
+pub struct VisibilitySetResult {
+    /// Shareable GitHub URL for the session. Present when the session is synced and the URL can be resolved.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub share_url: Option<String>,
+    /// Effective sharing status after the update. May differ from the requested status for task types that are already visible to repository readers by default. Absent when the update could not be applied (e.g. the session is not synced or the user is not authenticated).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status: Option<SessionVisibilityStatus>,
+    /// Whether the session has been synced to Mission Control (i.e. has a GitHub task). When false, the visibility change could not be applied and `status`/`shareUrl` are absent.
+    pub synced: bool,
 }
 
-/// User response for a pending user-input request, with answer text and whether it was typed freeform.
+/// A single changed file and its unified diff.
 ///
 /// <div class="warning">
 ///
@@ -19209,14 +20562,22 @@ pub struct UIHandlePendingSessionLimitsExhaustedRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIUserInputResponse {
-    /// The user's answer text
-    pub answer: String,
-    /// True if the user typed a freeform response, false if they selected a presented choice. Used by telemetry to differentiate between free text input and choice selection.
-    pub was_freeform: bool,
+pub struct WorkspaceDiffFileChange {
+    /// Type of change represented by this file diff.
+    pub change_type: WorkspaceDiffFileChangeType,
+    /// Unified diff content for the file. Empty when the diff was truncated.
+    pub diff: String,
+    /// Whether the diff content was omitted because it exceeded the per-file size limit.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub is_truncated: Option<bool>,
+    /// Original file path for renamed files.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub old_path: Option<String>,
+    /// Path to the changed file, relative to the workspace root when the file lives under it. A file changed outside the workspace root keeps a `../`-relative path, or an absolute path when no relative path exists (for example a different Windows drive).
+    pub path: String,
 }
 
-/// Request ID of a pending `user_input.requested` event and the user's response.
+/// Workspace diff result for the requested mode.
 ///
 /// <div class="warning">
 ///
@@ -19226,14 +20587,24 @@ pub struct UIUserInputResponse {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIHandlePendingUserInputRequest {
-    /// The unique request ID from the user_input.requested event
-    pub request_id: RequestId,
-    /// User response for a pending user-input request, with answer text and whether it was typed freeform.
-    pub response: UIUserInputResponse,
+pub struct WorkspaceDiffResult {
+    /// Default branch used for a branch diff, when branch mode was requested.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub base_branch: Option<String>,
+    /// Changed files and their unified diffs.
+    pub changes: Vec<WorkspaceDiffFileChange>,
+    /// Whether the requested diff fell back to unstaged changes, either because branch diff failed or session diff was unavailable.
+    pub is_fallback: bool,
+    /// Effective mode used for the returned changes.
+    pub mode: WorkspaceDiffMode,
+    /// Diff mode requested by the client.
+    pub requested_mode: WorkspaceDiffMode,
+    /// Why the session diff could not be produced, when applicable. Set only when `session` mode was requested and `isFallback` is true, so a client can tell the permanent `file-change-tracking-disabled` apart from the transient `session-busy`, which the same request answers once the session settles. Never set for `unstaged` or `branch` mode, and never `unsupported-remote-session`: a remote session's captures live on its own host, so a `session`-mode diff is rejected for one rather than answered with a controller-side fallback.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub unavailable_reason: Option<HistoryRewindUnavailableReason>,
 }
 
-/// Register an in-process handler for `auto_mode_switch.requested` events. The caller still attaches the actual listener via the standard event-subscription mechanism; this registration solely tells the server bridge to skip its own dispatch (so a remote client doesn't race the in-process handler for the same requestId).
+/// Compaction summary checkpoint to persist.
 ///
 /// <div class="warning">
 ///
@@ -19243,12 +20614,14 @@ pub struct UIHandlePendingUserInputRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIRegisterDirectAutoModeSwitchHandlerResult {
-    /// Opaque handle representing the registration. Pass this same handle to `unregisterDirectAutoModeSwitchHandler` when the in-process handler is no longer active. Multiple registrations are reference-counted; the server bridge will only dispatch auto-mode-switch requests when no handles are active.
-    pub handle: String,
+pub struct WorkspacesAddSummaryRequest {
+    /// Markdown summary content to persist.
+    pub content: String,
+    /// Summary title shown in checkpoint listings.
+    pub title: String,
 }
 
-/// Opaque handle previously returned by `registerDirectAutoModeSwitchHandler` to release.
+/// Persisted summary metadata and refreshed workspace metadata.
 ///
 /// <div class="warning">
 ///
@@ -19258,12 +20631,16 @@ pub struct UIRegisterDirectAutoModeSwitchHandlerResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIUnregisterDirectAutoModeSwitchHandlerRequest {
-    /// Handle previously returned by `registerDirectAutoModeSwitchHandler`
-    pub handle: String,
+pub struct WorkspacesAddSummaryResult {
+    /// Metadata for the persisted summary.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub summary: Option<serde_json::Value>,
+    /// Refreshed metadata for the containing workspace.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub workspace: Option<serde_json::Value>,
 }
 
-/// Indicates whether the handle was active and the registration count was decremented.
+/// Whether the autopilot objective file exists.
 ///
 /// <div class="warning">
 ///
@@ -19273,30 +20650,31 @@ pub struct UIUnregisterDirectAutoModeSwitchHandlerRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UIUnregisterDirectAutoModeSwitchHandlerResult {
-    /// True if the handle was active and decremented the counter; false if the handle was unknown.
-    pub unregistered: bool,
+pub struct WorkspacesAutopilotObjectiveExistsResult {
+    /// True when the objective file exists.
+    pub exists: bool,
 }
 
-/// Configured per-agent subagent overrides
+/// Workspace checkpoint metadata with assigned number, human-readable title, and checkpoint filename.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UpdateSubagentSettingsRequestSubagents {
-    /// Per-agent settings keyed by subagent agent_type
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub agents: Option<HashMap<String, SubagentSettingsEntry>>,
-    /// Names of subagents the user has turned off; they cannot be dispatched
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub disabled_subagents: Option<Vec<String>>,
-    /// Maximum number of subagents that can run concurrently; applies to usage-based billing users only
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_concurrency: Option<i32>,
-    /// Maximum subagent nesting depth; applies to usage-based billing users only
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_depth: Option<i32>,
+pub struct WorkspacesCheckpoints {
+    /// Filename of the checkpoint within the workspace checkpoints directory
+    pub filename: String,
+    /// Checkpoint number assigned by the workspace manager
+    pub number: i64,
+    /// Human-readable checkpoint title
+    pub title: String,
 }
 
-/// Subagent settings to apply to the current session
+/// Relative path and UTF-8 content for the workspace file to create or overwrite.
 ///
 /// <div class="warning">
 ///
@@ -19306,12 +20684,14 @@ pub struct UpdateSubagentSettingsRequestSubagents {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UpdateSubagentSettingsRequest {
-    /// Subagent settings to apply, or null to clear the live session override
-    pub subagents: Option<UpdateSubagentSettingsRequestSubagents>,
+pub struct WorkspacesCreateFileRequest {
+    /// File content to write as a UTF-8 string
+    pub content: String,
+    /// Relative path within the workspace files directory
+    pub path: String,
 }
 
-/// Request count and cost metrics for this model
+/// Result of deleting the autopilot objective file.
 ///
 /// <div class="warning">
 ///
@@ -19321,14 +20701,12 @@ pub struct UpdateSubagentSettingsRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UsageMetricsModelMetricRequests {
-    /// User-initiated premium request cost (with multiplier applied)
-    pub cost: f64,
-    /// Number of API requests made with this model
-    pub count: i64,
+pub struct WorkspacesDeleteAutopilotObjectiveResult {
+    /// True when a file was deleted.
+    pub deleted: bool,
 }
 
-/// Per-model token-detail entry containing the accumulated token count for one token type.
+/// Parameters for computing a workspace diff.
 ///
 /// <div class="warning">
 ///
@@ -19338,12 +20716,15 @@ pub struct UsageMetricsModelMetricRequests {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UsageMetricsModelMetricTokenDetail {
-    /// Accumulated token count for this token type
-    pub token_count: i64,
+pub struct WorkspacesDiffRequest {
+    /// When true, ignore whitespace-only changes (git `--ignore-all-space`). Defaults to false.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub ignore_whitespace: Option<bool>,
+    /// Diff mode requested by the client.
+    pub mode: WorkspaceDiffMode,
 }
 
-/// Token usage metrics for this model
+/// Optional session context used when creating a local workspace.
 ///
 /// <div class="warning">
 ///
@@ -19353,21 +20734,71 @@ pub struct UsageMetricsModelMetricTokenDetail {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UsageMetricsModelMetricUsage {
-    /// Total tokens read from prompt cache
-    pub cache_read_tokens: i64,
-    /// Total tokens written to prompt cache
-    pub cache_write_tokens: i64,
-    /// Total input tokens consumed
-    pub input_tokens: i64,
-    /// Total output tokens produced
-    pub output_tokens: i64,
-    /// Total output tokens used for reasoning
+pub struct WorkspacesEnsureRequest {
+    /// Opaque workspace context supplied by the session host.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub reasoning_tokens: Option<i64>,
+    pub context: Option<serde_json::Value>,
 }
 
-/// Per-model usage metrics, including request counts/costs, token usage, nano-AI units, and per-token-type details.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct WorkspacesGetWorkspaceResultWorkspace {
+    /// Current Git branch.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub branch: Option<String>,
+    /// Whether the per-session Chronicle upgrade prompt was dismissed for the workspace.
+    #[serde(
+        rename = "chronicle_sync_dismissed",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub chronicle_sync_dismissed: Option<bool>,
+    /// Name of the client that created the workspace.
+    #[serde(rename = "client_name", skip_serializing_if = "Option::is_none")]
+    pub client_name: Option<String>,
+    /// Timestamp when the workspace was created.
+    #[serde(rename = "created_at", skip_serializing_if = "Option::is_none")]
+    pub created_at: Option<String>,
+    /// Current working directory associated with the workspace.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cwd: Option<String>,
+    /// Git repository root associated with the workspace.
+    #[serde(rename = "git_root", skip_serializing_if = "Option::is_none")]
+    pub git_root: Option<String>,
+    /// Allowed values for the `WorkspacesWorkspaceDetailsHostType` enumeration.
+    #[serde(rename = "host_type", skip_serializing_if = "Option::is_none")]
+    pub host_type: Option<WorkspacesWorkspaceDetailsHostType>,
+    /// Stable workspace identifier.
+    pub id: String,
+    /// Most recent Mission Control event identifier observed for the workspace.
+    #[serde(rename = "mc_last_event_id", skip_serializing_if = "Option::is_none")]
+    pub mc_last_event_id: Option<String>,
+    /// Mission Control session identifier associated with the workspace.
+    #[serde(rename = "mc_session_id", skip_serializing_if = "Option::is_none")]
+    pub mc_session_id: Option<String>,
+    /// Mission Control task identifier associated with the workspace.
+    #[serde(rename = "mc_task_id", skip_serializing_if = "Option::is_none")]
+    pub mc_task_id: Option<String>,
+    /// Workspace display name.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    /// Whether the workspace session can be steered remotely.
+    #[serde(rename = "remote_steerable", skip_serializing_if = "Option::is_none")]
+    pub remote_steerable: Option<bool>,
+    /// Repository identifier associated with the workspace.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub repository: Option<String>,
+    /// Number of persisted summaries in the workspace.
+    #[serde(rename = "summary_count", skip_serializing_if = "Option::is_none")]
+    pub summary_count: Option<i64>,
+    /// Timestamp when the workspace was last updated.
+    #[serde(rename = "updated_at", skip_serializing_if = "Option::is_none")]
+    pub updated_at: Option<String>,
+    /// Whether the workspace name was explicitly chosen by the user.
+    #[serde(rename = "user_named", skip_serializing_if = "Option::is_none")]
+    pub user_named: Option<bool>,
+}
+
+/// Current workspace metadata for the session, including its absolute filesystem path when available.
 ///
 /// <div class="warning">
 ///
@@ -19377,23 +20808,15 @@ pub struct UsageMetricsModelMetricUsage {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UsageMetricsModelMetric {
-    /// Latest known prompt-cache expiration for this model. A timestamp in the past indicates that the observed cache has expired.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cache_expires_at: Option<String>,
-    /// Request count and cost metrics for this model
-    pub requests: UsageMetricsModelMetricRequests,
-    /// Token count details per type
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub token_details: Option<HashMap<String, UsageMetricsModelMetricTokenDetail>>,
-    /// Accumulated nano-AI units cost for this model
+pub struct WorkspacesGetWorkspaceResult {
+    /// Absolute filesystem path to the workspace directory. Omitted when the session has no workspace (e.g. remote sessions).
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub total_nano_aiu: Option<f64>,
-    /// Token usage metrics for this model
-    pub usage: UsageMetricsModelMetricUsage,
+    pub path: Option<String>,
+    /// Current workspace metadata, or null if not available
+    pub workspace: Option<WorkspacesGetWorkspaceResultWorkspace>,
 }
 
-/// Usage attributed to one agent instance, including its identity, API duration, AI units, and per-model breakdown.
+/// Workspace checkpoints in chronological order; empty when the workspace is not enabled.
 ///
 /// <div class="warning">
 ///
@@ -19403,22 +20826,12 @@ pub struct UsageMetricsModelMetric {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UsageMetricsAgentMetric {
-    /// Human-readable label for this subagent invocation, copied from the originating `subagent.started` event. For task-tool subagents this is the invocation's task description rather than the agent's configured display name, so group by `agentName` for stable per-agent labels.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub agent_display_name: Option<String>,
-    /// Configured agent name, when this is a subagent
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub agent_name: Option<String>,
-    /// Per-model usage for this agent, keyed by model identifier
-    pub model_metrics: HashMap<String, UsageMetricsModelMetric>,
-    /// Time spent in model API calls by this agent, in milliseconds
-    pub total_api_duration_ms: i64,
-    /// Accumulated nano-AI units cost for this agent
-    pub total_nano_aiu: f64,
+pub struct WorkspacesListCheckpointsResult {
+    /// Workspace checkpoints in chronological order. Empty when workspace is not enabled.
+    pub checkpoints: Vec<WorkspacesCheckpoints>,
 }
 
-/// Aggregated code change metrics
+/// Relative paths of files stored in the session workspace files directory.
 ///
 /// <div class="warning">
 ///
@@ -19428,18 +20841,12 @@ pub struct UsageMetricsAgentMetric {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UsageMetricsCodeChanges {
-    /// Distinct file paths modified during the session
-    pub files_modified: Vec<String>,
-    /// Number of distinct files modified
-    pub files_modified_count: i64,
-    /// Total lines of code added
-    pub lines_added: i64,
-    /// Total lines of code removed
-    pub lines_removed: i64,
+pub struct WorkspacesListFilesResult {
+    /// Relative file paths in the workspace files directory
+    pub files: Vec<String>,
 }
 
-/// Session-wide token-detail entry containing the accumulated token count for one token type.
+/// Autopilot objective file content, or null when missing.
 ///
 /// <div class="warning">
 ///
@@ -19449,12 +20856,12 @@ pub struct UsageMetricsCodeChanges {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UsageMetricsTokenDetail {
-    /// Accumulated token count for this token type
-    pub token_count: i64,
+pub struct WorkspacesReadAutopilotObjectiveResult {
+    /// Autopilot objective file content, or null when missing.
+    pub content: Option<String>,
 }
 
-/// Accumulated session usage metrics, including premium request cost, token counts, model breakdown, and code-change totals.
+/// Checkpoint number to read.
 ///
 /// <div class="warning">
 ///
@@ -19464,38 +20871,12 @@ pub struct UsageMetricsTokenDetail {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UsageGetMetricsResult {
-    /// Per-agent usage metrics, keyed by agent instance identifier. The main conversation uses the stable key `main`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub agent_metrics: Option<HashMap<String, UsageMetricsAgentMetric>>,
-    /// Aggregated code change metrics
-    pub code_changes: UsageMetricsCodeChanges,
-    /// Currently active model identifier
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub current_model: Option<String>,
-    /// Input tokens from the most recent main-agent API call
-    pub last_call_input_tokens: i64,
-    /// Output tokens from the most recent main-agent API call
-    pub last_call_output_tokens: i64,
-    /// Per-model token and request metrics, keyed by model identifier
-    pub model_metrics: HashMap<String, UsageMetricsModelMetric>,
-    /// ISO 8601 timestamp when the session started
-    pub session_start_time: String,
-    /// Session-wide per-token-type accumulated token counts
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub token_details: Option<HashMap<String, UsageMetricsTokenDetail>>,
-    /// Total time spent in model API calls (milliseconds)
-    pub total_api_duration_ms: i64,
-    /// Session-wide accumulated nano-AI units cost
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub total_nano_aiu: Option<f64>,
-    /// Total user-initiated premium request cost across all models (may be fractional due to multipliers)
-    pub total_premium_request_cost: f64,
-    /// Raw count of user-initiated API requests
-    pub total_user_requests: i64,
+pub struct WorkspacesReadCheckpointRequest {
+    /// Checkpoint number to read
+    pub number: i64,
 }
 
-/// Result of a user-requested shell command.
+/// Checkpoint content as a UTF-8 string, or null when the checkpoint or workspace is missing.
 ///
 /// <div class="warning">
 ///
@@ -19505,22 +20886,12 @@ pub struct UsageGetMetricsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UserRequestedShellCommandResult {
-    /// Error output when the execution failed
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Process exit code, when available
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub exit_code: Option<i64>,
-    /// Captured command output
-    pub output: String,
-    /// Whether the command completed successfully
-    pub success: bool,
-    /// Tool call id emitted for the shell execution
-    pub tool_call_id: String,
+pub struct WorkspacesReadCheckpointResult {
+    /// Checkpoint content as a UTF-8 string, or null when the checkpoint or workspace is missing
+    pub content: Option<String>,
 }
 
-/// A single user setting's effective value alongside its default, so consumers can render settings left at their default.
+/// Relative path of the workspace file to read.
 ///
 /// <div class="warning">
 ///
@@ -19530,16 +20901,12 @@ pub struct UserRequestedShellCommandResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UserSettingMetadata {
-    /// The centrally-known default for this setting (null when no default is registered).
-    pub default: serde_json::Value,
-    /// True when the user has not set an explicit value for this setting (i.e. it is left at its default). Reflects whether the user has overridden the key, not whether the effective value happens to equal the default — a key explicitly set to a value identical to the default still reports false.
-    pub is_default: bool,
-    /// The effective value: the user's value if set, otherwise the default.
-    pub value: serde_json::Value,
+pub struct WorkspacesReadFileRequest {
+    /// Relative path within the workspace files directory
+    pub path: String,
 }
 
-/// Per-key metadata for every known user setting (settings.json overlaid with the legacy config.json, config.json wins), including settings left at their default. Excludes repository- and enterprise-managed overrides.
+/// Contents of the requested workspace file as a UTF-8 string.
 ///
 /// <div class="warning">
 ///
@@ -19549,12 +20916,12 @@ pub struct UserSettingMetadata {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UserSettingsGetResult {
-    /// Every known user setting keyed by setting name, each with its effective value, default, and whether it is at the default.
-    pub settings: HashMap<String, UserSettingMetadata>,
+pub struct WorkspacesReadFileResult {
+    /// File content as a UTF-8 string
+    pub content: String,
 }
 
-/// Partial user settings to write to settings.json. Each top-level key is written individually, replacing the existing value; a key whose value is null is removed.
+/// Pasted content to save as a UTF-8 file in the session workspace.
 ///
 /// <div class="warning">
 ///
@@ -19564,12 +20931,23 @@ pub struct UserSettingsGetResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UserSettingsSetRequest {
-    /// Partial user settings to write, as a free-form object keyed by setting name
-    pub settings: serde_json::Value,
+pub struct WorkspacesSaveLargePasteRequest {
+    /// Pasted content to save as a UTF-8 file
+    pub content: String,
 }
 
-/// Outcome of writing user settings.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct WorkspacesSaveLargePasteResultSaved {
+    /// Filename within the workspace files directory
+    pub filename: String,
+    /// Absolute filesystem path to the saved paste file
+    pub file_path: String,
+    /// Size of the saved file in bytes
+    pub size_bytes: i64,
+}
+
+/// Descriptor for the saved paste file, or null when the workspace is unavailable.
 ///
 /// <div class="warning">
 ///
@@ -19579,12 +20957,12 @@ pub struct UserSettingsSetRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct UserSettingsSetResult {
-    /// Top-level keys whose write landed in settings.json but is shadowed by a value still present in the legacy config.json (config.json wins on read). The write does not take effect until the legacy value is removed.
-    pub shadowed_keys: Vec<String>,
+pub struct WorkspacesSaveLargePasteResult {
+    /// Saved-paste descriptor, or null when the workspace is unavailable (e.g. CCA runtime, non-infinite sessions, remote sessions)
+    pub saved: Option<WorkspacesSaveLargePasteResultSaved>,
 }
 
-/// Current sharing status and shareable GitHub URL for a session.
+/// Rollback point for local workspace summaries.
 ///
 /// <div class="warning">
 ///
@@ -19594,18 +20972,12 @@ pub struct UserSettingsSetResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct VisibilityGetResult {
-    /// Shareable GitHub URL for the session. Present when the session is synced and the URL can be resolved.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub share_url: Option<String>,
-    /// Current sharing status. Absent when the session is not synced or the status could not be retrieved (e.g. the user is not authenticated).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub status: Option<SessionVisibilityStatus>,
-    /// Whether the session has been synced to Mission Control (i.e. has a GitHub task). When false, the session cannot be shared and `status`/`shareUrl` are absent.
-    pub synced: bool,
+pub struct WorkspacesTruncateSummariesRequest {
+    /// Number of newest summaries to keep.
+    pub keep_count: i64,
 }
 
-/// Desired sharing status for the session.
+/// Public-facing workspace metadata for this session, or null if the session has no associated workspace. Excludes runtime-internal fields (GitHub IDs, summary count, internal flags).
 ///
 /// <div class="warning">
 ///
@@ -19615,12 +20987,39 @@ pub struct VisibilityGetResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct VisibilitySetRequest {
-    /// Sharing status to apply. "repo" makes the session visible to repository readers; "unshared" restricts it to the creator and collaborators.
-    pub status: SessionVisibilityStatus,
+pub struct WorkspaceSummary {
+    /// Branch checked out at session start, if any
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub branch: Option<String>,
+    /// ISO 8601 timestamp when the workspace was created
+    #[serde(rename = "created_at", skip_serializing_if = "Option::is_none")]
+    pub created_at: Option<String>,
+    /// Current working directory at session start
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cwd: Option<String>,
+    /// Resolved git root for cwd, if any
+    #[serde(rename = "git_root", skip_serializing_if = "Option::is_none")]
+    pub git_root: Option<String>,
+    /// Repository host type, if known
+    #[serde(rename = "host_type", skip_serializing_if = "Option::is_none")]
+    pub host_type: Option<WorkspaceSummaryHostType>,
+    /// Workspace identifier (1:1 with sessionId)
+    pub id: String,
+    /// Display name for the session, if set
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    /// Repository identifier in 'owner/repo' or 'org/project/repo' format, if any
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub repository: Option<String>,
+    /// ISO 8601 timestamp when the workspace was last updated
+    #[serde(rename = "updated_at", skip_serializing_if = "Option::is_none")]
+    pub updated_at: Option<String>,
+    /// Whether the display name was explicitly set by the user
+    #[serde(rename = "user_named", skip_serializing_if = "Option::is_none")]
+    pub user_named: Option<bool>,
 }
 
-/// Effective sharing status and shareable GitHub URL after updating session visibility.
+/// Workspace metadata fields to update.
 ///
 /// <div class="warning">
 ///
@@ -19630,18 +21029,16 @@ pub struct VisibilitySetRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct VisibilitySetResult {
-    /// Shareable GitHub URL for the session. Present when the session is synced and the URL can be resolved.
+pub struct WorkspacesUpdateMetadataRequest {
+    /// Opaque workspace context supplied by the session host.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub share_url: Option<String>,
-    /// Effective sharing status after the update. May differ from the requested status for task types that are already visible to repository readers by default. Absent when the update could not be applied (e.g. the session is not synced or the user is not authenticated).
+    pub context: Option<serde_json::Value>,
+    /// Optional workspace display name override.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub status: Option<SessionVisibilityStatus>,
-    /// Whether the session has been synced to Mission Control (i.e. has a GitHub task). When false, the visibility change could not be applied and `status`/`shareUrl` are absent.
-    pub synced: bool,
+    pub name: Option<String>,
 }
 
-/// A single changed file and its unified diff.
+/// Autopilot objective file content to persist.
 ///
 /// <div class="warning">
 ///
@@ -19651,22 +21048,12 @@ pub struct VisibilitySetResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspaceDiffFileChange {
-    /// Type of change represented by this file diff.
-    pub change_type: WorkspaceDiffFileChangeType,
-    /// Unified diff content for the file. Empty when the diff was truncated.
-    pub diff: String,
-    /// Whether the diff content was omitted because it exceeded the per-file size limit.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub is_truncated: Option<bool>,
-    /// Original file path for renamed files.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub old_path: Option<String>,
-    /// Path to the changed file, relative to the workspace root when the file lives under it. A file changed outside the workspace root keeps a `../`-relative path, or an absolute path when no relative path exists (for example a different Windows drive).
-    pub path: String,
+pub struct WorkspacesWriteAutopilotObjectiveRequest {
+    /// Autopilot objective file content.
+    pub content: String,
 }
 
-/// Workspace diff result for the requested mode.
+/// Result of writing the autopilot objective file.
 ///
 /// <div class="warning">
 ///
@@ -19676,24 +21063,12 @@ pub struct WorkspaceDiffFileChange {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspaceDiffResult {
-    /// Default branch used for a branch diff, when branch mode was requested.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub base_branch: Option<String>,
-    /// Changed files and their unified diffs.
-    pub changes: Vec<WorkspaceDiffFileChange>,
-    /// Whether the requested diff fell back to unstaged changes, either because branch diff failed or session diff was unavailable.
-    pub is_fallback: bool,
-    /// Effective mode used for the returned changes.
-    pub mode: WorkspaceDiffMode,
-    /// Diff mode requested by the client.
-    pub requested_mode: WorkspaceDiffMode,
-    /// Why the session diff could not be produced, when applicable. Set only when `session` mode was requested and `isFallback` is true, so a client can tell the permanent `file-change-tracking-disabled` apart from the transient `session-busy`, which the same request answers once the session settles. Never set for `unstaged` or `branch` mode, and never `unsupported-remote-session`: a remote session's captures live on its own host, so a `session`-mode diff is rejected for one rather than answered with a controller-side fallback.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub unavailable_reason: Option<HistoryRewindUnavailableReason>,
+pub struct WorkspacesWriteAutopilotObjectiveResult {
+    /// Filesystem operation performed.
+    pub operation: String,
 }
 
-/// Compaction summary checkpoint to persist.
+/// List of Copilot models available to the resolved user, including capabilities and billing metadata.
 ///
 /// <div class="warning">
 ///
@@ -19703,14 +21078,12 @@ pub struct WorkspaceDiffResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesAddSummaryRequest {
-    /// Markdown summary content to persist.
-    pub content: String,
-    /// Summary title shown in checkpoint listings.
-    pub title: String,
+pub struct ModelsListResult {
+    /// List of available models with full metadata
+    pub models: Vec<Model>,
 }
 
-/// Persisted summary metadata and refreshed workspace metadata.
+/// The running runtime's complete catalog of well-known built-in model IDs, including supported models and additional IDs with built-in metadata.
 ///
 /// <div class="warning">
 ///
@@ -19720,16 +21093,12 @@ pub struct WorkspacesAddSummaryRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesAddSummaryResult {
-    /// Metadata for the persisted summary.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub summary: Option<serde_json::Value>,
-    /// Refreshed metadata for the containing workspace.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub workspace: Option<serde_json::Value>,
+pub struct ModelsGetBuiltInCatalogResult {
+    /// Built-in model entries.
+    pub models: Vec<BuiltInModelCatalogEntry>,
 }
 
-/// Whether the autopilot objective file exists.
+/// Built-in tools available for the requested model, with their parameters and instructions.
 ///
 /// <div class="warning">
 ///
@@ -19739,12 +21108,12 @@ pub struct WorkspacesAddSummaryResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesAutopilotObjectiveExistsResult {
-    /// True when the objective file exists.
-    pub exists: bool,
+pub struct ToolsListResult {
+    /// List of available built-in tools with metadata
+    pub tools: Vec<Tool>,
 }
 
-/// Workspace checkpoint metadata with assigned number, human-readable title, and checkpoint filename.
+/// User-configured MCP servers, keyed by server name.
 ///
 /// <div class="warning">
 ///
@@ -19754,16 +21123,12 @@ pub struct WorkspacesAutopilotObjectiveExistsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesCheckpoints {
-    /// Filename of the checkpoint within the workspace checkpoints directory
-    pub filename: String,
-    /// Checkpoint number assigned by the workspace manager
-    pub number: i64,
-    /// Human-readable checkpoint title
-    pub title: String,
+pub struct McpConfigListResult {
+    /// All MCP servers from user config, keyed by name
+    pub servers: HashMap<String, serde_json::Value>,
 }
 
-/// Relative path and UTF-8 content for the workspace file to create or overwrite.
+/// Extensions discovered from persisted Copilot home state and their effective loading mode. Launch-scoped additional plugins are not included.
 ///
 /// <div class="warning">
 ///
@@ -19773,14 +21138,14 @@ pub struct WorkspacesCheckpoints {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesCreateFileRequest {
-    /// File content to write as a UTF-8 string
-    pub content: String,
-    /// Relative path within the workspace files directory
-    pub path: String,
+pub struct ExtensionsDiscoverResult {
+    /// Discovered user and enabled installed-plugin extensions from persisted Copilot home state
+    pub extensions: Vec<DiscoveredExtension>,
+    /// Effective extension loading mode. Defaults to load_and_augment when unset.
+    pub mode: DiscoveredExtensionMode,
 }
 
-/// Result of deleting the autopilot objective file.
+/// Plugins installed in user/global state.
 ///
 /// <div class="warning">
 ///
@@ -19790,12 +21155,12 @@ pub struct WorkspacesCreateFileRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesDeleteAutopilotObjectiveResult {
-    /// True when a file was deleted.
-    pub deleted: bool,
+pub struct PluginsListResult {
+    /// Installed plugins
+    pub plugins: Vec<InstalledPluginInfo>,
 }
 
-/// Parameters for computing a workspace diff.
+/// Result of installing a plugin.
 ///
 /// <div class="warning">
 ///
@@ -19805,15 +21170,20 @@ pub struct WorkspacesDeleteAutopilotObjectiveResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesDiffRequest {
-    /// When true, ignore whitespace-only changes (git `--ignore-all-space`). Defaults to false.
+pub struct PluginsInstallResult {
+    /// Set when the install path is deprecated (e.g. direct repo / URL / local installs). Callers should surface this to end users.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub ignore_whitespace: Option<bool>,
-    /// Diff mode requested by the client.
-    pub mode: WorkspaceDiffMode,
+    pub deprecation_warning: Option<String>,
+    /// The newly installed plugin's metadata
+    pub plugin: InstalledPluginInfo,
+    /// Optional post-install message provided by the plugin (e.g. setup instructions)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub post_install_message: Option<String>,
+    /// Number of skills discovered and installed from the plugin
+    pub skills_installed: i64,
 }
 
-/// Optional session context used when creating a local workspace.
+/// Result of updating a single plugin.
 ///
 /// <div class="warning">
 ///
@@ -19823,71 +21193,33 @@ pub struct WorkspacesDiffRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesEnsureRequest {
-    /// Opaque workspace context supplied by the session host.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub context: Option<serde_json::Value>,
-}
-
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct WorkspacesGetWorkspaceResultWorkspace {
-    /// Current Git branch.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub branch: Option<String>,
-    /// Whether the per-session Chronicle upgrade prompt was dismissed for the workspace.
-    #[serde(
-        rename = "chronicle_sync_dismissed",
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub chronicle_sync_dismissed: Option<bool>,
-    /// Name of the client that created the workspace.
-    #[serde(rename = "client_name", skip_serializing_if = "Option::is_none")]
-    pub client_name: Option<String>,
-    /// Timestamp when the workspace was created.
-    #[serde(rename = "created_at", skip_serializing_if = "Option::is_none")]
-    pub created_at: Option<String>,
-    /// Current working directory associated with the workspace.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cwd: Option<String>,
-    /// Git repository root associated with the workspace.
-    #[serde(rename = "git_root", skip_serializing_if = "Option::is_none")]
-    pub git_root: Option<String>,
-    /// Allowed values for the `WorkspacesWorkspaceDetailsHostType` enumeration.
-    #[serde(rename = "host_type", skip_serializing_if = "Option::is_none")]
-    pub host_type: Option<WorkspacesWorkspaceDetailsHostType>,
-    /// Stable workspace identifier.
-    pub id: String,
-    /// Most recent Mission Control event identifier observed for the workspace.
-    #[serde(rename = "mc_last_event_id", skip_serializing_if = "Option::is_none")]
-    pub mc_last_event_id: Option<String>,
-    /// Mission Control session identifier associated with the workspace.
-    #[serde(rename = "mc_session_id", skip_serializing_if = "Option::is_none")]
-    pub mc_session_id: Option<String>,
-    /// Mission Control task identifier associated with the workspace.
-    #[serde(rename = "mc_task_id", skip_serializing_if = "Option::is_none")]
-    pub mc_task_id: Option<String>,
-    /// Workspace display name.
+pub struct PluginsUpdateResult {
+    /// Version after the update, when reported by the plugin manifest
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    /// Whether the workspace session can be steered remotely.
-    #[serde(rename = "remote_steerable", skip_serializing_if = "Option::is_none")]
-    pub remote_steerable: Option<bool>,
-    /// Repository identifier associated with the workspace.
+    pub new_version: Option<String>,
+    /// Version that was previously installed, when available
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub repository: Option<String>,
-    /// Number of persisted summaries in the workspace.
-    #[serde(rename = "summary_count", skip_serializing_if = "Option::is_none")]
-    pub summary_count: Option<i64>,
-    /// Timestamp when the workspace was last updated.
-    #[serde(rename = "updated_at", skip_serializing_if = "Option::is_none")]
-    pub updated_at: Option<String>,
-    /// Whether the workspace name was explicitly chosen by the user.
-    #[serde(rename = "user_named", skip_serializing_if = "Option::is_none")]
-    pub user_named: Option<bool>,
+    pub previous_version: Option<String>,
+    /// Number of skills discovered and installed after the update
+    pub skills_installed: i64,
+}
+
+/// Result of updating all installed plugins.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PluginsUpdateAllResult {
+    /// Per-plugin update results in deterministic order.
+    pub results: Vec<PluginUpdateAllEntry>,
 }
 
-/// Current workspace metadata for the session, including its absolute filesystem path when available.
+/// All registered marketplaces, including built-in defaults.
 ///
 /// <div class="warning">
 ///
@@ -19897,15 +21229,12 @@ pub struct WorkspacesGetWorkspaceResultWorkspace {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesGetWorkspaceResult {
-    /// Absolute filesystem path to the workspace directory. Omitted when the session has no workspace (e.g. remote sessions).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub path: Option<String>,
-    /// Current workspace metadata, or null if not available
-    pub workspace: Option<WorkspacesGetWorkspaceResultWorkspace>,
+pub struct PluginsMarketplacesListResult {
+    /// Registered marketplaces
+    pub marketplaces: Vec<MarketplaceInfo>,
 }
 
-/// Workspace checkpoints in chronological order; empty when the workspace is not enabled.
+/// Result of registering a new marketplace.
 ///
 /// <div class="warning">
 ///
@@ -19915,12 +21244,12 @@ pub struct WorkspacesGetWorkspaceResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesListCheckpointsResult {
-    /// Workspace checkpoints in chronological order. Empty when workspace is not enabled.
-    pub checkpoints: Vec<WorkspacesCheckpoints>,
+pub struct PluginsMarketplacesAddResult {
+    /// Final name of the marketplace as resolved from its manifest
+    pub name: String,
 }
 
-/// Relative paths of files stored in the session workspace files directory.
+/// Outcome of the remove attempt, including dependent-plugin info when applicable.
 ///
 /// <div class="warning">
 ///
@@ -19930,12 +21259,15 @@ pub struct WorkspacesListCheckpointsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesListFilesResult {
-    /// Relative file paths in the workspace files directory
-    pub files: Vec<String>,
+pub struct PluginsMarketplacesRemoveResult {
+    /// Names of installed plugins that prevented removal. Populated only when `removed=false`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub dependent_plugins: Option<Vec<String>>,
+    /// True when the marketplace was actually removed. False when removal was skipped because the marketplace has dependent plugins and `force` was not set.
+    pub removed: bool,
 }
 
-/// Autopilot objective file content, or null when missing.
+/// Plugins advertised by the marketplace.
 ///
 /// <div class="warning">
 ///
@@ -19945,12 +21277,12 @@ pub struct WorkspacesListFilesResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesReadAutopilotObjectiveResult {
-    /// Autopilot objective file content, or null when missing.
-    pub content: Option<String>,
+pub struct PluginsMarketplacesBrowseResult {
+    /// Plugins advertised by the marketplace
+    pub plugins: Vec<MarketplacePluginInfo>,
 }
 
-/// Checkpoint number to read.
+/// Result of refreshing one or more marketplace catalogs.
 ///
 /// <div class="warning">
 ///
@@ -19960,12 +21292,12 @@ pub struct WorkspacesReadAutopilotObjectiveResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesReadCheckpointRequest {
-    /// Checkpoint number to read
-    pub number: i64,
+pub struct PluginsMarketplacesRefreshResult {
+    /// Per-marketplace refresh results in deterministic order.
+    pub results: Vec<MarketplaceRefreshEntry>,
 }
 
-/// Checkpoint content as a UTF-8 string, or null when the checkpoint or workspace is missing.
+/// Skills discovered across global and project sources.
 ///
 /// <div class="warning">
 ///
@@ -19975,12 +21307,15 @@ pub struct WorkspacesReadCheckpointRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesReadCheckpointResult {
-    /// Checkpoint content as a UTF-8 string, or null when the checkpoint or workspace is missing
-    pub content: Option<String>,
+pub struct SkillsDiscoverResult {
+    /// Messages for skills that failed to load (e.g. malformed SKILL.md). Empty when host skills are excluded so host-local paths are not disclosed to multitenant callers.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub errors: Option<Vec<String>>,
+    /// All discovered skills across all sources
+    pub skills: Vec<ServerSkill>,
 }
 
-/// Relative path of the workspace file to read.
+/// Canonical locations where skills can be created so the runtime will recognize them.
 ///
 /// <div class="warning">
 ///
@@ -19990,12 +21325,12 @@ pub struct WorkspacesReadCheckpointResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesReadFileRequest {
-    /// Relative path within the workspace files directory
-    pub path: String,
+pub struct SkillsGetDiscoveryPathsResult {
+    /// Canonical skill create/discovery directories, in priority order
+    pub paths: Vec<SkillDiscoveryPath>,
 }
 
-/// Contents of the requested workspace file as a UTF-8 string.
+/// Agents discovered across user, project, plugin, and remote sources.
 ///
 /// <div class="warning">
 ///
@@ -20005,12 +21340,12 @@ pub struct WorkspacesReadFileRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesReadFileResult {
-    /// File content as a UTF-8 string
-    pub content: String,
+pub struct AgentsDiscoverResult {
+    /// All discovered agents across all sources
+    pub agents: Vec<AgentInfo>,
 }
 
-/// Pasted content to save as a UTF-8 file in the session workspace.
+/// Canonical locations where custom agents can be created so the runtime will recognize them.
 ///
 /// <div class="warning">
 ///
@@ -20020,23 +21355,27 @@ pub struct WorkspacesReadFileResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesSaveLargePasteRequest {
-    /// Pasted content to save as a UTF-8 file
-    pub content: String,
+pub struct AgentsGetDiscoveryPathsResult {
+    /// Canonical agent create/discovery directories, in priority order
+    pub paths: Vec<AgentDiscoveryPath>,
 }
 
+/// Instruction sources discovered across user, repository, and plugin sources.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesSaveLargePasteResultSaved {
-    /// Filename within the workspace files directory
-    pub filename: String,
-    /// Absolute filesystem path to the saved paste file
-    pub file_path: String,
-    /// Size of the saved file in bytes
-    pub size_bytes: i64,
+pub struct InstructionsDiscoverResult {
+    /// All discovered instruction sources
+    pub sources: Vec<InstructionSource>,
 }
 
-/// Descriptor for the saved paste file, or null when the workspace is unavailable.
+/// Canonical files and directories where custom instructions can be created so the runtime will recognize them.
 ///
 /// <div class="warning">
 ///
@@ -20046,12 +21385,12 @@ pub struct WorkspacesSaveLargePasteResultSaved {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesSaveLargePasteResult {
-    /// Saved-paste descriptor, or null when the workspace is unavailable (e.g. CCA runtime, non-infinite sessions, remote sessions)
-    pub saved: Option<WorkspacesSaveLargePasteResultSaved>,
+pub struct InstructionsGetDiscoveryPathsResult {
+    /// Canonical instruction create/discovery files and directories, in priority order
+    pub paths: Vec<InstructionDiscoveryPath>,
 }
 
-/// Rollback point for local workspace summaries.
+/// Slash commands available in the session, after applying any include/exclude filters.
 ///
 /// <div class="warning">
 ///
@@ -20061,12 +21400,12 @@ pub struct WorkspacesSaveLargePasteResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesTruncateSummariesRequest {
-    /// Number of newest summaries to keep.
-    pub keep_count: i64,
+pub struct CommandsListResult {
+    /// Commands available in this session
+    pub commands: Vec<SlashCommandInfo>,
 }
 
-/// Public-facing workspace metadata for this session, or null if the session has no associated workspace. Excludes runtime-internal fields (GitHub IDs, summary count, internal flags).
+/// Result of opening a session.
 ///
 /// <div class="warning">
 ///
@@ -20076,39 +21415,31 @@ pub struct WorkspacesTruncateSummariesRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspaceSummary {
-    /// Branch checked out at session start, if any
+pub struct SessionsOpenResult {
+    /// Remote session metadata, present when status is `connected`.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub branch: Option<String>,
-    /// ISO 8601 timestamp when the workspace was created
-    #[serde(rename = "created_at", skip_serializing_if = "Option::is_none")]
-    pub created_at: Option<String>,
-    /// Current working directory at session start
+    pub metadata: Option<RemoteSessionMetadataValue>,
+    /// Handoff progress steps, present when status is `handed_off`.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub cwd: Option<String>,
-    /// Resolved git root for cwd, if any
-    #[serde(rename = "git_root", skip_serializing_if = "Option::is_none")]
-    pub git_root: Option<String>,
-    /// Repository host type, if known
-    #[serde(rename = "host_type", skip_serializing_if = "Option::is_none")]
-    pub host_type: Option<WorkspaceSummaryHostType>,
-    /// Workspace identifier (1:1 with sessionId)
-    pub id: String,
-    /// Display name for the session, if set
+    pub progress: Option<Vec<SessionsOpenProgress>>,
+    /// Remote session ID, present when status is `connected`.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    /// Repository identifier in 'owner/repo' or 'org/project/repo' format, if any
+    pub remote_session_id: Option<SessionId>,
+    /// In-process SessionClientApi handle for the opened session, returned to CLI callers as a transitional shortcut. Marked internal so the public SDK surface does not expose it; SDK consumers should construct per-session clients from `sessionId` instead.
+    #[doc(hidden)]
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub repository: Option<String>,
-    /// ISO 8601 timestamp when the workspace was last updated
-    #[serde(rename = "updated_at", skip_serializing_if = "Option::is_none")]
-    pub updated_at: Option<String>,
-    /// Whether the display name was explicitly set by the user
-    #[serde(rename = "user_named", skip_serializing_if = "Option::is_none")]
-    pub user_named: Option<bool>,
+    pub(crate) session_api: Option<serde_json::Value>,
+    /// Opened session ID. Omitted when status is `not_found`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub session_id: Option<SessionId>,
+    /// Startup prompts queued by user-level hook configs at session creation. Only populated when status is `created`; resumed sessions return an empty array.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub startup_prompts: Option<Vec<String>>,
+    /// Outcome of the open request.
+    pub status: SessionsOpenStatus,
 }
 
-/// Workspace metadata fields to update.
+/// Remote session connection result.
 ///
 /// <div class="warning">
 ///
@@ -20118,16 +21449,14 @@ pub struct WorkspaceSummary {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesUpdateMetadataRequest {
-    /// Opaque workspace context supplied by the session host.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub context: Option<serde_json::Value>,
-    /// Optional workspace display name override.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
+pub struct SessionsConnectResult {
+    /// Metadata for a connected remote session.
+    pub metadata: ConnectedRemoteSessionMetadata,
+    /// SDK session ID for the connected remote session.
+    pub session_id: SessionId,
 }
 
-/// Autopilot objective file content to persist.
+/// Sessions matching the filter, ordered most-recently-modified first.
 ///
 /// <div class="warning">
 ///
@@ -20137,12 +21466,12 @@ pub struct WorkspacesUpdateMetadataRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesWriteAutopilotObjectiveRequest {
-    /// Autopilot objective file content.
-    pub content: String,
+pub struct SessionsListResult {
+    /// Sessions ordered most-recently-modified first. Discriminated by `isRemote`.
+    pub sessions: Vec<serde_json::Value>,
 }
 
-/// Result of writing the autopilot objective file.
+/// ID of the local session bound to the given GitHub task, or omitted when none.
 ///
 /// <div class="warning">
 ///
@@ -20152,12 +21481,13 @@ pub struct WorkspacesWriteAutopilotObjectiveRequest {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct WorkspacesWriteAutopilotObjectiveResult {
-    /// Filesystem operation performed.
-    pub operation: String,
+pub struct SessionsFindByTaskIdResult {
+    /// Omitted when no local session is bound to that GitHub task
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub session_id: Option<SessionId>,
 }
 
-/// List of Copilot models available to the resolved user, including capabilities and billing metadata.
+/// Map of sessionId -> on-disk size in bytes for each session's workspace directory.
 ///
 /// <div class="warning">
 ///
@@ -20167,12 +21497,12 @@ pub struct WorkspacesWriteAutopilotObjectiveResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelsListResult {
-    /// List of available models with full metadata
-    pub models: Vec<Model>,
+pub struct SessionsGetSizesResult {
+    /// Map of sessionId -> on-disk size in bytes for the session's workspace directory
+    pub sizes: HashMap<String, i64>,
 }
 
-/// The running runtime's complete catalog of well-known built-in model IDs, including supported models and additional IDs with built-in metadata.
+/// Map of sessionId -> bytes freed by removing the session's workspace directory.
 ///
 /// <div class="warning">
 ///
@@ -20182,12 +21512,50 @@ pub struct ModelsListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ModelsGetBuiltInCatalogResult {
-    /// Built-in model entries.
-    pub models: Vec<BuiltInModelCatalogEntry>,
+pub struct SessionsBulkDeleteResult {
+    /// Map of sessionId -> bytes freed by removing the session's workspace directory. Sessions whose deletion failed are omitted from this map (failures are logged on the server but not surfaced per-id; check the map for absent IDs to detect them).
+    pub freed_bytes: HashMap<String, i64>,
+}
+
+/// Outcome of the prune operation: deleted IDs, dry-run candidates, skipped IDs, total bytes freed, and the dry-run flag.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionsPruneOldResult {
+    /// Session IDs that would be deleted in dry-run mode (always empty otherwise)
+    pub candidates: Vec<String>,
+    /// Session IDs that were deleted (always empty in dry-run mode)
+    pub deleted: Vec<String>,
+    /// True when no deletions were actually performed
+    pub dry_run: bool,
+    /// Total bytes freed (actual when not dry-run, projected when dry-run)
+    pub freed_bytes: i64,
+    /// Session IDs that were skipped (e.g., named sessions)
+    pub skipped: Vec<String>,
+}
+
+/// The enriched metadata records, with summary and context fields backfilled where available. Sessions confirmed empty and unnamed are omitted.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionsEnrichMetadataResult {
+    /// Enriched records, with summary and context backfilled. Sessions confirmed empty and unnamed may be omitted.
+    pub sessions: Vec<LocalSessionMetadataValue>,
 }
 
-/// Built-in tools available for the requested model, with their parameters and instructions.
+/// Queued repo-level startup prompts and the total hook command count after loading.
 ///
 /// <div class="warning">
 ///
@@ -20197,12 +21565,14 @@ pub struct ModelsGetBuiltInCatalogResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ToolsListResult {
-    /// List of available built-in tools with metadata
-    pub tools: Vec<Tool>,
+pub struct SessionsLoadDeferredRepoHooksResult {
+    /// Total hook command count (user + plugin + repo) loaded for the session by this call. Captured atomically with startupPrompts so callers don't need to read a separate counter.
+    pub hook_count: i64,
+    /// Repo-level startup prompts queued from repo hook configs. Empty on resume, when no repo configs were pending, or when disableAllHooks is set.
+    pub startup_prompts: Vec<String>,
 }
 
-/// User-configured MCP servers, keyed by server name.
+/// Wrapper for the singleton's current status.
 ///
 /// <div class="warning">
 ///
@@ -20212,12 +21582,12 @@ pub struct ToolsListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct McpConfigListResult {
-    /// All MCP servers from user config, keyed by name
-    pub servers: HashMap<String, serde_json::Value>,
+pub struct SessionsStartRemoteControlResult {
+    /// State of the runtime-managed remote-control singleton.
+    pub status: serde_json::Value,
 }
 
-/// Extensions discovered from persisted Copilot home state and their effective loading mode. Launch-scoped additional plugins are not included.
+/// Outcome of a transferRemoteControl call.
 ///
 /// <div class="warning">
 ///
@@ -20227,14 +21597,14 @@ pub struct McpConfigListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct ExtensionsDiscoverResult {
-    /// Discovered user and enabled installed-plugin extensions from persisted Copilot home state
-    pub extensions: Vec<DiscoveredExtension>,
-    /// Effective extension loading mode. Defaults to load_and_augment when unset.
-    pub mode: DiscoveredExtensionMode,
+pub struct SessionsTransferRemoteControlResult {
+    /// State of the runtime-managed remote-control singleton.
+    pub status: serde_json::Value,
+    /// Whether the rebinding actually happened.
+    pub transferred: bool,
 }
 
-/// Plugins installed in user/global state.
+/// Wrapper for the singleton's current status.
 ///
 /// <div class="warning">
 ///
@@ -20244,12 +21614,12 @@ pub struct ExtensionsDiscoverResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginsListResult {
-    /// Installed plugins
-    pub plugins: Vec<InstalledPluginInfo>,
+pub struct SessionsSetRemoteControlSteeringResult {
+    /// State of the runtime-managed remote-control singleton.
+    pub status: serde_json::Value,
 }
 
-/// Result of installing a plugin.
+/// Outcome of a stopRemoteControl call.
 ///
 /// <div class="warning">
 ///
@@ -20259,20 +21629,14 @@ pub struct PluginsListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginsInstallResult {
-    /// Set when the install path is deprecated (e.g. direct repo / URL / local installs). Callers should surface this to end users.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub deprecation_warning: Option<String>,
-    /// The newly installed plugin's metadata
-    pub plugin: InstalledPluginInfo,
-    /// Optional post-install message provided by the plugin (e.g. setup instructions)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub post_install_message: Option<String>,
-    /// Number of skills discovered and installed from the plugin
-    pub skills_installed: i64,
+pub struct SessionsStopRemoteControlResult {
+    /// State of the runtime-managed remote-control singleton.
+    pub status: serde_json::Value,
+    /// Whether the singleton was actually torn down by this call.
+    pub stopped: bool,
 }
 
-/// Result of updating a single plugin.
+/// Wrapper for the singleton's current status.
 ///
 /// <div class="warning">
 ///
@@ -20282,18 +21646,12 @@ pub struct PluginsInstallResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginsUpdateResult {
-    /// Version after the update, when reported by the plugin manifest
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub new_version: Option<String>,
-    /// Version that was previously installed, when available
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub previous_version: Option<String>,
-    /// Number of skills discovered and installed after the update
-    pub skills_installed: i64,
+pub struct SessionsGetRemoteControlStatusResult {
+    /// State of the runtime-managed remote-control singleton.
+    pub status: serde_json::Value,
 }
 
-/// Result of updating all installed plugins.
+/// Handle for releasing the extension tool registration.
 ///
 /// <div class="warning">
 ///
@@ -20303,12 +21661,13 @@ pub struct PluginsUpdateResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginsUpdateAllResult {
-    /// Per-plugin update results in deterministic order.
-    pub results: Vec<PluginUpdateAllEntry>,
+pub(crate) struct SessionsRegisterExtensionToolsOnSessionResult {
+    /// In-process unsubscribe function (CLI-only optimization). Marked internal: replaced by an explicit `extensions.unregister` RPC in the SDK migration.
+    #[doc(hidden)]
+    pub(crate) unsubscribe: serde_json::Value,
 }
 
-/// All registered marketplaces, including built-in defaults.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -20318,12 +21677,12 @@ pub struct PluginsUpdateAllResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginsMarketplacesListResult {
-    /// Registered marketplaces
-    pub marketplaces: Vec<MarketplaceInfo>,
+pub struct SessionSuspendParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Result of registering a new marketplace.
+/// Result of sending a user message
 ///
 /// <div class="warning">
 ///
@@ -20333,12 +21692,12 @@ pub struct PluginsMarketplacesListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginsMarketplacesAddResult {
-    /// Final name of the marketplace as resolved from its manifest
-    pub name: String,
+pub struct SessionSendResult {
+    /// Unique identifier assigned to the message
+    pub message_id: String,
 }
 
-/// Outcome of the remove attempt, including dependent-plugin info when applicable.
+/// Result of sending zero or more user messages
 ///
 /// <div class="warning">
 ///
@@ -20348,15 +21707,12 @@ pub struct PluginsMarketplacesAddResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginsMarketplacesRemoveResult {
-    /// Names of installed plugins that prevented removal. Populated only when `removed=false`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub dependent_plugins: Option<Vec<String>>,
-    /// True when the marketplace was actually removed. False when removal was skipped because the marketplace has dependent plugins and `force` was not set.
-    pub removed: bool,
+pub struct SessionSendMessagesResult {
+    /// Unique identifiers assigned to the messages, one per provided message in order. Empty when no messages were provided.
+    pub message_ids: Vec<String>,
 }
 
-/// Plugins advertised by the marketplace.
+/// Result of aborting the current turn
 ///
 /// <div class="warning">
 ///
@@ -20366,12 +21722,15 @@ pub struct PluginsMarketplacesRemoveResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginsMarketplacesBrowseResult {
-    /// Plugins advertised by the marketplace
-    pub plugins: Vec<MarketplacePluginInfo>,
+pub struct SessionAbortResult {
+    /// Error message if the abort failed
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// Whether the abort completed successfully
+    pub success: bool,
 }
 
-/// Result of refreshing one or more marketplace catalogs.
+/// Result of interrupting the main agent turn.
 ///
 /// <div class="warning">
 ///
@@ -20381,12 +21740,12 @@ pub struct PluginsMarketplacesBrowseResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PluginsMarketplacesRefreshResult {
-    /// Per-marketplace refresh results in deterministic order.
-    pub results: Vec<MarketplaceRefreshEntry>,
+pub struct SessionInterruptMainTurnResult {
+    /// Whether an in-flight main agent turn was interrupted. False when the main loop was not processing.
+    pub interrupted: bool,
 }
 
-/// Skills discovered across global and project sources.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -20396,15 +21755,12 @@ pub struct PluginsMarketplacesRefreshResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SkillsDiscoverResult {
-    /// Messages for skills that failed to load (e.g. malformed SKILL.md). Empty when host skills are excluded so host-local paths are not disclosed to multitenant callers.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub errors: Option<Vec<String>>,
-    /// All discovered skills across all sources
-    pub skills: Vec<ServerSkill>,
+pub struct SessionCancelAllBackgroundAgentsParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Canonical locations where skills can be created so the runtime will recognize them.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -20414,12 +21770,12 @@ pub struct SkillsDiscoverResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SkillsGetDiscoveryPathsResult {
-    /// Canonical skill create/discovery directories, in priority order
-    pub paths: Vec<SkillDiscoveryPath>,
+pub struct SessionGitHubAuthGetStatusParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Agents discovered across user, project, plugin, and remote sources.
+/// Authentication status and account metadata for the session.
 ///
 /// <div class="warning">
 ///
@@ -20429,12 +21785,27 @@ pub struct SkillsGetDiscoveryPathsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct AgentsDiscoverResult {
-    /// All discovered agents across all sources
-    pub agents: Vec<AgentInfo>,
+pub struct SessionGitHubAuthGetStatusResult {
+    /// Authentication type
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub auth_type: Option<AuthInfoType>,
+    /// Copilot plan tier (e.g., individual_pro, business)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub copilot_plan: Option<String>,
+    /// Authentication host URL
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub host: Option<String>,
+    /// Whether the session has resolved authentication
+    pub is_authenticated: bool,
+    /// Authenticated login/username, if available
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub login: Option<String>,
+    /// Human-readable authentication status description
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status_message: Option<String>,
 }
 
-/// Canonical locations where custom agents can be created so the runtime will recognize them.
+/// Indicates whether the credential update succeeded.
 ///
 /// <div class="warning">
 ///
@@ -20444,12 +21815,15 @@ pub struct AgentsDiscoverResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct AgentsGetDiscoveryPathsResult {
-    /// Canonical agent create/discovery directories, in priority order
-    pub paths: Vec<AgentDiscoveryPath>,
+pub struct SessionGitHubAuthSetCredentialsResult {
+    /// Whether the session ended up with a populated `copilotUser` for the installed credentials. `true` when the supplied credential already carried `copilotUser` or it was successfully re-resolved server-side. `false` when the credential is installed without `copilotUser` — either re-resolution failed, or the variant cannot be re-resolved from the credential alone (only the raw-token variants `token`, `env`, and `gh-cli` can). In both `false` cases the token swap still applied, but plan/quota/billing metadata is degraded. Present whenever a credential was supplied; omitted only when no credential was supplied (no-op call).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub copilot_user_resolved: Option<bool>,
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// Instruction sources discovered across user, repository, and plugin sources.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -20459,12 +21833,12 @@ pub struct AgentsGetDiscoveryPathsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct InstructionsDiscoverResult {
-    /// All discovered instruction sources
-    pub sources: Vec<InstructionSource>,
+pub struct SessionGitHubAuthGetCurrentAuthInfoParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Canonical files and directories where custom instructions can be created so the runtime will recognize them.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -20474,12 +21848,12 @@ pub struct InstructionsDiscoverResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct InstructionsGetDiscoveryPathsResult {
-    /// Canonical instruction create/discovery files and directories, in priority order
-    pub paths: Vec<InstructionDiscoveryPath>,
+pub struct SessionGitHubAuthGetAllAuthAvailableParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Slash commands available in the session, after applying any include/exclude filters.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -20489,12 +21863,12 @@ pub struct InstructionsGetDiscoveryPathsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct CommandsListResult {
-    /// Commands available in this session
-    pub commands: Vec<SlashCommandInfo>,
+pub struct SessionGitHubAuthRefreshCopilotUserParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Result of opening a session.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -20504,31 +21878,12 @@ pub struct CommandsListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsOpenResult {
-    /// Remote session metadata, present when status is `connected`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub metadata: Option<RemoteSessionMetadataValue>,
-    /// Handoff progress steps, present when status is `handed_off`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub progress: Option<Vec<SessionsOpenProgress>>,
-    /// Remote session ID, present when status is `connected`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub remote_session_id: Option<SessionId>,
-    /// In-process SessionClientApi handle for the opened session, returned to CLI callers as a transitional shortcut. Marked internal so the public SDK surface does not expose it; SDK consumers should construct per-session clients from `sessionId` instead.
-    #[doc(hidden)]
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub(crate) session_api: Option<serde_json::Value>,
-    /// Opened session ID. Omitted when status is `not_found`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub session_id: Option<SessionId>,
-    /// Startup prompts queued by user-level hook configs at session creation. Only populated when status is `created`; resumed sessions return an empty array.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub startup_prompts: Option<Vec<String>>,
-    /// Outcome of the open request.
-    pub status: SessionsOpenStatus,
+pub struct SessionGitHubAuthLogoutParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Remote session connection result.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -20538,14 +21893,12 @@ pub struct SessionsOpenResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsConnectResult {
-    /// Metadata for a connected remote session.
-    pub metadata: ConnectedRemoteSessionMetadata,
-    /// SDK session ID for the connected remote session.
+pub struct SessionGitHubAuthLastAuthErrorsParams {
+    /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Sessions matching the filter, ordered most-recently-modified first.
+/// Result of collecting a redacted debug bundle.
 ///
 /// <div class="warning">
 ///
@@ -20555,12 +21908,19 @@ pub struct SessionsConnectResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsListResult {
-    /// Sessions ordered most-recently-modified first. Discriminated by `isRemote`.
-    pub sessions: Vec<serde_json::Value>,
+pub struct SessionDebugCollectLogsResult {
+    /// Files included in the redacted bundle.
+    pub entries: Vec<DebugCollectLogsCollectedEntry>,
+    /// Destination kind that was written.
+    pub kind: DebugCollectLogsResultKind,
+    /// Actual archive path or staging directory path written. This may differ from the requested path when no-overwrite suffixing or fallback-to-temp-directory was needed.
+    pub path: String,
+    /// Optional files or directories that could not be included.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub skipped_entries: Option<Vec<DebugCollectLogsSkippedEntry>>,
 }
 
-/// ID of the local session bound to the given GitHub task, or omitted when none.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -20570,13 +21930,12 @@ pub struct SessionsListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsFindByTaskIdResult {
-    /// Omitted when no local session is bound to that GitHub task
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub session_id: Option<SessionId>,
+pub struct SessionCanvasListParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Map of sessionId -> on-disk size in bytes for each session's workspace directory.
+/// Declared canvases available in this session.
 ///
 /// <div class="warning">
 ///
@@ -20586,12 +21945,12 @@ pub struct SessionsFindByTaskIdResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsGetSizesResult {
-    /// Map of sessionId -> on-disk size in bytes for the session's workspace directory
-    pub sizes: HashMap<String, i64>,
+pub struct SessionCanvasListResult {
+    /// Declared canvases available in this session
+    pub canvases: Vec<DiscoveredCanvas>,
 }
 
-/// Map of sessionId -> bytes freed by removing the session's workspace directory.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -20601,12 +21960,12 @@ pub struct SessionsGetSizesResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsBulkDeleteResult {
-    /// Map of sessionId -> bytes freed by removing the session's workspace directory. Sessions whose deletion failed are omitted from this map (failures are logged on the server but not surfaced per-id; check the map for absent IDs to detect them).
-    pub freed_bytes: HashMap<String, i64>,
+pub struct SessionCanvasListOpenParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Outcome of the prune operation: deleted IDs, dry-run candidates, skipped IDs, total bytes freed, and the dry-run flag.
+/// Live open-canvas snapshot.
 ///
 /// <div class="warning">
 ///
@@ -20616,20 +21975,12 @@ pub struct SessionsBulkDeleteResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsPruneOldResult {
-    /// Session IDs that would be deleted in dry-run mode (always empty otherwise)
-    pub candidates: Vec<String>,
-    /// Session IDs that were deleted (always empty in dry-run mode)
-    pub deleted: Vec<String>,
-    /// True when no deletions were actually performed
-    pub dry_run: bool,
-    /// Total bytes freed (actual when not dry-run, projected when dry-run)
-    pub freed_bytes: i64,
-    /// Session IDs that were skipped (e.g., named sessions)
-    pub skipped: Vec<String>,
+pub struct SessionCanvasListOpenResult {
+    /// Currently open canvas instances
+    pub open_canvases: Vec<OpenCanvasInstance>,
 }
 
-/// The enriched metadata records, with summary and context fields backfilled where available. Sessions confirmed empty and unnamed are omitted.
+/// Open canvas instance snapshot.
 ///
 /// <div class="warning">
 ///
@@ -20639,12 +21990,34 @@ pub struct SessionsPruneOldResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsEnrichMetadataResult {
-    /// Enriched records, with summary and context backfilled. Sessions confirmed empty and unnamed may be omitted.
-    pub sessions: Vec<LocalSessionMetadataValue>,
+pub struct SessionCanvasOpenResult {
+    /// Provider-local canvas identifier
+    pub canvas_id: String,
+    /// Owning provider identifier
+    pub extension_id: String,
+    /// Owning extension display name, when available
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub extension_name: Option<String>,
+    /// Host-local PNG path for the canvas icon, when supplied
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub icon: Option<String>,
+    /// Input supplied when the instance was opened
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input: Option<serde_json::Value>,
+    /// Stable caller-supplied canvas instance identifier
+    pub instance_id: String,
+    /// Provider-supplied status text
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status: Option<String>,
+    /// Rendered title
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub title: Option<String>,
+    /// URL for web-rendered canvases
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub url: Option<String>,
 }
 
-/// Queued repo-level startup prompts and the total hook command count after loading.
+/// Canvas action invocation result.
 ///
 /// <div class="warning">
 ///
@@ -20654,14 +22027,13 @@ pub struct SessionsEnrichMetadataResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsLoadDeferredRepoHooksResult {
-    /// Total hook command count (user + plugin + repo) loaded for the session by this call. Captured atomically with startupPrompts so callers don't need to read a separate counter.
-    pub hook_count: i64,
-    /// Repo-level startup prompts queued from repo hook configs. Empty on resume, when no repo configs were pending, or when disableAllHooks is set.
-    pub startup_prompts: Vec<String>,
+pub struct SessionCanvasActionInvokeResult {
+    /// Provider-supplied action result
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub result: Option<serde_json::Value>,
 }
 
-/// Wrapper for the singleton's current status.
+/// Complete current or terminal factory run envelope.
 ///
 /// <div class="warning">
 ///
@@ -20671,12 +22043,29 @@ pub struct SessionsLoadDeferredRepoHooksResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsStartRemoteControlResult {
-    /// State of the runtime-managed remote-control singleton.
-    pub status: serde_json::Value,
+pub struct SessionFactoryRunResult {
+    /// Error message for an errored run.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// Machine-readable failure details for an errored run.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub failure: Option<serde_json::Value>,
+    /// Reason for a halted or cancelled run.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reason: Option<String>,
+    /// Completed factory result.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub result: Option<serde_json::Value>,
+    /// Factory run identifier.
+    pub run_id: String,
+    /// Partial journal and progress snapshot for a halted, cancelled, or errored run.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub snapshot: Option<serde_json::Value>,
+    /// Current or terminal factory run status.
+    pub status: FactoryRunStatus,
 }
 
-/// Outcome of a transferRemoteControl call.
+/// Resolved persisted factory identity and resumed run envelope.
 ///
 /// <div class="warning">
 ///
@@ -20686,14 +22075,14 @@ pub struct SessionsStartRemoteControlResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsTransferRemoteControlResult {
-    /// State of the runtime-managed remote-control singleton.
-    pub status: serde_json::Value,
-    /// Whether the rebinding actually happened.
-    pub transferred: bool,
+pub struct SessionFactoryResumeResult {
+    /// Persisted factory name resolved for the resumed run.
+    pub factory_name: String,
+    /// Terminal resumed run envelope.
+    pub run: FactoryRunResult,
 }
 
-/// Wrapper for the singleton's current status.
+/// Complete current or terminal factory run envelope.
 ///
 /// <div class="warning">
 ///
@@ -20703,12 +22092,29 @@ pub struct SessionsTransferRemoteControlResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsSetRemoteControlSteeringResult {
-    /// State of the runtime-managed remote-control singleton.
-    pub status: serde_json::Value,
+pub struct SessionFactoryGetRunResult {
+    /// Error message for an errored run.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// Machine-readable failure details for an errored run.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub failure: Option<serde_json::Value>,
+    /// Reason for a halted or cancelled run.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reason: Option<String>,
+    /// Completed factory result.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub result: Option<serde_json::Value>,
+    /// Factory run identifier.
+    pub run_id: String,
+    /// Partial journal and progress snapshot for a halted, cancelled, or errored run.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub snapshot: Option<serde_json::Value>,
+    /// Current or terminal factory run status.
+    pub status: FactoryRunStatus,
 }
 
-/// Outcome of a stopRemoteControl call.
+/// A page of factory runs in durable creation order.
 ///
 /// <div class="warning">
 ///
@@ -20718,14 +22124,24 @@ pub struct SessionsSetRemoteControlSteeringResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsStopRemoteControlResult {
-    /// State of the runtime-managed remote-control singleton.
-    pub status: serde_json::Value,
-    /// Whether the singleton was actually torn down by this call.
-    pub stopped: bool,
+pub struct SessionFactoryListRunsResult {
+    /// Whether terminal runs newer than this page exist.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub has_more_newer: Option<bool>,
+    /// Newest terminal-run cursor in this page, or null when the terminal window is empty.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub newest_seq: Option<i64>,
+    /// Oldest terminal-run cursor in this page, or null when the terminal window is empty.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub oldest_seq: Option<i64>,
+    /// Number of terminal runs older than this page.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub omitted_older: Option<i64>,
+    /// Factory run summaries in durable creation order.
+    pub runs: Vec<FactoryRunSummary>,
 }
 
-/// Wrapper for the singleton's current status.
+/// Full factory run observability detail.
 ///
 /// <div class="warning">
 ///
@@ -20735,12 +22151,54 @@ pub struct SessionsStopRemoteControlResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionsGetRemoteControlStatusResult {
-    /// State of the runtime-managed remote-control singleton.
-    pub status: serde_json::Value,
+pub struct SessionFactoryGetRunDetailResult {
+    /// Epoch milliseconds when the current active segment started, or null while inactive.
+    pub active_segment_started_at: Option<i64>,
+    /// Durable identities and live statuses for direct factory agents.
+    pub agents: Vec<FactoryAgentSummary>,
+    /// Approved effective resource ceilings, or null until approved.
+    pub approved: Option<FactoryDeclaredLimits>,
+    /// Epoch milliseconds when the run completed, or null while nonterminal.
+    pub completed_at: Option<i64>,
+    /// Durable resource consumption.
+    pub consumed: FactoryRunConsumed,
+    /// Epoch milliseconds when the run was created.
+    pub created_at: i64,
+    /// Current phase identity, or null before any phase is entered.
+    pub current_phase: Option<FactoryCurrentPhase>,
+    /// Resource ceilings declared by the factory.
+    pub declared_limits: FactoryDeclaredLimits,
+    /// Number of phases declared by the factory.
+    pub declared_phase_count: i64,
+    /// Human-readable factory description.
+    pub description: String,
+    /// Registered factory name.
+    pub factory_name: String,
+    /// Number of direct factory agents currently live.
+    pub live_agent_count: i64,
+    /// Epoch milliseconds when this live-overlay snapshot was observed.
+    pub observed_at: i64,
+    /// Lifecycle and timing observations for each factory phase.
+    pub phases: Vec<FactoryPhaseObservation>,
+    /// Bidirectional page of durable factory progress.
+    pub progress: FactoryProgressPage,
+    /// Monotonic durable run revision.
+    pub revision: i64,
+    /// Factory run identifier.
+    pub run_id: String,
+    /// Epoch milliseconds when execution first started, or null before start.
+    pub started_at: Option<i64>,
+    /// Current factory run status.
+    pub status: FactoryRunStatus,
+    /// Terminal run outcome, or null while nonterminal.
+    pub terminal: Option<FactoryRunTerminal>,
+    /// Total direct factory agents spawned across all attempts.
+    pub total_spawned_agent_count: i64,
+    /// Epoch milliseconds when the durable run was last updated.
+    pub updated_at: i64,
 }
 
-/// Handle for releasing the extension tool registration.
+/// A bidirectional page of factory progress.
 ///
 /// <div class="warning">
 ///
@@ -20750,13 +22208,22 @@ pub struct SessionsGetRemoteControlStatusResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub(crate) struct SessionsRegisterExtensionToolsOnSessionResult {
-    /// In-process unsubscribe function (CLI-only optimization). Marked internal: replaced by an explicit `extensions.unregister` RPC in the SDK migration.
-    #[doc(hidden)]
-    pub(crate) unsubscribe: serde_json::Value,
+pub struct SessionFactoryGetRunProgressResult {
+    /// Whether progress records newer than this page exist.
+    pub has_more_newer: bool,
+    /// Whether progress records older than this page exist.
+    pub has_more_older: bool,
+    /// Newest sequence number in this page, or null when empty.
+    pub newest_seq: Option<i64>,
+    /// Oldest sequence number in this page, or null when empty.
+    pub oldest_seq: Option<i64>,
+    /// Progress records in sequence order.
+    pub records: Vec<FactoryProgressLine>,
+    /// Run revision reflected by this page.
+    pub revision: i64,
 }
 
-/// Identifies the target session.
+/// Complete current or terminal factory run envelope.
 ///
 /// <div class="warning">
 ///
@@ -20766,12 +22233,29 @@ pub(crate) struct SessionsRegisterExtensionToolsOnSessionResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSuspendParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionFactoryCancelResult {
+    /// Error message for an errored run.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// Machine-readable failure details for an errored run.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub failure: Option<serde_json::Value>,
+    /// Reason for a halted or cancelled run.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reason: Option<String>,
+    /// Completed factory result.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub result: Option<serde_json::Value>,
+    /// Factory run identifier.
+    pub run_id: String,
+    /// Partial journal and progress snapshot for a halted, cancelled, or errored run.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub snapshot: Option<serde_json::Value>,
+    /// Current or terminal factory run status.
+    pub status: FactoryRunStatus,
 }
 
-/// Result of sending a user message
+/// Acknowledgement that a factory request was accepted.
 ///
 /// <div class="warning">
 ///
@@ -20781,12 +22265,9 @@ pub struct SessionSuspendParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSendResult {
-    /// Unique identifier assigned to the message
-    pub message_id: String,
-}
+pub struct SessionFactoryLogResult {}
 
-/// Result of sending zero or more user messages
+/// Result of one factory-scoped subagent call.
 ///
 /// <div class="warning">
 ///
@@ -20796,12 +22277,13 @@ pub struct SessionSendResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSendMessagesResult {
-    /// Unique identifiers assigned to the messages, one per provided message in order. Empty when no messages were provided.
-    pub message_ids: Vec<String>,
+pub struct SessionFactoryAgentResult {
+    /// Agent result, omitted when the agent produced no result.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub result: Option<serde_json::Value>,
 }
 
-/// Result of aborting the current turn
+/// Result of reading a factory journal entry.
 ///
 /// <div class="warning">
 ///
@@ -20811,15 +22293,15 @@ pub struct SessionSendMessagesResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionAbortResult {
-    /// Error message if the abort failed
+pub struct SessionFactoryJournalGetResult {
+    /// Whether the journal contained the requested key.
+    pub hit: bool,
+    /// Cached JSON result. The hit field distinguishes a cached JSON null from a miss.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Whether the abort completed successfully
-    pub success: bool,
+    pub result_json: Option<serde_json::Value>,
 }
 
-/// Result of interrupting the main agent turn.
+/// Acknowledgement that a factory request was accepted.
 ///
 /// <div class="warning">
 ///
@@ -20829,10 +22311,7 @@ pub struct SessionAbortResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionInterruptMainTurnResult {
-    /// Whether an in-flight main agent turn was interrupted. False when the main loop was not processing.
-    pub interrupted: bool,
-}
+pub struct SessionFactoryJournalPutResult {}
 
 /// Identifies the target session.
 ///
@@ -20844,12 +22323,12 @@ pub struct SessionInterruptMainTurnResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionCancelAllBackgroundAgentsParams {
+pub struct SessionModelGetCurrentParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Identifies the target session.
+/// The currently selected model, reasoning effort, and context tier for the session. The context tier reflects `Session.getContextTier()`, restored from the session journal on resume.
 ///
 /// <div class="warning">
 ///
@@ -20859,12 +22338,19 @@ pub struct SessionCancelAllBackgroundAgentsParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionGitHubAuthGetStatusParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionModelGetCurrentResult {
+    /// Context tier for models that support multiple context-window sizes.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub context_tier: Option<ContextTier>,
+    /// Currently active model identifier
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_id: Option<String>,
+    /// Reasoning effort level currently applied to the active model, when one is set. Reads `Session.getReasoningEffort()` synchronously after `getSelectedModel()` resolves so the two values are reported as a snapshot.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reasoning_effort: Option<String>,
 }
 
-/// Authentication status and account metadata for the session.
+/// The model identifier active on the session after the switch.
 ///
 /// <div class="warning">
 ///
@@ -20874,27 +22360,34 @@ pub struct SessionGitHubAuthGetStatusParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionGitHubAuthGetStatusResult {
-    /// Authentication type
+pub struct SessionModelSwitchToResult {
+    /// Compaction confirmation projection when status is confirmation_required
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub auth_type: Option<AuthInfoType>,
-    /// Copilot plan tier (e.g., individual_pro, business)
+    pub confirmation: Option<ModelSwitchConfirmation>,
+    /// True when the switch was deferred (enqueued as a cancellable `/model` command) because a turn was active or another model change was already queued, rather than applied immediately. When true, the session's live model is unchanged until the queued change drains.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub copilot_plan: Option<String>,
-    /// Authentication host URL
+    pub deferred: Option<bool>,
+    /// Deprecation warnings associated with the selected model or options.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub host: Option<String>,
-    /// Whether the session has resolved authentication
-    pub is_authenticated: bool,
-    /// Authenticated login/username, if available
+    pub deprecation_warnings: Option<Vec<String>>,
+    /// User-facing outcome message for the model switch.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub login: Option<String>,
-    /// Human-readable authentication status description
+    pub message: Option<String>,
+    /// Currently active model identifier after the switch
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub status_message: Option<String>,
+    pub model_id: Option<String>,
+    /// Persistence failure encountered after applying the model switch.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub persistence_error: Option<String>,
+    /// Lifecycle result for the requested switch
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status: Option<String>,
+    /// User-facing warning produced while applying the model switch.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub warning: Option<String>,
 }
 
-/// Indicates whether the credential update succeeded.
+/// The model identifier active on the session after the switch.
 ///
 /// <div class="warning">
 ///
@@ -20904,15 +22397,34 @@ pub struct SessionGitHubAuthGetStatusResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionGitHubAuthSetCredentialsResult {
-    /// Whether the session ended up with a populated `copilotUser` for the installed credentials. `true` when the supplied credential already carried `copilotUser` or it was successfully re-resolved server-side. `false` when the credential is installed without `copilotUser` — either re-resolution failed, or the variant cannot be re-resolved from the credential alone (only the raw-token variants `token`, `env`, and `gh-cli` can). In both `false` cases the token swap still applied, but plan/quota/billing metadata is degraded. Present whenever a credential was supplied; omitted only when no credential was supplied (no-op call).
+pub struct SessionModelApplyStartupOverlayResult {
+    /// Compaction confirmation projection when status is confirmation_required
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub copilot_user_resolved: Option<bool>,
-    /// Whether the operation succeeded
-    pub success: bool,
+    pub confirmation: Option<ModelSwitchConfirmation>,
+    /// True when the switch was deferred (enqueued as a cancellable `/model` command) because a turn was active or another model change was already queued, rather than applied immediately. When true, the session's live model is unchanged until the queued change drains.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub deferred: Option<bool>,
+    /// Deprecation warnings associated with the selected model or options.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub deprecation_warnings: Option<Vec<String>>,
+    /// User-facing outcome message for the model switch.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub message: Option<String>,
+    /// Currently active model identifier after the switch
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_id: Option<String>,
+    /// Persistence failure encountered after applying the model switch.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub persistence_error: Option<String>,
+    /// Lifecycle result for the requested switch
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status: Option<String>,
+    /// User-facing warning produced while applying the model switch.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub warning: Option<String>,
 }
 
-/// Identifies the target session.
+/// Update the session's reasoning effort without changing the selected model. Use `switchTo` instead when you also need to change the model. The runtime stores the effort on the session and applies it to subsequent turns.
 ///
 /// <div class="warning">
 ///
@@ -20922,12 +22434,12 @@ pub struct SessionGitHubAuthSetCredentialsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionGitHubAuthGetCurrentAuthInfoParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionModelSetReasoningEffortResult {
+    /// Reasoning effort level recorded on the session after the update
+    pub reasoning_effort: String,
 }
 
-/// Identifies the target session.
+/// The list of models available to this session.
 ///
 /// <div class="warning">
 ///
@@ -20937,9 +22449,15 @@ pub struct SessionGitHubAuthGetCurrentAuthInfoParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionGitHubAuthGetAllAuthAvailableParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionModelListResult {
+    /// Available models, ordered with the most preferred default first. Includes both Copilot (CAPI) models and any registry BYOK models; a BYOK model appears under its provider-qualified selection id (`provider/id`).
+    pub list: Vec<serde_json::Value>,
+    /// Cost categories for the full CAPI catalog, including picker-disabled models that Auto may select. Metadata only; entries absent from `list` are not manually selectable.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_price_categories: Option<Vec<SessionModelPriceCategory>>,
+    /// Per-quota snapshots returned alongside the model list, keyed by quota type.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub quota_snapshots: Option<HashMap<String, serde_json::Value>>,
 }
 
 /// Identifies the target session.
@@ -20952,12 +22470,12 @@ pub struct SessionGitHubAuthGetAllAuthAvailableParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionGitHubAuthRefreshCopilotUserParams {
+pub struct SessionModeGetParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Identifies the target session.
+/// Outcome of a session mode change, including any model switch it triggered and follow-up the host must perform.
 ///
 /// <div class="warning">
 ///
@@ -20967,9 +22485,29 @@ pub struct SessionGitHubAuthRefreshCopilotUserParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionGitHubAuthLogoutParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionModeSetResult {
+    /// Whether the host should arm an interactive continuation after the mode change.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub arm_interactive_continuation: Option<bool>,
+    /// Compaction confirmation required before the mode change can complete.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub confirmation: Option<ModelSwitchConfirmation>,
+    /// Whether the host must defer implementing the requested mode change.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub defer_implementation: Option<bool>,
+    /// Deprecation warnings associated with the model selected by the mode change.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub deprecation_warnings: Option<Vec<String>>,
+    /// User-facing outcome message for the model switch triggered by the mode change.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub message: Option<String>,
+    /// Whether applying the mode changed the active model.
+    pub model_changed: bool,
+    /// Lifecycle status of the requested mode change.
+    pub status: String,
+    /// User-facing warning produced while applying the mode change.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub warning: Option<String>,
 }
 
 /// Identifies the target session.
@@ -20982,12 +22520,12 @@ pub struct SessionGitHubAuthLogoutParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionGitHubAuthLastAuthErrorsParams {
+pub struct SessionNameGetParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Result of collecting a redacted debug bundle.
+/// The session's friendly name, or null when not yet set.
 ///
 /// <div class="warning">
 ///
@@ -20997,19 +22535,12 @@ pub struct SessionGitHubAuthLastAuthErrorsParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionDebugCollectLogsResult {
-    /// Files included in the redacted bundle.
-    pub entries: Vec<DebugCollectLogsCollectedEntry>,
-    /// Destination kind that was written.
-    pub kind: DebugCollectLogsResultKind,
-    /// Actual archive path or staging directory path written. This may differ from the requested path when no-overwrite suffixing or fallback-to-temp-directory was needed.
-    pub path: String,
-    /// Optional files or directories that could not be included.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub skipped_entries: Option<Vec<DebugCollectLogsSkippedEntry>>,
+pub struct SessionNameGetResult {
+    /// The session name (user-set or auto-generated), or null if not yet set
+    pub name: Option<String>,
 }
 
-/// Identifies the target session.
+/// Indicates whether the auto-generated summary was applied as the session's name.
 ///
 /// <div class="warning">
 ///
@@ -21019,12 +22550,12 @@ pub struct SessionDebugCollectLogsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionCanvasListParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionNameSetAutoResult {
+    /// Whether the auto-generated summary was persisted. False if the session already has a user-set name, the summary normalized to empty, or the session does not have a workspace.
+    pub applied: bool,
 }
 
-/// Declared canvases available in this session.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -21034,12 +22565,12 @@ pub struct SessionCanvasListParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionCanvasListResult {
-    /// Declared canvases available in this session
-    pub canvases: Vec<DiscoveredCanvas>,
+pub struct SessionPlanReadParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Identifies the target session.
+/// Existence, contents, and resolved path of the session plan file.
 ///
 /// <div class="warning">
 ///
@@ -21049,12 +22580,16 @@ pub struct SessionCanvasListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionCanvasListOpenParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionPlanReadResult {
+    /// The content of the plan file, or null if it does not exist
+    pub content: Option<String>,
+    /// Whether the plan file exists in the workspace
+    pub exists: bool,
+    /// Absolute file path of the plan file, or null if workspace is not enabled
+    pub path: Option<String>,
 }
 
-/// Live open-canvas snapshot.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -21064,12 +22599,12 @@ pub struct SessionCanvasListOpenParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionCanvasListOpenResult {
-    /// Currently open canvas instances
-    pub open_canvases: Vec<OpenCanvasInstance>,
+pub struct SessionPlanDeleteParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Open canvas instance snapshot.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -21077,36 +22612,14 @@ pub struct SessionCanvasListOpenResult {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionCanvasOpenResult {
-    /// Provider-local canvas identifier
-    pub canvas_id: String,
-    /// Owning provider identifier
-    pub extension_id: String,
-    /// Owning extension display name, when available
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub extension_name: Option<String>,
-    /// Host-local PNG path for the canvas icon, when supplied
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub icon: Option<String>,
-    /// Input supplied when the instance was opened
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub input: Option<serde_json::Value>,
-    /// Stable caller-supplied canvas instance identifier
-    pub instance_id: String,
-    /// Provider-supplied status text
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub status: Option<String>,
-    /// Rendered title
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub title: Option<String>,
-    /// URL for web-rendered canvases
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub url: Option<String>,
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionPlanReadSqlTodosParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Canvas action invocation result.
+/// Todo rows read from the session SQL database. Empty when no session database is available.
 ///
 /// <div class="warning">
 ///
@@ -21116,13 +22629,12 @@ pub struct SessionCanvasOpenResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionCanvasActionInvokeResult {
-    /// Provider-supplied action result
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub result: Option<serde_json::Value>,
+pub struct SessionPlanReadSqlTodosResult {
+    /// Rows from the session SQL todos table, ordered by creation time with insertion order used to break ties when available and id used for WITHOUT ROWID tables.
+    pub rows: Vec<PlanSqlTodosRow>,
 }
 
-/// Complete current or terminal factory run envelope.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -21132,29 +22644,12 @@ pub struct SessionCanvasActionInvokeResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFactoryRunResult {
-    /// Error message for an errored run.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Machine-readable failure details for an errored run.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub failure: Option<serde_json::Value>,
-    /// Reason for a halted or cancelled run.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub reason: Option<String>,
-    /// Completed factory result.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub result: Option<serde_json::Value>,
-    /// Factory run identifier.
-    pub run_id: String,
-    /// Partial journal and progress snapshot for a halted, cancelled, or errored run.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub snapshot: Option<serde_json::Value>,
-    /// Current or terminal factory run status.
-    pub status: FactoryRunStatus,
+pub struct SessionPlanReadSqlTodosWithDependenciesParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Resolved persisted factory identity and resumed run envelope.
+/// Todo rows + dependency edges read from the session SQL database.
 ///
 /// <div class="warning">
 ///
@@ -21164,14 +22659,14 @@ pub struct SessionFactoryRunResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFactoryResumeResult {
-    /// Persisted factory name resolved for the resumed run.
-    pub factory_name: String,
-    /// Terminal resumed run envelope.
-    pub run: FactoryRunResult,
+pub struct SessionPlanReadSqlTodosWithDependenciesResult {
+    /// Edges from the session SQL todo_deps table. Empty when no database, no todo_deps table, or the SELECT failed. Read independently from `rows`, so a broken todo_deps table does not affect the rows result and vice versa.
+    pub dependencies: Vec<PlanSqlTodoDependency>,
+    /// Rows from the session SQL todos table, ordered by creation time with insertion order used to break ties when available and id used for WITHOUT ROWID tables. Empty when no database, no todos table, or the SELECT failed.
+    pub rows: Vec<PlanSqlTodosRow>,
 }
 
-/// Complete current or terminal factory run envelope.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -21181,29 +22676,146 @@ pub struct SessionFactoryResumeResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFactoryGetRunResult {
-    /// Error message for an errored run.
+pub struct SessionWorkspacesGetWorkspaceParams {
+    /// Target session identifier
+    pub session_id: SessionId,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionWorkspacesGetWorkspaceResultWorkspace {
+    /// Current Git branch.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Machine-readable failure details for an errored run.
+    pub branch: Option<String>,
+    /// Whether the per-session Chronicle upgrade prompt was dismissed for the workspace.
+    #[serde(
+        rename = "chronicle_sync_dismissed",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub chronicle_sync_dismissed: Option<bool>,
+    /// Name of the client that created the workspace.
+    #[serde(rename = "client_name", skip_serializing_if = "Option::is_none")]
+    pub client_name: Option<String>,
+    /// Timestamp when the workspace was created.
+    #[serde(rename = "created_at", skip_serializing_if = "Option::is_none")]
+    pub created_at: Option<String>,
+    /// Current working directory associated with the workspace.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub failure: Option<serde_json::Value>,
-    /// Reason for a halted or cancelled run.
+    pub cwd: Option<String>,
+    /// Git repository root associated with the workspace.
+    #[serde(rename = "git_root", skip_serializing_if = "Option::is_none")]
+    pub git_root: Option<String>,
+    /// Allowed values for the `WorkspacesWorkspaceDetailsHostType` enumeration.
+    #[serde(rename = "host_type", skip_serializing_if = "Option::is_none")]
+    pub host_type: Option<WorkspacesWorkspaceDetailsHostType>,
+    /// Stable workspace identifier.
+    pub id: String,
+    /// Most recent Mission Control event identifier observed for the workspace.
+    #[serde(rename = "mc_last_event_id", skip_serializing_if = "Option::is_none")]
+    pub mc_last_event_id: Option<String>,
+    /// Mission Control session identifier associated with the workspace.
+    #[serde(rename = "mc_session_id", skip_serializing_if = "Option::is_none")]
+    pub mc_session_id: Option<String>,
+    /// Mission Control task identifier associated with the workspace.
+    #[serde(rename = "mc_task_id", skip_serializing_if = "Option::is_none")]
+    pub mc_task_id: Option<String>,
+    /// Workspace display name.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub reason: Option<String>,
-    /// Completed factory result.
+    pub name: Option<String>,
+    /// Whether the workspace session can be steered remotely.
+    #[serde(rename = "remote_steerable", skip_serializing_if = "Option::is_none")]
+    pub remote_steerable: Option<bool>,
+    /// Repository identifier associated with the workspace.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub result: Option<serde_json::Value>,
-    /// Factory run identifier.
-    pub run_id: String,
-    /// Partial journal and progress snapshot for a halted, cancelled, or errored run.
+    pub repository: Option<String>,
+    /// Number of persisted summaries in the workspace.
+    #[serde(rename = "summary_count", skip_serializing_if = "Option::is_none")]
+    pub summary_count: Option<i64>,
+    /// Timestamp when the workspace was last updated.
+    #[serde(rename = "updated_at", skip_serializing_if = "Option::is_none")]
+    pub updated_at: Option<String>,
+    /// Whether the workspace name was explicitly chosen by the user.
+    #[serde(rename = "user_named", skip_serializing_if = "Option::is_none")]
+    pub user_named: Option<bool>,
+}
+
+/// Current workspace metadata for the session, including its absolute filesystem path when available.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionWorkspacesGetWorkspaceResult {
+    /// Absolute filesystem path to the workspace directory. Omitted when the session has no workspace (e.g. remote sessions).
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub snapshot: Option<serde_json::Value>,
-    /// Current or terminal factory run status.
-    pub status: FactoryRunStatus,
+    pub path: Option<String>,
+    /// Current workspace metadata, or null if not available
+    pub workspace: Option<SessionWorkspacesGetWorkspaceResultWorkspace>,
 }
 
-/// A page of factory runs in durable creation order.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionWorkspacesUpdateMetadataResultWorkspace {
+    /// Current Git branch.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub branch: Option<String>,
+    /// Whether the per-session Chronicle upgrade prompt was dismissed for the workspace.
+    #[serde(
+        rename = "chronicle_sync_dismissed",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub chronicle_sync_dismissed: Option<bool>,
+    /// Name of the client that created the workspace.
+    #[serde(rename = "client_name", skip_serializing_if = "Option::is_none")]
+    pub client_name: Option<String>,
+    /// Timestamp when the workspace was created.
+    #[serde(rename = "created_at", skip_serializing_if = "Option::is_none")]
+    pub created_at: Option<String>,
+    /// Current working directory associated with the workspace.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cwd: Option<String>,
+    /// Git repository root associated with the workspace.
+    #[serde(rename = "git_root", skip_serializing_if = "Option::is_none")]
+    pub git_root: Option<String>,
+    /// Allowed values for the `WorkspacesWorkspaceDetailsHostType` enumeration.
+    #[serde(rename = "host_type", skip_serializing_if = "Option::is_none")]
+    pub host_type: Option<WorkspacesWorkspaceDetailsHostType>,
+    /// Stable workspace identifier.
+    pub id: String,
+    /// Most recent Mission Control event identifier observed for the workspace.
+    #[serde(rename = "mc_last_event_id", skip_serializing_if = "Option::is_none")]
+    pub mc_last_event_id: Option<String>,
+    /// Mission Control session identifier associated with the workspace.
+    #[serde(rename = "mc_session_id", skip_serializing_if = "Option::is_none")]
+    pub mc_session_id: Option<String>,
+    /// Mission Control task identifier associated with the workspace.
+    #[serde(rename = "mc_task_id", skip_serializing_if = "Option::is_none")]
+    pub mc_task_id: Option<String>,
+    /// Workspace display name.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    /// Whether the workspace session can be steered remotely.
+    #[serde(rename = "remote_steerable", skip_serializing_if = "Option::is_none")]
+    pub remote_steerable: Option<bool>,
+    /// Repository identifier associated with the workspace.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub repository: Option<String>,
+    /// Number of persisted summaries in the workspace.
+    #[serde(rename = "summary_count", skip_serializing_if = "Option::is_none")]
+    pub summary_count: Option<i64>,
+    /// Timestamp when the workspace was last updated.
+    #[serde(rename = "updated_at", skip_serializing_if = "Option::is_none")]
+    pub updated_at: Option<String>,
+    /// Whether the workspace name was explicitly chosen by the user.
+    #[serde(rename = "user_named", skip_serializing_if = "Option::is_none")]
+    pub user_named: Option<bool>,
+}
+
+/// Current workspace metadata for the session, including its absolute filesystem path when available.
 ///
 /// <div class="warning">
 ///
@@ -21213,24 +22825,73 @@ pub struct SessionFactoryGetRunResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFactoryListRunsResult {
-    /// Whether terminal runs newer than this page exist.
+pub struct SessionWorkspacesUpdateMetadataResult {
+    /// Absolute filesystem path to the workspace directory. Omitted when the session has no workspace (e.g. remote sessions).
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub has_more_newer: Option<bool>,
-    /// Newest terminal-run cursor in this page, or null when the terminal window is empty.
+    pub path: Option<String>,
+    /// Current workspace metadata, or null if not available
+    pub workspace: Option<SessionWorkspacesUpdateMetadataResultWorkspace>,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionWorkspacesEnsureResultWorkspace {
+    /// Current Git branch.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub newest_seq: Option<i64>,
-    /// Oldest terminal-run cursor in this page, or null when the terminal window is empty.
+    pub branch: Option<String>,
+    /// Whether the per-session Chronicle upgrade prompt was dismissed for the workspace.
+    #[serde(
+        rename = "chronicle_sync_dismissed",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub chronicle_sync_dismissed: Option<bool>,
+    /// Name of the client that created the workspace.
+    #[serde(rename = "client_name", skip_serializing_if = "Option::is_none")]
+    pub client_name: Option<String>,
+    /// Timestamp when the workspace was created.
+    #[serde(rename = "created_at", skip_serializing_if = "Option::is_none")]
+    pub created_at: Option<String>,
+    /// Current working directory associated with the workspace.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub oldest_seq: Option<i64>,
-    /// Number of terminal runs older than this page.
+    pub cwd: Option<String>,
+    /// Git repository root associated with the workspace.
+    #[serde(rename = "git_root", skip_serializing_if = "Option::is_none")]
+    pub git_root: Option<String>,
+    /// Allowed values for the `WorkspacesWorkspaceDetailsHostType` enumeration.
+    #[serde(rename = "host_type", skip_serializing_if = "Option::is_none")]
+    pub host_type: Option<WorkspacesWorkspaceDetailsHostType>,
+    /// Stable workspace identifier.
+    pub id: String,
+    /// Most recent Mission Control event identifier observed for the workspace.
+    #[serde(rename = "mc_last_event_id", skip_serializing_if = "Option::is_none")]
+    pub mc_last_event_id: Option<String>,
+    /// Mission Control session identifier associated with the workspace.
+    #[serde(rename = "mc_session_id", skip_serializing_if = "Option::is_none")]
+    pub mc_session_id: Option<String>,
+    /// Mission Control task identifier associated with the workspace.
+    #[serde(rename = "mc_task_id", skip_serializing_if = "Option::is_none")]
+    pub mc_task_id: Option<String>,
+    /// Workspace display name.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    /// Whether the workspace session can be steered remotely.
+    #[serde(rename = "remote_steerable", skip_serializing_if = "Option::is_none")]
+    pub remote_steerable: Option<bool>,
+    /// Repository identifier associated with the workspace.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub omitted_older: Option<i64>,
-    /// Factory run summaries in durable creation order.
-    pub runs: Vec<FactoryRunSummary>,
+    pub repository: Option<String>,
+    /// Number of persisted summaries in the workspace.
+    #[serde(rename = "summary_count", skip_serializing_if = "Option::is_none")]
+    pub summary_count: Option<i64>,
+    /// Timestamp when the workspace was last updated.
+    #[serde(rename = "updated_at", skip_serializing_if = "Option::is_none")]
+    pub updated_at: Option<String>,
+    /// Whether the workspace name was explicitly chosen by the user.
+    #[serde(rename = "user_named", skip_serializing_if = "Option::is_none")]
+    pub user_named: Option<bool>,
 }
 
-/// Full factory run observability detail.
+/// Current workspace metadata for the session, including its absolute filesystem path when available.
 ///
 /// <div class="warning">
 ///
@@ -21240,54 +22901,15 @@ pub struct SessionFactoryListRunsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFactoryGetRunDetailResult {
-    /// Epoch milliseconds when the current active segment started, or null while inactive.
-    pub active_segment_started_at: Option<i64>,
-    /// Durable identities and live statuses for direct factory agents.
-    pub agents: Vec<FactoryAgentSummary>,
-    /// Approved effective resource ceilings, or null until approved.
-    pub approved: Option<FactoryDeclaredLimits>,
-    /// Epoch milliseconds when the run completed, or null while nonterminal.
-    pub completed_at: Option<i64>,
-    /// Durable resource consumption.
-    pub consumed: FactoryRunConsumed,
-    /// Epoch milliseconds when the run was created.
-    pub created_at: i64,
-    /// Current phase identity, or null before any phase is entered.
-    pub current_phase: Option<FactoryCurrentPhase>,
-    /// Resource ceilings declared by the factory.
-    pub declared_limits: FactoryDeclaredLimits,
-    /// Number of phases declared by the factory.
-    pub declared_phase_count: i64,
-    /// Human-readable factory description.
-    pub description: String,
-    /// Registered factory name.
-    pub factory_name: String,
-    /// Number of direct factory agents currently live.
-    pub live_agent_count: i64,
-    /// Epoch milliseconds when this live-overlay snapshot was observed.
-    pub observed_at: i64,
-    /// Lifecycle and timing observations for each factory phase.
-    pub phases: Vec<FactoryPhaseObservation>,
-    /// Bidirectional page of durable factory progress.
-    pub progress: FactoryProgressPage,
-    /// Monotonic durable run revision.
-    pub revision: i64,
-    /// Factory run identifier.
-    pub run_id: String,
-    /// Epoch milliseconds when execution first started, or null before start.
-    pub started_at: Option<i64>,
-    /// Current factory run status.
-    pub status: FactoryRunStatus,
-    /// Terminal run outcome, or null while nonterminal.
-    pub terminal: Option<FactoryRunTerminal>,
-    /// Total direct factory agents spawned across all attempts.
-    pub total_spawned_agent_count: i64,
-    /// Epoch milliseconds when the durable run was last updated.
-    pub updated_at: i64,
+pub struct SessionWorkspacesEnsureResult {
+    /// Absolute filesystem path to the workspace directory. Omitted when the session has no workspace (e.g. remote sessions).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub path: Option<String>,
+    /// Current workspace metadata, or null if not available
+    pub workspace: Option<SessionWorkspacesEnsureResultWorkspace>,
 }
 
-/// A bidirectional page of factory progress.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -21297,22 +22919,12 @@ pub struct SessionFactoryGetRunDetailResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFactoryGetRunProgressResult {
-    /// Whether progress records newer than this page exist.
-    pub has_more_newer: bool,
-    /// Whether progress records older than this page exist.
-    pub has_more_older: bool,
-    /// Newest sequence number in this page, or null when empty.
-    pub newest_seq: Option<i64>,
-    /// Oldest sequence number in this page, or null when empty.
-    pub oldest_seq: Option<i64>,
-    /// Progress records in sequence order.
-    pub records: Vec<FactoryProgressLine>,
-    /// Run revision reflected by this page.
-    pub revision: i64,
+pub struct SessionWorkspacesListFilesParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Complete current or terminal factory run envelope.
+/// Relative paths of files stored in the session workspace files directory.
 ///
 /// <div class="warning">
 ///
@@ -21322,29 +22934,12 @@ pub struct SessionFactoryGetRunProgressResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFactoryCancelResult {
-    /// Error message for an errored run.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Machine-readable failure details for an errored run.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub failure: Option<serde_json::Value>,
-    /// Reason for a halted or cancelled run.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub reason: Option<String>,
-    /// Completed factory result.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub result: Option<serde_json::Value>,
-    /// Factory run identifier.
-    pub run_id: String,
-    /// Partial journal and progress snapshot for a halted, cancelled, or errored run.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub snapshot: Option<serde_json::Value>,
-    /// Current or terminal factory run status.
-    pub status: FactoryRunStatus,
+pub struct SessionWorkspacesListFilesResult {
+    /// Relative file paths in the workspace files directory
+    pub files: Vec<String>,
 }
 
-/// Acknowledgement that a factory request was accepted.
+/// Contents of the requested workspace file as a UTF-8 string.
 ///
 /// <div class="warning">
 ///
@@ -21354,9 +22949,12 @@ pub struct SessionFactoryCancelResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFactoryLogResult {}
+pub struct SessionWorkspacesReadFileResult {
+    /// File content as a UTF-8 string
+    pub content: String,
+}
 
-/// Result of one factory-scoped subagent call.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -21366,13 +22964,12 @@ pub struct SessionFactoryLogResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFactoryAgentResult {
-    /// Agent result, omitted when the agent produced no result.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub result: Option<serde_json::Value>,
+pub struct SessionWorkspacesListCheckpointsParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Result of reading a factory journal entry.
+/// Workspace checkpoints in chronological order; empty when the workspace is not enabled.
 ///
 /// <div class="warning">
 ///
@@ -21382,15 +22979,12 @@ pub struct SessionFactoryAgentResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFactoryJournalGetResult {
-    /// Whether the journal contained the requested key.
-    pub hit: bool,
-    /// Cached JSON result. The hit field distinguishes a cached JSON null from a miss.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub result_json: Option<serde_json::Value>,
+pub struct SessionWorkspacesListCheckpointsResult {
+    /// Workspace checkpoints in chronological order. Empty when workspace is not enabled.
+    pub checkpoints: Vec<WorkspacesCheckpoints>,
 }
 
-/// Acknowledgement that a factory request was accepted.
+/// Checkpoint content as a UTF-8 string, or null when the checkpoint or workspace is missing.
 ///
 /// <div class="warning">
 ///
@@ -21400,9 +22994,12 @@ pub struct SessionFactoryJournalGetResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFactoryJournalPutResult {}
+pub struct SessionWorkspacesReadCheckpointResult {
+    /// Checkpoint content as a UTF-8 string, or null when the checkpoint or workspace is missing
+    pub content: Option<String>,
+}
 
-/// Identifies the target session.
+/// Persisted summary metadata and refreshed workspace metadata.
 ///
 /// <div class="warning">
 ///
@@ -21412,34 +23009,74 @@ pub struct SessionFactoryJournalPutResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionModelGetCurrentParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionWorkspacesAddSummaryResult {
+    /// Metadata for the persisted summary.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub summary: Option<serde_json::Value>,
+    /// Refreshed metadata for the containing workspace.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub workspace: Option<serde_json::Value>,
 }
 
-/// The currently selected model, reasoning effort, and context tier for the session. The context tier reflects `Session.getContextTier()`, restored from the session journal on resume.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionModelGetCurrentResult {
-    /// Context tier for models that support multiple context-window sizes.
+pub struct SessionWorkspacesTruncateSummariesResultWorkspace {
+    /// Current Git branch.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub context_tier: Option<ContextTier>,
-    /// Currently active model identifier
+    pub branch: Option<String>,
+    /// Whether the per-session Chronicle upgrade prompt was dismissed for the workspace.
+    #[serde(
+        rename = "chronicle_sync_dismissed",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub chronicle_sync_dismissed: Option<bool>,
+    /// Name of the client that created the workspace.
+    #[serde(rename = "client_name", skip_serializing_if = "Option::is_none")]
+    pub client_name: Option<String>,
+    /// Timestamp when the workspace was created.
+    #[serde(rename = "created_at", skip_serializing_if = "Option::is_none")]
+    pub created_at: Option<String>,
+    /// Current working directory associated with the workspace.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub model_id: Option<String>,
-    /// Reasoning effort level currently applied to the active model, when one is set. Reads `Session.getReasoningEffort()` synchronously after `getSelectedModel()` resolves so the two values are reported as a snapshot.
+    pub cwd: Option<String>,
+    /// Git repository root associated with the workspace.
+    #[serde(rename = "git_root", skip_serializing_if = "Option::is_none")]
+    pub git_root: Option<String>,
+    /// Allowed values for the `WorkspacesWorkspaceDetailsHostType` enumeration.
+    #[serde(rename = "host_type", skip_serializing_if = "Option::is_none")]
+    pub host_type: Option<WorkspacesWorkspaceDetailsHostType>,
+    /// Stable workspace identifier.
+    pub id: String,
+    /// Most recent Mission Control event identifier observed for the workspace.
+    #[serde(rename = "mc_last_event_id", skip_serializing_if = "Option::is_none")]
+    pub mc_last_event_id: Option<String>,
+    /// Mission Control session identifier associated with the workspace.
+    #[serde(rename = "mc_session_id", skip_serializing_if = "Option::is_none")]
+    pub mc_session_id: Option<String>,
+    /// Mission Control task identifier associated with the workspace.
+    #[serde(rename = "mc_task_id", skip_serializing_if = "Option::is_none")]
+    pub mc_task_id: Option<String>,
+    /// Workspace display name.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub reasoning_effort: Option<String>,
+    pub name: Option<String>,
+    /// Whether the workspace session can be steered remotely.
+    #[serde(rename = "remote_steerable", skip_serializing_if = "Option::is_none")]
+    pub remote_steerable: Option<bool>,
+    /// Repository identifier associated with the workspace.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub repository: Option<String>,
+    /// Number of persisted summaries in the workspace.
+    #[serde(rename = "summary_count", skip_serializing_if = "Option::is_none")]
+    pub summary_count: Option<i64>,
+    /// Timestamp when the workspace was last updated.
+    #[serde(rename = "updated_at", skip_serializing_if = "Option::is_none")]
+    pub updated_at: Option<String>,
+    /// Whether the workspace name was explicitly chosen by the user.
+    #[serde(rename = "user_named", skip_serializing_if = "Option::is_none")]
+    pub user_named: Option<bool>,
 }
 
-/// The model identifier active on the session after the switch.
+/// Current workspace metadata for the session, including its absolute filesystem path when available.
 ///
 /// <div class="warning">
 ///
@@ -21449,34 +23086,15 @@ pub struct SessionModelGetCurrentResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionModelSwitchToResult {
-    /// Compaction confirmation projection when status is confirmation_required
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub confirmation: Option<ModelSwitchConfirmation>,
-    /// True when the switch was deferred (enqueued as a cancellable `/model` command) because a turn was active or another model change was already queued, rather than applied immediately. When true, the session's live model is unchanged until the queued change drains.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub deferred: Option<bool>,
-    /// Deprecation warnings associated with the selected model or options.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub deprecation_warnings: Option<Vec<String>>,
-    /// User-facing outcome message for the model switch.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub message: Option<String>,
-    /// Currently active model identifier after the switch
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub model_id: Option<String>,
-    /// Persistence failure encountered after applying the model switch.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub persistence_error: Option<String>,
-    /// Lifecycle result for the requested switch
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub status: Option<String>,
-    /// User-facing warning produced while applying the model switch.
+pub struct SessionWorkspacesTruncateSummariesResult {
+    /// Absolute filesystem path to the workspace directory. Omitted when the session has no workspace (e.g. remote sessions).
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub warning: Option<String>,
+    pub path: Option<String>,
+    /// Current workspace metadata, or null if not available
+    pub workspace: Option<SessionWorkspacesTruncateSummariesResultWorkspace>,
 }
 
-/// The model identifier active on the session after the switch.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -21486,34 +23104,12 @@ pub struct SessionModelSwitchToResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionModelApplyStartupOverlayResult {
-    /// Compaction confirmation projection when status is confirmation_required
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub confirmation: Option<ModelSwitchConfirmation>,
-    /// True when the switch was deferred (enqueued as a cancellable `/model` command) because a turn was active or another model change was already queued, rather than applied immediately. When true, the session's live model is unchanged until the queued change drains.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub deferred: Option<bool>,
-    /// Deprecation warnings associated with the selected model or options.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub deprecation_warnings: Option<Vec<String>>,
-    /// User-facing outcome message for the model switch.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub message: Option<String>,
-    /// Currently active model identifier after the switch
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub model_id: Option<String>,
-    /// Persistence failure encountered after applying the model switch.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub persistence_error: Option<String>,
-    /// Lifecycle result for the requested switch
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub status: Option<String>,
-    /// User-facing warning produced while applying the model switch.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub warning: Option<String>,
+pub struct SessionWorkspacesReadAutopilotObjectiveParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Update the session's reasoning effort without changing the selected model. Use `switchTo` instead when you also need to change the model. The runtime stores the effort on the session and applies it to subsequent turns.
+/// Autopilot objective file content, or null when missing.
 ///
 /// <div class="warning">
 ///
@@ -21523,12 +23119,12 @@ pub struct SessionModelApplyStartupOverlayResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionModelSetReasoningEffortResult {
-    /// Reasoning effort level recorded on the session after the update
-    pub reasoning_effort: String,
+pub struct SessionWorkspacesReadAutopilotObjectiveResult {
+    /// Autopilot objective file content, or null when missing.
+    pub content: Option<String>,
 }
 
-/// The list of models available to this session.
+/// Result of writing the autopilot objective file.
 ///
 /// <div class="warning">
 ///
@@ -21538,15 +23134,9 @@ pub struct SessionModelSetReasoningEffortResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionModelListResult {
-    /// Available models, ordered with the most preferred default first. Includes both Copilot (CAPI) models and any registry BYOK models; a BYOK model appears under its provider-qualified selection id (`provider/id`).
-    pub list: Vec<serde_json::Value>,
-    /// Cost categories for the full CAPI catalog, including picker-disabled models that Auto may select. Metadata only; entries absent from `list` are not manually selectable.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub model_price_categories: Option<Vec<SessionModelPriceCategory>>,
-    /// Per-quota snapshots returned alongside the model list, keyed by quota type.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub quota_snapshots: Option<HashMap<String, serde_json::Value>>,
+pub struct SessionWorkspacesWriteAutopilotObjectiveResult {
+    /// Filesystem operation performed.
+    pub operation: String,
 }
 
 /// Identifies the target session.
@@ -21559,12 +23149,12 @@ pub struct SessionModelListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionModeGetParams {
+pub struct SessionWorkspacesDeleteAutopilotObjectiveParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Outcome of a session mode change, including any model switch it triggered and follow-up the host must perform.
+/// Result of deleting the autopilot objective file.
 ///
 /// <div class="warning">
 ///
@@ -21574,29 +23164,9 @@ pub struct SessionModeGetParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionModeSetResult {
-    /// Whether the host should arm an interactive continuation after the mode change.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub arm_interactive_continuation: Option<bool>,
-    /// Compaction confirmation required before the mode change can complete.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub confirmation: Option<ModelSwitchConfirmation>,
-    /// Whether the host must defer implementing the requested mode change.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub defer_implementation: Option<bool>,
-    /// Deprecation warnings associated with the model selected by the mode change.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub deprecation_warnings: Option<Vec<String>>,
-    /// User-facing outcome message for the model switch triggered by the mode change.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub message: Option<String>,
-    /// Whether applying the mode changed the active model.
-    pub model_changed: bool,
-    /// Lifecycle status of the requested mode change.
-    pub status: String,
-    /// User-facing warning produced while applying the mode change.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub warning: Option<String>,
+pub struct SessionWorkspacesDeleteAutopilotObjectiveResult {
+    /// True when a file was deleted.
+    pub deleted: bool,
 }
 
 /// Identifies the target session.
@@ -21609,12 +23179,12 @@ pub struct SessionModeSetResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionNameGetParams {
+pub struct SessionWorkspacesAutopilotObjectiveExistsParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// The session's friendly name, or null when not yet set.
+/// Whether the autopilot objective file exists.
 ///
 /// <div class="warning">
 ///
@@ -21624,27 +23194,23 @@ pub struct SessionNameGetParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionNameGetResult {
-    /// The session name (user-set or auto-generated), or null if not yet set
-    pub name: Option<String>,
+pub struct SessionWorkspacesAutopilotObjectiveExistsResult {
+    /// True when the objective file exists.
+    pub exists: bool,
 }
 
-/// Indicates whether the auto-generated summary was applied as the session's name.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionNameSetAutoResult {
-    /// Whether the auto-generated summary was persisted. False if the session already has a user-set name, the summary normalized to empty, or the session does not have a workspace.
-    pub applied: bool,
+pub struct SessionWorkspacesSaveLargePasteResultSaved {
+    /// Filename within the workspace files directory
+    pub filename: String,
+    /// Absolute filesystem path to the saved paste file
+    pub file_path: String,
+    /// Size of the saved file in bytes
+    pub size_bytes: i64,
 }
 
-/// Identifies the target session.
+/// Descriptor for the saved paste file, or null when the workspace is unavailable.
 ///
 /// <div class="warning">
 ///
@@ -21654,12 +23220,12 @@ pub struct SessionNameSetAutoResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPlanReadParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionWorkspacesSaveLargePasteResult {
+    /// Saved-paste descriptor, or null when the workspace is unavailable (e.g. CCA runtime, non-infinite sessions, remote sessions)
+    pub saved: Option<SessionWorkspacesSaveLargePasteResultSaved>,
 }
 
-/// Existence, contents, and resolved path of the session plan file.
+/// Workspace diff result for the requested mode.
 ///
 /// <div class="warning">
 ///
@@ -21669,13 +23235,21 @@ pub struct SessionPlanReadParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPlanReadResult {
-    /// The content of the plan file, or null if it does not exist
-    pub content: Option<String>,
-    /// Whether the plan file exists in the workspace
-    pub exists: bool,
-    /// Absolute file path of the plan file, or null if workspace is not enabled
-    pub path: Option<String>,
+pub struct SessionWorkspacesDiffResult {
+    /// Default branch used for a branch diff, when branch mode was requested.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub base_branch: Option<String>,
+    /// Changed files and their unified diffs.
+    pub changes: Vec<WorkspaceDiffFileChange>,
+    /// Whether the requested diff fell back to unstaged changes, either because branch diff failed or session diff was unavailable.
+    pub is_fallback: bool,
+    /// Effective mode used for the returned changes.
+    pub mode: WorkspaceDiffMode,
+    /// Diff mode requested by the client.
+    pub requested_mode: WorkspaceDiffMode,
+    /// Why the session diff could not be produced, when applicable. Set only when `session` mode was requested and `isFallback` is true, so a client can tell the permanent `file-change-tracking-disabled` apart from the transient `session-busy`, which the same request answers once the session settles. Never set for `unstaged` or `branch` mode, and never `unsupported-remote-session`: a remote session's captures live on its own host, so a `session`-mode diff is rejected for one rather than answered with a controller-side fallback.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub unavailable_reason: Option<HistoryRewindUnavailableReason>,
 }
 
 /// Identifies the target session.
@@ -21688,12 +23262,12 @@ pub struct SessionPlanReadResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPlanDeleteParams {
+pub struct SessionCompletionsGetTriggerCharactersParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Identifies the target session.
+/// Characters that, when typed in the composer, should trigger a `completions.request`. Empty when the session has no host-driven completions (e.g. local sessions, or a relay host that does not advertise `completionTriggerCharacters`).
 ///
 /// <div class="warning">
 ///
@@ -21703,12 +23277,12 @@ pub struct SessionPlanDeleteParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPlanReadSqlTodosParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionCompletionsGetTriggerCharactersResult {
+    /// Trigger characters advertised by the host (e.g. `["@", "#"]`). Empty disables host-driven completions for the session.
+    pub trigger_characters: Vec<String>,
 }
 
-/// Todo rows read from the session SQL database. Empty when no session database is available.
+/// Host-driven completion items for the current composer input. Empty when the host returns no items or does not support completions.
 ///
 /// <div class="warning">
 ///
@@ -21718,9 +23292,9 @@ pub struct SessionPlanReadSqlTodosParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPlanReadSqlTodosResult {
-    /// Rows from the session SQL todos table, ordered by creation time with insertion order used to break ties when available and id used for WITHOUT ROWID tables.
-    pub rows: Vec<PlanSqlTodosRow>,
+pub struct SessionCompletionsRequestResult {
+    /// Completion items in host-ranked order.
+    pub items: Vec<SessionCompletionItem>,
 }
 
 /// Identifies the target session.
@@ -21733,12 +23307,12 @@ pub struct SessionPlanReadSqlTodosResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPlanReadSqlTodosWithDependenciesParams {
+pub struct SessionInstructionsGetSourcesParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Todo rows + dependency edges read from the session SQL database.
+/// Instruction sources loaded for the session, in merge order.
 ///
 /// <div class="warning">
 ///
@@ -21748,14 +23322,12 @@ pub struct SessionPlanReadSqlTodosWithDependenciesParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPlanReadSqlTodosWithDependenciesResult {
-    /// Edges from the session SQL todo_deps table. Empty when no database, no todo_deps table, or the SELECT failed. Read independently from `rows`, so a broken todo_deps table does not affect the rows result and vice versa.
-    pub dependencies: Vec<PlanSqlTodoDependency>,
-    /// Rows from the session SQL todos table, ordered by creation time with insertion order used to break ties when available and id used for WITHOUT ROWID tables. Empty when no database, no todos table, or the SELECT failed.
-    pub rows: Vec<PlanSqlTodosRow>,
+pub struct SessionInstructionsGetSourcesResult {
+    /// Instruction sources for the session
+    pub sources: Vec<InstructionSource>,
 }
 
-/// Identifies the target session.
+/// Indicates whether fleet mode was successfully activated.
 ///
 /// <div class="warning">
 ///
@@ -21765,70 +23337,12 @@ pub struct SessionPlanReadSqlTodosWithDependenciesResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesGetWorkspaceParams {
-    /// Target session identifier
-    pub session_id: SessionId,
-}
-
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesGetWorkspaceResultWorkspace {
-    /// Current Git branch.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub branch: Option<String>,
-    /// Whether the per-session Chronicle upgrade prompt was dismissed for the workspace.
-    #[serde(
-        rename = "chronicle_sync_dismissed",
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub chronicle_sync_dismissed: Option<bool>,
-    /// Name of the client that created the workspace.
-    #[serde(rename = "client_name", skip_serializing_if = "Option::is_none")]
-    pub client_name: Option<String>,
-    /// Timestamp when the workspace was created.
-    #[serde(rename = "created_at", skip_serializing_if = "Option::is_none")]
-    pub created_at: Option<String>,
-    /// Current working directory associated with the workspace.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cwd: Option<String>,
-    /// Git repository root associated with the workspace.
-    #[serde(rename = "git_root", skip_serializing_if = "Option::is_none")]
-    pub git_root: Option<String>,
-    /// Allowed values for the `WorkspacesWorkspaceDetailsHostType` enumeration.
-    #[serde(rename = "host_type", skip_serializing_if = "Option::is_none")]
-    pub host_type: Option<WorkspacesWorkspaceDetailsHostType>,
-    /// Stable workspace identifier.
-    pub id: String,
-    /// Most recent Mission Control event identifier observed for the workspace.
-    #[serde(rename = "mc_last_event_id", skip_serializing_if = "Option::is_none")]
-    pub mc_last_event_id: Option<String>,
-    /// Mission Control session identifier associated with the workspace.
-    #[serde(rename = "mc_session_id", skip_serializing_if = "Option::is_none")]
-    pub mc_session_id: Option<String>,
-    /// Mission Control task identifier associated with the workspace.
-    #[serde(rename = "mc_task_id", skip_serializing_if = "Option::is_none")]
-    pub mc_task_id: Option<String>,
-    /// Workspace display name.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    /// Whether the workspace session can be steered remotely.
-    #[serde(rename = "remote_steerable", skip_serializing_if = "Option::is_none")]
-    pub remote_steerable: Option<bool>,
-    /// Repository identifier associated with the workspace.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub repository: Option<String>,
-    /// Number of persisted summaries in the workspace.
-    #[serde(rename = "summary_count", skip_serializing_if = "Option::is_none")]
-    pub summary_count: Option<i64>,
-    /// Timestamp when the workspace was last updated.
-    #[serde(rename = "updated_at", skip_serializing_if = "Option::is_none")]
-    pub updated_at: Option<String>,
-    /// Whether the workspace name was explicitly chosen by the user.
-    #[serde(rename = "user_named", skip_serializing_if = "Option::is_none")]
-    pub user_named: Option<bool>,
+pub struct SessionFleetStartResult {
+    /// Whether fleet mode was successfully activated
+    pub started: bool,
 }
 
-/// Current workspace metadata for the session, including its absolute filesystem path when available.
+/// Agents available to the session.
 ///
 /// <div class="warning">
 ///
@@ -21838,73 +23352,27 @@ pub struct SessionWorkspacesGetWorkspaceResultWorkspace {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesGetWorkspaceResult {
-    /// Absolute filesystem path to the workspace directory. Omitted when the session has no workspace (e.g. remote sessions).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub path: Option<String>,
-    /// Current workspace metadata, or null if not available
-    pub workspace: Option<SessionWorkspacesGetWorkspaceResultWorkspace>,
+pub struct SessionAgentListResult {
+    /// Available agents
+    pub agents: Vec<AgentInfo>,
 }
 
+/// Identifies the target session.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesUpdateMetadataResultWorkspace {
-    /// Current Git branch.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub branch: Option<String>,
-    /// Whether the per-session Chronicle upgrade prompt was dismissed for the workspace.
-    #[serde(
-        rename = "chronicle_sync_dismissed",
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub chronicle_sync_dismissed: Option<bool>,
-    /// Name of the client that created the workspace.
-    #[serde(rename = "client_name", skip_serializing_if = "Option::is_none")]
-    pub client_name: Option<String>,
-    /// Timestamp when the workspace was created.
-    #[serde(rename = "created_at", skip_serializing_if = "Option::is_none")]
-    pub created_at: Option<String>,
-    /// Current working directory associated with the workspace.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cwd: Option<String>,
-    /// Git repository root associated with the workspace.
-    #[serde(rename = "git_root", skip_serializing_if = "Option::is_none")]
-    pub git_root: Option<String>,
-    /// Allowed values for the `WorkspacesWorkspaceDetailsHostType` enumeration.
-    #[serde(rename = "host_type", skip_serializing_if = "Option::is_none")]
-    pub host_type: Option<WorkspacesWorkspaceDetailsHostType>,
-    /// Stable workspace identifier.
-    pub id: String,
-    /// Most recent Mission Control event identifier observed for the workspace.
-    #[serde(rename = "mc_last_event_id", skip_serializing_if = "Option::is_none")]
-    pub mc_last_event_id: Option<String>,
-    /// Mission Control session identifier associated with the workspace.
-    #[serde(rename = "mc_session_id", skip_serializing_if = "Option::is_none")]
-    pub mc_session_id: Option<String>,
-    /// Mission Control task identifier associated with the workspace.
-    #[serde(rename = "mc_task_id", skip_serializing_if = "Option::is_none")]
-    pub mc_task_id: Option<String>,
-    /// Workspace display name.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    /// Whether the workspace session can be steered remotely.
-    #[serde(rename = "remote_steerable", skip_serializing_if = "Option::is_none")]
-    pub remote_steerable: Option<bool>,
-    /// Repository identifier associated with the workspace.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub repository: Option<String>,
-    /// Number of persisted summaries in the workspace.
-    #[serde(rename = "summary_count", skip_serializing_if = "Option::is_none")]
-    pub summary_count: Option<i64>,
-    /// Timestamp when the workspace was last updated.
-    #[serde(rename = "updated_at", skip_serializing_if = "Option::is_none")]
-    pub updated_at: Option<String>,
-    /// Whether the workspace name was explicitly chosen by the user.
-    #[serde(rename = "user_named", skip_serializing_if = "Option::is_none")]
-    pub user_named: Option<bool>,
+pub struct SessionAgentGetCurrentParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Current workspace metadata for the session, including its absolute filesystem path when available.
+/// The currently selected custom agent, or null when using the default agent.
 ///
 /// <div class="warning">
 ///
@@ -21914,73 +23382,27 @@ pub struct SessionWorkspacesUpdateMetadataResultWorkspace {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesUpdateMetadataResult {
-    /// Absolute filesystem path to the workspace directory. Omitted when the session has no workspace (e.g. remote sessions).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub path: Option<String>,
-    /// Current workspace metadata, or null if not available
-    pub workspace: Option<SessionWorkspacesUpdateMetadataResultWorkspace>,
+pub struct SessionAgentGetCurrentResult {
+    /// Currently selected custom agent, or null if using the default agent
+    pub agent: AgentInfo,
 }
 
+/// The newly selected custom agent.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesEnsureResultWorkspace {
-    /// Current Git branch.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub branch: Option<String>,
-    /// Whether the per-session Chronicle upgrade prompt was dismissed for the workspace.
-    #[serde(
-        rename = "chronicle_sync_dismissed",
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub chronicle_sync_dismissed: Option<bool>,
-    /// Name of the client that created the workspace.
-    #[serde(rename = "client_name", skip_serializing_if = "Option::is_none")]
-    pub client_name: Option<String>,
-    /// Timestamp when the workspace was created.
-    #[serde(rename = "created_at", skip_serializing_if = "Option::is_none")]
-    pub created_at: Option<String>,
-    /// Current working directory associated with the workspace.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cwd: Option<String>,
-    /// Git repository root associated with the workspace.
-    #[serde(rename = "git_root", skip_serializing_if = "Option::is_none")]
-    pub git_root: Option<String>,
-    /// Allowed values for the `WorkspacesWorkspaceDetailsHostType` enumeration.
-    #[serde(rename = "host_type", skip_serializing_if = "Option::is_none")]
-    pub host_type: Option<WorkspacesWorkspaceDetailsHostType>,
-    /// Stable workspace identifier.
-    pub id: String,
-    /// Most recent Mission Control event identifier observed for the workspace.
-    #[serde(rename = "mc_last_event_id", skip_serializing_if = "Option::is_none")]
-    pub mc_last_event_id: Option<String>,
-    /// Mission Control session identifier associated with the workspace.
-    #[serde(rename = "mc_session_id", skip_serializing_if = "Option::is_none")]
-    pub mc_session_id: Option<String>,
-    /// Mission Control task identifier associated with the workspace.
-    #[serde(rename = "mc_task_id", skip_serializing_if = "Option::is_none")]
-    pub mc_task_id: Option<String>,
-    /// Workspace display name.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    /// Whether the workspace session can be steered remotely.
-    #[serde(rename = "remote_steerable", skip_serializing_if = "Option::is_none")]
-    pub remote_steerable: Option<bool>,
-    /// Repository identifier associated with the workspace.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub repository: Option<String>,
-    /// Number of persisted summaries in the workspace.
-    #[serde(rename = "summary_count", skip_serializing_if = "Option::is_none")]
-    pub summary_count: Option<i64>,
-    /// Timestamp when the workspace was last updated.
-    #[serde(rename = "updated_at", skip_serializing_if = "Option::is_none")]
-    pub updated_at: Option<String>,
-    /// Whether the workspace name was explicitly chosen by the user.
-    #[serde(rename = "user_named", skip_serializing_if = "Option::is_none")]
-    pub user_named: Option<bool>,
+pub struct SessionAgentSelectResult {
+    /// The newly selected custom agent
+    pub agent: AgentInfo,
 }
 
-/// Current workspace metadata for the session, including its absolute filesystem path when available.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -21990,12 +23412,9 @@ pub struct SessionWorkspacesEnsureResultWorkspace {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesEnsureResult {
-    /// Absolute filesystem path to the workspace directory. Omitted when the session has no workspace (e.g. remote sessions).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub path: Option<String>,
-    /// Current workspace metadata, or null if not available
-    pub workspace: Option<SessionWorkspacesEnsureResultWorkspace>,
+pub struct SessionAgentDeselectParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
 /// Identifies the target session.
@@ -22008,12 +23427,12 @@ pub struct SessionWorkspacesEnsureResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesListFilesParams {
+pub struct SessionAgentReloadParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Relative paths of files stored in the session workspace files directory.
+/// Custom agents available to the session after reloading definitions from disk.
 ///
 /// <div class="warning">
 ///
@@ -22023,12 +23442,12 @@ pub struct SessionWorkspacesListFilesParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesListFilesResult {
-    /// Relative file paths in the workspace files directory
-    pub files: Vec<String>,
+pub struct SessionAgentReloadResult {
+    /// Reloaded custom agents
+    pub agents: Vec<AgentInfo>,
 }
 
-/// Contents of the requested workspace file as a UTF-8 string.
+/// Identifier assigned to the newly started background agent task.
 ///
 /// <div class="warning">
 ///
@@ -22038,9 +23457,9 @@ pub struct SessionWorkspacesListFilesResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesReadFileResult {
-    /// File content as a UTF-8 string
-    pub content: String,
+pub struct SessionTasksStartAgentResult {
+    /// Generated agent ID for the background task
+    pub agent_id: String,
 }
 
 /// Identifies the target session.
@@ -22053,12 +23472,12 @@ pub struct SessionWorkspacesReadFileResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesListCheckpointsParams {
+pub struct SessionTasksListParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Workspace checkpoints in chronological order; empty when the workspace is not enabled.
+/// Background tasks currently tracked by the session.
 ///
 /// <div class="warning">
 ///
@@ -22068,12 +23487,12 @@ pub struct SessionWorkspacesListCheckpointsParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesListCheckpointsResult {
-    /// Workspace checkpoints in chronological order. Empty when workspace is not enabled.
-    pub checkpoints: Vec<WorkspacesCheckpoints>,
+pub struct SessionTasksListResult {
+    /// Currently tracked tasks
+    pub tasks: Vec<serde_json::Value>,
 }
 
-/// Checkpoint content as a UTF-8 string, or null when the checkpoint or workspace is missing.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -22083,12 +23502,12 @@ pub struct SessionWorkspacesListCheckpointsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesReadCheckpointResult {
-    /// Checkpoint content as a UTF-8 string, or null when the checkpoint or workspace is missing
-    pub content: Option<String>,
+pub struct SessionTasksRefreshParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Persisted summary metadata and refreshed workspace metadata.
+/// Refresh metadata for any detached background shells the runtime knows about. Use after a long pause to pick up exit/output state for shells running outside the agent loop.
 ///
 /// <div class="warning">
 ///
@@ -22098,74 +23517,24 @@ pub struct SessionWorkspacesReadCheckpointResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesAddSummaryResult {
-    /// Metadata for the persisted summary.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub summary: Option<serde_json::Value>,
-    /// Refreshed metadata for the containing workspace.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub workspace: Option<serde_json::Value>,
-}
+pub struct SessionTasksRefreshResult {}
 
+/// Identifies the target session.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesTruncateSummariesResultWorkspace {
-    /// Current Git branch.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub branch: Option<String>,
-    /// Whether the per-session Chronicle upgrade prompt was dismissed for the workspace.
-    #[serde(
-        rename = "chronicle_sync_dismissed",
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub chronicle_sync_dismissed: Option<bool>,
-    /// Name of the client that created the workspace.
-    #[serde(rename = "client_name", skip_serializing_if = "Option::is_none")]
-    pub client_name: Option<String>,
-    /// Timestamp when the workspace was created.
-    #[serde(rename = "created_at", skip_serializing_if = "Option::is_none")]
-    pub created_at: Option<String>,
-    /// Current working directory associated with the workspace.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cwd: Option<String>,
-    /// Git repository root associated with the workspace.
-    #[serde(rename = "git_root", skip_serializing_if = "Option::is_none")]
-    pub git_root: Option<String>,
-    /// Allowed values for the `WorkspacesWorkspaceDetailsHostType` enumeration.
-    #[serde(rename = "host_type", skip_serializing_if = "Option::is_none")]
-    pub host_type: Option<WorkspacesWorkspaceDetailsHostType>,
-    /// Stable workspace identifier.
-    pub id: String,
-    /// Most recent Mission Control event identifier observed for the workspace.
-    #[serde(rename = "mc_last_event_id", skip_serializing_if = "Option::is_none")]
-    pub mc_last_event_id: Option<String>,
-    /// Mission Control session identifier associated with the workspace.
-    #[serde(rename = "mc_session_id", skip_serializing_if = "Option::is_none")]
-    pub mc_session_id: Option<String>,
-    /// Mission Control task identifier associated with the workspace.
-    #[serde(rename = "mc_task_id", skip_serializing_if = "Option::is_none")]
-    pub mc_task_id: Option<String>,
-    /// Workspace display name.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    /// Whether the workspace session can be steered remotely.
-    #[serde(rename = "remote_steerable", skip_serializing_if = "Option::is_none")]
-    pub remote_steerable: Option<bool>,
-    /// Repository identifier associated with the workspace.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub repository: Option<String>,
-    /// Number of persisted summaries in the workspace.
-    #[serde(rename = "summary_count", skip_serializing_if = "Option::is_none")]
-    pub summary_count: Option<i64>,
-    /// Timestamp when the workspace was last updated.
-    #[serde(rename = "updated_at", skip_serializing_if = "Option::is_none")]
-    pub updated_at: Option<String>,
-    /// Whether the workspace name was explicitly chosen by the user.
-    #[serde(rename = "user_named", skip_serializing_if = "Option::is_none")]
-    pub user_named: Option<bool>,
+pub struct SessionTasksWaitForPendingParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Current workspace metadata for the session, including its absolute filesystem path when available.
+/// Wait until all in-flight background tasks (agents + shells) and any follow-up turns scheduled by their completions have settled. Returns when the runtime is fully drained or after an internal timeout (default 10 minutes; configurable via COPILOT_TASK_WAIT_TIMEOUT_SECONDS).
 ///
 /// <div class="warning">
 ///
@@ -22175,12 +23544,21 @@ pub struct SessionWorkspacesTruncateSummariesResultWorkspace {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesTruncateSummariesResult {
-    /// Absolute filesystem path to the workspace directory. Omitted when the session has no workspace (e.g. remote sessions).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub path: Option<String>,
-    /// Current workspace metadata, or null if not available
-    pub workspace: Option<SessionWorkspacesTruncateSummariesResultWorkspace>,
+pub struct SessionTasksWaitForPendingResult {}
+
+/// Progress information for the task, or null when no task with that ID is tracked.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionTasksGetProgressResult {
+    /// Progress information for the task, discriminated by type. Returns null when no task with this ID is currently tracked.
+    pub progress: Option<serde_json::Value>,
 }
 
 /// Identifies the target session.
@@ -22193,12 +23571,12 @@ pub struct SessionWorkspacesTruncateSummariesResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesReadAutopilotObjectiveParams {
+pub struct SessionTasksGetCurrentPromotableParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Autopilot objective file content, or null when missing.
+/// The first sync-waiting task that can currently be promoted to background mode.
 ///
 /// <div class="warning">
 ///
@@ -22208,12 +23586,13 @@ pub struct SessionWorkspacesReadAutopilotObjectiveParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesReadAutopilotObjectiveResult {
-    /// Autopilot objective file content, or null when missing.
-    pub content: Option<String>,
+pub struct SessionTasksGetCurrentPromotableResult {
+    /// The first sync-waiting task (agent first, then shell) that can currently be promoted to background mode. Omitted if no such task exists. The returned task is guaranteed to have executionMode='sync' and canPromoteToBackground=true at the time of the call.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub task: Option<serde_json::Value>,
 }
 
-/// Result of writing the autopilot objective file.
+/// Indicates whether the task was successfully promoted to background mode.
 ///
 /// <div class="warning">
 ///
@@ -22223,9 +23602,9 @@ pub struct SessionWorkspacesReadAutopilotObjectiveResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesWriteAutopilotObjectiveResult {
-    /// Filesystem operation performed.
-    pub operation: String,
+pub struct SessionTasksPromoteToBackgroundResult {
+    /// Whether the task was successfully promoted to background mode
+    pub promoted: bool,
 }
 
 /// Identifies the target session.
@@ -22238,12 +23617,12 @@ pub struct SessionWorkspacesWriteAutopilotObjectiveResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesDeleteAutopilotObjectiveParams {
+pub struct SessionTasksPromoteCurrentToBackgroundParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Result of deleting the autopilot objective file.
+/// The promoted task as it now exists in background mode, omitted if no promotable task was waiting.
 ///
 /// <div class="warning">
 ///
@@ -22253,12 +23632,13 @@ pub struct SessionWorkspacesDeleteAutopilotObjectiveParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesDeleteAutopilotObjectiveResult {
-    /// True when a file was deleted.
-    pub deleted: bool,
+pub struct SessionTasksPromoteCurrentToBackgroundResult {
+    /// The promoted task as it now exists in background mode, omitted if no promotable task was waiting. Atomic operation: avoids the race window of getCurrentPromotable + promoteToBackground.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub task: Option<serde_json::Value>,
 }
 
-/// Identifies the target session.
+/// Indicates whether the background task was successfully cancelled.
 ///
 /// <div class="warning">
 ///
@@ -22268,12 +23648,12 @@ pub struct SessionWorkspacesDeleteAutopilotObjectiveResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesAutopilotObjectiveExistsParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionTasksCancelResult {
+    /// Whether the task was successfully cancelled
+    pub cancelled: bool,
 }
 
-/// Whether the autopilot objective file exists.
+/// Indicates whether the task was removed. False when the task does not exist or is still running/idle.
 ///
 /// <div class="warning">
 ///
@@ -22283,23 +23663,30 @@ pub struct SessionWorkspacesAutopilotObjectiveExistsParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesAutopilotObjectiveExistsResult {
-    /// True when the objective file exists.
-    pub exists: bool,
+pub struct SessionTasksRemoveResult {
+    /// Whether the task was removed. Returns false if the task does not exist or is still running/idle (cancel it first).
+    pub removed: bool,
 }
 
+/// Indicates whether the message was delivered, with an error message when delivery failed.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesSaveLargePasteResultSaved {
-    /// Filename within the workspace files directory
-    pub filename: String,
-    /// Absolute filesystem path to the saved paste file
-    pub file_path: String,
-    /// Size of the saved file in bytes
-    pub size_bytes: i64,
+pub struct SessionTasksSendMessageResult {
+    /// Error message if delivery failed
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// Whether the message was successfully delivered or steered
+    pub sent: bool,
 }
 
-/// Descriptor for the saved paste file, or null when the workspace is unavailable.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -22309,12 +23696,12 @@ pub struct SessionWorkspacesSaveLargePasteResultSaved {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesSaveLargePasteResult {
-    /// Saved-paste descriptor, or null when the workspace is unavailable (e.g. CCA runtime, non-infinite sessions, remote sessions)
-    pub saved: Option<SessionWorkspacesSaveLargePasteResultSaved>,
+pub struct SessionSkillsListParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Workspace diff result for the requested mode.
+/// Skills available to the session, with their enabled state.
 ///
 /// <div class="warning">
 ///
@@ -22324,21 +23711,9 @@ pub struct SessionWorkspacesSaveLargePasteResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionWorkspacesDiffResult {
-    /// Default branch used for a branch diff, when branch mode was requested.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub base_branch: Option<String>,
-    /// Changed files and their unified diffs.
-    pub changes: Vec<WorkspaceDiffFileChange>,
-    /// Whether the requested diff fell back to unstaged changes, either because branch diff failed or session diff was unavailable.
-    pub is_fallback: bool,
-    /// Effective mode used for the returned changes.
-    pub mode: WorkspaceDiffMode,
-    /// Diff mode requested by the client.
-    pub requested_mode: WorkspaceDiffMode,
-    /// Why the session diff could not be produced, when applicable. Set only when `session` mode was requested and `isFallback` is true, so a client can tell the permanent `file-change-tracking-disabled` apart from the transient `session-busy`, which the same request answers once the session settles. Never set for `unstaged` or `branch` mode, and never `unsupported-remote-session`: a remote session's captures live on its own host, so a `session`-mode diff is rejected for one rather than answered with a controller-side fallback.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub unavailable_reason: Option<HistoryRewindUnavailableReason>,
+pub struct SessionSkillsListResult {
+    /// Available skills
+    pub skills: Vec<Skill>,
 }
 
 /// Identifies the target session.
@@ -22351,12 +23726,12 @@ pub struct SessionWorkspacesDiffResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionCompletionsGetTriggerCharactersParams {
+pub struct SessionSkillsGetInvokedParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Characters that, when typed in the composer, should trigger a `completions.request`. Empty when the session has no host-driven completions (e.g. local sessions, or a relay host that does not advertise `completionTriggerCharacters`).
+/// Skills invoked during this session, ordered by invocation time (most recent last).
 ///
 /// <div class="warning">
 ///
@@ -22366,12 +23741,12 @@ pub struct SessionCompletionsGetTriggerCharactersParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionCompletionsGetTriggerCharactersResult {
-    /// Trigger characters advertised by the host (e.g. `["@", "#"]`). Empty disables host-driven completions for the session.
-    pub trigger_characters: Vec<String>,
+pub struct SessionSkillsGetInvokedResult {
+    /// Skills invoked during this session, ordered by invocation time (most recent last)
+    pub skills: Vec<SkillsInvokedSkill>,
 }
 
-/// Host-driven completion items for the current composer input. Empty when the host returns no items or does not support completions.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -22381,9 +23756,26 @@ pub struct SessionCompletionsGetTriggerCharactersResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionCompletionsRequestResult {
-    /// Completion items in host-ranked order.
-    pub items: Vec<SessionCompletionItem>,
+pub struct SessionSkillsReloadParams {
+    /// Target session identifier
+    pub session_id: SessionId,
+}
+
+/// Diagnostics from reloading skill definitions, with warnings and errors as separate lists.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionSkillsReloadResult {
+    /// Errors emitted while loading skills (e.g. skills that failed to load entirely)
+    pub errors: Vec<String>,
+    /// Warnings emitted while loading skills (e.g. skills that loaded but had issues)
+    pub warnings: Vec<String>,
 }
 
 /// Identifies the target session.
@@ -22396,12 +23788,12 @@ pub struct SessionCompletionsRequestResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionInstructionsGetSourcesParams {
+pub struct SessionSkillsEnsureLoadedParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Instruction sources loaded for the session, in merge order.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -22411,12 +23803,12 @@ pub struct SessionInstructionsGetSourcesParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionInstructionsGetSourcesResult {
-    /// Instruction sources for the session
-    pub sources: Vec<InstructionSource>,
+pub struct SessionMcpListParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Indicates whether fleet mode was successfully activated.
+/// MCP servers configured for the session, with their connection status and host-level state.
 ///
 /// <div class="warning">
 ///
@@ -22426,12 +23818,15 @@ pub struct SessionInstructionsGetSourcesResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionFleetStartResult {
-    /// Whether fleet mode was successfully activated
-    pub started: bool,
+pub struct SessionMcpListResult {
+    /// Host-level state, omitted when no MCP host is initialized.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub host: Option<McpHostState>,
+    /// Configured MCP servers
+    pub servers: Vec<McpServer>,
 }
 
-/// Agents available to the session.
+/// Tools exposed by the connected MCP server. Throws when the server is not connected.
 ///
 /// <div class="warning">
 ///
@@ -22441,9 +23836,9 @@ pub struct SessionFleetStartResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionAgentListResult {
-    /// Available agents
-    pub agents: Vec<AgentInfo>,
+pub struct SessionMcpListToolsResult {
+    /// Tools exposed by the server.
+    pub tools: Vec<McpTools>,
 }
 
 /// Identifies the target session.
@@ -22456,12 +23851,12 @@ pub struct SessionAgentListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionAgentGetCurrentParams {
+pub struct SessionMcpReloadParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// The currently selected custom agent, or null when using the default agent.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -22471,12 +23866,12 @@ pub struct SessionAgentGetCurrentParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionAgentGetCurrentResult {
-    /// Currently selected custom agent, or null if using the default agent
-    pub agent: AgentInfo,
+pub struct SessionMcpMoveLoadingToBackgroundParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// The newly selected custom agent.
+/// Result of moving in-flight MCP loading to the background.
 ///
 /// <div class="warning">
 ///
@@ -22486,12 +23881,12 @@ pub struct SessionAgentGetCurrentResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionAgentSelectResult {
-    /// The newly selected custom agent
-    pub agent: AgentInfo,
+pub struct SessionMcpMoveLoadingToBackgroundResult {
+    /// Whether an in-flight MCP load was moved to the background, releasing turns that were waiting on it. False when no MCP load was in flight or the waiting turns had already been released.
+    pub moved_to_background: bool,
 }
 
-/// Identifies the target session.
+/// MCP server startup filtering result.
 ///
 /// <div class="warning">
 ///
@@ -22501,9 +23896,66 @@ pub struct SessionAgentSelectResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionAgentDeselectParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionMcpReloadWithConfigResult {
+    /// Non-default servers allowed by policy
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub allowed_servers: Option<Vec<McpAllowedServer>>,
+    /// Servers whose connection attempt failed.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub failed_servers: Option<Vec<McpFailedServer>>,
+    /// Servers filtered out before startup
+    pub filtered_servers: Vec<McpFilteredServer>,
+}
+
+/// Outcome of an MCP sampling execution: success result, failure error, or cancellation.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionMcpExecuteSamplingResult {
+    /// Outcome of the sampling inference. 'success' produced a response; 'failure' encountered an error (including agent-side rejection by content filter or criteria); 'cancelled' the caller cancelled this execution via cancelSamplingExecution.
+    pub action: McpSamplingExecutionAction,
+    /// Error description, present when action='failure'.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// MCP CreateMessageResult payload (with optional 'tools' extension), present when action='success'. Treated as opaque at the schema layer; consumers should construct/consume it per the MCP CreateMessageResult shape.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub result: Option<McpExecuteSamplingResult>,
+}
+
+/// Indicates whether an in-flight sampling execution with the given requestId was found and cancelled.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionMcpCancelSamplingExecutionResult {
+    /// True if an in-flight execution with the given requestId was found and signalled to cancel. False when no such execution is in flight (already completed, never started, or cancelled by another caller).
+    pub cancelled: bool,
+}
+
+/// Env-value mode recorded on the session after the update.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionMcpSetEnvValueModeResult {
+    /// Mode recorded on the session after the update
+    pub mode: McpSetEnvValueModeDetails,
 }
 
 /// Identifies the target session.
@@ -22516,12 +23968,12 @@ pub struct SessionAgentDeselectParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionAgentReloadParams {
+pub struct SessionMcpRemoveGitHubParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Custom agents available to the session after reloading definitions from disk.
+/// Indicates whether the auto-managed `github` MCP server was removed (false when nothing to remove).
 ///
 /// <div class="warning">
 ///
@@ -22531,12 +23983,12 @@ pub struct SessionAgentReloadParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionAgentReloadResult {
-    /// Reloaded custom agents
-    pub agents: Vec<AgentInfo>,
+pub struct SessionMcpRemoveGitHubResult {
+    /// True when the auto-managed `github` MCP server was removed; false when no removal happened (e.g. user has explicitly configured a `github` server, or the server was not registered).
+    pub removed: bool,
 }
 
-/// Identifier assigned to the newly started background agent task.
+/// Result of configuring GitHub MCP.
 ///
 /// <div class="warning">
 ///
@@ -22546,12 +23998,12 @@ pub struct SessionAgentReloadResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionTasksStartAgentResult {
-    /// Generated agent ID for the background task
-    pub agent_id: String,
+pub struct SessionMcpConfigureGitHubResult {
+    /// Whether GitHub MCP configuration changed.
+    pub changed: bool,
 }
 
-/// Identifies the target session.
+/// Whether the named MCP server is running.
 ///
 /// <div class="warning">
 ///
@@ -22561,12 +24013,12 @@ pub struct SessionTasksStartAgentResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionTasksListParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionMcpIsServerRunningResult {
+    /// True if the server has an active client and transport.
+    pub running: bool,
 }
 
-/// Background tasks currently tracked by the session.
+/// Indicates whether the pending MCP OAuth response was accepted.
 ///
 /// <div class="warning">
 ///
@@ -22576,12 +24028,12 @@ pub struct SessionTasksListParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionTasksListResult {
-    /// Currently tracked tasks
-    pub tasks: Vec<serde_json::Value>,
+pub struct SessionMcpOauthHandlePendingRequestResult {
+    /// Whether the response was accepted. False if the request was unknown, timed out, or already resolved.
+    pub success: bool,
 }
 
-/// Identifies the target session.
+/// OAuth authorization URL the caller should open, or empty when cached tokens already authenticated the server.
 ///
 /// <div class="warning">
 ///
@@ -22591,12 +24043,13 @@ pub struct SessionTasksListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionTasksRefreshParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionMcpOauthLoginResult {
+    /// URL the caller should open in a browser to complete OAuth. Omitted when cached tokens were still valid and no browser interaction was needed — the server is already reconnected in that case. When present, the runtime starts the callback listener before returning and continues the flow in the background; completion is signaled via session.mcp_server_status_changed.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub authorization_url: Option<String>,
 }
 
-/// Refresh metadata for any detached background shells the runtime knows about. Use after a long pause to pick up exit/output state for shells running outside the agent loop.
+/// Indicates whether the pending MCP OAuth response was accepted.
 ///
 /// <div class="warning">
 ///
@@ -22606,9 +24059,12 @@ pub struct SessionTasksRefreshParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionTasksRefreshResult {}
+pub struct SessionMcpOauthRespondResult {
+    /// Whether the response was accepted. False if the request was unknown, timed out, or already resolved.
+    pub success: bool,
+}
 
-/// Identifies the target session.
+/// Indicates whether the pending MCP headers refresh response was accepted.
 ///
 /// <div class="warning">
 ///
@@ -22618,12 +24074,12 @@ pub struct SessionTasksRefreshResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionTasksWaitForPendingParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionMcpHeadersHandlePendingHeadersRefreshRequestResult {
+    /// Whether the response was accepted. False if the request was unknown, timed out, or already resolved.
+    pub success: bool,
 }
 
-/// Wait until all in-flight background tasks (agents + shells) and any follow-up turns scheduled by their completions have settled. Returns when the runtime is fully drained or after an internal timeout (default 10 minutes; configurable via COPILOT_TASK_WAIT_TIMEOUT_SECONDS).
+/// Resource contents returned by the MCP server.
 ///
 /// <div class="warning">
 ///
@@ -22633,9 +24089,12 @@ pub struct SessionTasksWaitForPendingParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionTasksWaitForPendingResult {}
+pub struct SessionMcpAppsReadResourceResult {
+    /// Resource contents returned by the server
+    pub contents: Vec<McpAppsResourceContent>,
+}
 
-/// Progress information for the task, or null when no task with that ID is tracked.
+/// App-callable tools from the named MCP server.
 ///
 /// <div class="warning">
 ///
@@ -22645,9 +24104,9 @@ pub struct SessionTasksWaitForPendingResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionTasksGetProgressResult {
-    /// Progress information for the task, discriminated by type. Returns null when no task with this ID is currently tracked.
-    pub progress: Option<serde_json::Value>,
+pub struct SessionMcpAppsListToolsResult {
+    /// App-callable tools from the server
+    pub tools: Vec<HashMap<String, serde_json::Value>>,
 }
 
 /// Identifies the target session.
@@ -22660,12 +24119,12 @@ pub struct SessionTasksGetProgressResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionTasksGetCurrentPromotableParams {
+pub struct SessionMcpAppsGetHostContextParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// The first sync-waiting task that can currently be promoted to background mode.
+/// Current host context advertised to MCP App guests.
 ///
 /// <div class="warning">
 ///
@@ -22675,13 +24134,12 @@ pub struct SessionTasksGetCurrentPromotableParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionTasksGetCurrentPromotableResult {
-    /// The first sync-waiting task (agent first, then shell) that can currently be promoted to background mode. Omitted if no such task exists. The returned task is guaranteed to have executionMode='sync' and canPromoteToBackground=true at the time of the call.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub task: Option<serde_json::Value>,
+pub struct SessionMcpAppsGetHostContextResult {
+    /// Current host context
+    pub context: McpAppsHostContextDetails,
 }
 
-/// Indicates whether the task was successfully promoted to background mode.
+/// Diagnostic snapshot of MCP Apps wiring for the named server.
 ///
 /// <div class="warning">
 ///
@@ -22691,12 +24149,14 @@ pub struct SessionTasksGetCurrentPromotableResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionTasksPromoteToBackgroundResult {
-    /// Whether the task was successfully promoted to background mode
-    pub promoted: bool,
+pub struct SessionMcpAppsDiagnoseResult {
+    /// Capability negotiation snapshot
+    pub capability: McpAppsDiagnoseCapability,
+    /// What the server returned for this session
+    pub server: McpAppsDiagnoseServer,
 }
 
-/// Identifies the target session.
+/// Resource contents returned by the MCP server.
 ///
 /// <div class="warning">
 ///
@@ -22706,12 +24166,12 @@ pub struct SessionTasksPromoteToBackgroundResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionTasksPromoteCurrentToBackgroundParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionMcpResourcesReadResult {
+    /// Resource contents returned by the server
+    pub contents: Vec<McpResourceContent>,
 }
 
-/// The promoted task as it now exists in background mode, omitted if no promotable task was waiting.
+/// One page of resources advertised by the named MCP server.
 ///
 /// <div class="warning">
 ///
@@ -22721,13 +24181,15 @@ pub struct SessionTasksPromoteCurrentToBackgroundParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionTasksPromoteCurrentToBackgroundResult {
-    /// The promoted task as it now exists in background mode, omitted if no promotable task was waiting. Atomic operation: avoids the race window of getCurrentPromotable + promoteToBackground.
+pub struct SessionMcpResourcesListResult {
+    /// Opaque cursor for the next page, if the server has more resources
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub task: Option<serde_json::Value>,
+    pub next_cursor: Option<String>,
+    /// Resources advertised by the server (proxied MCP `resources/list`)
+    pub resources: Vec<McpResource>,
 }
 
-/// Indicates whether the background task was successfully cancelled.
+/// One page of resource templates advertised by the named MCP server.
 ///
 /// <div class="warning">
 ///
@@ -22737,12 +24199,15 @@ pub struct SessionTasksPromoteCurrentToBackgroundResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionTasksCancelResult {
-    /// Whether the task was successfully cancelled
-    pub cancelled: bool,
+pub struct SessionMcpResourcesListTemplatesResult {
+    /// Opaque cursor for the next page, if the server has more resource templates
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_cursor: Option<String>,
+    /// Resource templates advertised by the server (proxied MCP `resources/templates/list`)
+    pub resource_templates: Vec<McpResourceTemplate>,
 }
 
-/// Indicates whether the task was removed. False when the task does not exist or is still running/idle.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -22752,12 +24217,12 @@ pub struct SessionTasksCancelResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionTasksRemoveResult {
-    /// Whether the task was removed. Returns false if the task does not exist or is still running/idle (cancel it first).
-    pub removed: bool,
+pub struct SessionPluginsListParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Indicates whether the message was delivered, with an error message when delivery failed.
+/// Plugins installed for the session, with their enabled state and version metadata.
 ///
 /// <div class="warning">
 ///
@@ -22767,15 +24232,12 @@ pub struct SessionTasksRemoveResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionTasksSendMessageResult {
-    /// Error message if delivery failed
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Whether the message was successfully delivered or steered
-    pub sent: bool,
+pub struct SessionPluginsListResult {
+    /// Installed plugins
+    pub plugins: Vec<Plugin>,
 }
 
-/// Identifies the target session.
+/// A snapshot of the provider endpoint the session is currently configured to talk to.
 ///
 /// <div class="warning">
 ///
@@ -22785,12 +24247,28 @@ pub struct SessionTasksSendMessageResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSkillsListParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionProviderGetEndpointResult {
+    /// A credential the caller should use with this endpoint. Omitted only when the endpoint accepts unauthenticated requests.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub api_key: Option<String>,
+    /// Base URL to pass to the LLM client library.
+    pub base_url: String,
+    /// HTTP headers the caller must include on every outbound request.
+    pub headers: HashMap<String, String>,
+    /// Short-lived, rotating credential the caller must send on every request, in addition to `apiKey` if one is present. Omitted when the endpoint does not require one.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub session_token: Option<ProviderSessionToken>,
+    /// Transport to be used for provider requests.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub transport: Option<ProviderEndpointTransport>,
+    /// Provider family. Matches the `type` field of a BYOK provider config.
+    pub r#type: ProviderEndpointType,
+    /// Wire API to be used, when required for the provider type.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub wire_api: Option<ProviderEndpointWireApi>,
 }
 
-/// Skills available to the session, with their enabled state.
+/// The selectable model entries synthesized for the models added by this call.
 ///
 /// <div class="warning">
 ///
@@ -22800,12 +24278,12 @@ pub struct SessionSkillsListParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSkillsListResult {
-    /// Available skills
-    pub skills: Vec<Skill>,
+pub struct SessionProviderAddResult {
+    /// Synthesized selectable model entries for the newly added BYOK models, each under its provider-qualified selection id (`provider/id`). Empty when only providers were added.
+    pub models: Vec<serde_json::Value>,
 }
 
-/// Identifies the target session.
+/// Indicates whether the session options patch was applied successfully.
 ///
 /// <div class="warning">
 ///
@@ -22815,12 +24293,15 @@ pub struct SessionSkillsListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSkillsGetInvokedParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionOptionsUpdateResult {
+    /// Number of hooks loaded from installed plugins, returned when installedPlugins is updated
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub plugin_hook_count: Option<i64>,
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// Skills invoked during this session, ordered by invocation time (most recent last).
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -22830,12 +24311,12 @@ pub struct SessionSkillsGetInvokedParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSkillsGetInvokedResult {
-    /// Skills invoked during this session, ordered by invocation time (most recent last)
-    pub skills: Vec<SkillsInvokedSkill>,
+pub struct SessionExtensionsListParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Identifies the target session.
+/// Extensions discovered for the session, with their current status.
 ///
 /// <div class="warning">
 ///
@@ -22845,12 +24326,12 @@ pub struct SessionSkillsGetInvokedResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSkillsReloadParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionExtensionsListResult {
+    /// Discovered extensions and their current status
+    pub extensions: Vec<Extension>,
 }
 
-/// Diagnostics from reloading skill definitions, with warnings and errors as separate lists.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -22860,14 +24341,12 @@ pub struct SessionSkillsReloadParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSkillsReloadResult {
-    /// Errors emitted while loading skills (e.g. skills that failed to load entirely)
-    pub errors: Vec<String>,
-    /// Warnings emitted while loading skills (e.g. skills that loaded but had issues)
-    pub warnings: Vec<String>,
+pub struct SessionExtensionsReloadParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Identifies the target session.
+/// Rust-owned built-in tool descriptors for the session.
 ///
 /// <div class="warning">
 ///
@@ -22877,12 +24356,12 @@ pub struct SessionSkillsReloadResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSkillsEnsureLoadedParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionToolsGetBuiltinDescriptorsResult {
+    /// Built-in tool descriptors materialized for the session.
+    pub tools: Vec<BuiltinToolDescriptor>,
 }
 
-/// Identifies the target session.
+/// Task completion notification with summary from the agent
 ///
 /// <div class="warning">
 ///
@@ -22892,12 +24371,25 @@ pub struct SessionSkillsEnsureLoadedParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpListParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionToolsTaskCompleteEventDataResult {
+    /// Active autopilot objective ID evaluated by the completion reviewer
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub objective_id: Option<i64>,
+    /// Semantic completion decision. Absent on legacy events and invalid tool calls
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub outcome: Option<TaskCompletionOutcome>,
+    /// Label-safe runtime rationale for the completion decision (e.g. a cancellation or pause/resume downgrade), when one applies. Reviewer-authored rationale is intentionally omitted here because this event has no IFC label channel; the reviewer's findings remain available through its own labeled sub-agent events
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reason: Option<String>,
+    /// Whether the task was accepted as complete. False when validation failed or completion was rejected or blocked by the reviewer
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub success: Option<bool>,
+    /// Summary of the completed task, provided by the agent
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub summary: Option<String>,
 }
 
-/// MCP servers configured for the session, with their connection status and host-level state.
+/// Indicates whether the external tool call result was handled successfully.
 ///
 /// <div class="warning">
 ///
@@ -22907,15 +24399,12 @@ pub struct SessionMcpListParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpListResult {
-    /// Host-level state, omitted when no MCP host is initialized.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub host: Option<McpHostState>,
-    /// Configured MCP servers
-    pub servers: Vec<McpServer>,
+pub struct SessionToolsHandlePendingToolCallResult {
+    /// Whether the tool call result was handled successfully
+    pub success: bool,
 }
 
-/// Tools exposed by the connected MCP server. Throws when the server is not connected.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -22925,12 +24414,12 @@ pub struct SessionMcpListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpListToolsResult {
-    /// Tools exposed by the server.
-    pub tools: Vec<McpTools>,
+pub struct SessionToolsInitializeAndValidateParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Identifies the target session.
+/// Resolve, build, and validate the runtime tool list for this session. Subagent sessions and consumer flows that need an initialized tool set before `send` invoke this. Default base-class implementation is a no-op for sessions that don't support tool validation.
 ///
 /// <div class="warning">
 ///
@@ -22940,12 +24429,9 @@ pub struct SessionMcpListToolsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpReloadParams {
-    /// Target session identifier
-    pub session_id: SessionId,
-}
+pub struct SessionToolsInitializeAndValidateResult {}
 
-/// MCP server startup filtering result.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -22955,18 +24441,12 @@ pub struct SessionMcpReloadParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpReloadWithConfigResult {
-    /// Non-default servers allowed by policy
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub allowed_servers: Option<Vec<McpAllowedServer>>,
-    /// Servers whose connection attempt failed.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub failed_servers: Option<Vec<McpFailedServer>>,
-    /// Servers filtered out before startup
-    pub filtered_servers: Vec<McpFilteredServer>,
+pub struct SessionToolsGetCurrentMetadataParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Outcome of an MCP sampling execution: success result, failure error, or cancellation.
+/// Current lightweight tool metadata snapshot for the session.
 ///
 /// <div class="warning">
 ///
@@ -22976,18 +24456,12 @@ pub struct SessionMcpReloadWithConfigResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpExecuteSamplingResult {
-    /// Outcome of the sampling inference. 'success' produced a response; 'failure' encountered an error (including agent-side rejection by content filter or criteria); 'cancelled' the caller cancelled this execution via cancelSamplingExecution.
-    pub action: McpSamplingExecutionAction,
-    /// Error description, present when action='failure'.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// MCP CreateMessageResult payload (with optional 'tools' extension), present when action='success'. Treated as opaque at the schema layer; consumers should construct/consume it per the MCP CreateMessageResult shape.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub result: Option<McpExecuteSamplingResult>,
+pub struct SessionToolsGetCurrentMetadataResult {
+    /// Current tool metadata, or null when tools have not been initialized yet
+    pub tools: Option<Vec<CurrentToolMetadata>>,
 }
 
-/// Indicates whether an in-flight sampling execution with the given requestId was found and cancelled.
+/// Empty result after replacing the calling connection's externally implemented tools.
 ///
 /// <div class="warning">
 ///
@@ -22997,12 +24471,9 @@ pub struct SessionMcpExecuteSamplingResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpCancelSamplingExecutionResult {
-    /// True if an in-flight execution with the given requestId was found and signalled to cancel. False when no such execution is in flight (already completed, never started, or cancelled by another caller).
-    pub cancelled: bool,
-}
+pub struct SessionToolsSetResult {}
 
-/// Env-value mode recorded on the session after the update.
+/// Empty result after applying subagent settings
 ///
 /// <div class="warning">
 ///
@@ -23012,12 +24483,9 @@ pub struct SessionMcpCancelSamplingExecutionResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpSetEnvValueModeResult {
-    /// Mode recorded on the session after the update
-    pub mode: McpSetEnvValueModeDetails,
-}
+pub struct SessionToolsUpdateSubagentSettingsResult {}
 
-/// Identifies the target session.
+/// Slash commands available in the session, after applying any include/exclude filters.
 ///
 /// <div class="warning">
 ///
@@ -23027,12 +24495,12 @@ pub struct SessionMcpSetEnvValueModeResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpRemoveGitHubParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionCommandsListResult {
+    /// Commands available in this session
+    pub commands: Vec<SlashCommandInfo>,
 }
 
-/// Indicates whether the auto-managed `github` MCP server was removed (false when nothing to remove).
+/// Whether finalizing the invocation effect succeeded, and the failure reason when it did not.
 ///
 /// <div class="warning">
 ///
@@ -23042,12 +24510,15 @@ pub struct SessionMcpRemoveGitHubParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpRemoveGitHubResult {
-    /// True when the auto-managed `github` MCP server was removed; false when no removal happened (e.g. user has explicitly configured a `github` server, or the server was not registered).
-    pub removed: bool,
+pub struct SessionCommandsFinalizeInvocationEffectResult {
+    /// Failure reason when the invocation effect could not be finalized.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// Whether the pending invocation effect was finalized successfully.
+    pub success: bool,
 }
 
-/// Result of configuring GitHub MCP.
+/// Indicates whether the pending client-handled command was completed successfully.
 ///
 /// <div class="warning">
 ///
@@ -23057,12 +24528,12 @@ pub struct SessionMcpRemoveGitHubResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpConfigureGitHubResult {
-    /// Whether GitHub MCP configuration changed.
-    pub changed: bool,
+pub struct SessionCommandsHandlePendingCommandResult {
+    /// Whether the command was handled successfully
+    pub success: bool,
 }
 
-/// Whether the named MCP server is running.
+/// Error message produced while executing the command, if any.
 ///
 /// <div class="warning">
 ///
@@ -23072,12 +24543,13 @@ pub struct SessionMcpConfigureGitHubResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpIsServerRunningResult {
-    /// True if the server has an active client and transport.
-    pub running: bool,
+pub struct SessionCommandsExecuteResult {
+    /// Error message produced while executing the command, if any. Omitted when the handler succeeded.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
 }
 
-/// Indicates whether the pending MCP OAuth response was accepted.
+/// Indicates whether the command was accepted into the local execution queue.
 ///
 /// <div class="warning">
 ///
@@ -23087,12 +24559,12 @@ pub struct SessionMcpIsServerRunningResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpOauthHandlePendingRequestResult {
-    /// Whether the response was accepted. False if the request was unknown, timed out, or already resolved.
-    pub success: bool,
+pub struct SessionCommandsEnqueueResult {
+    /// True when the command was accepted into the local execution queue. False when the call targets a session that does not support local command queueing (e.g. remote sessions).
+    pub queued: bool,
 }
 
-/// OAuth authorization URL the caller should open, or empty when cached tokens already authenticated the server.
+/// Indicates whether the queued-command response was matched to a pending request.
 ///
 /// <div class="warning">
 ///
@@ -23102,13 +24574,12 @@ pub struct SessionMcpOauthHandlePendingRequestResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpOauthLoginResult {
-    /// URL the caller should open in a browser to complete OAuth. Omitted when cached tokens were still valid and no browser interaction was needed — the server is already reconnected in that case. When present, the runtime starts the callback listener before returning and continues the flow in the background; completion is signaled via session.mcp_server_status_changed.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub authorization_url: Option<String>,
+pub struct SessionCommandsRespondToQueuedCommandResult {
+    /// Whether a pending queued command with the given request ID was found and resolved. False when the request was already resolved, cancelled, or unknown.
+    pub success: bool,
 }
 
-/// Indicates whether the pending MCP OAuth response was accepted.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -23118,12 +24589,12 @@ pub struct SessionMcpOauthLoginResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpOauthRespondResult {
-    /// Whether the response was accepted. False if the request was unknown, timed out, or already resolved.
-    pub success: bool,
+pub struct SessionTelemetryGetEngagementIdParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Indicates whether the pending MCP headers refresh response was accepted.
+/// Telemetry engagement ID for the session, when available.
 ///
 /// <div class="warning">
 ///
@@ -23133,12 +24604,13 @@ pub struct SessionMcpOauthRespondResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpHeadersHandlePendingHeadersRefreshRequestResult {
-    /// Whether the response was accepted. False if the request was unknown, timed out, or already resolved.
-    pub success: bool,
+pub struct SessionTelemetryGetEngagementIdResult {
+    /// Current telemetry engagement ID, when available.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub engagement_id: Option<String>,
 }
 
-/// Resource contents returned by the MCP server.
+/// Completed transient query. Ordered chunks and the terminal outcome are also delivered through `ui.ephemeral_query` session events while it runs.
 ///
 /// <div class="warning">
 ///
@@ -23148,12 +24620,12 @@ pub struct SessionMcpHeadersHandlePendingHeadersRefreshRequestResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpAppsReadResourceResult {
-    /// Resource contents returned by the server
-    pub contents: Vec<McpAppsResourceContent>,
+pub struct SessionUiEphemeralQueryResult {
+    /// Answer returned by the model
+    pub answer: String,
 }
 
-/// App-callable tools from the named MCP server.
+/// The elicitation response (accept with form values, decline, or cancel)
 ///
 /// <div class="warning">
 ///
@@ -23163,12 +24635,18 @@ pub struct SessionMcpAppsReadResourceResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpAppsListToolsResult {
-    /// App-callable tools from the server
-    pub tools: Vec<HashMap<String, serde_json::Value>>,
+pub struct SessionUiElicitationResult {
+    /// MCP response metadata.
+    #[serde(rename = "_meta", skip_serializing_if = "Option::is_none")]
+    pub meta: Option<HashMap<String, serde_json::Value>>,
+    /// The user's response: accept (submitted), decline (rejected), or cancel (dismissed)
+    pub action: UIElicitationResponseAction,
+    /// The form values submitted by the user (present when action is 'accept')
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub content: Option<HashMap<String, serde_json::Value>>,
 }
 
-/// Identifies the target session.
+/// Indicates whether the elicitation response was accepted; false if it was already resolved by another client.
 ///
 /// <div class="warning">
 ///
@@ -23178,12 +24656,12 @@ pub struct SessionMcpAppsListToolsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpAppsGetHostContextParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionUiHandlePendingElicitationResult {
+    /// Whether the response was accepted. False if the request was already resolved by another client.
+    pub success: bool,
 }
 
-/// Current host context advertised to MCP App guests.
+/// Indicates whether the pending UI request was resolved by this call.
 ///
 /// <div class="warning">
 ///
@@ -23193,12 +24671,12 @@ pub struct SessionMcpAppsGetHostContextParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpAppsGetHostContextResult {
-    /// Current host context
-    pub context: McpAppsHostContextDetails,
+pub struct SessionUiHandlePendingUserInputResult {
+    /// True if the request was still pending and was resolved by this call. False if the request ID was unknown, already resolved by another client (e.g. GitHub), expired, or otherwise no longer pending.
+    pub success: bool,
 }
 
-/// Diagnostic snapshot of MCP Apps wiring for the named server.
+/// Indicates whether the pending UI request was resolved by this call.
 ///
 /// <div class="warning">
 ///
@@ -23208,14 +24686,12 @@ pub struct SessionMcpAppsGetHostContextResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpAppsDiagnoseResult {
-    /// Capability negotiation snapshot
-    pub capability: McpAppsDiagnoseCapability,
-    /// What the server returned for this session
-    pub server: McpAppsDiagnoseServer,
+pub struct SessionUiHandlePendingSamplingResult {
+    /// True if the request was still pending and was resolved by this call. False if the request ID was unknown, already resolved by another client (e.g. GitHub), expired, or otherwise no longer pending.
+    pub success: bool,
 }
 
-/// Resource contents returned by the MCP server.
+/// Indicates whether the pending UI request was resolved by this call.
 ///
 /// <div class="warning">
 ///
@@ -23225,12 +24701,12 @@ pub struct SessionMcpAppsDiagnoseResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpResourcesReadResult {
-    /// Resource contents returned by the server
-    pub contents: Vec<McpResourceContent>,
+pub struct SessionUiHandlePendingAutoModeSwitchResult {
+    /// True if the request was still pending and was resolved by this call. False if the request ID was unknown, already resolved by another client (e.g. GitHub), expired, or otherwise no longer pending.
+    pub success: bool,
 }
 
-/// One page of resources advertised by the named MCP server.
+/// Indicates whether the pending UI request was resolved by this call.
 ///
 /// <div class="warning">
 ///
@@ -23240,15 +24716,12 @@ pub struct SessionMcpResourcesReadResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpResourcesListResult {
-    /// Opaque cursor for the next page, if the server has more resources
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub next_cursor: Option<String>,
-    /// Resources advertised by the server (proxied MCP `resources/list`)
-    pub resources: Vec<McpResource>,
+pub struct SessionUiHandlePendingSessionLimitsExhaustedResult {
+    /// True if the request was still pending and was resolved by this call. False if the request ID was unknown, already resolved by another client (e.g. GitHub), expired, or otherwise no longer pending.
+    pub success: bool,
 }
 
-/// One page of resource templates advertised by the named MCP server.
+/// Indicates whether the pending UI request was resolved by this call.
 ///
 /// <div class="warning">
 ///
@@ -23258,12 +24731,9 @@ pub struct SessionMcpResourcesListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMcpResourcesListTemplatesResult {
-    /// Opaque cursor for the next page, if the server has more resource templates
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub next_cursor: Option<String>,
-    /// Resource templates advertised by the server (proxied MCP `resources/templates/list`)
-    pub resource_templates: Vec<McpResourceTemplate>,
+pub struct SessionUiHandlePendingExitPlanModeResult {
+    /// True if the request was still pending and was resolved by this call. False if the request ID was unknown, already resolved by another client (e.g. GitHub), expired, or otherwise no longer pending.
+    pub success: bool,
 }
 
 /// Identifies the target session.
@@ -23276,12 +24746,12 @@ pub struct SessionMcpResourcesListTemplatesResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPluginsListParams {
+pub struct SessionUiRegisterDirectAutoModeSwitchHandlerParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Plugins installed for the session, with their enabled state and version metadata.
+/// Register an in-process handler for `auto_mode_switch.requested` events. The caller still attaches the actual listener via the standard event-subscription mechanism; this registration solely tells the server bridge to skip its own dispatch (so a remote client doesn't race the in-process handler for the same requestId).
 ///
 /// <div class="warning">
 ///
@@ -23291,12 +24761,12 @@ pub struct SessionPluginsListParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPluginsListResult {
-    /// Installed plugins
-    pub plugins: Vec<Plugin>,
+pub struct SessionUiRegisterDirectAutoModeSwitchHandlerResult {
+    /// Opaque handle representing the registration. Pass this same handle to `unregisterDirectAutoModeSwitchHandler` when the in-process handler is no longer active. Multiple registrations are reference-counted; the server bridge will only dispatch auto-mode-switch requests when no handles are active.
+    pub handle: String,
 }
 
-/// A snapshot of the provider endpoint the session is currently configured to talk to.
+/// Indicates whether the handle was active and the registration count was decremented.
 ///
 /// <div class="warning">
 ///
@@ -23306,28 +24776,12 @@ pub struct SessionPluginsListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionProviderGetEndpointResult {
-    /// A credential the caller should use with this endpoint. Omitted only when the endpoint accepts unauthenticated requests.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub api_key: Option<String>,
-    /// Base URL to pass to the LLM client library.
-    pub base_url: String,
-    /// HTTP headers the caller must include on every outbound request.
-    pub headers: HashMap<String, String>,
-    /// Short-lived, rotating credential the caller must send on every request, in addition to `apiKey` if one is present. Omitted when the endpoint does not require one.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub session_token: Option<ProviderSessionToken>,
-    /// Transport to be used for provider requests.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub transport: Option<ProviderEndpointTransport>,
-    /// Provider family. Matches the `type` field of a BYOK provider config.
-    pub r#type: ProviderEndpointType,
-    /// Wire API to be used, when required for the provider type.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub wire_api: Option<ProviderEndpointWireApi>,
+pub struct SessionUiUnregisterDirectAutoModeSwitchHandlerResult {
+    /// True if the handle was active and decremented the counter; false if the handle was unknown.
+    pub unregistered: bool,
 }
 
-/// The selectable model entries synthesized for the models added by this call.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -23337,12 +24791,12 @@ pub struct SessionProviderGetEndpointResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionProviderAddResult {
-    /// Synthesized selectable model entries for the newly added BYOK models, each under its provider-qualified selection id (`provider/id`). Empty when only providers were added.
-    pub models: Vec<serde_json::Value>,
+pub struct SessionPermissionsConfigureResult {
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// Indicates whether the session options patch was applied successfully.
+/// Indicates whether the permission decision was applied; false when the request was already resolved.
 ///
 /// <div class="warning">
 ///
@@ -23352,15 +24806,12 @@ pub struct SessionProviderAddResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionOptionsUpdateResult {
-    /// Number of hooks loaded from installed plugins, returned when installedPlugins is updated
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub plugin_hook_count: Option<i64>,
-    /// Whether the operation succeeded
+pub struct SessionPermissionsHandlePendingPermissionRequestResult {
+    /// Whether the permission request was handled successfully
     pub success: bool,
 }
 
-/// Identifies the target session.
+/// List of pending permission requests reconstructed from event history.
 ///
 /// <div class="warning">
 ///
@@ -23370,12 +24821,12 @@ pub struct SessionOptionsUpdateResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionExtensionsListParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionPermissionsPendingRequestsResult {
+    /// Pending permission prompts reconstructed from the session's event history. Equivalent to the set of `permission.requested` events that have not yet been followed by a matching `permission.completed` event. Used by clients (e.g. the CLI) to hydrate UI for prompts that were emitted before the client attached to the session.
+    pub items: Vec<PendingPermissionRequest>,
 }
 
-/// Extensions discovered for the session, with their current status.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -23385,12 +24836,12 @@ pub struct SessionExtensionsListParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionExtensionsListResult {
-    /// Discovered extensions and their current status
-    pub extensions: Vec<Extension>,
+pub struct SessionPermissionsSetApproveAllResult {
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// Identifies the target session.
+/// Indicates whether the requested permission mode was applied and reports the authoritative post-mutation mode.
 ///
 /// <div class="warning">
 ///
@@ -23400,12 +24851,14 @@ pub struct SessionExtensionsListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionExtensionsReloadParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionPermissionsSetModeResult {
+    /// Authoritative permission mode after the mutation
+    pub mode: PermissionMode,
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// Rust-owned built-in tool descriptors for the session.
+/// Current permission mode.
 ///
 /// <div class="warning">
 ///
@@ -23415,12 +24868,12 @@ pub struct SessionExtensionsReloadParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionToolsGetBuiltinDescriptorsResult {
-    /// Built-in tool descriptors materialized for the session.
-    pub tools: Vec<BuiltinToolDescriptor>,
+pub struct SessionPermissionsGetModeResult {
+    /// Current permission mode
+    pub mode: PermissionMode,
 }
 
-/// Task completion notification with summary from the agent
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -23430,25 +24883,12 @@ pub struct SessionToolsGetBuiltinDescriptorsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionToolsTaskCompleteEventDataResult {
-    /// Active autopilot objective ID evaluated by the completion reviewer
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub objective_id: Option<i64>,
-    /// Semantic completion decision. Absent on legacy events and invalid tool calls
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub outcome: Option<TaskCompletionOutcome>,
-    /// Label-safe runtime rationale for the completion decision (e.g. a cancellation or pause/resume downgrade), when one applies. Reviewer-authored rationale is intentionally omitted here because this event has no IFC label channel; the reviewer's findings remain available through its own labeled sub-agent events
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub reason: Option<String>,
-    /// Whether the task was accepted as complete. False when validation failed or completion was rejected or blocked by the reviewer
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub success: Option<bool>,
-    /// Summary of the completed task, provided by the agent
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub summary: Option<String>,
+pub struct SessionPermissionsModifyRulesResult {
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// Indicates whether the external tool call result was handled successfully.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -23458,12 +24898,12 @@ pub struct SessionToolsTaskCompleteEventDataResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionToolsHandlePendingToolCallResult {
-    /// Whether the tool call result was handled successfully
+pub struct SessionPermissionsSetRequiredResult {
+    /// Whether the operation succeeded
     pub success: bool,
 }
 
-/// Identifies the target session.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -23473,12 +24913,12 @@ pub struct SessionToolsHandlePendingToolCallResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionToolsInitializeAndValidateParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionPermissionsResetSessionApprovalsResult {
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// Resolve, build, and validate the runtime tool list for this session. Subagent sessions and consumer flows that need an initialized tool set before `send` invoke this. Default base-class implementation is a no-op for sessions that don't support tool validation.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -23488,9 +24928,12 @@ pub struct SessionToolsInitializeAndValidateParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionToolsInitializeAndValidateResult {}
+pub struct SessionPermissionsNotifyPromptShownResult {
+    /// Whether the operation succeeded
+    pub success: bool,
+}
 
-/// Identifies the target session.
+/// Snapshot of the session's allow-listed directories and primary working directory.
 ///
 /// <div class="warning">
 ///
@@ -23500,12 +24943,14 @@ pub struct SessionToolsInitializeAndValidateResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionToolsGetCurrentMetadataParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionPermissionsPathsListResult {
+    /// All directories currently allowed for tool access on this session.
+    pub directories: Vec<String>,
+    /// The primary working directory for this session.
+    pub primary: String,
 }
 
-/// Current lightweight tool metadata snapshot for the session.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -23515,12 +24960,12 @@ pub struct SessionToolsGetCurrentMetadataParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionToolsGetCurrentMetadataResult {
-    /// Current tool metadata, or null when tools have not been initialized yet
-    pub tools: Option<Vec<CurrentToolMetadata>>,
+pub struct SessionPermissionsPathsAddResult {
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// Empty result after replacing the calling connection's externally implemented tools.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -23530,9 +24975,12 @@ pub struct SessionToolsGetCurrentMetadataResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionToolsSetResult {}
+pub struct SessionPermissionsPathsUpdatePrimaryResult {
+    /// Whether the operation succeeded
+    pub success: bool,
+}
 
-/// Empty result after applying subagent settings
+/// Indicates whether the supplied path is within the session's allowed directories.
 ///
 /// <div class="warning">
 ///
@@ -23542,9 +24990,12 @@ pub struct SessionToolsSetResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionToolsUpdateSubagentSettingsResult {}
+pub struct SessionPermissionsPathsIsPathWithinAllowedDirectoriesResult {
+    /// Whether the path is within the session's allowed directories
+    pub allowed: bool,
+}
 
-/// Slash commands available in the session, after applying any include/exclude filters.
+/// Indicates whether the supplied path is within the session's workspace directory.
 ///
 /// <div class="warning">
 ///
@@ -23554,12 +25005,12 @@ pub struct SessionToolsUpdateSubagentSettingsResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionCommandsListResult {
-    /// Commands available in this session
-    pub commands: Vec<SlashCommandInfo>,
+pub struct SessionPermissionsPathsIsPathWithinWorkspaceResult {
+    /// Whether the path is within the session workspace directory
+    pub allowed: bool,
 }
 
-/// Whether finalizing the invocation effect succeeded, and the failure reason when it did not.
+/// Resolved location-permissions key and type.
 ///
 /// <div class="warning">
 ///
@@ -23569,15 +25020,14 @@ pub struct SessionCommandsListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionCommandsFinalizeInvocationEffectResult {
-    /// Failure reason when the invocation effect could not be finalized.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Whether the pending invocation effect was finalized successfully.
-    pub success: bool,
+pub struct SessionPermissionsLocationsResolveResult {
+    /// Location key used in the location-permissions store
+    pub location_key: String,
+    /// Whether the location is a git repo or directory
+    pub location_type: PermissionLocationType,
 }
 
-/// Indicates whether the pending client-handled command was completed successfully.
+/// Summary of persisted location permissions applied to the session.
 ///
 /// <div class="warning">
 ///
@@ -23587,12 +25037,22 @@ pub struct SessionCommandsFinalizeInvocationEffectResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionCommandsHandlePendingCommandResult {
-    /// Whether the command was handled successfully
-    pub success: bool,
+pub struct SessionPermissionsLocationsApplyResult {
+    /// Number of persisted allowed directories added to the live path manager
+    pub applied_directory_count: i64,
+    /// Number of location-scoped rules added to the live permission service
+    pub applied_rule_count: i64,
+    /// Location-scoped rules applied to the live permission service
+    pub applied_rules: Vec<PermissionRule>,
+    /// Whether a different location was applied since the previous apply call
+    pub changed: bool,
+    /// Location key used in the location-permissions store
+    pub location_key: String,
+    /// Whether the location is a git repo or directory
+    pub location_type: PermissionLocationType,
 }
 
-/// Error message produced while executing the command, if any.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -23602,13 +25062,12 @@ pub struct SessionCommandsHandlePendingCommandResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionCommandsExecuteResult {
-    /// Error message produced while executing the command, if any. Omitted when the handler succeeded.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
+pub struct SessionPermissionsLocationsAddToolApprovalResult {
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// Indicates whether the command was accepted into the local execution queue.
+/// Folder trust check result.
 ///
 /// <div class="warning">
 ///
@@ -23618,12 +25077,12 @@ pub struct SessionCommandsExecuteResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionCommandsEnqueueResult {
-    /// True when the command was accepted into the local execution queue. False when the call targets a session that does not support local command queueing (e.g. remote sessions).
-    pub queued: bool,
+pub struct SessionPermissionsFolderTrustIsTrustedResult {
+    /// Whether the folder is trusted
+    pub trusted: bool,
 }
 
-/// Indicates whether the queued-command response was matched to a pending request.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -23633,12 +25092,12 @@ pub struct SessionCommandsEnqueueResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionCommandsRespondToQueuedCommandResult {
-    /// Whether a pending queued command with the given request ID was found and resolved. False when the request was already resolved, cancelled, or unknown.
+pub struct SessionPermissionsFolderTrustAddTrustedResult {
+    /// Whether the operation succeeded
     pub success: bool,
 }
 
-/// Identifies the target session.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -23648,12 +25107,12 @@ pub struct SessionCommandsRespondToQueuedCommandResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionTelemetryGetEngagementIdParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionPermissionsUrlsSetUnrestrictedModeResult {
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
-/// Telemetry engagement ID for the session, when available.
+/// Identifier of the session event that was emitted for the log message.
 ///
 /// <div class="warning">
 ///
@@ -23663,13 +25122,12 @@ pub struct SessionTelemetryGetEngagementIdParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionTelemetryGetEngagementIdResult {
-    /// Current telemetry engagement ID, when available.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub engagement_id: Option<String>,
+pub struct SessionLogResult {
+    /// The unique identifier of the emitted session event
+    pub event_id: String,
 }
 
-/// Completed transient query. Ordered chunks and the terminal outcome are also delivered through `ui.ephemeral_query` session events while it runs.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -23679,12 +25137,47 @@ pub struct SessionTelemetryGetEngagementIdResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionUiEphemeralQueryResult {
-    /// Answer returned by the model
-    pub answer: String,
+pub struct SessionMetadataSnapshotParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// The elicitation response (accept with form values, decline, or cancel)
+/// Public-facing projection of workspace metadata for SDK / TUI consumers
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionMetadataSnapshotResultWorkspace {
+    /// Branch checked out at session start, if any
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub branch: Option<String>,
+    /// ISO 8601 timestamp when the workspace was created
+    #[serde(rename = "created_at", skip_serializing_if = "Option::is_none")]
+    pub created_at: Option<String>,
+    /// Current working directory at session start
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cwd: Option<String>,
+    /// Resolved git root for cwd, if any
+    #[serde(rename = "git_root", skip_serializing_if = "Option::is_none")]
+    pub git_root: Option<String>,
+    /// Repository host type, if known
+    #[serde(rename = "host_type", skip_serializing_if = "Option::is_none")]
+    pub host_type: Option<WorkspaceSummaryHostType>,
+    /// Workspace identifier (1:1 with sessionId)
+    pub id: String,
+    /// Display name for the session, if set
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    /// Repository identifier in 'owner/repo' or 'org/project/repo' format, if any
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub repository: Option<String>,
+    /// ISO 8601 timestamp when the workspace was last updated
+    #[serde(rename = "updated_at", skip_serializing_if = "Option::is_none")]
+    pub updated_at: Option<String>,
+    /// Whether the display name was explicitly set by the user
+    #[serde(rename = "user_named", skip_serializing_if = "Option::is_none")]
+    pub user_named: Option<bool>,
+}
+
+/// Point-in-time snapshot of slow-changing session identifier and state fields
 ///
 /// <div class="warning">
 ///
@@ -23694,18 +25187,45 @@ pub struct SessionUiEphemeralQueryResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionUiElicitationResult {
-    /// MCP response metadata.
-    #[serde(rename = "_meta", skip_serializing_if = "Option::is_none")]
-    pub meta: Option<HashMap<String, serde_json::Value>>,
-    /// The user's response: accept (submitted), decline (rejected), or cancel (dismissed)
-    pub action: UIElicitationResponseAction,
-    /// The form values submitted by the user (present when action is 'accept')
+pub struct SessionMetadataSnapshotResult {
+    /// True when the session was detected to be in use by another process at construction time. Local consumers may surface a confirmation prompt before fully attaching. Always false for new sessions.
+    pub already_in_use: bool,
+    /// Runtime client name associated with the session (telemetry identifier).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub client_name: Option<String>,
+    /// The current agent mode for this session (e.g., 'interactive', 'plan', 'autopilot')
+    pub current_mode: MetadataSnapshotCurrentMode,
+    /// User-provided name supplied at session construction (via `--name`), if any. Immutable after construction.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub initial_name: Option<String>,
+    /// Whether this is a remote session (i.e., one whose runtime executes elsewhere and is steered through this process)
+    pub is_remote: bool,
+    /// ISO 8601 timestamp of when the session's persisted state was last modified on disk. For new sessions, equals startTime. For resumed sessions, reflects the previous modification time at construction.
+    pub modified_time: String,
+    /// Remote-session-specific metadata. Populated only when `isRemote` is true. Fields are immutable for the lifetime of the session.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub remote_metadata: Option<MetadataSnapshotRemoteMetadata>,
+    /// Currently selected model identifier, if any
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub selected_model: Option<String>,
+    /// The unique identifier of the session
+    pub session_id: SessionId,
+    /// Current session limits, or null when no limits are active
+    pub session_limits: Option<SessionLimitsConfig>,
+    /// ISO 8601 timestamp of when the session started
+    pub start_time: String,
+    /// Short human-readable summary of the session, if known. Omitted when no summary has been generated.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub content: Option<HashMap<String, serde_json::Value>>,
+    pub summary: Option<String>,
+    /// Absolute path to the session's current working directory
+    pub working_directory: String,
+    /// Public-facing workspace metadata for this session, or null if the session has no associated workspace. Excludes runtime-internal fields (GitHub IDs, summary count, internal flags).
+    pub workspace: Option<SessionMetadataSnapshotResultWorkspace>,
+    /// Absolute path to the session's workspace directory on disk, or null if the session has no associated workspace
+    pub workspace_path: Option<String>,
 }
 
-/// Indicates whether the elicitation response was accepted; false if it was already resolved by another client.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -23715,12 +25235,12 @@ pub struct SessionUiElicitationResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionUiHandlePendingElicitationResult {
-    /// Whether the response was accepted. False if the request was already resolved by another client.
-    pub success: bool,
+pub struct SessionMetadataIsProcessingParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Indicates whether the pending UI request was resolved by this call.
+/// Indicates whether the local session is currently processing a turn or background continuation.
 ///
 /// <div class="warning">
 ///
@@ -23730,12 +25250,12 @@ pub struct SessionUiHandlePendingElicitationResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionUiHandlePendingUserInputResult {
-    /// True if the request was still pending and was resolved by this call. False if the request ID was unknown, already resolved by another client (e.g. GitHub), expired, or otherwise no longer pending.
-    pub success: bool,
+pub struct SessionMetadataIsProcessingResult {
+    /// Whether the session is currently processing user/agent messages. False for non-local sessions (which don't run a local agentic loop). Reflects an in-flight turn or background continuation.
+    pub processing: bool,
 }
 
-/// Indicates whether the pending UI request was resolved by this call.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -23745,12 +25265,12 @@ pub struct SessionUiHandlePendingUserInputResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionUiHandlePendingSamplingResult {
-    /// True if the request was still pending and was resolved by this call. False if the request ID was unknown, already resolved by another client (e.g. GitHub), expired, or otherwise no longer pending.
-    pub success: bool,
+pub struct SessionMetadataActivityParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Indicates whether the pending UI request was resolved by this call.
+/// Current activity flags for the session.
 ///
 /// <div class="warning">
 ///
@@ -23760,27 +25280,40 @@ pub struct SessionUiHandlePendingSamplingResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionUiHandlePendingAutoModeSwitchResult {
-    /// True if the request was still pending and was resolved by this call. False if the request ID was unknown, already resolved by another client (e.g. GitHub), expired, or otherwise no longer pending.
-    pub success: bool,
+pub struct SessionMetadataActivityResult {
+    /// Whether an in-flight operation can currently be aborted.
+    pub abortable: bool,
+    /// Whether the session currently has active work, including running turns or tasks.
+    pub has_active_work: bool,
 }
 
-/// Indicates whether the pending UI request was resolved by this call.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
+/// Token-usage breakdown for the session's current context window
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionUiHandlePendingSessionLimitsExhaustedResult {
-    /// True if the request was still pending and was resolved by this call. False if the request ID was unknown, already resolved by another client (e.g. GitHub), expired, or otherwise no longer pending.
-    pub success: bool,
+pub struct SessionMetadataContextInfoResultContextInfo {
+    /// Output reserve plus tokens after the buffer-exhaustion blocking threshold (default 95%)
+    pub buffer_tokens: i64,
+    /// Token count at which background compaction starts (configurable percentage of promptTokenLimit)
+    pub compaction_threshold: i64,
+    /// Tokens consumed by user/assistant/tool messages
+    pub conversation_tokens: i64,
+    /// Prompt token limit plus the model's full output token limit.
+    pub limit: i64,
+    /// Tokens consumed by MCP tool definitions (subset of toolDefinitionsTokens, excludes deferred tools)
+    pub mcp_tools_tokens: i64,
+    /// The model used for token counting
+    pub model_name: String,
+    /// Maximum prompt tokens allowed by the model (or DEFAULT_TOKEN_LIMIT if unspecified)
+    pub prompt_token_limit: i64,
+    /// Tokens consumed by the system prompt
+    pub system_tokens: i64,
+    /// Tokens consumed by tool definitions sent to the model (excludes deferred tools)
+    pub tool_definitions_tokens: i64,
+    /// Sum of system, conversation and tool-definition tokens
+    pub total_tokens: i64,
 }
 
-/// Indicates whether the pending UI request was resolved by this call.
+/// Token breakdown for the session's current context window, or null if uninitialized.
 ///
 /// <div class="warning">
 ///
@@ -23790,9 +25323,9 @@ pub struct SessionUiHandlePendingSessionLimitsExhaustedResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionUiHandlePendingExitPlanModeResult {
-    /// True if the request was still pending and was resolved by this call. False if the request ID was unknown, already resolved by another client (e.g. GitHub), expired, or otherwise no longer pending.
-    pub success: bool,
+pub struct SessionMetadataContextInfoResult {
+    /// Token breakdown for the current context window, or null if the session has not yet been initialized (no system prompt or tool metadata cached).
+    pub context_info: Option<SessionMetadataContextInfoResultContextInfo>,
 }
 
 /// Identifies the target session.
@@ -23805,42 +25338,85 @@ pub struct SessionUiHandlePendingExitPlanModeResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionUiRegisterDirectAutoModeSwitchHandlerParams {
+pub struct SessionMetadataGetContextAttributionParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Register an in-process handler for `auto_mode_switch.requested` events. The caller still attaches the actual listener via the standard event-subscription mechanism; this registration solely tells the server bridge to skip its own dispatch (so a remote client doesn't race the in-process handler for the same requestId).
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
+/// The six normalized `/context` header buckets, computed from the same tokenization as `entries` so the two never disagree. Convenience rollups: `freeSpace` and `buffer` describe window capacity rather than occupied context, so the values do not sum to `totalTokens`.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionUiRegisterDirectAutoModeSwitchHandlerResult {
-    /// Opaque handle representing the registration. Pass this same handle to `unregisterDirectAutoModeSwitchHandler` when the in-process handler is no longer active. Multiple registrations are reference-counted; the server bridge will only dispatch auto-mode-switch requests when no handles are active.
-    pub handle: String,
+pub struct SessionMetadataGetContextAttributionResultContextAttributionCategories {
+    /// Output reserve plus post-blocking-threshold buffer.
+    pub buffer: i64,
+    /// Custom-instructions tokens (0 when none are configured).
+    pub custom_instructions: i64,
+    /// Remaining unused window capacity (clamped at 0).
+    pub free_space: i64,
+    /// MCP tool-definition tokens.
+    pub mcp_tools: i64,
+    /// Conversation (user/assistant/tool) message tokens.
+    pub messages: i64,
+    /// System prompt tokens, excluding custom instructions.
+    pub system_prompt: i64,
+    /// Non-MCP tool-definition tokens.
+    pub system_tools: i64,
 }
 
-/// Indicates whether the handle was active and the registration count was decremented.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
+/// Successful compaction history for the session.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionUiUnregisterDirectAutoModeSwitchHandlerResult {
-    /// True if the handle was active and decremented the counter; false if the handle was unknown.
-    pub unregistered: bool,
+pub struct SessionMetadataGetContextAttributionResultContextAttributionCompactions {
+    /// Number of successful compactions in this session.
+    pub count: i64,
 }
 
-/// Indicates whether the operation succeeded.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionMetadataGetContextAttributionResultContextAttributionEntriesItem {
+    /// Supplementary per-entry metadata (e.g. `messageCount`, `role`, `evictable`, `pluginSource`). Values are stringified; parse as needed and ignore unrecognized keys.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub attributes: Option<HashMap<String, String>>,
+    /// Identifier for this entry, formed by joining its `kind` and source name (e.g. `tool:bash`, `skill:tmux`, `toolDefinition:bash`); unique within the snapshot. Use it to match the same entry across snapshots, to correlate with other APIs (skill/agent/MCP registries), and as the `parentId` target for nesting. Distinct from the human-facing `label`.
+    pub id: String,
+    /// Source category for this entry. Not a closed set — tolerate unknown values. Known values today: `skill`, `subagent`, `mcpServer`, `tool`, `system`, `toolDefinition`, `plugin`.
+    pub kind: String,
+    /// Human-readable display label, e.g. `bash` or `skill: tmux`. Presentation-only; may be localized/reformatted without notice — do not key off it.
+    pub label: String,
+    /// Optional `id` of the parent entry: e.g. a `plugin` entry parenting its `skill`/`mcpServer` entries, or the `system` entry parenting `toolDefinition` entries. Omitted for top-level entries.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub parent_id: Option<String>,
+    /// Token count currently in context attributable to this entry.
+    pub tokens: i64,
+}
+
+/// Per-source token attribution snapshot for the current context window. The heaviest individual messages are available separately via `metadata.getContextHeaviestMessages`.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionMetadataGetContextAttributionResultContextAttribution {
+    /// Output reserve plus the tokens past the buffer-exhaustion blocking threshold. Mirrors `SessionContextInfo.bufferTokens`.
+    pub buffer_tokens: i64,
+    /// The six normalized `/context` header buckets, computed from the same tokenization as `entries` so the two never disagree. Convenience rollups: `freeSpace` and `buffer` describe window capacity rather than occupied context, so the values do not sum to `totalTokens`.
+    pub categories: SessionMetadataGetContextAttributionResultContextAttributionCategories,
+    /// Successful compaction history for the session.
+    pub compactions: SessionMetadataGetContextAttributionResultContextAttributionCompactions,
+    /// Token count at which background compaction starts. Mirrors `SessionContextInfo.compactionThreshold`.
+    pub compaction_threshold: i64,
+    /// Flat list of per-source attribution entries. Group by `kind` and render unrecognized kinds generically. Nesting and rollups are expressed via `parentId`.
+    pub entries: Vec<SessionMetadataGetContextAttributionResultContextAttributionEntriesItem>,
+    /// Prompt limit plus the model's output reserve: the full context window `categories.freeSpace` and `categories.buffer` are measured against. Mirrors `SessionContextInfo.limit`.
+    pub limit: i64,
+    /// The concrete model id the entire breakdown was tokenized against (feeds the per-model token multiplier). Under `Auto` (Free/Student) this is the resolved model, not the literal `auto` sentinel, so totals are not undercounted. A single-model approximation of a potentially multi-model Auto session.
+    pub model_id: String,
+    /// How `modelId` was chosen. Not a closed set — tolerate unknown values. Known values today: `autoResolved` (the model Auto resolved to), `selected` (the user's explicitly selected model), `default` (a fallback before any model is known).
+    pub model_source: String,
+    /// Maximum prompt tokens the resolved model accepts — the denominator for a `##k/###k` context-usage display. Mirrors `SessionContextInfo.promptTokenLimit`.
+    pub prompt_token_limit: i64,
+    /// Total token count of the current context window the entries are measured against (system message + conversation messages + tool definitions — the same total reported by /context). Divide an entry's `tokens` by this to derive its share.
+    pub total_tokens: i64,
+}
+
+/// Per-source attribution breakdown for the session's current context window, or null if uninitialized.
 ///
 /// <div class="warning">
 ///
@@ -23850,12 +25426,12 @@ pub struct SessionUiUnregisterDirectAutoModeSwitchHandlerResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsConfigureResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct SessionMetadataGetContextAttributionResult {
+    /// Per-source context-window attribution, or null if the session has not yet been initialized (no system prompt or tool metadata cached).
+    pub context_attribution: Option<SessionMetadataGetContextAttributionResultContextAttribution>,
 }
 
-/// Indicates whether the permission decision was applied; false when the request was already resolved.
+/// The heaviest individual messages in the session's context window, most-expensive first.
 ///
 /// <div class="warning">
 ///
@@ -23865,12 +25441,14 @@ pub struct SessionPermissionsConfigureResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsHandlePendingPermissionRequestResult {
-    /// Whether the permission request was handled successfully
-    pub success: bool,
+pub struct SessionMetadataGetContextHeaviestMessagesResult {
+    /// Heaviest messages, most-expensive first.
+    pub messages: Vec<ContextHeaviestMessage>,
+    /// Total token count of the current context window, so callers can compute each message's share without a second call.
+    pub total_tokens: i64,
 }
 
-/// List of pending permission requests reconstructed from event history.
+/// Notify the session that its working directory context has changed. Emits a `session.context_changed` event so consumers (telemetry, OTel tracker, ACP, the timeline UI) can react. Use this when the host has detected a cwd/branch/repo change outside the session's normal lifecycle (e.g., after a shell command in interactive mode). For a local session, a report whose `cwd` diverges from the session's current working directory is ignored (the call still succeeds but records nothing and emits no event); move a local session's working directory via `metadata.setWorkingDirectory` instead.
 ///
 /// <div class="warning">
 ///
@@ -23880,12 +25458,9 @@ pub struct SessionPermissionsHandlePendingPermissionRequestResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsPendingRequestsResult {
-    /// Pending permission prompts reconstructed from the session's event history. Equivalent to the set of `permission.requested` events that have not yet been followed by a matching `permission.completed` event. Used by clients (e.g. the CLI) to hydrate UI for prompts that were emitted before the client attached to the session.
-    pub items: Vec<PendingPermissionRequest>,
-}
+pub struct SessionMetadataRecordContextChangeResult {}
 
-/// Indicates whether the operation succeeded.
+/// Update the session's working directory. Used by the host when the user explicitly changes cwd (e.g., the `/cd` slash command). The host is responsible for any related side-effects (file index, etc.); it does NOT change the process working directory (a session's cwd is per-session, not process-global). For local sessions the runtime validates the target first (an absolute path that exists on disk) and re-bases the permission primary directory; a rejected validation fails the call before anything is mutated, persisted, or emitted. Location-scoped permission rules are then re-keyed to the new directory (best-effort). Remote sessions only record the path.
 ///
 /// <div class="warning">
 ///
@@ -23895,12 +25470,12 @@ pub struct SessionPermissionsPendingRequestsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsSetApproveAllResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct SessionMetadataSetWorkingDirectoryResult {
+    /// Working directory after the update
+    pub working_directory: String,
 }
 
-/// Indicates whether the operation succeeded and reports the post-mutation state.
+/// Re-tokenize the session's existing messages against `modelId` and return the token totals. Useful for hosts that want an initial estimate of context usage on session resume, before the next agent turn fires `session.context_info_changed` events. Returns zeros for an empty session.
 ///
 /// <div class="warning">
 ///
@@ -23910,17 +25485,16 @@ pub struct SessionPermissionsSetApproveAllResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsSetAllowAllResult {
-    /// Authoritative full allow-all state after the mutation
-    pub enabled: bool,
-    /// Authoritative allow-all mode after the mutation
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mode: Option<PermissionsAllowAllMode>,
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct SessionMetadataRecomputeContextTokensResult {
+    /// Tokens contributed by user/assistant/tool messages (excludes system/developer prompts).
+    pub messages_token_count: i64,
+    /// Tokens contributed by system/developer prompt snapshots.
+    pub system_token_count: i64,
+    /// Sum of tokens across chat-context and system-context messages currently held by the session.
+    pub total_tokens: i64,
 }
 
-/// Current allow-all permission mode.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -23930,15 +25504,12 @@ pub struct SessionPermissionsSetAllowAllResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsGetAllowAllResult {
-    /// Whether full allow-all permissions are currently active
-    pub enabled: bool,
-    /// Current allow-all mode
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mode: Option<PermissionsAllowAllMode>,
+pub struct SessionSettingsSnapshotParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Indicates whether the operation succeeded.
+/// Redacted, serializable view of session runtime settings for SDK boundary consumers. Secrets and raw feature flags are intentionally excluded.
 ///
 /// <div class="warning">
 ///
@@ -23948,12 +25519,32 @@ pub struct SessionPermissionsGetAllowAllResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsModifyRulesResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct SessionSettingsSnapshotResult {
+    /// Name of the SDK client that created the session.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub client_name: Option<String>,
+    /// Redacted job settings.
+    pub job: SessionSettingsJobSnapshot,
+    /// Redacted model routing settings.
+    pub model: SessionSettingsModelSnapshot,
+    /// Online-evaluation settings safe for SDK consumers.
+    pub online_evaluation: SessionSettingsOnlineEvaluationSnapshot,
+    /// Redacted repository and host settings.
+    pub repo: SessionSettingsRepoSnapshot,
+    /// Session start time as Unix epoch milliseconds.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub start_time_ms: Option<f64>,
+    /// Session timeout in milliseconds.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub timeout_ms: Option<f64>,
+    /// Redacted validation and memory-tool settings.
+    pub validation: SessionSettingsValidationSnapshot,
+    /// Agent runtime version selector copied from the session settings, such as `latest` or a runtime release identifier.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub version: Option<String>,
 }
 
-/// Indicates whether the operation succeeded.
+/// Batch content-exclusion result. Callers must fail closed when policy evaluation is unavailable.
 ///
 /// <div class="warning">
 ///
@@ -23963,12 +25554,14 @@ pub struct SessionPermissionsModifyRulesResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsSetRequiredResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct SessionContentExclusionCheckPathsResult {
+    /// Whether the session's policy service was available for the complete batch. When false, checks is empty and callers must treat every requested path as excluded.
+    pub available: bool,
+    /// Per-path decisions in request order. Empty when available is false.
+    pub checks: Vec<ContentExclusionPathCheck>,
 }
 
-/// Indicates whether the operation succeeded.
+/// Identifier of the spawned process, used to correlate streamed output and exit notifications.
 ///
 /// <div class="warning">
 ///
@@ -23978,12 +25571,12 @@ pub struct SessionPermissionsSetRequiredResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsResetSessionApprovalsResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct SessionShellExecResult {
+    /// Unique identifier for tracking streamed output
+    pub process_id: String,
 }
 
-/// Indicates whether the operation succeeded.
+/// Indicates whether the signal was delivered; false if the process was unknown or already exited.
 ///
 /// <div class="warning">
 ///
@@ -23993,12 +25586,12 @@ pub struct SessionPermissionsResetSessionApprovalsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsNotifyPromptShownResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct SessionShellKillResult {
+    /// Whether the signal was sent successfully
+    pub killed: bool,
 }
 
-/// Snapshot of the session's allow-listed directories and primary working directory.
+/// Result of a user-requested shell command.
 ///
 /// <div class="warning">
 ///
@@ -24008,14 +25601,22 @@ pub struct SessionPermissionsNotifyPromptShownResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsPathsListResult {
-    /// All directories currently allowed for tool access on this session.
-    pub directories: Vec<String>,
-    /// The primary working directory for this session.
-    pub primary: String,
+pub struct SessionShellExecuteUserRequestedResult {
+    /// Error output when the execution failed
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// Process exit code, when available
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub exit_code: Option<i64>,
+    /// Captured command output
+    pub output: String,
+    /// Whether the command completed successfully
+    pub success: bool,
+    /// Tool call id emitted for the shell execution
+    pub tool_call_id: String,
 }
 
-/// Indicates whether the operation succeeded.
+/// Cancellation result for a user-requested shell command.
 ///
 /// <div class="warning">
 ///
@@ -24025,12 +25626,12 @@ pub struct SessionPermissionsPathsListResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsPathsAddResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct SessionShellCancelUserRequestedResult {
+    /// Whether an in-flight execution was found and signalled to cancel
+    pub cancelled: bool,
 }
 
-/// Indicates whether the operation succeeded.
+/// Compaction outcome with the number of tokens and messages removed, summary text, and the resulting context window breakdown.
 ///
 /// <div class="warning">
 ///
@@ -24040,12 +25641,22 @@ pub struct SessionPermissionsPathsAddResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsPathsUpdatePrimaryResult {
-    /// Whether the operation succeeded
+pub struct SessionHistoryCompactResult {
+    /// Post-compaction context window usage breakdown
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub context_window: Option<HistoryCompactContextWindow>,
+    /// Number of messages removed during compaction
+    pub messages_removed: i64,
+    /// Whether compaction completed successfully
     pub success: bool,
+    /// Summary text produced by compaction. Omitted when compaction did not produce a summary (e.g. failure path).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub summary_content: Option<String>,
+    /// Number of tokens freed by compaction
+    pub tokens_removed: i64,
 }
 
-/// Indicates whether the supplied path is within the session's allowed directories.
+/// Number of events that were removed by the truncation.
 ///
 /// <div class="warning">
 ///
@@ -24055,12 +25666,18 @@ pub struct SessionPermissionsPathsUpdatePrimaryResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsPathsIsPathWithinAllowedDirectoriesResult {
-    /// Whether the path is within the session's allowed directories
-    pub allowed: bool,
+pub struct SessionHistoryTruncateResult {
+    /// Failure detail when checkpointCleanupFailed is true.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub checkpoint_cleanup_error: Option<String>,
+    /// True when conversation truncation succeeded but post-truncation workspace checkpoint cleanup failed. History is already truncated; callers may still prune snapshots but should report a checkpoint-cleanup rather than a truncation failure.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub checkpoint_cleanup_failed: Option<bool>,
+    /// Number of events that were removed
+    pub events_removed: i64,
 }
 
-/// Indicates whether the supplied path is within the session's workspace directory.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -24070,12 +25687,12 @@ pub struct SessionPermissionsPathsIsPathWithinAllowedDirectoriesResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsPathsIsPathWithinWorkspaceResult {
-    /// Whether the path is within the session workspace directory
-    pub allowed: bool,
+pub struct SessionHistoryListRewindPointsParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Resolved location-permissions key and type.
+/// Rewind points and file-change-tracking availability for the session.
 ///
 /// <div class="warning">
 ///
@@ -24085,14 +25702,17 @@ pub struct SessionPermissionsPathsIsPathWithinWorkspaceResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsLocationsResolveResult {
-    /// Location key used in the location-permissions store
-    pub location_key: String,
-    /// Whether the location is a git repo or directory
-    pub location_type: PermissionLocationType,
+pub struct SessionHistoryListRewindPointsResult {
+    /// Whether this session captured file changes from its first turn.
+    pub file_change_tracking_enabled: bool,
+    /// Root user turns in chronological order. Empty when `unavailableReason` is set.
+    pub points: Vec<HistoryRewindPoint>,
+    /// Why the listed points could not be produced, when applicable; the points list is empty whenever it is set. `unsupported-remote-session` is permanent for the session and comes with `fileChangeTrackingEnabled: false`. `session-busy` is transient and only ever reported by a session that *is* tracking (`fileChangeTrackingEnabled: true`), because the file-change captures cannot be read while work that may still mutate them is in flight; the same request succeeds once the session settles, so a client that wants points should retry rather than treat it as a failure. It is never `file-change-tracking-disabled`: an untracked local session still lists conversation-only points and reports that through `fileChangeTrackingEnabled: false`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub unavailable_reason: Option<HistoryRewindUnavailableReason>,
 }
 
-/// Summary of persisted location permissions applied to the session.
+/// Files and aggregate changes for a prospective rewind.
 ///
 /// <div class="warning">
 ///
@@ -24102,22 +25722,19 @@ pub struct SessionPermissionsLocationsResolveResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsLocationsApplyResult {
-    /// Number of persisted allowed directories added to the live path manager
-    pub applied_directory_count: i64,
-    /// Number of location-scoped rules added to the live permission service
-    pub applied_rule_count: i64,
-    /// Location-scoped rules applied to the live permission service
-    pub applied_rules: Vec<PermissionRule>,
-    /// Whether a different location was applied since the previous apply call
-    pub changed: bool,
-    /// Location key used in the location-permissions store
-    pub location_key: String,
-    /// Whether the location is a git repo or directory
-    pub location_type: PermissionLocationType,
+pub struct SessionHistoryPreviewRewindResult {
+    /// Whether file restore is available for this session. This is authoritative: switch on it and read `reason` only when it is false.
+    pub available: bool,
+    /// Number of unique files in the preview.
+    pub file_count: i64,
+    /// Files ordered by path.
+    pub files: Vec<HistoryRewindFilePreview>,
+    /// Why file restore is unavailable, when applicable. Populated only when `available` is false and never set when `available` is true.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reason: Option<HistoryRewindUnavailableReason>,
 }
 
-/// Indicates whether the operation succeeded.
+/// Structured outcome of a rewind request.
 ///
 /// <div class="warning">
 ///
@@ -24127,12 +25744,22 @@ pub struct SessionPermissionsLocationsApplyResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsLocationsAddToolApprovalResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct SessionHistoryRewindResult {
+    /// Failure detail. Set only for the failure and partial-failure outcomes (`files-rolled-back`, `rollback-incomplete`, `truncation-failed`, `checkpoint-cleanup-failed`, `snapshot-prune-failed`); omitted for `success` and for the unavailable outcomes (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// Number of persisted events removed by conversation truncation. Present only when truncation succeeded (outcomes `success`, `checkpoint-cleanup-failed`, and `snapshot-prune-failed`); omitted for every unavailable outcome (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`) and for `truncation-failed`, `files-rolled-back`, and `rollback-incomplete`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub events_removed: Option<i64>,
+    /// Overall rewind outcome. This discriminates the result: it governs which of the remaining fields are populated, so consumers must switch on it before reading `eventsRemoved`, `restoredFiles`, `skippedFiles`, or `error`. See each field for the outcomes that populate it.
+    pub outcome: HistoryRewindOutcome,
+    /// Absolute paths restored to their captured preimages. Always empty for conversation-only rewinds and for the unavailable outcomes (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`); only conversation-and-files outcomes that reached the file-restore stage populate it.
+    pub restored_files: Vec<String>,
+    /// Captured files intentionally left unchanged. Always empty for conversation-only rewinds and for the unavailable outcomes (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`); only conversation-and-files outcomes that reached the file-restore stage populate it.
+    pub skipped_files: Vec<HistorySkippedFileRestore>,
 }
 
-/// Folder trust check result.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -24142,12 +25769,12 @@ pub struct SessionPermissionsLocationsAddToolApprovalResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsFolderTrustIsTrustedResult {
-    /// Whether the folder is trusted
-    pub trusted: bool,
+pub struct SessionHistoryCancelBackgroundCompactionParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Indicates whether the operation succeeded.
+/// Indicates whether an in-progress background compaction was cancelled.
 ///
 /// <div class="warning">
 ///
@@ -24157,12 +25784,12 @@ pub struct SessionPermissionsFolderTrustIsTrustedResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsFolderTrustAddTrustedResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct SessionHistoryCancelBackgroundCompactionResult {
+    /// Whether an in-progress background compaction was cancelled. False when no compaction was running, when the session is remote, or when the underlying processor was unavailable.
+    pub cancelled: bool,
 }
 
-/// Indicates whether the operation succeeded.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -24172,12 +25799,12 @@ pub struct SessionPermissionsFolderTrustAddTrustedResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionPermissionsUrlsSetUnrestrictedModeResult {
-    /// Whether the operation succeeded
-    pub success: bool,
+pub struct SessionHistoryAbortManualCompactionParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Identifier of the session event that was emitted for the log message.
+/// Indicates whether an in-progress manual compaction was aborted.
 ///
 /// <div class="warning">
 ///
@@ -24187,9 +25814,9 @@ pub struct SessionPermissionsUrlsSetUnrestrictedModeResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionLogResult {
-    /// The unique identifier of the emitted session event
-    pub event_id: String,
+pub struct SessionHistoryAbortManualCompactionResult {
+    /// Whether an in-progress manual compaction was aborted. False when no manual compaction was running, when its abort controller was already aborted, or when the session is remote.
+    pub aborted: bool,
 }
 
 /// Identifies the target session.
@@ -24202,47 +25829,12 @@ pub struct SessionLogResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMetadataSnapshotParams {
+pub struct SessionHistorySummarizeForHandoffParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Public-facing projection of workspace metadata for SDK / TUI consumers
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionMetadataSnapshotResultWorkspace {
-    /// Branch checked out at session start, if any
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub branch: Option<String>,
-    /// ISO 8601 timestamp when the workspace was created
-    #[serde(rename = "created_at", skip_serializing_if = "Option::is_none")]
-    pub created_at: Option<String>,
-    /// Current working directory at session start
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cwd: Option<String>,
-    /// Resolved git root for cwd, if any
-    #[serde(rename = "git_root", skip_serializing_if = "Option::is_none")]
-    pub git_root: Option<String>,
-    /// Repository host type, if known
-    #[serde(rename = "host_type", skip_serializing_if = "Option::is_none")]
-    pub host_type: Option<WorkspaceSummaryHostType>,
-    /// Workspace identifier (1:1 with sessionId)
-    pub id: String,
-    /// Display name for the session, if set
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub name: Option<String>,
-    /// Repository identifier in 'owner/repo' or 'org/project/repo' format, if any
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub repository: Option<String>,
-    /// ISO 8601 timestamp when the workspace was last updated
-    #[serde(rename = "updated_at", skip_serializing_if = "Option::is_none")]
-    pub updated_at: Option<String>,
-    /// Whether the display name was explicitly set by the user
-    #[serde(rename = "user_named", skip_serializing_if = "Option::is_none")]
-    pub user_named: Option<bool>,
-}
-
-/// Point-in-time snapshot of slow-changing session identifier and state fields
+/// Markdown summary of the conversation context (empty when not available).
 ///
 /// <div class="warning">
 ///
@@ -24252,42 +25844,24 @@ pub struct SessionMetadataSnapshotResultWorkspace {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMetadataSnapshotResult {
-    /// True when the session was detected to be in use by another process at construction time. Local consumers may surface a confirmation prompt before fully attaching. Always false for new sessions.
-    pub already_in_use: bool,
-    /// Runtime client name associated with the session (telemetry identifier).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub client_name: Option<String>,
-    /// The current agent mode for this session (e.g., 'interactive', 'plan', 'autopilot')
-    pub current_mode: MetadataSnapshotCurrentMode,
-    /// User-provided name supplied at session construction (via `--name`), if any. Immutable after construction.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub initial_name: Option<String>,
-    /// Whether this is a remote session (i.e., one whose runtime executes elsewhere and is steered through this process)
-    pub is_remote: bool,
-    /// ISO 8601 timestamp of when the session's persisted state was last modified on disk. For new sessions, equals startTime. For resumed sessions, reflects the previous modification time at construction.
-    pub modified_time: String,
-    /// Remote-session-specific metadata. Populated only when `isRemote` is true. Fields are immutable for the lifetime of the session.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub remote_metadata: Option<MetadataSnapshotRemoteMetadata>,
-    /// Currently selected model identifier, if any
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub selected_model: Option<String>,
-    /// The unique identifier of the session
-    pub session_id: SessionId,
-    /// Current session limits, or null when no limits are active
-    pub session_limits: Option<SessionLimitsConfig>,
-    /// ISO 8601 timestamp of when the session started
-    pub start_time: String,
-    /// Short human-readable summary of the session, if known. Omitted when no summary has been generated.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub summary: Option<String>,
-    /// Absolute path to the session's current working directory
-    pub working_directory: String,
-    /// Public-facing workspace metadata for this session, or null if the session has no associated workspace. Excludes runtime-internal fields (GitHub IDs, summary count, internal flags).
-    pub workspace: Option<SessionMetadataSnapshotResultWorkspace>,
-    /// Absolute path to the session's workspace directory on disk, or null if the session has no associated workspace
-    pub workspace_path: Option<String>,
+pub struct SessionHistorySummarizeForHandoffResult {
+    /// Markdown summary of the conversation context produced by an LLM. Empty string when there are no messages or when the session does not support local summarization.
+    pub summary: String,
+}
+
+/// What a successful clear removed. A clear that could not be applied rejects instead of reporting a count.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionHistoryClearContextResult {
+    /// Number of non-system, non-developer messages that were removed from the conversation. Zero only when the window already held no conversation.
+    pub messages_cleared: i64,
 }
 
 /// Identifies the target session.
@@ -24300,12 +25874,12 @@ pub struct SessionMetadataSnapshotResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMetadataIsProcessingParams {
+pub struct SessionQueuePendingItemsParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Indicates whether the local session is currently processing a turn or background continuation.
+/// Snapshot of the session's pending queued items and immediate-steering messages.
 ///
 /// <div class="warning">
 ///
@@ -24315,9 +25889,11 @@ pub struct SessionMetadataIsProcessingParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMetadataIsProcessingResult {
-    /// Whether the session is currently processing user/agent messages. False for non-local sessions (which don't run a local agentic loop). Reflects an in-flight turn or background continuation.
-    pub processing: bool,
+pub struct SessionQueuePendingItemsResult {
+    /// Pending queued items in submission order. Includes user messages, queued slash commands, and queued model changes; omits internal system items.
+    pub items: Vec<QueuePendingItems>,
+    /// Display text for messages currently in the immediate steering queue (interjections sent during a running turn).
+    pub steering_messages: Vec<String>,
 }
 
 /// Identifies the target session.
@@ -24330,12 +25906,12 @@ pub struct SessionMetadataIsProcessingResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMetadataActivityParams {
+pub struct SessionQueueSnapshotParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Current activity flags for the session.
+/// Internal snapshot of native queue state for local session orchestration.
 ///
 /// <div class="warning">
 ///
@@ -24345,40 +25921,20 @@ pub struct SessionMetadataActivityParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMetadataActivityResult {
-    /// Whether an in-flight operation can currently be aborted.
-    pub abortable: bool,
-    /// Whether the session currently has active work, including running turns or tasks.
-    pub has_active_work: bool,
-}
-
-/// Token-usage breakdown for the session's current context window
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionMetadataContextInfoResultContextInfo {
-    /// Output reserve plus tokens after the buffer-exhaustion blocking threshold (default 95%)
-    pub buffer_tokens: i64,
-    /// Token count at which background compaction starts (configurable percentage of promptTokenLimit)
-    pub compaction_threshold: i64,
-    /// Tokens consumed by user/assistant/tool messages
-    pub conversation_tokens: i64,
-    /// Prompt token limit plus the model's full output token limit.
-    pub limit: i64,
-    /// Tokens consumed by MCP tool definitions (subset of toolDefinitionsTokens, excludes deferred tools)
-    pub mcp_tools_tokens: i64,
-    /// The model used for token counting
-    pub model_name: String,
-    /// Maximum prompt tokens allowed by the model (or DEFAULT_TOKEN_LIMIT if unspecified)
-    pub prompt_token_limit: i64,
-    /// Tokens consumed by the system prompt
-    pub system_tokens: i64,
-    /// Tokens consumed by tool definitions sent to the model (excludes deferred tools)
-    pub tool_definitions_tokens: i64,
-    /// Sum of system, conversation and tool-definition tokens
-    pub total_tokens: i64,
+pub struct SessionQueueSnapshotResult {
+    /// Insertion orders for queued items, aligned with `items`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub item_orders: Option<Vec<i64>>,
+    /// User-facing pending items in FIFO order.
+    pub items: Vec<QueuePendingItems>,
+    /// Insertion orders for immediate steering messages, aligned with `steeringMessages`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub steering_message_orders: Option<Vec<i64>>,
+    /// Immediate steering messages waiting for an active turn.
+    pub steering_messages: Vec<String>,
 }
 
-/// Token breakdown for the session's current context window, or null if uninitialized.
+/// Result of moving a queued item.
 ///
 /// <div class="warning">
 ///
@@ -24388,12 +25944,12 @@ pub struct SessionMetadataContextInfoResultContextInfo {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMetadataContextInfoResult {
-    /// Token breakdown for the current context window, or null if the session has not yet been initialized (no system prompt or tool metadata cached).
-    pub context_info: Option<SessionMetadataContextInfoResultContextInfo>,
+pub struct SessionQueueMoveItemResult {
+    /// True when the item changed position; false when it was already at the requested position.
+    pub changed: bool,
 }
 
-/// Identifies the target session.
+/// Result of inserting a queued message.
 ///
 /// <div class="warning">
 ///
@@ -24403,85 +25959,27 @@ pub struct SessionMetadataContextInfoResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMetadataGetContextAttributionParams {
-    /// Target session identifier
-    pub session_id: SessionId,
-}
-
-/// The six normalized `/context` header buckets, computed from the same tokenization as `entries` so the two never disagree. Convenience rollups: `freeSpace` and `buffer` describe window capacity rather than occupied context, so the values do not sum to `totalTokens`.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionMetadataGetContextAttributionResultContextAttributionCategories {
-    /// Output reserve plus post-blocking-threshold buffer.
-    pub buffer: i64,
-    /// Custom-instructions tokens (0 when none are configured).
-    pub custom_instructions: i64,
-    /// Remaining unused window capacity (clamped at 0).
-    pub free_space: i64,
-    /// MCP tool-definition tokens.
-    pub mcp_tools: i64,
-    /// Conversation (user/assistant/tool) message tokens.
-    pub messages: i64,
-    /// System prompt tokens, excluding custom instructions.
-    pub system_prompt: i64,
-    /// Non-MCP tool-definition tokens.
-    pub system_tools: i64,
-}
-
-/// Successful compaction history for the session.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionMetadataGetContextAttributionResultContextAttributionCompactions {
-    /// Number of successful compactions in this session.
-    pub count: i64,
-}
-
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionMetadataGetContextAttributionResultContextAttributionEntriesItem {
-    /// Supplementary per-entry metadata (e.g. `messageCount`, `role`, `evictable`, `pluginSource`). Values are stringified; parse as needed and ignore unrecognized keys.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub attributes: Option<HashMap<String, String>>,
-    /// Identifier for this entry, formed by joining its `kind` and source name (e.g. `tool:bash`, `skill:tmux`, `toolDefinition:bash`); unique within the snapshot. Use it to match the same entry across snapshots, to correlate with other APIs (skill/agent/MCP registries), and as the `parentId` target for nesting. Distinct from the human-facing `label`.
+pub struct SessionQueueInsertAtResult {
+    /// Fresh stable opaque id assigned to the inserted item.
     pub id: String,
-    /// Source category for this entry. Not a closed set — tolerate unknown values. Known values today: `skill`, `subagent`, `mcpServer`, `tool`, `system`, `toolDefinition`, `plugin`.
-    pub kind: String,
-    /// Human-readable display label, e.g. `bash` or `skill: tmux`. Presentation-only; may be localized/reformatted without notice — do not key off it.
-    pub label: String,
-    /// Optional `id` of the parent entry: e.g. a `plugin` entry parenting its `skill`/`mcpServer` entries, or the `system` entry parenting `toolDefinition` entries. Omitted for top-level entries.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub parent_id: Option<String>,
-    /// Token count currently in context attributable to this entry.
-    pub tokens: i64,
 }
 
-/// Per-source token attribution snapshot for the current context window. The heaviest individual messages are available separately via `metadata.getContextHeaviestMessages`.
+/// Result of removing a queued item.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMetadataGetContextAttributionResultContextAttribution {
-    /// Output reserve plus the tokens past the buffer-exhaustion blocking threshold. Mirrors `SessionContextInfo.bufferTokens`.
-    pub buffer_tokens: i64,
-    /// The six normalized `/context` header buckets, computed from the same tokenization as `entries` so the two never disagree. Convenience rollups: `freeSpace` and `buffer` describe window capacity rather than occupied context, so the values do not sum to `totalTokens`.
-    pub categories: SessionMetadataGetContextAttributionResultContextAttributionCategories,
-    /// Successful compaction history for the session.
-    pub compactions: SessionMetadataGetContextAttributionResultContextAttributionCompactions,
-    /// Token count at which background compaction starts. Mirrors `SessionContextInfo.compactionThreshold`.
-    pub compaction_threshold: i64,
-    /// Flat list of per-source attribution entries. Group by `kind` and render unrecognized kinds generically. Nesting and rollups are expressed via `parentId`.
-    pub entries: Vec<SessionMetadataGetContextAttributionResultContextAttributionEntriesItem>,
-    /// Prompt limit plus the model's output reserve: the full context window `categories.freeSpace` and `categories.buffer` are measured against. Mirrors `SessionContextInfo.limit`.
-    pub limit: i64,
-    /// The concrete model id the entire breakdown was tokenized against (feeds the per-model token multiplier). Under `Auto` (Free/Student) this is the resolved model, not the literal `auto` sentinel, so totals are not undercounted. A single-model approximation of a potentially multi-model Auto session.
-    pub model_id: String,
-    /// How `modelId` was chosen. Not a closed set — tolerate unknown values. Known values today: `autoResolved` (the model Auto resolved to), `selected` (the user's explicitly selected model), `default` (a fallback before any model is known).
-    pub model_source: String,
-    /// Maximum prompt tokens the resolved model accepts — the denominator for a `##k/###k` context-usage display. Mirrors `SessionContextInfo.promptTokenLimit`.
-    pub prompt_token_limit: i64,
-    /// Total token count of the current context window the entries are measured against (system message + conversation messages + tool definitions — the same total reported by /context). Divide an entry's `tokens` by this to derive its share.
-    pub total_tokens: i64,
+pub struct SessionQueueRemoveAtResult {
+    /// True when the addressed item was removed.
+    pub removed: bool,
 }
 
-/// Per-source attribution breakdown for the session's current context window, or null if uninitialized.
+/// Result of editing a queued message.
 ///
 /// <div class="warning">
 ///
@@ -24491,12 +25989,12 @@ pub struct SessionMetadataGetContextAttributionResultContextAttribution {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMetadataGetContextAttributionResult {
-    /// Per-source context-window attribution, or null if the session has not yet been initialized (no system prompt or tool metadata cached).
-    pub context_attribution: Option<SessionMetadataGetContextAttributionResultContextAttribution>,
+pub struct SessionQueueUpdateTextResult {
+    /// True when the stored text changed.
+    pub updated: bool,
 }
 
-/// The heaviest individual messages in the session's context window, most-expensive first.
+/// Result of duplicating a queued item.
 ///
 /// <div class="warning">
 ///
@@ -24506,14 +26004,12 @@ pub struct SessionMetadataGetContextAttributionResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMetadataGetContextHeaviestMessagesResult {
-    /// Heaviest messages, most-expensive first.
-    pub messages: Vec<ContextHeaviestMessage>,
-    /// Total token count of the current context window, so callers can compute each message's share without a second call.
-    pub total_tokens: i64,
+pub struct SessionQueueDuplicateAtResult {
+    /// Fresh stable opaque id assigned to the duplicate.
+    pub id: String,
 }
 
-/// Notify the session that its working directory context has changed. Emits a `session.context_changed` event so consumers (telemetry, OTel tracker, ACP, the timeline UI) can react. Use this when the host has detected a cwd/branch/repo change outside the session's normal lifecycle (e.g., after a shell command in interactive mode). For a local session, a report whose `cwd` diverges from the session's current working directory is ignored (the call still succeeds but records nothing and emits no event); move a local session's working directory via `metadata.setWorkingDirectory` instead.
+/// Result of trying to steer a queued message into a live turn.
 ///
 /// <div class="warning">
 ///
@@ -24523,9 +26019,12 @@ pub struct SessionMetadataGetContextHeaviestMessagesResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMetadataRecordContextChangeResult {}
+pub struct SessionQueueSendNowResult {
+    /// True when the item was accepted into the steering lane; false when no main turn was live.
+    pub steered: bool,
+}
 
-/// Update the session's working directory. Used by the host when the user explicitly changes cwd (e.g., the `/cd` slash command). The host is responsible for any related side-effects (file index, etc.); it does NOT change the process working directory (a session's cwd is per-session, not process-global). For local sessions the runtime validates the target first (an absolute path that exists on disk) and re-bases the permission primary directory; a rejected validation fails the call before anything is mutated, persisted, or emitted. Location-scoped permission rules are then re-keyed to the new directory (best-effort). Remote sessions only record the path.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -24535,12 +26034,12 @@ pub struct SessionMetadataRecordContextChangeResult {}
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMetadataSetWorkingDirectoryResult {
-    /// Working directory after the update
-    pub working_directory: String,
+pub struct SessionQueueHasPendingParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Re-tokenize the session's existing messages against `modelId` and return the token totals. Useful for hosts that want an initial estimate of context usage on session resume, before the next agent turn fires `session.context_info_changed` events. Returns zeros for an empty session.
+/// Whether the native queue has pending work.
 ///
 /// <div class="warning">
 ///
@@ -24550,16 +26049,12 @@ pub struct SessionMetadataSetWorkingDirectoryResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionMetadataRecomputeContextTokensResult {
-    /// Tokens contributed by user/assistant/tool messages (excludes system/developer prompts).
-    pub messages_token_count: i64,
-    /// Tokens contributed by system/developer prompt snapshots.
-    pub system_token_count: i64,
-    /// Sum of tokens across chat-context and system-context messages currently held by the session.
-    pub total_tokens: i64,
+pub struct SessionQueueHasPendingResult {
+    /// True when queued or immediate native work is pending.
+    pub has_pending: bool,
 }
 
-/// Identifies the target session.
+/// Whether a deferred-idle drain should run.
 ///
 /// <div class="warning">
 ///
@@ -24569,12 +26064,12 @@ pub struct SessionMetadataRecomputeContextTokensResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSettingsSnapshotParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct SessionQueueBeginDeferredIdleDrainResult {
+    /// True when the host should run finishDeferredIdleDrain asynchronously.
+    pub should_drain: bool,
 }
 
-/// Redacted, serializable view of session runtime settings for SDK boundary consumers. Secrets and raw feature flags are intentionally excluded.
+/// Action selected by the native deferred-idle drain.
 ///
 /// <div class="warning">
 ///
@@ -24584,32 +26079,29 @@ pub struct SessionSettingsSnapshotParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionSettingsSnapshotResult {
-    /// Name of the SDK client that created the session.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub client_name: Option<String>,
-    /// Redacted job settings.
-    pub job: SessionSettingsJobSnapshot,
-    /// Redacted model routing settings.
-    pub model: SessionSettingsModelSnapshot,
-    /// Online-evaluation settings safe for SDK consumers.
-    pub online_evaluation: SessionSettingsOnlineEvaluationSnapshot,
-    /// Redacted repository and host settings.
-    pub repo: SessionSettingsRepoSnapshot,
-    /// Session start time as Unix epoch milliseconds.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub start_time_ms: Option<f64>,
-    /// Session timeout in milliseconds.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub timeout_ms: Option<f64>,
-    /// Redacted validation and memory-tool settings.
-    pub validation: SessionSettingsValidationSnapshot,
-    /// Agent runtime version selector copied from the session settings, such as `latest` or a runtime release identifier.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub version: Option<String>,
+pub struct SessionQueueFinishDeferredIdleDrainResult {
+    /// Whether the deferred idle was caused by an aborted foreground turn.
+    pub aborted: bool,
+    /// One of none, processQueue, or emitSessionIdle.
+    pub action: String,
+}
+
+/// Identifies the target session.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionQueueRemoveMostRecentParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Batch content-exclusion result. Callers must fail closed when policy evaluation is unavailable.
+/// Indicates whether a user-facing pending item was removed.
 ///
 /// <div class="warning">
 ///
@@ -24619,14 +26111,12 @@ pub struct SessionSettingsSnapshotResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionContentExclusionCheckPathsResult {
-    /// Whether the session's policy service was available for the complete batch. When false, checks is empty and callers must treat every requested path as excluded.
-    pub available: bool,
-    /// Per-path decisions in request order. Empty when available is false.
-    pub checks: Vec<ContentExclusionPathCheck>,
+pub struct SessionQueueRemoveMostRecentResult {
+    /// True if a user-facing pending item was removed (LIFO across both queues); false when no removable items remained.
+    pub removed: bool,
 }
 
-/// Identifier of the spawned process, used to correlate streamed output and exit notifications.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -24636,12 +26126,12 @@ pub struct SessionContentExclusionCheckPathsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionShellExecResult {
-    /// Unique identifier for tracking streamed output
-    pub process_id: String,
+pub struct SessionQueueClearParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Indicates whether the signal was delivered; false if the process was unknown or already exited.
+/// Indicates whether a user-facing pending item was removed.
 ///
 /// <div class="warning">
 ///
@@ -24651,12 +26141,12 @@ pub struct SessionShellExecResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionShellKillResult {
-    /// Whether the signal was sent successfully
-    pub killed: bool,
+pub struct SessionQueueConsumeSystemNotificationsResult {
+    /// True if a user-facing pending item was removed (LIFO across both queues); false when no removable items remained.
+    pub removed: bool,
 }
 
-/// Result of a user-requested shell command.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -24666,22 +26156,12 @@ pub struct SessionShellKillResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionShellExecuteUserRequestedResult {
-    /// Error output when the execution failed
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Process exit code, when available
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub exit_code: Option<i64>,
-    /// Captured command output
-    pub output: String,
-    /// Whether the command completed successfully
-    pub success: bool,
-    /// Tool call id emitted for the shell execution
-    pub tool_call_id: String,
+pub struct SessionQueueEnqueueResumePendingParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Cancellation result for a user-requested shell command.
+/// Result of enqueueing the resume-pending wake item.
 ///
 /// <div class="warning">
 ///
@@ -24691,12 +26171,12 @@ pub struct SessionShellExecuteUserRequestedResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionShellCancelUserRequestedResult {
-    /// Whether an in-flight execution was found and signalled to cancel
-    pub cancelled: bool,
+pub struct SessionQueueEnqueueResumePendingResult {
+    /// True when a wake item was newly queued.
+    pub queued: bool,
 }
 
-/// Compaction outcome with the number of tokens and messages removed, summary text, and the resulting context window breakdown.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -24706,22 +26186,12 @@ pub struct SessionShellCancelUserRequestedResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionHistoryCompactResult {
-    /// Post-compaction context window usage breakdown
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub context_window: Option<HistoryCompactContextWindow>,
-    /// Number of messages removed during compaction
-    pub messages_removed: i64,
-    /// Whether compaction completed successfully
-    pub success: bool,
-    /// Summary text produced by compaction. Omitted when compaction did not produce a summary (e.g. failure path).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub summary_content: Option<String>,
-    /// Number of tokens freed by compaction
-    pub tokens_removed: i64,
+pub struct SessionQueueProcessParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Number of events that were removed by the truncation.
+/// Batch of session events returned by a read, with cursor and continuation metadata.
 ///
 /// <div class="warning">
 ///
@@ -24731,15 +26201,15 @@ pub struct SessionHistoryCompactResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionHistoryTruncateResult {
-    /// Failure detail when checkpointCleanupFailed is true.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub checkpoint_cleanup_error: Option<String>,
-    /// True when conversation truncation succeeded but post-truncation workspace checkpoint cleanup failed. History is already truncated; callers may still prune snapshots but should report a checkpoint-cleanup rather than a truncation failure.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub checkpoint_cleanup_failed: Option<bool>,
-    /// Number of events that were removed
-    pub events_removed: i64,
+pub struct SessionEventLogReadResult {
+    /// Opaque cursor for the next read. Pass back unchanged in the next read.cursor to continue from where this read left off. Always present, even when no events were returned. For a backward read this cursor pages toward OLDER events; keep passing `direction: backward` with it (the cursor is also self-describing, so backward paging continues correctly).
+    pub cursor: String,
+    /// Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history. For a forward read the fallback starts from the beginning of the remaining history; for a backward read it falls back to the tail (the newest window). Because the fallback page is a fresh boundary snapshot rather than a continuation of the requested cursor, it may overlap events the consumer has already rendered — a backward fallback to the tail in particular can repeat the newest window. On 'expired', consumers should reset or rebase their local pagination state (or deduplicate by event id) before continuing from the returned cursor rather than blindly appending/prepending the fallback page.
+    pub cursor_status: EventsCursorStatus,
+    /// Session events for this batch, merged into a single stream in creation order: durable (persisted) events and ephemeral events interleave exactly as they were emitted. Set `includeEphemeral: false` to receive only durable events. Ephemeral events are never replayable once pruned from the in-memory ring, so a consumer that needs them should keep reading with a non-zero `waitMs`. For a backward (tail-first) read, the returned window contains persisted events only, still in chronological (oldest-to-newest) append order.
+    pub events: Vec<SessionEvent>,
+    /// True when more events are available in the read's direction. For a forward read, true means the batch returned `max` events and more are available immediately. For a backward read, true means older persisted events remain before the returned window.
+    pub has_more: bool,
 }
 
 /// Identifies the target session.
@@ -24752,12 +26222,12 @@ pub struct SessionHistoryTruncateResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionHistoryListRewindPointsParams {
+pub struct SessionEventLogTailParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Rewind points and file-change-tracking availability for the session.
+/// Snapshot of the current tail cursor without returning any events. Use this when a consumer wants to subscribe to live events going forward without first paginating through the entire persisted history (which would happen if `read` were called without a cursor on a long-lived session).
 ///
 /// <div class="warning">
 ///
@@ -24767,17 +26237,12 @@ pub struct SessionHistoryListRewindPointsParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionHistoryListRewindPointsResult {
-    /// Whether this session captured file changes from its first turn.
-    pub file_change_tracking_enabled: bool,
-    /// Root user turns in chronological order. Empty when `unavailableReason` is set.
-    pub points: Vec<HistoryRewindPoint>,
-    /// Why the listed points could not be produced, when applicable; the points list is empty whenever it is set. `unsupported-remote-session` is permanent for the session and comes with `fileChangeTrackingEnabled: false`. `session-busy` is transient and only ever reported by a session that *is* tracking (`fileChangeTrackingEnabled: true`), because the file-change captures cannot be read while work that may still mutate them is in flight; the same request succeeds once the session settles, so a client that wants points should retry rather than treat it as a failure. It is never `file-change-tracking-disabled`: an untracked local session still lists conversation-only points and reports that through `fileChangeTrackingEnabled: false`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub unavailable_reason: Option<HistoryRewindUnavailableReason>,
+pub struct SessionEventLogTailResult {
+    /// Opaque cursor pointing at the current tail of the session's persisted-events history. Pass back to `read` to receive only events that arrive AFTER this snapshot. When the session has no events, this returns the same sentinel as an unset cursor (i.e. equivalent to omitting the cursor on a first read).
+    pub cursor: String,
 }
 
-/// Files and aggregate changes for a prospective rewind.
+/// Opaque handle representing an event-type interest registration.
 ///
 /// <div class="warning">
 ///
@@ -24787,19 +26252,12 @@ pub struct SessionHistoryListRewindPointsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionHistoryPreviewRewindResult {
-    /// Whether file restore is available for this session. This is authoritative: switch on it and read `reason` only when it is false.
-    pub available: bool,
-    /// Number of unique files in the preview.
-    pub file_count: i64,
-    /// Files ordered by path.
-    pub files: Vec<HistoryRewindFilePreview>,
-    /// Why file restore is unavailable, when applicable. Populated only when `available` is false and never set when `available` is true.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub reason: Option<HistoryRewindUnavailableReason>,
+pub struct SessionEventLogRegisterInterestResult {
+    /// Opaque handle for this registration. Pass to releaseInterest to release. Each call to registerInterest produces a fresh handle, even when the same eventType is registered multiple times.
+    pub handle: String,
 }
 
-/// Structured outcome of a rewind request.
+/// Indicates whether the operation succeeded.
 ///
 /// <div class="warning">
 ///
@@ -24809,19 +26267,9 @@ pub struct SessionHistoryPreviewRewindResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionHistoryRewindResult {
-    /// Failure detail. Set only for the failure and partial-failure outcomes (`files-rolled-back`, `rollback-incomplete`, `truncation-failed`, `checkpoint-cleanup-failed`, `snapshot-prune-failed`); omitted for `success` and for the unavailable outcomes (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Number of persisted events removed by conversation truncation. Present only when truncation succeeded (outcomes `success`, `checkpoint-cleanup-failed`, and `snapshot-prune-failed`); omitted for every unavailable outcome (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`) and for `truncation-failed`, `files-rolled-back`, and `rollback-incomplete`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub events_removed: Option<i64>,
-    /// Overall rewind outcome. This discriminates the result: it governs which of the remaining fields are populated, so consumers must switch on it before reading `eventsRemoved`, `restoredFiles`, `skippedFiles`, or `error`. See each field for the outcomes that populate it.
-    pub outcome: HistoryRewindOutcome,
-    /// Absolute paths restored to their captured preimages. Always empty for conversation-only rewinds and for the unavailable outcomes (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`); only conversation-and-files outcomes that reached the file-restore stage populate it.
-    pub restored_files: Vec<String>,
-    /// Captured files intentionally left unchanged. Always empty for conversation-only rewinds and for the unavailable outcomes (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`); only conversation-and-files outcomes that reached the file-restore stage populate it.
-    pub skipped_files: Vec<HistorySkippedFileRestore>,
+pub struct SessionEventLogReleaseInterestResult {
+    /// Whether the operation succeeded
+    pub success: bool,
 }
 
 /// Identifies the target session.
@@ -24834,12 +26282,12 @@ pub struct SessionHistoryRewindResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionHistoryCancelBackgroundCompactionParams {
+pub struct SessionUsageGetMetricsParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Indicates whether an in-progress background compaction was cancelled.
+/// Accumulated session usage metrics, including premium request cost, token counts, model breakdown, and code-change totals.
 ///
 /// <div class="warning">
 ///
@@ -24849,9 +26297,53 @@ pub struct SessionHistoryCancelBackgroundCompactionParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionHistoryCancelBackgroundCompactionResult {
-    /// Whether an in-progress background compaction was cancelled. False when no compaction was running, when the session is remote, or when the underlying processor was unavailable.
-    pub cancelled: bool,
+pub struct SessionUsageGetMetricsResult {
+    /// Per-agent usage metrics, keyed by agent instance identifier. The main conversation uses the stable key `main`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub agent_metrics: Option<HashMap<String, UsageMetricsAgentMetric>>,
+    /// Aggregated code change metrics
+    pub code_changes: UsageMetricsCodeChanges,
+    /// Currently active model identifier
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub current_model: Option<String>,
+    /// Input tokens from the most recent main-agent API call
+    pub last_call_input_tokens: i64,
+    /// Output tokens from the most recent main-agent API call
+    pub last_call_output_tokens: i64,
+    /// Per-model token and request metrics, keyed by model identifier
+    pub model_metrics: HashMap<String, UsageMetricsModelMetric>,
+    /// ISO 8601 timestamp when the session started
+    pub session_start_time: String,
+    /// Session-wide per-token-type accumulated token counts
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub token_details: Option<HashMap<String, UsageMetricsTokenDetail>>,
+    /// Total time spent in model API calls (milliseconds)
+    pub total_api_duration_ms: i64,
+    /// Session-wide accumulated nano-AI units cost
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub total_nano_aiu: Option<f64>,
+    /// Total user-initiated premium request cost across all models (may be fractional due to multipliers)
+    pub total_premium_request_cost: f64,
+    /// Raw count of user-initiated API requests
+    pub total_user_requests: i64,
+}
+
+/// GitHub URL for the session and a flag indicating whether remote steering is enabled.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionRemoteEnableResult {
+    /// Whether remote steering is enabled
+    pub remote_steerable: bool,
+    /// GitHub frontend URL for this session
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub url: Option<String>,
 }
 
 /// Identifies the target session.
@@ -24864,12 +26356,12 @@ pub struct SessionHistoryCancelBackgroundCompactionResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionHistoryAbortManualCompactionParams {
+pub struct SessionRemoteDisableParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Indicates whether an in-progress manual compaction was aborted.
+/// Persist a steerability change as a `session.remote_steerable_changed` event. Used by the host (CLI / SDK consumer) when it has just finished enabling or disabling steering on a remote exporter that the runtime does not directly own.
 ///
 /// <div class="warning">
 ///
@@ -24879,10 +26371,7 @@ pub struct SessionHistoryAbortManualCompactionParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionHistoryAbortManualCompactionResult {
-    /// Whether an in-progress manual compaction was aborted. False when no manual compaction was running, when its abort controller was already aborted, or when the session is remote.
-    pub aborted: bool,
-}
+pub struct SessionRemoteNotifySteerableChangedResult {}
 
 /// Identifies the target session.
 ///
@@ -24894,12 +26383,12 @@ pub struct SessionHistoryAbortManualCompactionResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionHistorySummarizeForHandoffParams {
+pub struct SessionVisibilityGetParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Markdown summary of the conversation context (empty when not available).
+/// Current sharing status and shareable GitHub URL for a session.
 ///
 /// <div class="warning">
 ///
@@ -24909,12 +26398,18 @@ pub struct SessionHistorySummarizeForHandoffParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionHistorySummarizeForHandoffResult {
-    /// Markdown summary of the conversation context produced by an LLM. Empty string when there are no messages or when the session does not support local summarization.
-    pub summary: String,
+pub struct SessionVisibilityGetResult {
+    /// Shareable GitHub URL for the session. Present when the session is synced and the URL can be resolved.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub share_url: Option<String>,
+    /// Current sharing status. Absent when the session is not synced or the status could not be retrieved (e.g. the user is not authenticated).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status: Option<SessionVisibilityStatus>,
+    /// Whether the session has been synced to Mission Control (i.e. has a GitHub task). When false, the session cannot be shared and `status`/`shareUrl` are absent.
+    pub synced: bool,
 }
 
-/// What a successful clear removed. A clear that could not be applied rejects instead of reporting a count.
+/// Effective sharing status and shareable GitHub URL after updating session visibility.
 ///
 /// <div class="warning">
 ///
@@ -24924,9 +26419,15 @@ pub struct SessionHistorySummarizeForHandoffResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionHistoryClearContextResult {
-    /// Number of non-system, non-developer messages that were removed from the conversation. Zero only when the window already held no conversation.
-    pub messages_cleared: i64,
+pub struct SessionVisibilitySetResult {
+    /// Shareable GitHub URL for the session. Present when the session is synced and the URL can be resolved.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub share_url: Option<String>,
+    /// Effective sharing status after the update. May differ from the requested status for task types that are already visible to repository readers by default. Absent when the update could not be applied (e.g. the session is not synced or the user is not authenticated).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status: Option<SessionVisibilityStatus>,
+    /// Whether the session has been synced to Mission Control (i.e. has a GitHub task). When false, the visibility change could not be applied and `status`/`shareUrl` are absent.
+    pub synced: bool,
 }
 
 /// Identifies the target session.
@@ -24939,12 +26440,27 @@ pub struct SessionHistoryClearContextResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionQueuePendingItemsParams {
+pub struct SessionScheduleListParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Snapshot of the session's pending queued items and immediate-steering messages.
+/// Snapshot of the currently active recurring prompts for this session.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionScheduleListResult {
+    /// Active scheduled prompts, ordered by id.
+    pub entries: Vec<ScheduleEntry>,
+}
+
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -24954,11 +26470,9 @@ pub struct SessionQueuePendingItemsParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionQueuePendingItemsResult {
-    /// Pending queued items in submission order. Includes user messages, queued slash commands, and queued model changes; omits internal system items.
-    pub items: Vec<QueuePendingItems>,
-    /// Display text for messages currently in the immediate steering queue (interjections sent during a running turn).
-    pub steering_messages: Vec<String>,
+pub struct SessionScheduleHydrateParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
 /// Identifies the target session.
@@ -24971,12 +26485,12 @@ pub struct SessionQueuePendingItemsResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionQueueSnapshotParams {
+pub struct SessionScheduleHasSelfPacedParams {
     /// Target session identifier
     pub session_id: SessionId,
 }
 
-/// Internal snapshot of native queue state for local session orchestration.
+/// Whether the session currently has an active self-paced schedule.
 ///
 /// <div class="warning">
 ///
@@ -24986,20 +26500,12 @@ pub struct SessionQueueSnapshotParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionQueueSnapshotResult {
-    /// Insertion orders for queued items, aligned with `items`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub item_orders: Option<Vec<i64>>,
-    /// User-facing pending items in FIFO order.
-    pub items: Vec<QueuePendingItems>,
-    /// Insertion orders for immediate steering messages, aligned with `steeringMessages`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub steering_message_orders: Option<Vec<i64>>,
-    /// Immediate steering messages waiting for an active turn.
-    pub steering_messages: Vec<String>,
+pub struct SessionScheduleHasSelfPacedResult {
+    /// True when at least one active schedule is self-paced.
+    pub has_self_paced: bool,
 }
 
-/// Result of moving a queued item.
+/// Result of registering or re-arming a scheduled prompt.
 ///
 /// <div class="warning">
 ///
@@ -25009,12 +26515,16 @@ pub struct SessionQueueSnapshotResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionQueueMoveItemResult {
-    /// True when the item changed position; false when it was already at the requested position.
-    pub changed: bool,
+pub struct SessionScheduleAddResult {
+    /// The registered or updated schedule entry.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub entry: Option<ScheduleEntry>,
+    /// User-facing validation error, when registration failed.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
 }
 
-/// Result of inserting a queued message.
+/// Result of registering or re-arming a scheduled prompt.
 ///
 /// <div class="warning">
 ///
@@ -25024,12 +26534,16 @@ pub struct SessionQueueMoveItemResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionQueueInsertAtResult {
-    /// Fresh stable opaque id assigned to the inserted item.
-    pub id: String,
+pub struct SessionScheduleAddCronResult {
+    /// The registered or updated schedule entry.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub entry: Option<ScheduleEntry>,
+    /// User-facing validation error, when registration failed.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
 }
 
-/// Result of removing a queued item.
+/// Result of registering or re-arming a scheduled prompt.
 ///
 /// <div class="warning">
 ///
@@ -25039,12 +26553,16 @@ pub struct SessionQueueInsertAtResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionQueueRemoveAtResult {
-    /// True when the addressed item was removed.
-    pub removed: bool,
+pub struct SessionScheduleAddAtResult {
+    /// The registered or updated schedule entry.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub entry: Option<ScheduleEntry>,
+    /// User-facing validation error, when registration failed.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
 }
 
-/// Result of editing a queued message.
+/// Result of registering or re-arming a scheduled prompt.
 ///
 /// <div class="warning">
 ///
@@ -25054,12 +26572,16 @@ pub struct SessionQueueRemoveAtResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionQueueUpdateTextResult {
-    /// True when the stored text changed.
-    pub updated: bool,
+pub struct SessionScheduleAddSelfPacedResult {
+    /// The registered or updated schedule entry.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub entry: Option<ScheduleEntry>,
+    /// User-facing validation error, when registration failed.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
 }
 
-/// Result of duplicating a queued item.
+/// Result of registering or re-arming a scheduled prompt.
 ///
 /// <div class="warning">
 ///
@@ -25069,12 +26591,16 @@ pub struct SessionQueueUpdateTextResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionQueueDuplicateAtResult {
-    /// Fresh stable opaque id assigned to the duplicate.
-    pub id: String,
+pub struct SessionScheduleRearmSelfPacedResult {
+    /// The registered or updated schedule entry.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub entry: Option<ScheduleEntry>,
+    /// User-facing validation error, when registration failed.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
 }
 
-/// Result of trying to steer a queued message into a live turn.
+/// Remove a scheduled prompt by id. The result entry is omitted if the id was unknown.
 ///
 /// <div class="warning">
 ///
@@ -25084,12 +26610,13 @@ pub struct SessionQueueDuplicateAtResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionQueueSendNowResult {
-    /// True when the item was accepted into the steering lane; false when no main turn was live.
-    pub steered: bool,
+pub struct SessionScheduleStopResult {
+    /// The removed entry, or omitted if no entry matched.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub entry: Option<ScheduleEntry>,
 }
 
-/// Identifies the target session.
+/// A bearer token supplied by the SDK client for a BYOK provider. The runtime sets it as `Authorization: Bearer <token>` on the outbound request and does no caching; the SDK consumer owns token caching and refresh.
 ///
 /// <div class="warning">
 ///
@@ -25099,12 +26626,12 @@ pub struct SessionQueueSendNowResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionQueueHasPendingParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+pub struct ProviderTokenGetTokenResult {
+    /// The bearer token value (without the `Bearer ` prefix).
+    pub token: String,
 }
 
-/// Whether the native queue has pending work.
+/// Acknowledgement that a factory request was accepted.
 ///
 /// <div class="warning">
 ///
@@ -25114,12 +26641,9 @@ pub struct SessionQueueHasPendingParams {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionQueueHasPendingResult {
-    /// True when queued or immediate native work is pending.
-    pub has_pending: bool,
-}
+pub struct FactoryAbortResult {}
 
-/// Whether a deferred-idle drain should run.
+/// Identifies the target session.
 ///
 /// <div class="warning">
 ///
@@ -25129,12 +26653,12 @@ pub struct SessionQueueHasPendingResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionQueueBeginDeferredIdleDrainResult {
-    /// True when the host should run finishDeferredIdleDrain asynchronously.
-    pub should_drain: bool,
+pub struct SessionFsSqliteExistsParams {
+    /// Target session identifier
+    pub session_id: SessionId,
 }
 
-/// Action selected by the native deferred-idle drain.
+/// Canvas open result returned by the provider.
 ///
 /// <div class="warning">
 ///
@@ -25144,14 +26668,19 @@ pub struct SessionQueueBeginDeferredIdleDrainResult {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct SessionQueueFinishDeferredIdleDrainResult {
-    /// Whether the deferred idle was caused by an aborted foreground turn.
-    pub aborted: bool,
-    /// One of none, processQueue, or emitSessionIdle.
-    pub action: String,
+pub struct CanvasOpenResult {
+    /// Provider-supplied status text
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status: Option<String>,
+    /// Provider-supplied title
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub title: Option<String>,
+    /// URL for web-rendered canvases
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub url: Option<String>,
 }
 
-/// Identifies the target session.
+/// Validation errors from the most recent authentication attempt.
 ///
 /// <div class="warning">
 ///
@@ -25159,14 +26688,9 @@ pub struct SessionQueueFinishDeferredIdleDrainResult {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionQueueRemoveMostRecentParams {
-    /// Target session identifier
-    pub session_id: SessionId,
-}
+pub type AuthValidationErrors = Vec<AuthValidationError>;
 
-/// Indicates whether a user-facing pending item was removed.
+/// SHA-256 digest encoded as exactly 64 lowercase hexadecimal characters.
 ///
 /// <div class="warning">
 ///
@@ -25174,14 +26698,9 @@ pub struct SessionQueueRemoveMostRecentParams {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionQueueRemoveMostRecentResult {
-    /// True if a user-facing pending item was removed (LIFO across both queues); false when no removable items remained.
-    pub removed: bool,
-}
+pub type CardDigestValue = String;
 
-/// Identifies the target session.
+/// Bounded extensible wire-feature identifier. Known values are described by `CatalogCapability`; newer callers may send future identifiers so an older runtime can return a typed negotiation refusal instead of failing schema validation. Capability negotiation establishes contract understanding, while each operation's result separately reports runtime availability.
 ///
 /// <div class="warning">
 ///
@@ -25189,14 +26708,9 @@ pub struct SessionQueueRemoveMostRecentResult {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionQueueClearParams {
-    /// Target session identifier
-    pub session_id: SessionId,
-}
+pub type CatalogCapabilityId = String;
 
-/// Indicates whether a user-facing pending item was removed.
+/// HTTP headers as a map from lowercased header name to a list of values. Multi-valued headers (e.g. Set-Cookie) preserve all values.
 ///
 /// <div class="warning">
 ///
@@ -25204,14 +26718,9 @@ pub struct SessionQueueClearParams {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionQueueConsumeSystemNotificationsResult {
-    /// True if a user-facing pending item was removed (LIFO across both queues); false when no removable items remained.
-    pub removed: bool,
-}
+pub type LlmInferenceHeaders = HashMap<String, Vec<String>>;
 
-/// Identifies the target session.
+/// MCP CreateMessageResult payload (with optional 'tools' extension), present when action='success'. Treated as opaque at the schema layer; consumers should construct/consume it per the MCP CreateMessageResult shape.
 ///
 /// <div class="warning">
 ///
@@ -25219,14 +26728,9 @@ pub struct SessionQueueConsumeSystemNotificationsResult {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionQueueEnqueueResumePendingParams {
-    /// Target session identifier
-    pub session_id: SessionId,
-}
+pub type McpExecuteSamplingResult = HashMap<String, serde_json::Value>;
 
-/// Result of enqueueing the resume-pending wake item.
+/// A runtime-assigned secret placeholder. The identifier is carried once, inside the placeholder, so it cannot contradict a separate secret-id field.
 ///
 /// <div class="warning">
 ///
@@ -25234,14 +26738,9 @@ pub struct SessionQueueEnqueueResumePendingParams {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionQueueEnqueueResumePendingResult {
-    /// True when a wake item was newly queued.
-    pub queued: bool,
-}
+pub type McpPlanSecretReference = String;
 
-/// Identifies the target session.
+/// The form values submitted by the user (present when action is 'accept')
 ///
 /// <div class="warning">
 ///
@@ -25249,14 +26748,9 @@ pub struct SessionQueueEnqueueResumePendingResult {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionQueueProcessParams {
-    /// Target session identifier
-    pub session_id: SessionId,
-}
+pub type UIElicitationResponseContent = HashMap<String, serde_json::Value>;
 
-/// Batch of session events returned by a read, with cursor and continuation metadata.
+/// List of all authenticated users
 ///
 /// <div class="warning">
 ///
@@ -25264,20 +26758,9 @@ pub struct SessionQueueProcessParams {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionEventLogReadResult {
-    /// Opaque cursor for the next read. Pass back unchanged in the next read.cursor to continue from where this read left off. Always present, even when no events were returned. For a backward read this cursor pages toward OLDER events; keep passing `direction: backward` with it (the cursor is also self-describing, so backward paging continues correctly).
-    pub cursor: String,
-    /// Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history. For a forward read the fallback starts from the beginning of the remaining history; for a backward read it falls back to the tail (the newest window). Because the fallback page is a fresh boundary snapshot rather than a continuation of the requested cursor, it may overlap events the consumer has already rendered — a backward fallback to the tail in particular can repeat the newest window. On 'expired', consumers should reset or rebase their local pagination state (or deduplicate by event id) before continuing from the returned cursor rather than blindly appending/prepending the fallback page.
-    pub cursor_status: EventsCursorStatus,
-    /// Session events for this batch, merged into a single stream in creation order: durable (persisted) events and ephemeral events interleave exactly as they were emitted. Set `includeEphemeral: false` to receive only durable events. Ephemeral events are never replayable once pruned from the in-memory ring, so a consumer that needs them should keep reading with a non-zero `waitMs`. For a backward (tail-first) read, the returned window contains persisted events only, still in chronological (oldest-to-newest) append order.
-    pub events: Vec<SessionEvent>,
-    /// True when more events are available in the read's direction. For a forward read, true means the batch returned `max` events and more are available immediately. For a backward read, true means older persisted events remain before the returned window.
-    pub has_more: bool,
-}
+pub type AccountGetAllUsersResult = Vec<AccountAllUsers>;
 
-/// Identifies the target session.
+/// The number of running background agents (task-registry agents) that were cancelled.
 ///
 /// <div class="warning">
 ///
@@ -25285,14 +26768,9 @@ pub struct SessionEventLogReadResult {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionEventLogTailParams {
-    /// Target session identifier
-    pub session_id: SessionId,
-}
+pub type SessionCancelAllBackgroundAgentsResult = i64;
 
-/// Snapshot of the current tail cursor without returning any events. Use this when a consumer wants to subscribe to live events going forward without first paginating through the entire persisted history (which would happen if `read` were called without a cursor on a long-lived session).
+/// Authentication accounts available to the internal session host.
 ///
 /// <div class="warning">
 ///
@@ -25300,14 +26778,9 @@ pub struct SessionEventLogTailParams {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionEventLogTailResult {
-    /// Opaque cursor pointing at the current tail of the session's persisted-events history. Pass back to `read` to receive only events that arrive AFTER this snapshot. When the session has no events, this returns the same sentinel as an unset cursor (i.e. equivalent to omitting the cursor on a first read).
-    pub cursor: String,
-}
+pub type SessionGitHubAuthGetAllAuthAvailableResult = Vec<SessionAuthStatus>;
 
-/// Opaque handle representing an event-type interest registration.
+/// Whether the current authentication was logged out.
 ///
 /// <div class="warning">
 ///
@@ -25315,14 +26788,9 @@ pub struct SessionEventLogTailResult {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionEventLogRegisterInterestResult {
-    /// Opaque handle for this registration. Pass to releaseInterest to release. Each call to registerInterest produces a fresh handle, even when the same eventType is registered multiple times.
-    pub handle: String,
-}
+pub type SessionGitHubAuthLogoutResult = bool;
 
-/// Indicates whether the operation succeeded.
+/// Whether the requested authentication was logged out.
 ///
 /// <div class="warning">
 ///
@@ -25330,14 +26798,9 @@ pub struct SessionEventLogRegisterInterestResult {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionEventLogReleaseInterestResult {
-    /// Whether the operation succeeded
-    pub success: bool,
-}
+pub type SessionGitHubAuthLogoutUserResult = bool;
 
-/// Identifies the target session.
+/// Validation errors from the most recent authentication attempt.
 ///
 /// <div class="warning">
 ///
@@ -25345,14 +26808,9 @@ pub struct SessionEventLogReleaseInterestResult {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionUsageGetMetricsParams {
-    /// Target session identifier
-    pub session_id: SessionId,
-}
+pub type SessionGitHubAuthLastAuthErrorsResult = Vec<AuthValidationError>;
 
-/// Accumulated session usage metrics, including premium request cost, token counts, model breakdown, and code-change totals.
+/// Standard MCP CallToolResult
 ///
 /// <div class="warning">
 ///
@@ -25360,40 +26818,81 @@ pub struct SessionUsageGetMetricsParams {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionUsageGetMetricsResult {
-    /// Per-agent usage metrics, keyed by agent instance identifier. The main conversation uses the stable key `main`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub agent_metrics: Option<HashMap<String, UsageMetricsAgentMetric>>,
-    /// Aggregated code change metrics
-    pub code_changes: UsageMetricsCodeChanges,
-    /// Currently active model identifier
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub current_model: Option<String>,
-    /// Input tokens from the most recent main-agent API call
-    pub last_call_input_tokens: i64,
-    /// Output tokens from the most recent main-agent API call
-    pub last_call_output_tokens: i64,
-    /// Per-model token and request metrics, keyed by model identifier
-    pub model_metrics: HashMap<String, UsageMetricsModelMetric>,
-    /// ISO 8601 timestamp when the session started
-    pub session_start_time: String,
-    /// Session-wide per-token-type accumulated token counts
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub token_details: Option<HashMap<String, UsageMetricsTokenDetail>>,
-    /// Total time spent in model API calls (milliseconds)
-    pub total_api_duration_ms: i64,
-    /// Session-wide accumulated nano-AI units cost
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub total_nano_aiu: Option<f64>,
-    /// Total user-initiated premium request cost across all models (may be fractional due to multipliers)
-    pub total_premium_request_cost: f64,
-    /// Raw count of user-initiated API requests
-    pub total_user_requests: i64,
+pub type SessionMcpAppsCallToolResult = HashMap<String, serde_json::Value>;
+
+/// Authentication host. HMAC auth always targets the public GitHub host.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum HMACAuthInfoHost {
+    #[serde(rename = "https://github.com")]
+    #[default]
+    HttpsGitHubCom,
 }
 
-/// GitHub URL for the session and a flag indicating whether remote steering is enabled.
+/// HMAC-based authentication used by GitHub-internal services.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum HMACAuthInfoType {
+    #[serde(rename = "hmac")]
+    #[default]
+    Hmac,
+}
+
+/// Personal access token (PAT) or server-to-server token sourced from an environment variable.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum EnvAuthInfoType {
+    #[serde(rename = "env")]
+    #[default]
+    Env,
+}
+
+/// SDK-side token authentication; the host configured the token directly via the SDK.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum TokenAuthInfoType {
+    #[serde(rename = "token")]
+    #[default]
+    Token,
+}
+
+/// Authentication host (always the public GitHub host).
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CopilotApiTokenAuthInfoHost {
+    #[serde(rename = "https://github.com")]
+    #[default]
+    HttpsGitHubCom,
+}
+
+/// Direct Copilot API authentication via the `GITHUB_COPILOT_API_TOKEN` + `COPILOT_API_URL` environment-variable pair. The token itself is read from the environment by the runtime, not carried in this struct.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CopilotApiTokenAuthInfoType {
+    #[serde(rename = "copilot-api-token")]
+    #[default]
+    CopilotApiToken,
+}
+
+/// OAuth user authentication. The token itself is held in the runtime's secret token store (keyed by host+login) and is NOT carried in this struct.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum UserAuthInfoType {
+    #[serde(rename = "user")]
+    #[default]
+    User,
+}
+
+/// Authentication via the `gh` CLI's saved credentials.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum GhCliAuthInfoType {
+    #[serde(rename = "gh-cli")]
+    #[default]
+    GhCli,
+}
+
+/// API-key authentication for non-GitHub LLM providers (e.g. when running BYOM-style).
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum ApiKeyAuthInfoType {
+    #[serde(rename = "api-key")]
+    #[default]
+    ApiKey,
+}
+
+/// Authentication credentials accepted only at native protocol ingress. Runtime outputs use credential-free `AuthIdentity` metadata.
 ///
 /// <div class="warning">
 ///
@@ -25401,17 +26900,19 @@ pub struct SessionUsageGetMetricsResult {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionRemoteEnableResult {
-    /// Whether remote steering is enabled
-    pub remote_steerable: bool,
-    /// GitHub frontend URL for this session
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub url: Option<String>,
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(untagged)]
+pub enum AuthInfo {
+    Hmac(HMACAuthInfo),
+    Env(EnvAuthInfo),
+    Token(TokenAuthInfo),
+    CopilotApiToken(CopilotApiTokenAuthInfo),
+    User(UserAuthInfo),
+    GhCli(GhCliAuthInfo),
+    ApiKey(ApiKeyAuthInfo),
 }
 
-/// Identifies the target session.
+/// Resolved Anthropic adaptive-thinking capability for a model.
 ///
 /// <div class="warning">
 ///
@@ -25419,14 +26920,24 @@ pub struct SessionRemoteEnableResult {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionRemoteDisableParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AdaptiveThinkingSupport {
+    /// The model does not accept thinking.type='adaptive'
+    #[serde(rename = "unsupported")]
+    Unsupported,
+    /// The model accepts adaptive thinking but also accepts thinking.type='enabled'
+    #[serde(rename = "optional")]
+    Optional,
+    /// The model only accepts adaptive thinking and rejects thinking.type='enabled' with HTTP 400 (e.g. opus-4.7/4.8)
+    #[serde(rename = "required")]
+    Required,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
 }
 
-/// Persist a steerability change as a `session.remote_steerable_changed` event. Used by the host (CLI / SDK consumer) when it has just finished enabling or disabling steering on a remote exporter that the runtime does not directly own.
+/// Which tier this directory belongs to
 ///
 /// <div class="warning">
 ///
@@ -25434,11 +26945,21 @@ pub struct SessionRemoteDisableParams {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionRemoteNotifySteerableChangedResult {}
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AgentDiscoveryPathScope {
+    /// The user's personal agent configuration directory.
+    #[serde(rename = "user")]
+    User,
+    /// A project's repository agent directory.
+    #[serde(rename = "project")]
+    Project,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
 
-/// Identifies the target session.
+/// Where the agent definition was loaded from
 ///
 /// <div class="warning">
 ///
@@ -25446,14 +26967,33 @@ pub struct SessionRemoteNotifySteerableChangedResult {}
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionVisibilityGetParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AgentInfoSource {
+    /// Agent loaded from the user's personal agent configuration.
+    #[serde(rename = "user")]
+    User,
+    /// Agent loaded from the current project's repository configuration.
+    #[serde(rename = "project")]
+    Project,
+    /// Agent inherited from a parent project or workspace.
+    #[serde(rename = "inherited")]
+    Inherited,
+    /// Agent provided by a remote runtime or service.
+    #[serde(rename = "remote")]
+    Remote,
+    /// Agent contributed by an installed plugin.
+    #[serde(rename = "plugin")]
+    Plugin,
+    /// Agent built into the Copilot runtime.
+    #[serde(rename = "builtin")]
+    Builtin,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
 }
 
-/// Current sharing status and shareable GitHub URL for a session.
+/// Kind of attention required when status === "attention". Meaningful only when status === "attention".
 ///
 /// <div class="warning">
 ///
@@ -25461,20 +27001,30 @@ pub struct SessionVisibilityGetParams {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionVisibilityGetResult {
-    /// Shareable GitHub URL for the session. Present when the session is synced and the URL can be resolved.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub share_url: Option<String>,
-    /// Current sharing status. Absent when the session is not synced or the status could not be retrieved (e.g. the user is not authenticated).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub status: Option<SessionVisibilityStatus>,
-    /// Whether the session has been synced to Mission Control (i.e. has a GitHub task). When false, the session cannot be shared and `status`/`shareUrl` are absent.
-    pub synced: bool,
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AgentRegistryLiveTargetEntryAttentionKind {
+    /// Session is blocked on an unrecoverable error
+    #[serde(rename = "error")]
+    Error,
+    /// Session is waiting for a tool-permission decision
+    #[serde(rename = "permission")]
+    Permission,
+    /// Session is waiting for the user to approve or reject a plan
+    #[serde(rename = "exit_plan")]
+    ExitPlan,
+    /// Session is waiting on an elicitation prompt
+    #[serde(rename = "elicitation")]
+    Elicitation,
+    /// Session is waiting for free-form user input
+    #[serde(rename = "user_input")]
+    UserInput,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
 }
 
-/// Effective sharing status and shareable GitHub URL after updating session visibility.
+/// Process kind tag for the registry entry
 ///
 /// <div class="warning">
 ///
@@ -25482,20 +27032,21 @@ pub struct SessionVisibilityGetResult {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionVisibilitySetResult {
-    /// Shareable GitHub URL for the session. Present when the session is synced and the URL can be resolved.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub share_url: Option<String>,
-    /// Effective sharing status after the update. May differ from the requested status for task types that are already visible to repository readers by default. Absent when the update could not be applied (e.g. the session is not synced or the user is not authenticated).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub status: Option<SessionVisibilityStatus>,
-    /// Whether the session has been synced to Mission Control (i.e. has a GitHub task). When false, the visibility change could not be applied and `status`/`shareUrl` are absent.
-    pub synced: bool,
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AgentRegistryLiveTargetEntryKind {
+    /// Interactive Copilot CLI exposing a UI server (legacy/normal CLI process)
+    #[serde(rename = "ui-server")]
+    UiServer,
+    /// Headless `--server --managed-server` child spawned by a controller
+    #[serde(rename = "managed-server")]
+    ManagedServer,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
 }
 
-/// Identifies the target session.
+/// How the most recent turn ended (clean vs aborted). Lets the renderer distinguish done from done_cancelled.
 ///
 /// <div class="warning">
 ///
@@ -25503,14 +27054,21 @@ pub struct SessionVisibilitySetResult {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionScheduleListParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AgentRegistryLiveTargetEntryLastTerminalEvent {
+    /// Last turn ended cleanly (model returned a final assistant message)
+    #[serde(rename = "turn_end")]
+    TurnEnd,
+    /// Last turn was aborted (e.g. user interrupted)
+    #[serde(rename = "abort")]
+    Abort,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
 }
 
-/// Snapshot of the currently active recurring prompts for this session.
+/// Coarse lifecycle status of the foreground session
 ///
 /// <div class="warning">
 ///
@@ -25518,14 +27076,27 @@ pub struct SessionScheduleListParams {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionScheduleListResult {
-    /// Active scheduled prompts, ordered by id.
-    pub entries: Vec<ScheduleEntry>,
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AgentRegistryLiveTargetEntryStatus {
+    /// Session is actively processing a turn
+    #[serde(rename = "working")]
+    Working,
+    /// Session is idle, waiting for input
+    #[serde(rename = "waiting")]
+    Waiting,
+    /// Last turn completed successfully
+    #[serde(rename = "done")]
+    Done,
+    /// Session needs user attention (see attentionKind for the specific reason)
+    #[serde(rename = "attention")]
+    Attention,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
 }
 
-/// Identifies the target session.
+/// Categorized reason for log-open failure
 ///
 /// <div class="warning">
 ///
@@ -25533,14 +27104,32 @@ pub struct SessionScheduleListResult {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionScheduleHydrateParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AgentRegistryLogCaptureOpenErrorReason {
+    /// Filesystem permission denied opening the log file
+    #[serde(rename = "permission")]
+    Permission,
+    /// No space left on device
+    #[serde(rename = "disk_full")]
+    DiskFull,
+    /// Other / uncategorized open failure
+    #[serde(rename = "other")]
+    Other,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
 }
 
-/// Identifies the target session.
+/// Discriminator: child_process.spawn itself failed
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AgentRegistrySpawnErrorKind {
+    #[serde(rename = "spawn-error")]
+    #[default]
+    SpawnError,
+}
+
+/// Permission posture for the new session. 'yolo' requires the controller-local session to currently be in allow-all mode.
 ///
 /// <div class="warning">
 ///
@@ -25548,14 +27137,37 @@ pub struct SessionScheduleHydrateParams {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionScheduleHasSelfPacedParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AgentRegistrySpawnPermissionMode {
+    /// Standard permission posture (prompts for each request)
+    #[serde(rename = "default")]
+    Default,
+    /// Full allow-all (requires the controller-local session to currently be in allow-all mode)
+    #[serde(rename = "yolo")]
+    Yolo,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
 }
 
-/// Whether the session currently has an active self-paced schedule.
+/// Discriminator: spawn succeeded but child never registered
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AgentRegistrySpawnRegistryTimeoutKind {
+    #[serde(rename = "registry-timeout")]
+    #[default]
+    RegistryTimeout,
+}
+
+/// Discriminator: managed-server child spawned successfully
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AgentRegistrySpawnSpawnedKind {
+    #[serde(rename = "spawned")]
+    #[default]
+    Spawned,
+}
+
+/// Which parameter field was invalid. Omitted when the rejection is not field-specific.
 ///
 /// <div class="warning">
 ///
@@ -25563,14 +27175,38 @@ pub struct SessionScheduleHasSelfPacedParams {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionScheduleHasSelfPacedResult {
-    /// True when at least one active schedule is self-paced.
-    pub has_self_paced: bool,
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AgentRegistrySpawnValidationErrorField {
+    /// The cwd parameter
+    #[serde(rename = "cwd")]
+    Cwd,
+    /// The session name parameter
+    #[serde(rename = "name")]
+    Name,
+    /// The agentName parameter
+    #[serde(rename = "agentName")]
+    AgentName,
+    /// The model parameter
+    #[serde(rename = "model")]
+    Model,
+    /// The permissionMode parameter
+    #[serde(rename = "permissionMode")]
+    PermissionMode,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
 }
 
-/// Result of registering or re-arming a scheduled prompt.
+/// Discriminator: synchronous pre-validation rejected the request
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AgentRegistrySpawnValidationErrorKind {
+    #[serde(rename = "validation-error")]
+    #[default]
+    ValidationError,
+}
+
+/// Categorized reason for the rejection. Low-cardinality enum so telemetry can aggregate by reason without leaking raw paths or agent/model names.
 ///
 /// <div class="warning">
 ///
@@ -25578,18 +27214,33 @@ pub struct SessionScheduleHasSelfPacedResult {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionScheduleAddResult {
-    /// The registered or updated schedule entry.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub entry: Option<ScheduleEntry>,
-    /// User-facing validation error, when registration failed.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AgentRegistrySpawnValidationErrorReason {
+    /// Provided cwd does not exist on disk
+    #[serde(rename = "cwd-not-found")]
+    CwdNotFound,
+    /// Provided cwd exists but is not a directory
+    #[serde(rename = "cwd-not-directory")]
+    CwdNotDirectory,
+    /// Session name failed validateSessionName
+    #[serde(rename = "invalid-name")]
+    InvalidName,
+    /// Requested agent name was not found in builtin or custom agents
+    #[serde(rename = "unknown-agent")]
+    UnknownAgent,
+    /// Requested model is not available to this session
+    #[serde(rename = "unknown-model")]
+    UnknownModel,
+    /// Caller asked for permissionMode='yolo' but the controller is not currently in allow-all mode
+    #[serde(rename = "yolo-not-allowed")]
+    YoloNotAllowed,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
 }
 
-/// Result of registering or re-arming a scheduled prompt.
+/// Outcome of an agentRegistry.spawn call.
 ///
 /// <div class="warning">
 ///
@@ -25597,18 +27248,80 @@ pub struct SessionScheduleAddResult {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionScheduleAddCronResult {
-    /// The registered or updated schedule entry.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub entry: Option<ScheduleEntry>,
-    /// User-facing validation error, when registration failed.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(untagged)]
+pub enum AgentRegistrySpawnResult {
+    Spawned(AgentRegistrySpawnSpawned),
+    SpawnError(AgentRegistrySpawnError),
+    RegistryTimeout(AgentRegistrySpawnRegistryTimeout),
+    ValidationError(AgentRegistrySpawnValidationError),
+}
+
+/// Attachment type discriminator
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AttachmentBlobType {
+    #[serde(rename = "blob")]
+    #[default]
+    Blob,
+}
+
+/// Attachment type discriminator
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AttachmentDirectoryType {
+    #[serde(rename = "directory")]
+    #[default]
+    Directory,
+}
+
+/// Attachment type discriminator
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AttachmentExtensionContextType {
+    #[serde(rename = "extension_context")]
+    #[default]
+    ExtensionContext,
+}
+
+/// Attachment type discriminator
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AttachmentFileType {
+    #[serde(rename = "file")]
+    #[default]
+    File,
+}
+
+/// Attachment type discriminator
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AttachmentGitHubActionsJobType {
+    #[serde(rename = "github_actions_job")]
+    #[default]
+    GitHubActionsJob,
+}
+
+/// Attachment type discriminator
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AttachmentGitHubCommitType {
+    #[serde(rename = "github_commit")]
+    #[default]
+    GitHubCommit,
+}
+
+/// Attachment type discriminator
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AttachmentGitHubFileType {
+    #[serde(rename = "github_file")]
+    #[default]
+    GitHubFile,
+}
+
+/// Attachment type discriminator
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AttachmentGitHubFileDiffType {
+    #[serde(rename = "github_file_diff")]
+    #[default]
+    GitHubFileDiff,
 }
 
-/// Result of registering or re-arming a scheduled prompt.
+/// Type of GitHub reference
 ///
 /// <div class="warning">
 ///
@@ -25616,114 +27329,72 @@ pub struct SessionScheduleAddCronResult {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionScheduleAddAtResult {
-    /// The registered or updated schedule entry.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub entry: Option<ScheduleEntry>,
-    /// User-facing validation error, when registration failed.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AttachmentGitHubReferenceType {
+    /// GitHub issue reference.
+    #[serde(rename = "issue")]
+    Issue,
+    /// GitHub pull request reference.
+    #[serde(rename = "pr")]
+    Pr,
+    /// GitHub discussion reference.
+    #[serde(rename = "discussion")]
+    Discussion,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
 }
 
-/// Result of registering or re-arming a scheduled prompt.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionScheduleAddSelfPacedResult {
-    /// The registered or updated schedule entry.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub entry: Option<ScheduleEntry>,
-    /// User-facing validation error, when registration failed.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
+/// Attachment type discriminator
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AttachmentGitHubReleaseType {
+    #[serde(rename = "github_release")]
+    #[default]
+    GitHubRelease,
 }
 
-/// Result of registering or re-arming a scheduled prompt.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionScheduleRearmSelfPacedResult {
-    /// The registered or updated schedule entry.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub entry: Option<ScheduleEntry>,
-    /// User-facing validation error, when registration failed.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
+/// Attachment type discriminator
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AttachmentGitHubRepositoryType {
+    #[serde(rename = "github_repository")]
+    #[default]
+    GitHubRepository,
 }
 
-/// Remove a scheduled prompt by id. The result entry is omitted if the id was unknown.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionScheduleStopResult {
-    /// The removed entry, or omitted if no entry matched.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub entry: Option<ScheduleEntry>,
+/// Attachment type discriminator
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AttachmentGitHubSnippetType {
+    #[serde(rename = "github_snippet")]
+    #[default]
+    GitHubSnippet,
 }
 
-/// A bearer token supplied by the SDK client for a BYOK provider. The runtime sets it as `Authorization: Bearer <token>` on the outbound request and does no caching; the SDK consumer owns token caching and refresh.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ProviderTokenGetTokenResult {
-    /// The bearer token value (without the `Bearer ` prefix).
-    pub token: String,
+/// Attachment type discriminator
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AttachmentGitHubTreeComparisonType {
+    #[serde(rename = "github_tree_comparison")]
+    #[default]
+    GitHubTreeComparison,
 }
 
-/// Acknowledgement that a factory request was accepted.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct FactoryAbortResult {}
+/// Attachment type discriminator
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AttachmentGitHubUrlType {
+    #[serde(rename = "github_url")]
+    #[default]
+    GitHubUrl,
+}
 
-/// Identifies the target session.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionFsSqliteExistsParams {
-    /// Target session identifier
-    pub session_id: SessionId,
+/// Attachment type discriminator
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AttachmentSelectionType {
+    #[serde(rename = "selection")]
+    #[default]
+    Selection,
 }
 
-/// Canvas open result returned by the provider.
+/// Authentication type
 ///
 /// <div class="warning">
 ///
@@ -25731,21 +27402,36 @@ pub struct SessionFsSqliteExistsParams {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct CanvasOpenResult {
-    /// Provider-supplied status text
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub status: Option<String>,
-    /// Provider-supplied title
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub title: Option<String>,
-    /// URL for web-rendered canvases
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub url: Option<String>,
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AuthInfoType {
+    /// Authentication provided by a GitHub App HMAC credential.
+    #[serde(rename = "hmac")]
+    Hmac,
+    /// Authentication resolved from environment-provided credentials.
+    #[serde(rename = "env")]
+    Env,
+    /// Authentication from an interactive user sign-in.
+    #[serde(rename = "user")]
+    User,
+    /// Authentication delegated to the GitHub CLI.
+    #[serde(rename = "gh-cli")]
+    GhCli,
+    /// Authentication from an API key credential.
+    #[serde(rename = "api-key")]
+    ApiKey,
+    /// Authentication from a GitHub token.
+    #[serde(rename = "token")]
+    Token,
+    /// Authentication from a Copilot API token.
+    #[serde(rename = "copilot-api-token")]
+    CopilotApiToken,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
 }
 
-/// Validation errors from the most recent authentication attempt.
+/// Custom input-format kind.
 ///
 /// <div class="warning">
 ///
@@ -25753,9 +27439,18 @@ pub struct CanvasOpenResult {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-pub type AuthValidationErrors = Vec<AuthValidationError>;
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum BuiltinToolFormatType {
+    /// The tool input is parsed with the supplied grammar.
+    #[serde(rename = "grammar")]
+    Grammar,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
 
-/// HTTP headers as a map from lowercased header name to a list of values. Multi-valued headers (e.g. Set-Cookie) preserve all values.
+/// Root JSON Schema type for a built-in tool input.
 ///
 /// <div class="warning">
 ///
@@ -25763,9 +27458,18 @@ pub type AuthValidationErrors = Vec<AuthValidationError>;
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-pub type LlmInferenceHeaders = HashMap<String, Vec<String>>;
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum BuiltinToolInputSchemaType {
+    /// The tool accepts a JSON object.
+    #[serde(rename = "object")]
+    Object,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
 
-/// MCP CreateMessageResult payload (with optional 'tools' extension), present when action='success'. Treated as opaque at the schema layer; consumers should construct/consume it per the MCP CreateMessageResult shape.
+/// Canonical digest algorithm for a validated MCP card
 ///
 /// <div class="warning">
 ///
@@ -25773,19 +27477,66 @@ pub type LlmInferenceHeaders = HashMap<String, Vec<String>>;
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-pub type McpExecuteSamplingResult = HashMap<String, serde_json::Value>;
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CardDigestAlgorithm {
+    /// SHA-256 over RFC 8785 canonical JSON encoded as UTF-8.
+    #[serde(rename = "sha256-rfc8785")]
+    Sha256Rfc8785,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
 
-/// The form values submitted by the user (present when action is 'accept')
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-pub type UIElicitationResponseContent = HashMap<String, serde_json::Value>;
+/// AI skills are discovery-only and cannot be installed through this surface
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogAiSkillCandidateInstallability {
+    #[serde(rename = "not-installable-kind")]
+    #[default]
+    NotInstallableKind,
+}
+
+/// Discriminator: this candidate describes an AI skill
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogAiSkillCandidateKind {
+    #[serde(rename = "ai-skill")]
+    #[default]
+    AiSkill,
+}
+
+/// Media type of the underlying AI skill card
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogAiSkillCandidateMediaType {
+    #[serde(rename = "application/ai-skill")]
+    #[default]
+    ApplicationAiSkill,
+}
+
+/// Media type advertised for the referenced AI skill card
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogAiSkillCandidateProvenanceMediaType {
+    #[serde(rename = "application/ai-skill")]
+    #[default]
+    ApplicationAiSkill,
+}
+
+/// Discriminator: the card is URL-backed, and carries no embedded data
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogCandidateSourceUrlKind {
+    #[serde(rename = "url")]
+    #[default]
+    Url,
+}
 
-/// List of all authenticated users
+/// Discriminator: the card is embedded, and carries no URL
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogCandidateSourceEmbeddedKind {
+    #[serde(rename = "embedded")]
+    #[default]
+    Embedded,
+}
+
+/// Where a candidate's card came from. Exactly one of a URL or embedded data: the union has no variant carrying both, and no variant carrying neither, so the rule holds structurally rather than by validation.
 ///
 /// <div class="warning">
 ///
@@ -25793,9 +27544,22 @@ pub type UIElicitationResponseContent = HashMap<String, serde_json::Value>;
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-pub type AccountGetAllUsersResult = Vec<AccountAllUsers>;
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(untagged)]
+pub enum CatalogCandidateSource {
+    Url(CatalogCandidateSourceUrl),
+    Embedded(CatalogCandidateSourceEmbedded),
+}
 
-/// The number of running background agents (task-registry agents) that were cancelled.
+/// Discriminator: the caller is not authenticated
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogAuthenticationRequiredErrorKind {
+    #[serde(rename = "authentication-required")]
+    #[default]
+    AuthenticationRequired,
+}
+
+/// Why the catalog authority did not accept the caller's identity
 ///
 /// <div class="warning">
 ///
@@ -25803,9 +27567,24 @@ pub type AccountGetAllUsersResult = Vec<AccountAllUsers>;
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-pub type SessionCancelAllBackgroundAgentsResult = i64;
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogAuthenticationRequiredReason {
+    /// No credential was presented, so there is nothing to refresh and the caller must sign in.
+    #[serde(rename = "no-credential")]
+    NoCredential,
+    /// A credential was presented and its lifetime has elapsed. A silent refresh is worth attempting before prompting anyone.
+    #[serde(rename = "credential-expired")]
+    CredentialExpired,
+    /// A credential was presented and the authority refused it, for example because it was revoked, malformed, or issued for another audience. Refreshing the same rejected credential is not useful; the caller must sign in again.
+    #[serde(rename = "credential-rejected")]
+    CredentialRejected,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
 
-/// Authentication accounts available to the internal session host.
+/// Whether an MCP server candidate can be planned for installation
 ///
 /// <div class="warning">
 ///
@@ -25813,9 +27592,29 @@ pub type SessionCancelAllBackgroundAgentsResult = i64;
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-pub type SessionGitHubAuthGetAllAuthAvailableResult = Vec<SessionAuthStatus>;
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogMcpServerInstallability {
+    /// An install plan can be computed for this MCP server candidate.
+    #[serde(rename = "installable")]
+    Installable,
+    /// Policy forbids installing this MCP server candidate.
+    #[serde(rename = "not-installable-policy")]
+    NotInstallablePolicy,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
 
-/// Whether the current authentication was logged out.
+/// Discriminator: this candidate describes an MCP server
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogMcpServerCandidateKind {
+    #[serde(rename = "mcp-server")]
+    #[default]
+    McpServer,
+}
+
+/// JSON MCP card media type accepted for install planning
 ///
 /// <div class="warning">
 ///
@@ -25823,9 +27622,21 @@ pub type SessionGitHubAuthGetAllAuthAvailableResult = Vec<SessionAuthStatus>;
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-pub type SessionGitHubAuthLogoutResult = bool;
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum McpServerCardMediaType {
+    /// The current MCP server card media type.
+    #[serde(rename = "application/mcp-server-card+json")]
+    ApplicationMcpServerCardJson,
+    /// The legacy MCP server card media type, accepted for compatibility.
+    #[serde(rename = "application/mcp-server+json")]
+    ApplicationMcpServerJson,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
 
-/// Whether the requested authentication was logged out.
+/// One inert catalog result, represented as an MCP server or discovery-only AI skill variant so kind, media type, provenance, and installability cannot contradict each other.
 ///
 /// <div class="warning">
 ///
@@ -25833,9 +27644,14 @@ pub type SessionGitHubAuthLogoutResult = bool;
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-pub type SessionGitHubAuthLogoutUserResult = bool;
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(untagged)]
+pub enum CatalogCandidate {
+    McpServer(CatalogMcpServerCandidate),
+    AiSkill(CatalogAiSkillCandidate),
+}
 
-/// Validation errors from the most recent authentication attempt.
+/// What kind of resource a catalog candidate describes
 ///
 /// <div class="warning">
 ///
@@ -25843,9 +27659,21 @@ pub type SessionGitHubAuthLogoutUserResult = bool;
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-pub type SessionGitHubAuthLastAuthErrorsResult = Vec<AuthValidationError>;
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogCandidateKind {
+    /// An MCP server, which can be planned for installation.
+    #[serde(rename = "mcp-server")]
+    McpServer,
+    /// An AI skill, which is discoverable but not installable through this surface.
+    #[serde(rename = "ai-skill")]
+    AiSkill,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
 
-/// Standard MCP CallToolResult
+/// A wire feature a caller can require of the catalog surface, negotiated per request. A grant means the runtime understands the feature's contract, not that the deployment has enabled the operation; typed unavailable results report availability separately.
 ///
 /// <div class="warning">
 ///
@@ -25853,81 +27681,38 @@ pub type SessionGitHubAuthLastAuthErrorsResult = Vec<AuthValidationError>;
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-pub type SessionMcpAppsCallToolResult = HashMap<String, serde_json::Value>;
-
-/// Authentication host. HMAC auth always targets the public GitHub host.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum HMACAuthInfoHost {
-    #[serde(rename = "https://github.com")]
-    #[default]
-    HttpsGitHubCom,
-}
-
-/// HMAC-based authentication used by GitHub-internal services.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum HMACAuthInfoType {
-    #[serde(rename = "hmac")]
-    #[default]
-    Hmac,
-}
-
-/// Personal access token (PAT) or server-to-server token sourced from an environment variable.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum EnvAuthInfoType {
-    #[serde(rename = "env")]
-    #[default]
-    Env,
-}
-
-/// SDK-side token authentication; the host configured the token directly via the SDK.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum TokenAuthInfoType {
-    #[serde(rename = "token")]
-    #[default]
-    Token,
-}
-
-/// Authentication host (always the public GitHub host).
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum CopilotApiTokenAuthInfoHost {
-    #[serde(rename = "https://github.com")]
-    #[default]
-    HttpsGitHubCom,
-}
-
-/// Direct Copilot API authentication via the `GITHUB_COPILOT_API_TOKEN` + `COPILOT_API_URL` environment-variable pair. The token itself is read from the environment by the runtime, not carried in this struct.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum CopilotApiTokenAuthInfoType {
-    #[serde(rename = "copilot-api-token")]
-    #[default]
-    CopilotApiToken,
-}
-
-/// OAuth user authentication. The token itself is held in the runtime's secret token store (keyed by host+login) and is NOT carried in this struct.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum UserAuthInfoType {
-    #[serde(rename = "user")]
-    #[default]
-    User,
-}
-
-/// Authentication via the `gh` CLI's saved credentials.
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum GhCliAuthInfoType {
-    #[serde(rename = "gh-cli")]
+pub enum CatalogCapability {
+    /// Understands the current `application/mcp-server-card+json` media type.
+    #[serde(rename = "mcp-server-card")]
+    McpServerCard,
+    /// Understands the legacy `application/mcp-server+json` media type.
+    #[serde(rename = "legacy-mcp-server-card")]
+    LegacyMcpServerCard,
+    /// Understands `application/ai-skill` candidates as discovery-only and typed non-installable.
+    #[serde(rename = "ai-skill-discovery")]
+    AiSkillDiscovery,
+    /// Understands side-effect-free MCP install-plan requests, results, and plan handles; `planning-unavailable` separately reports that planning is not enabled.
+    #[serde(rename = "mcp-install-planning")]
+    McpInstallPlanning,
+    /// Understands plans that enumerate every eligible transport rather than a single preferred one.
+    #[serde(rename = "multiple-transport-choice")]
+    MultipleTransportChoice,
+    /// Unknown variant for forward compatibility.
     #[default]
-    GhCli,
+    #[serde(other)]
+    Unknown,
 }
 
-/// API-key authentication for non-GitHub LLM providers (e.g. when running BYOM-style).
+/// Discriminator: the upstream response broke the contract
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum ApiKeyAuthInfoType {
-    #[serde(rename = "api-key")]
+pub enum CatalogContractViolationErrorKind {
+    #[serde(rename = "contract-violation")]
     #[default]
-    ApiKey,
+    ContractViolation,
 }
 
-/// Authentication credentials accepted only at native protocol ingress. Runtime outputs use credential-free `AuthIdentity` metadata.
+/// Which wire-contract rule an upstream response broke
 ///
 /// <div class="warning">
 ///
@@ -25935,19 +27720,27 @@ pub enum ApiKeyAuthInfoType {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(untagged)]
-pub enum AuthInfo {
-    Hmac(HMACAuthInfo),
-    Env(EnvAuthInfo),
-    Token(TokenAuthInfo),
-    CopilotApiToken(CopilotApiTokenAuthInfo),
-    User(UserAuthInfo),
-    GhCli(GhCliAuthInfo),
-    ApiKey(ApiKeyAuthInfo),
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogContractViolationReason {
+    /// A result carried both a URL and embedded data, when exactly one is permitted.
+    #[serde(rename = "both-url-and-data")]
+    BothUrlAndData,
+    /// A result carried neither a URL nor embedded data, when exactly one is required.
+    #[serde(rename = "neither-url-nor-data")]
+    NeitherUrlNorData,
+    /// Two results claimed the same normalised identity.
+    #[serde(rename = "duplicate-identity")]
+    DuplicateIdentity,
+    /// A result declared no media type, or one this contract does not model.
+    #[serde(rename = "unknown-media-type")]
+    UnknownMediaType,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
 }
 
-/// Resolved Anthropic adaptive-thinking capability for a model.
+/// Which kind of opaque handle was presented
 ///
 /// <div class="warning">
 ///
@@ -25956,23 +27749,28 @@ pub enum AuthInfo {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AdaptiveThinkingSupport {
-    /// The model does not accept thinking.type='adaptive'
-    #[serde(rename = "unsupported")]
-    Unsupported,
-    /// The model accepts adaptive thinking but also accepts thinking.type='enabled'
-    #[serde(rename = "optional")]
-    Optional,
-    /// The model only accepts adaptive thinking and rejects thinking.type='enabled' with HTTP 400 (e.g. opus-4.7/4.8)
-    #[serde(rename = "required")]
-    Required,
+pub enum CatalogHandleType {
+    /// A search candidate handle.
+    #[serde(rename = "candidate")]
+    Candidate,
+    /// An install plan handle.
+    #[serde(rename = "plan")]
+    Plan,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Which tier this directory belongs to
+/// Discriminator: a handle was rejected
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogHandleRejectedErrorKind {
+    #[serde(rename = "handle-rejected")]
+    #[default]
+    HandleRejected,
+}
+
+/// Why a presented handle was rejected
 ///
 /// <div class="warning">
 ///
@@ -25981,20 +27779,26 @@ pub enum AdaptiveThinkingSupport {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AgentDiscoveryPathScope {
-    /// The user's personal agent configuration directory.
-    #[serde(rename = "user")]
-    User,
-    /// A project's repository agent directory.
-    #[serde(rename = "project")]
-    Project,
+pub enum CatalogHandleRejectionReason {
+    /// The handle is unparseable, unknown, or was issued for a different operation.
+    #[serde(rename = "invalid")]
+    Invalid,
+    /// The handle's time to live has elapsed.
+    #[serde(rename = "stale")]
+    Stale,
+    /// The handle has already been used, and handles are single-use.
+    #[serde(rename = "replayed")]
+    Replayed,
+    /// The handle was issued by a different runtime instance.
+    #[serde(rename = "foreign")]
+    Foreign,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Where the agent definition was loaded from
+/// Which request field was rejected before any work was done
 ///
 /// <div class="warning">
 ///
@@ -26003,32 +27807,51 @@ pub enum AgentDiscoveryPathScope {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AgentInfoSource {
-    /// Agent loaded from the user's personal agent configuration.
-    #[serde(rename = "user")]
-    User,
-    /// Agent loaded from the current project's repository configuration.
-    #[serde(rename = "project")]
-    Project,
-    /// Agent inherited from a parent project or workspace.
-    #[serde(rename = "inherited")]
-    Inherited,
-    /// Agent provided by a remote runtime or service.
-    #[serde(rename = "remote")]
-    Remote,
-    /// Agent contributed by an installed plugin.
-    #[serde(rename = "plugin")]
-    Plugin,
-    /// Agent built into the Copilot runtime.
-    #[serde(rename = "builtin")]
-    Builtin,
+pub enum CatalogInvalidRequestField {
+    /// The search query was empty or longer than permitted.
+    #[serde(rename = "query")]
+    Query,
+    /// The requested result count fell outside its permitted range.
+    #[serde(rename = "limit")]
+    Limit,
+    /// The requested candidate kinds were empty or contained a duplicate.
+    #[serde(rename = "kinds")]
+    Kinds,
+    /// The negotiation block was missing or malformed.
+    #[serde(rename = "contract")]
+    Contract,
+    /// The plan source was missing or malformed.
+    #[serde(rename = "source")]
+    Source,
+    /// The supplied card was missing its media type, URL, or data.
+    #[serde(rename = "card")]
+    Card,
+    /// The requested configuration scope is not one this runtime writes.
+    #[serde(rename = "scope")]
+    Scope,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Kind of attention required when status === "attention". Meaningful only when status === "attention".
+/// Discriminator: the request itself was invalid
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogInvalidRequestErrorKind {
+    #[serde(rename = "invalid-request")]
+    #[default]
+    InvalidRequest,
+}
+
+/// Discriminator: the card was malformed
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogMalformedCardErrorKind {
+    #[serde(rename = "malformed-card")]
+    #[default]
+    MalformedCard,
+}
+
+/// Media type a catalog card is interpreted as
 ///
 /// <div class="warning">
 ///
@@ -26037,29 +27860,23 @@ pub enum AgentInfoSource {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AgentRegistryLiveTargetEntryAttentionKind {
-    /// Session is blocked on an unrecoverable error
-    #[serde(rename = "error")]
-    Error,
-    /// Session is waiting for a tool-permission decision
-    #[serde(rename = "permission")]
-    Permission,
-    /// Session is waiting for the user to approve or reject a plan
-    #[serde(rename = "exit_plan")]
-    ExitPlan,
-    /// Session is waiting on an elicitation prompt
-    #[serde(rename = "elicitation")]
-    Elicitation,
-    /// Session is waiting for free-form user input
-    #[serde(rename = "user_input")]
-    UserInput,
+pub enum CatalogMediaType {
+    /// The current MCP server card media type.
+    #[serde(rename = "application/mcp-server-card+json")]
+    ApplicationMcpServerCardJson,
+    /// The legacy MCP server card media type, accepted for compatibility.
+    #[serde(rename = "application/mcp-server+json")]
+    ApplicationMcpServerJson,
+    /// An AI skill card. Representable and searchable, but typed non-installable.
+    #[serde(rename = "application/ai-skill")]
+    ApplicationAiSkill,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Process kind tag for the registry entry
+/// How a card failed validation
 ///
 /// <div class="warning">
 ///
@@ -26068,20 +27885,37 @@ pub enum AgentRegistryLiveTargetEntryAttentionKind {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AgentRegistryLiveTargetEntryKind {
-    /// Interactive Copilot CLI exposing a UI server (legacy/normal CLI process)
-    #[serde(rename = "ui-server")]
-    UiServer,
-    /// Headless `--server --managed-server` child spawned by a controller
-    #[serde(rename = "managed-server")]
-    ManagedServer,
+pub enum CatalogMalformedCardReason {
+    /// The document is not well-formed JSON.
+    #[serde(rename = "invalid-json")]
+    InvalidJson,
+    /// The document does not satisfy its media type's schema.
+    #[serde(rename = "schema-violation")]
+    SchemaViolation,
+    /// The declared media type is not one this runtime understands.
+    #[serde(rename = "unsupported-media-type")]
+    UnsupportedMediaType,
+    /// A field the media type requires is absent.
+    #[serde(rename = "missing-required-field")]
+    MissingRequiredField,
+    /// The document exceeded the permitted size.
+    #[serde(rename = "size-limit-exceeded")]
+    SizeLimitExceeded,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// How the most recent turn ended (clean vs aborted). Lets the renderer distinguish done from done_cancelled.
+/// Discriminator: capability or protocol-version negotiation failed
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogNegotiationRefusedErrorKind {
+    #[serde(rename = "negotiation-refused")]
+    #[default]
+    NegotiationRefused,
+}
+
+/// Why capability and protocol-version negotiation refused a caller
 ///
 /// <div class="warning">
 ///
@@ -26090,48 +27924,76 @@ pub enum AgentRegistryLiveTargetEntryKind {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AgentRegistryLiveTargetEntryLastTerminalEvent {
-    /// Last turn ended cleanly (model returned a final assistant message)
-    #[serde(rename = "turn_end")]
-    TurnEnd,
-    /// Last turn was aborted (e.g. user interrupted)
-    #[serde(rename = "abort")]
-    Abort,
+pub enum CatalogNegotiationRefusedReason {
+    /// The caller's protocol version is below the lowest this runtime serves.
+    #[serde(rename = "unsupported-protocol-version")]
+    UnsupportedProtocolVersion,
+    /// The caller requires at least one capability this runtime cannot honour.
+    #[serde(rename = "unsupported-capability")]
+    UnsupportedCapability,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Coarse lifecycle status of the foreground session
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
+/// Discriminator: the network operation failed
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AgentRegistryLiveTargetEntryStatus {
-    /// Session is actively processing a turn
-    #[serde(rename = "working")]
-    Working,
-    /// Session is idle, waiting for input
-    #[serde(rename = "waiting")]
-    Waiting,
-    /// Last turn completed successfully
-    #[serde(rename = "done")]
-    Done,
-    /// Session needs user attention (see attentionKind for the specific reason)
-    #[serde(rename = "attention")]
-    Attention,
+pub enum CatalogNetworkFailureErrorKind {
+    #[serde(rename = "network-failure")]
+    #[default]
+    NetworkFailure,
+}
+
+/// Categorised network failure, low cardinality so it can be aggregated without carrying a URL
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogNetworkFailureReason {
+    /// No network is available, so nothing was attempted.
+    #[serde(rename = "offline")]
+    Offline,
+    /// The authority's name could not be resolved.
+    #[serde(rename = "dns")]
+    Dns,
+    /// The request exceeded its time budget.
+    #[serde(rename = "timeout")]
+    Timeout,
+    /// The TLS handshake or certificate validation failed.
+    #[serde(rename = "tls")]
+    Tls,
+    /// The connection was refused or reset.
+    #[serde(rename = "connection-refused")]
+    ConnectionRefused,
+    /// The authority returned a status the runtime treats as a failure.
+    #[serde(rename = "http-status")]
+    HttpStatus,
+    /// The response exceeded the permitted size.
+    #[serde(rename = "response-too-large")]
+    ResponseTooLarge,
+    /// A redirect was refused by the runtime's redirect policy.
+    #[serde(rename = "redirect-rejected")]
+    RedirectRejected,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Categorized reason for log-open failure
+/// Discriminator: the candidate cannot be installed
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogNotInstallableErrorKind {
+    #[serde(rename = "not-installable")]
+    #[default]
+    NotInstallable,
+}
+
+/// Why a discoverable candidate cannot be installed
 ///
 /// <div class="warning">
 ///
@@ -26140,31 +28002,31 @@ pub enum AgentRegistryLiveTargetEntryStatus {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AgentRegistryLogCaptureOpenErrorReason {
-    /// Filesystem permission denied opening the log file
-    #[serde(rename = "permission")]
-    Permission,
-    /// No space left on device
-    #[serde(rename = "disk_full")]
-    DiskFull,
-    /// Other / uncategorized open failure
-    #[serde(rename = "other")]
-    Other,
+pub enum CatalogNotInstallableReason {
+    /// This kind of resource is not installable through this surface.
+    #[serde(rename = "kind-not-installable")]
+    KindNotInstallable,
+    /// AI skills are discoverable but have no typed importer in this phase.
+    #[serde(rename = "ai-skill-not-installable")]
+    AiSkillNotInstallable,
+    /// Policy forbids installing this candidate.
+    #[serde(rename = "policy-forbids")]
+    PolicyForbids,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Discriminator: child_process.spawn itself failed
+/// Discriminator: policy refused the operation
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AgentRegistrySpawnErrorKind {
-    #[serde(rename = "spawn-error")]
+pub enum CatalogPolicyRejectedErrorKind {
+    #[serde(rename = "policy-rejected")]
     #[default]
-    SpawnError,
+    PolicyRejected,
 }
 
-/// Permission posture for the new session. 'yolo' requires the controller-local session to currently be in allow-all mode.
+/// Which authority produced a policy decision
 ///
 /// <div class="warning">
 ///
@@ -26173,36 +28035,50 @@ pub enum AgentRegistrySpawnErrorKind {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AgentRegistrySpawnPermissionMode {
-    /// Standard permission posture (prompts for each request)
-    #[serde(rename = "default")]
-    Default,
-    /// Full allow-all (requires the controller-local session to currently be in allow-all mode)
-    #[serde(rename = "yolo")]
-    Yolo,
+pub enum McpPlanPolicySource {
+    /// No policy applied, so the server is permitted by default.
+    #[serde(rename = "none")]
+    None,
+    /// An enterprise allowlist evaluated the server.
+    #[serde(rename = "enterprise-allowlist")]
+    EnterpriseAllowlist,
+    /// The registry the card came from evaluated the server.
+    #[serde(rename = "registry-policy")]
+    RegistryPolicy,
+    /// Local trust settings evaluated the server.
+    #[serde(rename = "local-trust")]
+    LocalTrust,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Discriminator: spawn succeeded but child never registered
+/// Discriminator: the search completed
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AgentRegistrySpawnRegistryTimeoutKind {
-    #[serde(rename = "registry-timeout")]
+pub enum CatalogSearchSucceededKind {
+    #[serde(rename = "succeeded")]
     #[default]
-    RegistryTimeout,
+    Succeeded,
 }
 
-/// Discriminator: managed-server child spawned successfully
+/// Discriminator: an unsupported candidate kind was requested
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AgentRegistrySpawnSpawnedKind {
-    #[serde(rename = "spawned")]
+pub enum CatalogUnsupportedKindErrorKind {
+    #[serde(rename = "unsupported-kind")]
     #[default]
-    Spawned,
+    UnsupportedKind,
 }
 
-/// Which parameter field was invalid. Omitted when the rejection is not field-specific.
+/// Discriminator: retrieval was refused as unsafe
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogUnsafeRetrievalErrorKind {
+    #[serde(rename = "unsafe-retrieval")]
+    #[default]
+    UnsafeRetrieval,
+}
+
+/// Which hardened-fetch control refused a retrieval
 ///
 /// <div class="warning">
 ///
@@ -26211,37 +28087,40 @@ pub enum AgentRegistrySpawnSpawnedKind {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AgentRegistrySpawnValidationErrorField {
-    /// The cwd parameter
-    #[serde(rename = "cwd")]
-    Cwd,
-    /// The session name parameter
-    #[serde(rename = "name")]
-    Name,
-    /// The agentName parameter
-    #[serde(rename = "agentName")]
-    AgentName,
-    /// The model parameter
-    #[serde(rename = "model")]
-    Model,
-    /// The permissionMode parameter
-    #[serde(rename = "permissionMode")]
-    PermissionMode,
+pub enum CatalogUnsafeRetrievalReason {
+    /// The URL used a scheme the runtime refuses to fetch.
+    #[serde(rename = "blocked-scheme")]
+    BlockedScheme,
+    /// The URL embedded credentials.
+    #[serde(rename = "credentials-in-url")]
+    CredentialsInUrl,
+    /// The URL resolved to a loopback, private, link-local, or cloud metadata address.
+    #[serde(rename = "blocked-address")]
+    BlockedAddress,
+    /// A redirect target resolved to a blocked address.
+    #[serde(rename = "redirect-to-blocked-address")]
+    RedirectToBlockedAddress,
+    /// The configured proxy policy refused the request.
+    #[serde(rename = "proxy-rejected")]
+    ProxyRejected,
+    /// The authority is not permitted for card retrieval.
+    #[serde(rename = "host-not-permitted")]
+    HostNotPermitted,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Discriminator: synchronous pre-validation rejected the request
+/// Discriminator: the operation is not available
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AgentRegistrySpawnValidationErrorKind {
-    #[serde(rename = "validation-error")]
+pub enum CatalogUnavailableErrorKind {
+    #[serde(rename = "unavailable")]
     #[default]
-    ValidationError,
+    Unavailable,
 }
 
-/// Categorized reason for the rejection. Low-cardinality enum so telemetry can aggregate by reason without leaking raw paths or agent/model names.
+/// Why a catalog operation is not available on this runtime
 ///
 /// <div class="warning">
 ///
@@ -26250,32 +28129,26 @@ pub enum AgentRegistrySpawnValidationErrorKind {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AgentRegistrySpawnValidationErrorReason {
-    /// Provided cwd does not exist on disk
-    #[serde(rename = "cwd-not-found")]
-    CwdNotFound,
-    /// Provided cwd exists but is not a directory
-    #[serde(rename = "cwd-not-directory")]
-    CwdNotDirectory,
-    /// Session name failed validateSessionName
-    #[serde(rename = "invalid-name")]
-    InvalidName,
-    /// Requested agent name was not found in builtin or custom agents
-    #[serde(rename = "unknown-agent")]
-    UnknownAgent,
-    /// Requested model is not available to this session
-    #[serde(rename = "unknown-model")]
-    UnknownModel,
-    /// Caller asked for permissionMode='yolo' but the controller is not currently in allow-all mode
-    #[serde(rename = "yolo-not-allowed")]
-    YoloNotAllowed,
+pub enum CatalogUnavailableReason {
+    /// Bounded search is not wired up on this runtime build.
+    #[serde(rename = "search-unavailable")]
+    SearchUnavailable,
+    /// Install planning is not wired up on this runtime build.
+    #[serde(rename = "planning-unavailable")]
+    PlanningUnavailable,
+    /// No catalog authority is configured for this runtime.
+    #[serde(rename = "authority-not-configured")]
+    AuthorityNotConfigured,
+    /// The surface is disabled by policy on this runtime.
+    #[serde(rename = "disabled-by-policy")]
+    DisabledByPolicy,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Outcome of an agentRegistry.spawn call.
+/// Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal. Never a partial success.
 ///
 /// <div class="warning">
 ///
@@ -26285,14 +28158,29 @@ pub enum AgentRegistrySpawnValidationErrorReason {
 /// </div>
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(untagged)]
-pub enum AgentRegistrySpawnResult {
-    Spawned(AgentRegistrySpawnSpawned),
-    SpawnError(AgentRegistrySpawnError),
-    RegistryTimeout(AgentRegistrySpawnRegistryTimeout),
-    ValidationError(AgentRegistrySpawnValidationError),
+pub enum CatalogSearchResult {
+    Succeeded(CatalogSearchSucceeded),
+    NegotiationRefused(CatalogNegotiationRefusedError),
+    UnsupportedKind(CatalogUnsupportedKindError),
+    InvalidRequest(CatalogInvalidRequestError),
+    AuthenticationRequired(CatalogAuthenticationRequiredError),
+    PolicyRejected(CatalogPolicyRejectedError),
+    NetworkFailure(CatalogNetworkFailureError),
+    UnsafeRetrieval(CatalogUnsafeRetrievalError),
+    MalformedCard(CatalogMalformedCardError),
+    ContractViolation(CatalogContractViolationError),
+    Unavailable(CatalogUnavailableError),
+}
+
+/// Discriminator: no usable transport is available
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum CatalogUnavailableTransportErrorKind {
+    #[serde(rename = "unavailable-transport")]
+    #[default]
+    UnavailableTransport,
 }
 
-/// Current or requested allow-all mode.
+/// Why no usable transport could be offered
 ///
 /// <div class="warning">
 ///
@@ -26301,87 +28189,153 @@ pub enum AgentRegistrySpawnResult {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum PermissionsAllowAllMode {
-    /// Permission requests follow the normal approval flow.
-    #[serde(rename = "off")]
-    Off,
-    /// Tool, path, and URL permission requests are automatically approved.
-    #[serde(rename = "on")]
-    On,
-    /// Permission requests follow the normal approval flow with an LLM advisory recommendation attached; clients may choose to auto-approve requests the judge evaluated as acceptable.
-    #[serde(rename = "auto")]
-    Auto,
+pub enum CatalogUnavailableTransportReason {
+    /// The card advertises no transport this runtime can use.
+    #[serde(rename = "no-eligible-transport")]
+    NoEligibleTransport,
+    /// Every advertised transport is of a kind this runtime does not implement.
+    #[serde(rename = "transport-not-supported")]
+    TransportNotSupported,
+    /// Eligible remotes could not be enumerated, so no explicit choice can be offered.
+    #[serde(rename = "remote-enumeration-unavailable")]
+    RemoteEnumerationUnavailable,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Attachment type discriminator
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AttachmentBlobType {
-    #[serde(rename = "blob")]
-    #[default]
-    Blob,
-}
-
-/// Attachment type discriminator
+/// Optional completion hint for the input (e.g. 'directory' for filesystem path completion)
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AttachmentDirectoryType {
+pub enum SlashCommandInputCompletion {
+    /// Input should complete filesystem directories.
     #[serde(rename = "directory")]
-    #[default]
     Directory,
-}
-
-/// Attachment type discriminator
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AttachmentExtensionContextType {
-    #[serde(rename = "extension_context")]
+    /// Unknown variant for forward compatibility.
     #[default]
-    ExtensionContext,
+    #[serde(other)]
+    Unknown,
 }
 
-/// Attachment type discriminator
+/// Coarse command category for grouping and behavior: runtime built-in, skill-backed command, or SDK/client-owned command
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AttachmentFileType {
-    #[serde(rename = "file")]
+pub enum SlashCommandKind {
+    /// Command implemented by the runtime.
+    #[serde(rename = "builtin")]
+    Builtin,
+    /// Command backed by a skill.
+    #[serde(rename = "skill")]
+    Skill,
+    /// Command registered by an SDK client or extension.
+    #[serde(rename = "client")]
+    Client,
+    /// Unknown variant for forward compatibility.
     #[default]
-    File,
+    #[serde(other)]
+    Unknown,
 }
 
-/// Attachment type discriminator
+/// Whether a pending slash-command invocation effect was applied or cancelled by the host.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AttachmentGitHubActionsJobType {
-    #[serde(rename = "github_actions_job")]
+pub enum CommandsInvocationEffectOutcome {
+    /// The host applied the pending invocation effect.
+    #[serde(rename = "applied")]
+    Applied,
+    /// The host cancelled the pending invocation effect, so any provisional state must be reverted.
+    #[serde(rename = "cancelled")]
+    Cancelled,
+    /// Unknown variant for forward compatibility.
     #[default]
-    GitHubActionsJob,
+    #[serde(other)]
+    Unknown,
 }
 
-/// Attachment type discriminator
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AttachmentGitHubCommitType {
-    #[serde(rename = "github_commit")]
+pub enum CommandsInvocationOrigin {
+    #[serde(rename = "settings")]
+    Settings,
+    /// Unknown variant for forward compatibility.
     #[default]
-    GitHubCommit,
+    #[serde(other)]
+    Unknown,
 }
 
-/// Attachment type discriminator
+/// Neutral SDK discriminator for the connected remote session kind.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AttachmentGitHubFileType {
-    #[serde(rename = "github_file")]
+pub enum ConnectedRemoteSessionMetadataKind {
+    /// Remote CLI session.
+    #[serde(rename = "remote-session")]
+    RemoteSession,
+    /// GitHub Copilot coding agent session.
+    #[serde(rename = "coding-agent")]
+    CodingAgent,
+    /// Unknown variant for forward compatibility.
     #[default]
-    GitHubFile,
+    #[serde(other)]
+    Unknown,
 }
 
-/// Attachment type discriminator
+/// Controls how MCP tool result content is filtered: none leaves content unchanged, markdown sanitizes HTML while preserving Markdown-friendly output, and hidden_characters removes characters that can hide directives.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AttachmentGitHubFileDiffType {
-    #[serde(rename = "github_file_diff")]
+pub enum ContentFilterMode {
+    /// Leave MCP tool result content unchanged.
+    #[serde(rename = "none")]
+    None,
+    /// Sanitize HTML while preserving Markdown-friendly output.
+    #[serde(rename = "markdown")]
+    Markdown,
+    /// Remove characters that can hide directives.
+    #[serde(rename = "hidden_characters")]
+    HiddenCharacters,
+    /// Unknown variant for forward compatibility.
     #[default]
-    GitHubFileDiff,
+    #[serde(other)]
+    Unknown,
 }
 
-/// Type of GitHub reference
+/// Source category for a collected debug bundle entry.
 ///
 /// <div class="warning">
 ///
@@ -26390,71 +28344,122 @@ pub enum AttachmentGitHubFileDiffType {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AttachmentGitHubReferenceType {
-    /// GitHub issue reference.
-    #[serde(rename = "issue")]
-    Issue,
-    /// GitHub pull request reference.
-    #[serde(rename = "pr")]
-    Pr,
-    /// GitHub discussion reference.
-    #[serde(rename = "discussion")]
-    Discussion,
+pub enum DebugCollectLogsSource {
+    /// Session event log.
+    #[serde(rename = "events")]
+    Events,
+    /// Process log for the session.
+    #[serde(rename = "process-log")]
+    ProcessLog,
+    /// Interactive shell log for the session.
+    #[serde(rename = "shell-log")]
+    ShellLog,
+    /// Caller-provided diagnostic entry.
+    #[serde(rename = "additional")]
+    Additional,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Attachment type discriminator
+/// Destination variant discriminator.
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AttachmentGitHubReleaseType {
-    #[serde(rename = "github_release")]
+pub enum DebugCollectLogsDestinationArchiveKind {
+    #[serde(rename = "archive")]
     #[default]
-    GitHubRelease,
+    Archive,
 }
 
-/// Attachment type discriminator
+/// Destination variant discriminator.
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AttachmentGitHubRepositoryType {
-    #[serde(rename = "github_repository")]
+pub enum DebugCollectLogsDestinationDirectoryKind {
+    #[serde(rename = "directory")]
     #[default]
-    GitHubRepository,
+    Directory,
 }
 
-/// Attachment type discriminator
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AttachmentGitHubSnippetType {
-    #[serde(rename = "github_snippet")]
-    #[default]
-    GitHubSnippet,
+/// Destination for the redacted debug bundle.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(untagged)]
+pub enum DebugCollectLogsDestination {
+    Archive(DebugCollectLogsDestinationArchive),
+    Directory(DebugCollectLogsDestinationDirectory),
 }
 
-/// Attachment type discriminator
+/// Kind of caller-provided debug log entry.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AttachmentGitHubTreeComparisonType {
-    #[serde(rename = "github_tree_comparison")]
+pub enum DebugCollectLogsEntryKind {
+    /// Include a single server-local file.
+    #[serde(rename = "file")]
+    File,
+    /// Include files from a server-local directory recursively.
+    #[serde(rename = "directory")]
+    Directory,
+    /// Unknown variant for forward compatibility.
     #[default]
-    GitHubTreeComparison,
+    #[serde(other)]
+    Unknown,
 }
 
-/// Attachment type discriminator
+/// How a collected debug entry should be redacted before being staged.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AttachmentGitHubUrlType {
-    #[serde(rename = "github_url")]
+pub enum DebugCollectLogsRedaction {
+    /// Redact the file as plain UTF-8 log text.
+    #[serde(rename = "plain-text")]
+    PlainText,
+    /// Redact each non-empty line as a session event JSON object, falling back to plain-text redaction for malformed lines.
+    #[serde(rename = "events-jsonl")]
+    EventsJsonl,
+    /// Unknown variant for forward compatibility.
     #[default]
-    GitHubUrl,
+    #[serde(other)]
+    Unknown,
 }
 
-/// Attachment type discriminator
+/// Destination kind that was written.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AttachmentSelectionType {
-    #[serde(rename = "selection")]
+pub enum DebugCollectLogsResultKind {
+    /// A .tgz archive was written.
+    #[serde(rename = "archive")]
+    Archive,
+    /// A directory containing redacted files was written.
+    #[serde(rename = "directory")]
+    Directory,
+    /// Unknown variant for forward compatibility.
     #[default]
-    Selection,
+    #[serde(other)]
+    Unknown,
 }
 
-/// Authentication type
 ///
 /// <div class="warning">
 ///
@@ -26463,35 +28468,16 @@ pub enum AttachmentSelectionType {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AuthInfoType {
-    /// Authentication provided by a GitHub App HMAC credential.
-    #[serde(rename = "hmac")]
-    Hmac,
-    /// Authentication resolved from environment-provided credentials.
-    #[serde(rename = "env")]
-    Env,
-    /// Authentication from an interactive user sign-in.
-    #[serde(rename = "user")]
-    User,
-    /// Authentication delegated to the GitHub CLI.
-    #[serde(rename = "gh-cli")]
-    GhCli,
-    /// Authentication from an API key credential.
-    #[serde(rename = "api-key")]
-    ApiKey,
-    /// Authentication from a GitHub token.
-    #[serde(rename = "token")]
-    Token,
-    /// Authentication from a Copilot API token.
-    #[serde(rename = "copilot-api-token")]
-    CopilotApiToken,
+pub enum DisableBypassPermissionsMode {
+    #[serde(rename = "disable")]
+    Disable,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Custom input-format kind.
+/// Persisted extension discovery source
 ///
 /// <div class="warning">
 ///
@@ -26500,17 +28486,20 @@ pub enum AuthInfoType {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum BuiltinToolFormatType {
-    /// The tool input is parsed with the supplied grammar.
-    #[serde(rename = "grammar")]
-    Grammar,
+pub enum DiscoveredExtensionSource {
+    /// Extension discovered from the user's extensions directory.
+    #[serde(rename = "user")]
+    User,
+    /// Extension contributed by an installed plugin.
+    #[serde(rename = "plugin")]
+    Plugin,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Root JSON Schema type for a built-in tool input.
+/// Effective extension loading and agent-management mode
 ///
 /// <div class="warning">
 ///
@@ -26519,17 +28508,23 @@ pub enum BuiltinToolFormatType {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum BuiltinToolInputSchemaType {
-    /// The tool accepts a JSON object.
-    #[serde(rename = "object")]
-    Object,
+pub enum DiscoveredExtensionMode {
+    /// Extensions are not loaded.
+    #[serde(rename = "disabled")]
+    Disabled,
+    /// Extensions are loaded, but the agent cannot create, reload, or manage them.
+    #[serde(rename = "load_only")]
+    LoadOnly,
+    /// Extensions are loaded and the agent can create, reload, and manage them.
+    #[serde(rename = "load_and_augment")]
+    LoadAndAugment,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Optional completion hint for the input (e.g. 'directory' for filesystem path completion)
+/// Server transport type: stdio, http, sse (deprecated), or memory
 ///
 /// <div class="warning">
 ///
@@ -26538,17 +28533,26 @@ pub enum BuiltinToolInputSchemaType {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum SlashCommandInputCompletion {
-    /// Input should complete filesystem directories.
-    #[serde(rename = "directory")]
-    Directory,
+pub enum DiscoveredMcpServerType {
+    /// Server communicates over stdio with a local child process.
+    #[serde(rename = "stdio")]
+    Stdio,
+    /// Server communicates over streamable HTTP.
+    #[serde(rename = "http")]
+    Http,
+    /// Server communicates over Server-Sent Events (deprecated).
+    #[serde(rename = "sse")]
+    Sse,
+    /// Server is backed by an in-memory runtime implementation.
+    #[serde(rename = "memory")]
+    Memory,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Coarse command category for grouping and behavior: runtime built-in, skill-backed command, or SDK/client-owned command
+/// Agent-scope filter: 'primary' returns only main-agent events plus events whose type starts with 'subagent.' (matching the typed-subscription default behavior); 'all' returns events from all agents (matching wildcard-subscription behavior). Default is 'all' to preserve wildcard semantics for catch-up callers.
 ///
 /// <div class="warning">
 ///
@@ -26557,23 +28561,20 @@ pub enum SlashCommandInputCompletion {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum SlashCommandKind {
-    /// Command implemented by the runtime.
-    #[serde(rename = "builtin")]
-    Builtin,
-    /// Command backed by a skill.
-    #[serde(rename = "skill")]
-    Skill,
-    /// Command registered by an SDK client or extension.
-    #[serde(rename = "client")]
-    Client,
+pub enum EventsAgentScope {
+    /// Return main-agent events and typed subagent lifecycle events.
+    #[serde(rename = "primary")]
+    Primary,
+    /// Return events from all agents.
+    #[serde(rename = "all")]
+    All,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Whether a pending slash-command invocation effect was applied or cancelled by the host.
+/// Direction to page through the session's persisted event history. 'forward' pages from the cursor toward newer events; 'backward' returns the newest window first (tail-first) and pages toward older events. Events within a returned batch are always chronological (oldest-to-newest), even for a backward read.
 ///
 /// <div class="warning">
 ///
@@ -26582,19 +28583,20 @@ pub enum SlashCommandKind {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum CommandsInvocationEffectOutcome {
-    /// The host applied the pending invocation effect.
-    #[serde(rename = "applied")]
-    Applied,
-    /// The host cancelled the pending invocation effect, so any provisional state must be reverted.
-    #[serde(rename = "cancelled")]
-    Cancelled,
+pub enum EventsReadDirection {
+    /// Page from the cursor toward newer events (default).
+    #[serde(rename = "forward")]
+    Forward,
+    /// Tail-first: return the newest events and page toward older events.
+    #[serde(rename = "backward")]
+    Backward,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
+/// Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history (the beginning for a forward read, the tail for a backward read). The fallback page is a fresh boundary snapshot, not a continuation of the requested cursor, so it may overlap already-rendered events; on 'expired' a consumer should reset/rebase its pagination state (or deduplicate by event id) before continuing from the returned cursor.
 ///
 /// <div class="warning">
 ///
@@ -26603,16 +28605,20 @@ pub enum CommandsInvocationEffectOutcome {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum CommandsInvocationOrigin {
-    #[serde(rename = "settings")]
-    Settings,
+pub enum EventsCursorStatus {
+    /// The cursor was applied successfully.
+    #[serde(rename = "ok")]
+    Ok,
+    /// The cursor referred to history that is no longer available.
+    #[serde(rename = "expired")]
+    Expired,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Neutral SDK discriminator for the connected remote session kind.
+/// Discovery source: project (.github/extensions/), user (~/.copilot/extensions/), plugin (installed plugin), or session (session-state/<id>/extensions/)
 ///
 /// <div class="warning">
 ///
@@ -26621,20 +28627,26 @@ pub enum CommandsInvocationOrigin {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum ConnectedRemoteSessionMetadataKind {
-    /// Remote CLI session.
-    #[serde(rename = "remote-session")]
-    RemoteSession,
-    /// GitHub Copilot coding agent session.
-    #[serde(rename = "coding-agent")]
-    CodingAgent,
+pub enum ExtensionSource {
+    /// Extension discovered from the current project's .github/extensions directory.
+    #[serde(rename = "project")]
+    Project,
+    /// Extension discovered from the user's ~/.copilot/extensions directory.
+    #[serde(rename = "user")]
+    User,
+    /// Extension contributed by an installed plugin.
+    #[serde(rename = "plugin")]
+    Plugin,
+    /// Extension discovered from the current session's state directory (loaded only for this session).
+    #[serde(rename = "session")]
+    Session,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Controls how MCP tool result content is filtered: none leaves content unchanged, markdown sanitizes HTML while preserving Markdown-friendly output, and hidden_characters removes characters that can hide directives.
+/// Current status: running, disabled, failed, or starting
 ///
 /// <div class="warning">
 ///
@@ -26643,23 +28655,34 @@ pub enum ConnectedRemoteSessionMetadataKind {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum ContentFilterMode {
-    /// Leave MCP tool result content unchanged.
-    #[serde(rename = "none")]
-    None,
-    /// Sanitize HTML while preserving Markdown-friendly output.
-    #[serde(rename = "markdown")]
-    Markdown,
-    /// Remove characters that can hide directives.
-    #[serde(rename = "hidden_characters")]
-    HiddenCharacters,
+pub enum ExtensionStatus {
+    /// The extension process is running.
+    #[serde(rename = "running")]
+    Running,
+    /// The extension is installed but disabled.
+    #[serde(rename = "disabled")]
+    Disabled,
+    /// The extension failed to start or crashed.
+    #[serde(rename = "failed")]
+    Failed,
+    /// The extension process is starting.
+    #[serde(rename = "starting")]
+    Starting,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Source category for a collected debug bundle entry.
+/// Attachment type discriminator
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum ExtensionContextPushInputType {
+    #[serde(rename = "extension_context")]
+    #[default]
+    ExtensionContext,
+}
+
+/// Binary result type discriminator. Use "image" for images and "resource" for other binary data.
 ///
 /// <div class="warning">
 ///
@@ -26668,57 +28691,44 @@ pub enum ContentFilterMode {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum DebugCollectLogsSource {
-    /// Session event log.
-    #[serde(rename = "events")]
-    Events,
-    /// Process log for the session.
-    #[serde(rename = "process-log")]
-    ProcessLog,
-    /// Interactive shell log for the session.
-    #[serde(rename = "shell-log")]
-    ShellLog,
-    /// Caller-provided diagnostic entry.
-    #[serde(rename = "additional")]
-    Additional,
+pub enum ExternalToolTextResultForLlmBinaryResultsForLlmType {
+    /// Binary image data.
+    #[serde(rename = "image")]
+    Image,
+    /// Other binary resource data.
+    #[serde(rename = "resource")]
+    Resource,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Destination variant discriminator.
+/// Content block type discriminator
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum DebugCollectLogsDestinationArchiveKind {
-    #[serde(rename = "archive")]
+pub enum ExternalToolTextResultForLlmContentAudioType {
+    #[serde(rename = "audio")]
     #[default]
-    Archive,
+    Audio,
 }
 
-/// Destination variant discriminator.
+/// Content block type discriminator
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum DebugCollectLogsDestinationDirectoryKind {
-    #[serde(rename = "directory")]
+pub enum ExternalToolTextResultForLlmContentImageType {
+    #[serde(rename = "image")]
     #[default]
-    Directory,
+    Image,
 }
 
-/// Destination for the redacted debug bundle.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(untagged)]
-pub enum DebugCollectLogsDestination {
-    Archive(DebugCollectLogsDestinationArchive),
-    Directory(DebugCollectLogsDestinationDirectory),
+/// Content block type discriminator
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum ExternalToolTextResultForLlmContentResourceType {
+    #[serde(rename = "resource")]
+    #[default]
+    Resource,
 }
 
-/// Kind of caller-provided debug log entry.
+/// Theme variant this icon is intended for
 ///
 /// <div class="warning">
 ///
@@ -26727,63 +28737,52 @@ pub enum DebugCollectLogsDestination {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum DebugCollectLogsEntryKind {
-    /// Include a single server-local file.
-    #[serde(rename = "file")]
-    File,
-    /// Include files from a server-local directory recursively.
-    #[serde(rename = "directory")]
-    Directory,
+pub enum ExternalToolTextResultForLlmContentResourceLinkIconTheme {
+    /// Icon intended for light themes.
+    #[serde(rename = "light")]
+    Light,
+    /// Icon intended for dark themes.
+    #[serde(rename = "dark")]
+    Dark,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// How a collected debug entry should be redacted before being staged.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
+/// Content block type discriminator
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum DebugCollectLogsRedaction {
-    /// Redact the file as plain UTF-8 log text.
-    #[serde(rename = "plain-text")]
-    PlainText,
-    /// Redact each non-empty line as a session event JSON object, falling back to plain-text redaction for malformed lines.
-    #[serde(rename = "events-jsonl")]
-    EventsJsonl,
-    /// Unknown variant for forward compatibility.
+pub enum ExternalToolTextResultForLlmContentResourceLinkType {
+    #[serde(rename = "resource_link")]
     #[default]
-    #[serde(other)]
-    Unknown,
+    ResourceLink,
 }
 
-/// Destination kind that was written.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
+/// Content block type discriminator
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum DebugCollectLogsResultKind {
-    /// A .tgz archive was written.
-    #[serde(rename = "archive")]
-    Archive,
-    /// A directory containing redacted files was written.
-    #[serde(rename = "directory")]
-    Directory,
-    /// Unknown variant for forward compatibility.
+pub enum ExternalToolTextResultForLlmContentShellExitType {
+    #[serde(rename = "shell_exit")]
     #[default]
-    #[serde(other)]
-    Unknown,
+    ShellExit,
+}
+
+/// Content block type discriminator
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum ExternalToolTextResultForLlmContentTerminalType {
+    #[serde(rename = "terminal")]
+    #[default]
+    Terminal,
+}
+
+/// Content block type discriminator
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum ExternalToolTextResultForLlmContentTextType {
+    #[serde(rename = "text")]
+    #[default]
+    Text,
 }
 
+/// Execution-critical factory storage operation.
 ///
 /// <div class="warning">
 ///
@@ -26792,16 +28791,47 @@ pub enum DebugCollectLogsResultKind {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum DisableBypassPermissionsMode {
-    #[serde(rename = "disable")]
-    Disable,
+pub enum FactoryDurableOperation {
+    /// Creating the durable run and declared phases.
+    #[serde(rename = "createRun")]
+    CreateRun,
+    /// Persisting the transition to running.
+    #[serde(rename = "markRunStarted")]
+    MarkRunStarted,
+    /// Persisting the terminal run envelope.
+    #[serde(rename = "finishRun")]
+    FinishRun,
+    /// Persisting subagent admission accounting.
+    #[serde(rename = "reserveAgent")]
+    ReserveAgent,
+    /// Rolling back an uncommitted subagent admission.
+    #[serde(rename = "releaseAgent")]
+    ReleaseAgent,
+    /// Persisting an idempotent model-usage charge.
+    #[serde(rename = "chargeCredit")]
+    ChargeCredit,
+    /// Persisting active execution time.
+    #[serde(rename = "addElapsed")]
+    AddElapsed,
+    /// Reading the authoritative AI-credit total.
+    #[serde(rename = "reconcileCreditTotal")]
+    ReconcileCreditTotal,
+    /// Reading a journal entry without treating storage failure as a cache miss.
+    #[serde(rename = "journalGet")]
+    JournalGet,
+    /// Persisting a journal entry before reporting success.
+    #[serde(rename = "journalPut")]
+    JournalPut,
+    /// Renewing the durable owner lease that proves this process still owns the run.
+    #[serde(rename = "refreshLease")]
+    RefreshLease,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Persisted extension discovery source
+/// Current or terminal state of a factory run.
 ///
 /// <div class="warning">
 ///
@@ -26810,20 +28840,32 @@ pub enum DisableBypassPermissionsMode {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum DiscoveredExtensionSource {
-    /// Extension discovered from the user's extensions directory.
-    #[serde(rename = "user")]
-    User,
-    /// Extension contributed by an installed plugin.
-    #[serde(rename = "plugin")]
-    Plugin,
+pub enum FactoryRunStatus {
+    /// The run was minted and is awaiting approval.
+    #[serde(rename = "pending")]
+    Pending,
+    /// The run is executing.
+    #[serde(rename = "running")]
+    Running,
+    /// The run completed successfully.
+    #[serde(rename = "completed")]
+    Completed,
+    /// The run was interrupted while resource budget remained.
+    #[serde(rename = "halted")]
+    Halted,
+    /// The run was cancelled before completion.
+    #[serde(rename = "cancelled")]
+    Cancelled,
+    /// The factory body failed or reached a cumulative resource ceiling.
+    #[serde(rename = "error")]
+    Error,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Effective extension loading and agent-management mode
+/// Kind of factory progress line.
 ///
 /// <div class="warning">
 ///
@@ -26831,24 +28873,21 @@ pub enum DiscoveredExtensionSource {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum DiscoveredExtensionMode {
-    /// Extensions are not loaded.
-    #[serde(rename = "disabled")]
-    Disabled,
-    /// Extensions are loaded, but the agent cannot create, reload, or manage them.
-    #[serde(rename = "load_only")]
-    LoadOnly,
-    /// Extensions are loaded and the agent can create, reload, and manage them.
-    #[serde(rename = "load_and_augment")]
-    LoadAndAugment,
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum FactoryLogLineKind {
+    /// A narrator log line.
+    #[serde(rename = "log")]
+    Log,
+    /// A named factory phase marker.
+    #[serde(rename = "phase")]
+    Phase,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Server transport type: stdio, http, sse (deprecated), or memory
+/// Derived lifecycle state of a factory phase.
 ///
 /// <div class="warning">
 ///
@@ -26857,26 +28896,26 @@ pub enum DiscoveredExtensionMode {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum DiscoveredMcpServerType {
-    /// Server communicates over stdio with a local child process.
-    #[serde(rename = "stdio")]
-    Stdio,
-    /// Server communicates over streamable HTTP.
-    #[serde(rename = "http")]
-    Http,
-    /// Server communicates over Server-Sent Events (deprecated).
-    #[serde(rename = "sse")]
-    Sse,
-    /// Server is backed by an in-memory runtime implementation.
-    #[serde(rename = "memory")]
-    Memory,
+pub enum FactoryPhaseStatus {
+    /// The phase has not been entered yet.
+    #[serde(rename = "pending")]
+    Pending,
+    /// The phase is currently entered and accumulating active time.
+    #[serde(rename = "active")]
+    Active,
+    /// The phase was entered and has since been closed.
+    #[serde(rename = "completed")]
+    Completed,
+    /// The phase was never entered because a later phase was entered or the run reached a terminal state.
+    #[serde(rename = "skipped")]
+    Skipped,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Agent-scope filter: 'primary' returns only main-agent events plus events whose type starts with 'subagent.' (matching the typed-subscription default behavior); 'all' returns events from all agents (matching wildcard-subscription behavior). Default is 'all' to preserve wildcard semantics for catch-up callers.
+/// Cumulative resource ceiling that stopped a factory run.
 ///
 /// <div class="warning">
 ///
@@ -26885,20 +28924,38 @@ pub enum DiscoveredMcpServerType {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum EventsAgentScope {
-    /// Return main-agent events and typed subagent lifecycle events.
-    #[serde(rename = "primary")]
-    Primary,
-    /// Return events from all agents.
-    #[serde(rename = "all")]
-    All,
+pub enum FactoryRunFailureKind {
+    /// The run admitted the approved maximum total number of subagents.
+    #[serde(rename = "maxTotalSubagents")]
+    MaxTotalSubagents,
+    /// The run reached the approved accumulated active-execution time in seconds.
+    #[serde(rename = "timeoutSeconds")]
+    TimeoutSeconds,
+    /// The run's settled subagent model usage exceeded the approved AI-credit ceiling, or no headroom remained for another subagent.
+    #[serde(rename = "maxAiCredits")]
+    MaxAiCredits,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Direction to page through the session's persisted event history. 'forward' pages from the cursor toward newer events; 'backward' returns the newest window first (tail-first) and pages toward older events. Events within a returned batch are always chronological (oldest-to-newest), even for a backward read.
+/// What initiated this compaction request, recorded as the `trigger` on the persisted `session.compaction_start` / `session.compaction_complete` events. When absent, the compaction is persisted without trigger attribution (initiator unknown).
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum HistoryCompactRequestTrigger {
+    /// User-requested compaction, e.g. the /compact command or a direct history.compact call.
+    #[serde(rename = "manual")]
+    Manual,
+    /// Compaction requested while switching to a model with a smaller context window.
+    #[serde(rename = "model_switch")]
+    ModelSwitch,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
+/// Reason a captured file was not restored.
 ///
 /// <div class="warning">
 ///
@@ -26907,20 +28964,20 @@ pub enum EventsAgentScope {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum EventsReadDirection {
-    /// Page from the cursor toward newer events (default).
-    #[serde(rename = "forward")]
-    Forward,
-    /// Tail-first: return the newest events and page toward older events.
-    #[serde(rename = "backward")]
-    Backward,
+pub enum HistoryFileRestoreSkipReason {
+    /// The file changed after Copilot's last captured write.
+    #[serde(rename = "user-modified")]
+    UserModified,
+    /// A faithful preimage was not captured.
+    #[serde(rename = "skipped-capture")]
+    SkippedCapture,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history (the beginning for a forward read, the tail for a backward read). The fallback page is a fresh boundary snapshot, not a continuation of the requested cursor, so it may overlap already-rendered events; on 'expired' a consumer should reset/rebase its pagination state (or deduplicate by event id) before continuing from the returned cursor.
+/// Reason a rewind read (rewind points, file-restore preview, or session diff) could not be answered from the session's file-change captures.
 ///
 /// <div class="warning">
 ///
@@ -26929,20 +28986,23 @@ pub enum EventsReadDirection {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum EventsCursorStatus {
-    /// The cursor was applied successfully.
-    #[serde(rename = "ok")]
-    Ok,
-    /// The cursor referred to history that is no longer available.
-    #[serde(rename = "expired")]
-    Expired,
+pub enum HistoryRewindUnavailableReason {
+    /// The session did not opt into file-change tracking before its first turn.
+    #[serde(rename = "file-change-tracking-disabled")]
+    FileChangeTrackingDisabled,
+    /// The session still has work that may mutate files or history. Transient: the same request succeeds once the session settles, so callers should retry rather than treat it as a failure.
+    #[serde(rename = "session-busy")]
+    SessionBusy,
+    /// Remote-backed rewind routing is not supported.
+    #[serde(rename = "unsupported-remote-session")]
+    UnsupportedRemoteSession,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Discovery source: project (.github/extensions/), user (~/.copilot/extensions/), plugin (installed plugin), or session (session-state/<id>/extensions/)
+/// Aggregate file change represented by a rewind preview.
 ///
 /// <div class="warning">
 ///
@@ -26951,26 +29011,23 @@ pub enum EventsCursorStatus {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum ExtensionSource {
-    /// Extension discovered from the current project's .github/extensions directory.
-    #[serde(rename = "project")]
-    Project,
-    /// Extension discovered from the user's ~/.copilot/extensions directory.
-    #[serde(rename = "user")]
-    User,
-    /// Extension contributed by an installed plugin.
-    #[serde(rename = "plugin")]
-    Plugin,
-    /// Extension discovered from the current session's state directory (loaded only for this session).
-    #[serde(rename = "session")]
-    Session,
+pub enum HistoryRewindChangeType {
+    /// The discarded turns created the file.
+    #[serde(rename = "created")]
+    Created,
+    /// The discarded turns deleted the file.
+    #[serde(rename = "deleted")]
+    Deleted,
+    /// The discarded turns modified the file.
+    #[serde(rename = "modified")]
+    Modified,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Current status: running, disabled, failed, or starting
+/// Scope of a rewind operation.
 ///
 /// <div class="warning">
 ///
@@ -26979,34 +29036,20 @@ pub enum ExtensionSource {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum ExtensionStatus {
-    /// The extension process is running.
-    #[serde(rename = "running")]
-    Running,
-    /// The extension is installed but disabled.
-    #[serde(rename = "disabled")]
-    Disabled,
-    /// The extension failed to start or crashed.
-    #[serde(rename = "failed")]
-    Failed,
-    /// The extension process is starting.
-    #[serde(rename = "starting")]
-    Starting,
+pub enum HistoryRewindMode {
+    /// Discard conversation events while leaving files unchanged.
+    #[serde(rename = "conversation")]
+    Conversation,
+    /// Discard conversation events and restore captured files changed by those turns.
+    #[serde(rename = "conversation-and-files")]
+    ConversationAndFiles,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Attachment type discriminator
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum ExtensionContextPushInputType {
-    #[serde(rename = "extension_context")]
-    #[default]
-    ExtensionContext,
-}
-
-/// Binary result type discriminator. Use "image" for images and "resource" for other binary data.
+/// Outcome of a rewind request.
 ///
 /// <div class="warning">
 ///
@@ -27015,44 +29058,125 @@ pub enum ExtensionContextPushInputType {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum ExternalToolTextResultForLlmBinaryResultsForLlmType {
-    /// Binary image data.
-    #[serde(rename = "image")]
-    Image,
-    /// Other binary resource data.
-    #[serde(rename = "resource")]
-    Resource,
+pub enum HistoryRewindOutcome {
+    /// The requested rewind completed; reachable in either mode.
+    #[serde(rename = "success")]
+    Success,
+    /// The session still has work that may mutate files or history; reachable in either mode.
+    #[serde(rename = "session-busy")]
+    SessionBusy,
+    /// A conversation-and-files rewind was requested for a session that did not enable capture; conversation-only rewinds never produce this.
+    #[serde(rename = "file-change-tracking-disabled")]
+    FileChangeTrackingDisabled,
+    /// Remote-backed rewind routing is not supported; reachable in either mode.
+    #[serde(rename = "unsupported-remote-session")]
+    UnsupportedRemoteSession,
+    /// File restore failed and all applied file changes were rolled back; only conversation-and-files rewinds produce this.
+    #[serde(rename = "files-rolled-back")]
+    FilesRolledBack,
+    /// File restore failed and its rollback could not fully restore the pre-rewind state; only conversation-and-files rewinds produce this.
+    #[serde(rename = "rollback-incomplete")]
+    RollbackIncomplete,
+    /// Conversation truncation failed. In conversation-and-files mode any files that were restored are left in place because conversation history cannot be un-truncated; in conversation-only mode no files are restored. Consult restoredFiles for what, if anything, was applied.
+    #[serde(rename = "truncation-failed")]
+    TruncationFailed,
+    /// The conversation was rewound (and, in conversation-and-files mode, captured files were restored), but persisted checkpoints could not be cleaned up; reachable in either mode.
+    #[serde(rename = "checkpoint-cleanup-failed")]
+    CheckpointCleanupFailed,
+    /// Files and conversation were rewound, but obsolete file snapshots could not be removed; only conversation-and-files rewinds produce this.
+    #[serde(rename = "snapshot-prune-failed")]
+    SnapshotPruneFailed,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
+/// Hook event name dispatched through the SDK callback transport.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum HookType {
+    /// Runs before a tool is invoked.
+    #[serde(rename = "preToolUse")]
+    PreToolUse,
+    /// Runs before an MCP tool is invoked.
+    #[serde(rename = "preMcpToolCall")]
+    PreMcpToolCall,
+    /// Runs after a tool completes successfully.
+    #[serde(rename = "postToolUse")]
+    PostToolUse,
+    /// Runs after a tool fails.
+    #[serde(rename = "postToolUseFailure")]
+    PostToolUseFailure,
+    /// Runs after the user submits a prompt.
+    #[serde(rename = "userPromptSubmitted")]
+    UserPromptSubmitted,
+    /// Runs after the runtime transforms the submitted prompt for the model, before it is added to session history.
+    #[serde(rename = "userPromptTransformed")]
+    UserPromptTransformed,
+    /// Runs when a session starts.
+    #[serde(rename = "sessionStart")]
+    SessionStart,
+    /// Runs when a session ends.
+    #[serde(rename = "sessionEnd")]
+    SessionEnd,
+    /// Runs after an agent result is produced.
+    #[serde(rename = "postResult")]
+    PostResult,
+    /// Runs before a pull request description is generated.
+    #[serde(rename = "prePRDescription")]
+    PrePRDescription,
+    /// Runs when the agent encounters an error.
+    #[serde(rename = "errorOccurred")]
+    ErrorOccurred,
+    /// Runs when the agent stops.
+    #[serde(rename = "agentStop")]
+    AgentStop,
+    /// Runs when a subagent starts.
+    #[serde(rename = "subagentStart")]
+    SubagentStart,
+    /// Runs when a subagent stops.
+    #[serde(rename = "subagentStop")]
+    SubagentStop,
+    /// Runs before conversation context is compacted.
+    #[serde(rename = "preCompact")]
+    PreCompact,
+    /// Runs when the agent requests permission.
+    #[serde(rename = "permissionRequest")]
+    PermissionRequest,
+    /// Runs when the agent emits a notification.
+    #[serde(rename = "notification")]
+    Notification,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Content block type discriminator
+/// Constant value. Always "github".
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum ExternalToolTextResultForLlmContentAudioType {
-    #[serde(rename = "audio")]
+pub enum InstalledPluginSourceGitHubSource {
+    #[serde(rename = "github")]
     #[default]
-    Audio,
+    GitHub,
 }
 
-/// Content block type discriminator
+/// Constant value. Always "local".
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum ExternalToolTextResultForLlmContentImageType {
-    #[serde(rename = "image")]
+pub enum InstalledPluginSourceLocalSource {
+    #[serde(rename = "local")]
     #[default]
-    Image,
+    Local,
 }
 
-/// Content block type discriminator
+/// Constant value. Always "url".
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum ExternalToolTextResultForLlmContentResourceType {
-    #[serde(rename = "resource")]
+pub enum InstalledPluginSourceUrlSource {
+    #[serde(rename = "url")]
     #[default]
-    Resource,
+    Url,
 }
 
-/// Theme variant this icon is intended for
+/// Whether the target is a single file or a directory of instruction files
 ///
 /// <div class="warning">
 ///
@@ -27061,52 +29185,76 @@ pub enum ExternalToolTextResultForLlmContentResourceType {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum ExternalToolTextResultForLlmContentResourceLinkIconTheme {
-    /// Icon intended for light themes.
-    #[serde(rename = "light")]
-    Light,
-    /// Icon intended for dark themes.
-    #[serde(rename = "dark")]
-    Dark,
+pub enum InstructionDiscoveryPathKind {
+    /// The target is a single instruction file.
+    #[serde(rename = "file")]
+    File,
+    /// The target is a directory that holds instruction files.
+    #[serde(rename = "directory")]
+    Directory,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Content block type discriminator
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum ExternalToolTextResultForLlmContentResourceLinkType {
-    #[serde(rename = "resource_link")]
-    #[default]
-    ResourceLink,
-}
-
-/// Content block type discriminator
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum ExternalToolTextResultForLlmContentShellExitType {
-    #[serde(rename = "shell_exit")]
-    #[default]
-    ShellExit,
-}
-
-/// Content block type discriminator
+/// Which tier this target belongs to
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum ExternalToolTextResultForLlmContentTerminalType {
-    #[serde(rename = "terminal")]
+pub enum InstructionDiscoveryPathLocation {
+    /// Instructions live in user-level configuration.
+    #[serde(rename = "user")]
+    User,
+    /// Instructions live in repository-level configuration.
+    #[serde(rename = "repository")]
+    Repository,
+    /// Instructions live under the current working directory.
+    #[serde(rename = "working-directory")]
+    WorkingDirectory,
+    /// Instructions live in plugin-provided configuration.
+    #[serde(rename = "plugin")]
+    Plugin,
+    /// Unknown variant for forward compatibility.
     #[default]
-    Terminal,
+    #[serde(other)]
+    Unknown,
 }
 
-/// Content block type discriminator
+/// Where this source lives — used for UI grouping
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum ExternalToolTextResultForLlmContentTextType {
-    #[serde(rename = "text")]
+pub enum InstructionSourceLocation {
+    /// Instructions live in user-level configuration.
+    #[serde(rename = "user")]
+    User,
+    /// Instructions live in repository-level configuration.
+    #[serde(rename = "repository")]
+    Repository,
+    /// Instructions live under the current working directory.
+    #[serde(rename = "working-directory")]
+    WorkingDirectory,
+    /// Instructions live in plugin-provided configuration.
+    #[serde(rename = "plugin")]
+    Plugin,
+    /// Unknown variant for forward compatibility.
     #[default]
-    Text,
+    #[serde(other)]
+    Unknown,
 }
 
-/// Execution-critical factory storage operation.
+/// Category of instruction source — used for merge logic
 ///
 /// <div class="warning">
 ///
@@ -27115,47 +29263,50 @@ pub enum ExternalToolTextResultForLlmContentTextType {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum FactoryDurableOperation {
-    /// Creating the durable run and declared phases.
-    #[serde(rename = "createRun")]
-    CreateRun,
-    /// Persisting the transition to running.
-    #[serde(rename = "markRunStarted")]
-    MarkRunStarted,
-    /// Persisting the terminal run envelope.
-    #[serde(rename = "finishRun")]
-    FinishRun,
-    /// Persisting subagent admission accounting.
-    #[serde(rename = "reserveAgent")]
-    ReserveAgent,
-    /// Rolling back an uncommitted subagent admission.
-    #[serde(rename = "releaseAgent")]
-    ReleaseAgent,
-    /// Persisting an idempotent model-usage charge.
-    #[serde(rename = "chargeCredit")]
-    ChargeCredit,
-    /// Persisting active execution time.
-    #[serde(rename = "addElapsed")]
-    AddElapsed,
-    /// Reading the authoritative AI-credit total.
-    #[serde(rename = "reconcileCreditTotal")]
-    ReconcileCreditTotal,
-    /// Reading a journal entry without treating storage failure as a cache miss.
-    #[serde(rename = "journalGet")]
-    JournalGet,
-    /// Persisting a journal entry before reporting success.
-    #[serde(rename = "journalPut")]
-    JournalPut,
-    /// Renewing the durable owner lease that proves this process still owns the run.
-    #[serde(rename = "refreshLease")]
-    RefreshLease,
+pub enum InstructionSourceType {
+    /// Instructions loaded from the user's home configuration.
+    #[serde(rename = "home")]
+    Home,
+    /// Instructions loaded from repository-scoped files.
+    #[serde(rename = "repo")]
+    Repo,
+    /// Instructions loaded from model-specific files.
+    #[serde(rename = "model")]
+    Model,
+    /// Instructions loaded from VS Code instruction files.
+    #[serde(rename = "vscode")]
+    Vscode,
+    /// Instructions discovered from nested agent files.
+    #[serde(rename = "nested-agents")]
+    NestedAgents,
+    /// Instructions inherited from child instruction files.
+    #[serde(rename = "child-instructions")]
+    ChildInstructions,
+    /// Instructions supplied by an installed plugin.
+    #[serde(rename = "plugin")]
+    Plugin,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Current or terminal state of a factory run.
+/// Transport the runtime would otherwise use for this request. `http` (the default when absent) covers plain HTTP and SSE responses; `websocket` indicates a full-duplex message channel where each body chunk maps to one WebSocket message and the `binary` flag distinguishes text from binary frames. The SDK consumer uses this to decide whether to service the request with an HTTP client or a WebSocket client. It is the one piece of request metadata the consumer cannot reliably infer from the URL or headers alone.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum LlmInferenceHttpRequestStartTransport {
+    /// Plain HTTP or SSE response. Each body chunk is an opaque byte range; the response is a status line, headers, and a (possibly streamed) body.
+    #[serde(rename = "http")]
+    Http,
+    /// Full-duplex WebSocket channel. Each body chunk maps to exactly one WebSocket message and the `binary` flag distinguishes text from binary frames; request and response chunks flow concurrently.
+    #[serde(rename = "websocket")]
+    Websocket,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
+/// Repository host type
 ///
 /// <div class="warning">
 ///
@@ -27164,32 +29315,20 @@ pub enum FactoryDurableOperation {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum FactoryRunStatus {
-    /// The run was minted and is awaiting approval.
-    #[serde(rename = "pending")]
-    Pending,
-    /// The run is executing.
-    #[serde(rename = "running")]
-    Running,
-    /// The run completed successfully.
-    #[serde(rename = "completed")]
-    Completed,
-    /// The run was interrupted while resource budget remained.
-    #[serde(rename = "halted")]
-    Halted,
-    /// The run was cancelled before completion.
-    #[serde(rename = "cancelled")]
-    Cancelled,
-    /// The factory body failed or reached a cumulative resource ceiling.
-    #[serde(rename = "error")]
-    Error,
+pub enum SessionContextHostType {
+    /// Session repository is hosted on GitHub.
+    #[serde(rename = "github")]
+    GitHub,
+    /// Session repository is hosted on Azure DevOps.
+    #[serde(rename = "ado")]
+    Ado,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Kind of factory progress line.
+/// Log severity level. Determines how the message is displayed in the timeline. Defaults to "info".
 ///
 /// <div class="warning">
 ///
@@ -27198,20 +29337,23 @@ pub enum FactoryRunStatus {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum FactoryLogLineKind {
-    /// A narrator log line.
-    #[serde(rename = "log")]
-    Log,
-    /// A named factory phase marker.
-    #[serde(rename = "phase")]
-    Phase,
+pub enum SessionLogLevel {
+    /// Informational message.
+    #[serde(rename = "info")]
+    Info,
+    /// Warning message that may require attention.
+    #[serde(rename = "warning")]
+    Warning,
+    /// Error message describing a failure.
+    #[serde(rename = "error")]
+    Error,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Derived lifecycle state of a factory phase.
+/// Allowed values for the `McpAppsHostContextDetailsAvailableDisplayMode` enumeration.
 ///
 /// <div class="warning">
 ///
@@ -27220,26 +29362,23 @@ pub enum FactoryLogLineKind {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum FactoryPhaseStatus {
-    /// The phase has not been entered yet.
-    #[serde(rename = "pending")]
-    Pending,
-    /// The phase is currently entered and accumulating active time.
-    #[serde(rename = "active")]
-    Active,
-    /// The phase was entered and has since been closed.
-    #[serde(rename = "completed")]
-    Completed,
-    /// The phase was never entered because a later phase was entered or the run reached a terminal state.
-    #[serde(rename = "skipped")]
-    Skipped,
+pub enum McpAppsHostContextDetailsAvailableDisplayMode {
+    /// Rendered inline within the host conversation surface
+    #[serde(rename = "inline")]
+    Inline,
+    /// Rendered as a fullscreen overlay
+    #[serde(rename = "fullscreen")]
+    Fullscreen,
+    /// Rendered as a picture-in-picture floating panel
+    #[serde(rename = "pip")]
+    Pip,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Cumulative resource ceiling that stopped a factory run.
+/// Current display mode (SEP-1865)
 ///
 /// <div class="warning">
 ///
@@ -27248,38 +29387,48 @@ pub enum FactoryPhaseStatus {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum FactoryRunFailureKind {
-    /// The run admitted the approved maximum total number of subagents.
-    #[serde(rename = "maxTotalSubagents")]
-    MaxTotalSubagents,
-    /// The run reached the approved accumulated active-execution time in seconds.
-    #[serde(rename = "timeoutSeconds")]
-    TimeoutSeconds,
-    /// The run's settled subagent model usage exceeded the approved AI-credit ceiling, or no headroom remained for another subagent.
-    #[serde(rename = "maxAiCredits")]
-    MaxAiCredits,
+pub enum McpAppsHostContextDetailsDisplayMode {
+    /// Rendered inline within the host conversation surface
+    #[serde(rename = "inline")]
+    Inline,
+    /// Rendered as a fullscreen overlay
+    #[serde(rename = "fullscreen")]
+    Fullscreen,
+    /// Rendered as a picture-in-picture floating panel
+    #[serde(rename = "pip")]
+    Pip,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// What initiated this compaction request, recorded as the `trigger` on the persisted `session.compaction_start` / `session.compaction_complete` events. When absent, the compaction is persisted without trigger attribution (initiator unknown).
+/// Platform type for responsive design
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum HistoryCompactRequestTrigger {
-    /// User-requested compaction, e.g. the /compact command or a direct history.compact call.
-    #[serde(rename = "manual")]
-    Manual,
-    /// Compaction requested while switching to a model with a smaller context window.
-    #[serde(rename = "model_switch")]
-    ModelSwitch,
+pub enum McpAppsHostContextDetailsPlatform {
+    /// Host runs in a web browser
+    #[serde(rename = "web")]
+    Web,
+    /// Host runs as a desktop application
+    #[serde(rename = "desktop")]
+    Desktop,
+    /// Host runs on a mobile device
+    #[serde(rename = "mobile")]
+    Mobile,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Reason a captured file was not restored.
+/// UI theme preference per SEP-1865
 ///
 /// <div class="warning">
 ///
@@ -27288,20 +29437,20 @@ pub enum HistoryCompactRequestTrigger {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum HistoryFileRestoreSkipReason {
-    /// The file changed after Copilot's last captured write.
-    #[serde(rename = "user-modified")]
-    UserModified,
-    /// A faithful preimage was not captured.
-    #[serde(rename = "skipped-capture")]
-    SkippedCapture,
+pub enum McpAppsHostContextDetailsTheme {
+    /// Light UI theme
+    #[serde(rename = "light")]
+    Light,
+    /// Dark UI theme
+    #[serde(rename = "dark")]
+    Dark,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Reason a rewind read (rewind points, file-restore preview, or session diff) could not be answered from the session's file-change captures.
+/// Allowed values for the `McpAppsSetHostContextDetailsAvailableDisplayMode` enumeration.
 ///
 /// <div class="warning">
 ///
@@ -27310,23 +29459,23 @@ pub enum HistoryFileRestoreSkipReason {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum HistoryRewindUnavailableReason {
-    /// The session did not opt into file-change tracking before its first turn.
-    #[serde(rename = "file-change-tracking-disabled")]
-    FileChangeTrackingDisabled,
-    /// The session still has work that may mutate files or history. Transient: the same request succeeds once the session settles, so callers should retry rather than treat it as a failure.
-    #[serde(rename = "session-busy")]
-    SessionBusy,
-    /// Remote-backed rewind routing is not supported.
-    #[serde(rename = "unsupported-remote-session")]
-    UnsupportedRemoteSession,
+pub enum McpAppsSetHostContextDetailsAvailableDisplayMode {
+    /// Rendered inline within the host conversation surface
+    #[serde(rename = "inline")]
+    Inline,
+    /// Rendered as a fullscreen overlay
+    #[serde(rename = "fullscreen")]
+    Fullscreen,
+    /// Rendered as a picture-in-picture floating panel
+    #[serde(rename = "pip")]
+    Pip,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Aggregate file change represented by a rewind preview.
+/// Current display mode (SEP-1865)
 ///
 /// <div class="warning">
 ///
@@ -27335,23 +29484,23 @@ pub enum HistoryRewindUnavailableReason {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum HistoryRewindChangeType {
-    /// The discarded turns created the file.
-    #[serde(rename = "created")]
-    Created,
-    /// The discarded turns deleted the file.
-    #[serde(rename = "deleted")]
-    Deleted,
-    /// The discarded turns modified the file.
-    #[serde(rename = "modified")]
-    Modified,
+pub enum McpAppsSetHostContextDetailsDisplayMode {
+    /// Rendered inline within the host conversation surface
+    #[serde(rename = "inline")]
+    Inline,
+    /// Rendered as a fullscreen overlay
+    #[serde(rename = "fullscreen")]
+    Fullscreen,
+    /// Rendered as a picture-in-picture floating panel
+    #[serde(rename = "pip")]
+    Pip,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Scope of a rewind operation.
+/// Platform type for responsive design
 ///
 /// <div class="warning">
 ///
@@ -27360,20 +29509,23 @@ pub enum HistoryRewindChangeType {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum HistoryRewindMode {
-    /// Discard conversation events while leaving files unchanged.
-    #[serde(rename = "conversation")]
-    Conversation,
-    /// Discard conversation events and restore captured files changed by those turns.
-    #[serde(rename = "conversation-and-files")]
-    ConversationAndFiles,
+pub enum McpAppsSetHostContextDetailsPlatform {
+    /// Host runs in a web browser
+    #[serde(rename = "web")]
+    Web,
+    /// Host runs as a desktop application
+    #[serde(rename = "desktop")]
+    Desktop,
+    /// Host runs on a mobile device
+    #[serde(rename = "mobile")]
+    Mobile,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Outcome of a rewind request.
+/// UI theme preference per SEP-1865
 ///
 /// <div class="warning">
 ///
@@ -27382,125 +29534,69 @@ pub enum HistoryRewindMode {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum HistoryRewindOutcome {
-    /// The requested rewind completed; reachable in either mode.
-    #[serde(rename = "success")]
-    Success,
-    /// The session still has work that may mutate files or history; reachable in either mode.
-    #[serde(rename = "session-busy")]
-    SessionBusy,
-    /// A conversation-and-files rewind was requested for a session that did not enable capture; conversation-only rewinds never produce this.
-    #[serde(rename = "file-change-tracking-disabled")]
-    FileChangeTrackingDisabled,
-    /// Remote-backed rewind routing is not supported; reachable in either mode.
-    #[serde(rename = "unsupported-remote-session")]
-    UnsupportedRemoteSession,
-    /// File restore failed and all applied file changes were rolled back; only conversation-and-files rewinds produce this.
-    #[serde(rename = "files-rolled-back")]
-    FilesRolledBack,
-    /// File restore failed and its rollback could not fully restore the pre-rewind state; only conversation-and-files rewinds produce this.
-    #[serde(rename = "rollback-incomplete")]
-    RollbackIncomplete,
-    /// Conversation truncation failed. In conversation-and-files mode any files that were restored are left in place because conversation history cannot be un-truncated; in conversation-only mode no files are restored. Consult restoredFiles for what, if anything, was applied.
-    #[serde(rename = "truncation-failed")]
-    TruncationFailed,
-    /// The conversation was rewound (and, in conversation-and-files mode, captured files were restored), but persisted checkpoints could not be cleaned up; reachable in either mode.
-    #[serde(rename = "checkpoint-cleanup-failed")]
-    CheckpointCleanupFailed,
-    /// Files and conversation were rewound, but obsolete file snapshots could not be removed; only conversation-and-files rewinds produce this.
-    #[serde(rename = "snapshot-prune-failed")]
-    SnapshotPruneFailed,
+pub enum McpAppsSetHostContextDetailsTheme {
+    /// Light UI theme
+    #[serde(rename = "light")]
+    Light,
+    /// Dark UI theme
+    #[serde(rename = "dark")]
+    Dark,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Hook event name dispatched through the SDK callback transport.
+/// Structured MCP elicitation mode.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum HookType {
-    /// Runs before a tool is invoked.
-    #[serde(rename = "preToolUse")]
-    PreToolUse,
-    /// Runs before an MCP tool is invoked.
-    #[serde(rename = "preMcpToolCall")]
-    PreMcpToolCall,
-    /// Runs after a tool completes successfully.
-    #[serde(rename = "postToolUse")]
-    PostToolUse,
-    /// Runs after a tool fails.
-    #[serde(rename = "postToolUseFailure")]
-    PostToolUseFailure,
-    /// Runs after the user submits a prompt.
-    #[serde(rename = "userPromptSubmitted")]
-    UserPromptSubmitted,
-    /// Runs after the runtime transforms the submitted prompt for the model, before it is added to session history.
-    #[serde(rename = "userPromptTransformed")]
-    UserPromptTransformed,
-    /// Runs when a session starts.
-    #[serde(rename = "sessionStart")]
-    SessionStart,
-    /// Runs when a session ends.
-    #[serde(rename = "sessionEnd")]
-    SessionEnd,
-    /// Runs after an agent result is produced.
-    #[serde(rename = "postResult")]
-    PostResult,
-    /// Runs before a pull request description is generated.
-    #[serde(rename = "prePRDescription")]
-    PrePRDescription,
-    /// Runs when the agent encounters an error.
-    #[serde(rename = "errorOccurred")]
-    ErrorOccurred,
-    /// Runs when the agent stops.
-    #[serde(rename = "agentStop")]
-    AgentStop,
-    /// Runs when a subagent starts.
-    #[serde(rename = "subagentStart")]
-    SubagentStart,
-    /// Runs when a subagent stops.
-    #[serde(rename = "subagentStop")]
-    SubagentStop,
-    /// Runs before conversation context is compacted.
-    #[serde(rename = "preCompact")]
-    PreCompact,
-    /// Runs when the agent requests permission.
-    #[serde(rename = "permissionRequest")]
-    PermissionRequest,
-    /// Runs when the agent emits a notification.
-    #[serde(rename = "notification")]
-    Notification,
+pub enum McpElicitationFormMode {
+    #[serde(rename = "form")]
+    Form,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Constant value. Always "github".
+/// Headers-refresh response variant discriminator.
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum InstalledPluginSourceGitHubSource {
-    #[serde(rename = "github")]
+pub enum McpHeadersHandlePendingHeadersRefreshRequestHeadersKind {
+    #[serde(rename = "headers")]
     #[default]
-    GitHub,
+    Headers,
 }
 
-/// Constant value. Always "local".
+/// Headers-refresh response variant discriminator.
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum InstalledPluginSourceLocalSource {
-    #[serde(rename = "local")]
+pub enum McpHeadersHandlePendingHeadersRefreshRequestNoneKind {
+    #[serde(rename = "none")]
     #[default]
-    Local,
+    None,
 }
 
-/// Constant value. Always "url".
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum InstalledPluginSourceUrlSource {
-    #[serde(rename = "url")]
-    #[default]
-    Url,
+/// Host response: supply dynamic headers or decline this refresh.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(untagged)]
+pub enum McpHeadersHandlePendingHeadersRefreshRequest {
+    Headers(McpHeadersHandlePendingHeadersRefreshRequestHeaders),
+    None(McpHeadersHandlePendingHeadersRefreshRequestNone),
 }
 
-/// Whether the target is a single file or a directory of instruction files
+/// Whether a planned configuration change would create or modify an entry
 ///
 /// <div class="warning">
 ///
@@ -27509,20 +29605,20 @@ pub enum InstalledPluginSourceUrlSource {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum InstructionDiscoveryPathKind {
-    /// The target is a single instruction file.
-    #[serde(rename = "file")]
-    File,
-    /// The target is a directory that holds instruction files.
-    #[serde(rename = "directory")]
-    Directory,
+pub enum McpPlanConfigurationOperation {
+    /// Creates a configuration entry that does not exist yet.
+    #[serde(rename = "add")]
+    Add,
+    /// Modifies a configuration entry that already exists.
+    #[serde(rename = "update")]
+    Update,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Which tier this target belongs to
+/// Configuration scope an MCP install plan targets
 ///
 /// <div class="warning">
 ///
@@ -27531,26 +29627,17 @@ pub enum InstructionDiscoveryPathKind {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum InstructionDiscoveryPathLocation {
-    /// Instructions live in user-level configuration.
+pub enum McpPlanScope {
+    /// The user's own MCP configuration.
     #[serde(rename = "user")]
     User,
-    /// Instructions live in repository-level configuration.
-    #[serde(rename = "repository")]
-    Repository,
-    /// Instructions live under the current working directory.
-    #[serde(rename = "working-directory")]
-    WorkingDirectory,
-    /// Instructions live in plugin-provided configuration.
-    #[serde(rename = "plugin")]
-    Plugin,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Where this source lives — used for UI grouping
+/// What policy decided for a planned server
 ///
 /// <div class="warning">
 ///
@@ -27559,26 +29646,23 @@ pub enum InstructionDiscoveryPathLocation {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum InstructionSourceLocation {
-    /// Instructions live in user-level configuration.
-    #[serde(rename = "user")]
-    User,
-    /// Instructions live in repository-level configuration.
-    #[serde(rename = "repository")]
-    Repository,
-    /// Instructions live under the current working directory.
-    #[serde(rename = "working-directory")]
-    WorkingDirectory,
-    /// Instructions live in plugin-provided configuration.
-    #[serde(rename = "plugin")]
-    Plugin,
+pub enum McpPlanPolicyDecision {
+    /// Policy permits the server.
+    #[serde(rename = "allowed")]
+    Allowed,
+    /// Policy forbids the server, so the plan cannot be applied.
+    #[serde(rename = "blocked")]
+    Blocked,
+    /// Policy permits the server only after an explicit approval.
+    #[serde(rename = "requires-approval")]
+    RequiresApproval,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Category of instruction source — used for merge logic
+/// Consumer allowed to call an MCP tool.
 ///
 /// <div class="warning">
 ///
@@ -27587,72 +29671,36 @@ pub enum InstructionSourceLocation {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum InstructionSourceType {
-    /// Instructions loaded from the user's home configuration.
-    #[serde(rename = "home")]
-    Home,
-    /// Instructions loaded from repository-scoped files.
-    #[serde(rename = "repo")]
-    Repo,
-    /// Instructions loaded from model-specific files.
+pub enum McpToolUiVisibility {
+    /// The model may call the tool.
     #[serde(rename = "model")]
     Model,
-    /// Instructions loaded from VS Code instruction files.
-    #[serde(rename = "vscode")]
-    Vscode,
-    /// Instructions discovered from nested agent files.
-    #[serde(rename = "nested-agents")]
-    NestedAgents,
-    /// Instructions inherited from child instruction files.
-    #[serde(rename = "child-instructions")]
-    ChildInstructions,
-    /// Instructions supplied by an installed plugin.
-    #[serde(rename = "plugin")]
-    Plugin,
+    /// An MCP App view may call the tool.
+    #[serde(rename = "app")]
+    App,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Transport the runtime would otherwise use for this request. `http` (the default when absent) covers plain HTTP and SSE responses; `websocket` indicates a full-duplex message channel where each body chunk maps to one WebSocket message and the `binary` flag distinguishes text from binary frames. The SDK consumer uses this to decide whether to service the request with an HTTP client or a WebSocket client. It is the one piece of request metadata the consumer cannot reliably infer from the URL or headers alone.
+/// OAuth response variant discriminator.
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum LlmInferenceHttpRequestStartTransport {
-    /// Plain HTTP or SSE response. Each body chunk is an opaque byte range; the response is a status line, headers, and a (possibly streamed) body.
-    #[serde(rename = "http")]
-    Http,
-    /// Full-duplex WebSocket channel. Each body chunk maps to exactly one WebSocket message and the `binary` flag distinguishes text from binary frames; request and response chunks flow concurrently.
-    #[serde(rename = "websocket")]
-    Websocket,
-    /// Unknown variant for forward compatibility.
+pub enum McpOauthPendingRequestResponseTokenKind {
+    #[serde(rename = "token")]
     #[default]
-    #[serde(other)]
-    Unknown,
+    Token,
 }
 
-/// Repository host type
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
+/// OAuth response variant discriminator.
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum SessionContextHostType {
-    /// Session repository is hosted on GitHub.
-    #[serde(rename = "github")]
-    GitHub,
-    /// Session repository is hosted on Azure DevOps.
-    #[serde(rename = "ado")]
-    Ado,
-    /// Unknown variant for forward compatibility.
+pub enum McpOauthPendingRequestResponseCancelledKind {
+    #[serde(rename = "cancelled")]
     #[default]
-    #[serde(other)]
-    Unknown,
+    Cancelled,
 }
 
-/// Log severity level. Determines how the message is displayed in the timeline. Defaults to "info".
+/// Host response to the pending OAuth request.
 ///
 /// <div class="warning">
 ///
@@ -27660,24 +29708,14 @@ pub enum SessionContextHostType {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum SessionLogLevel {
-    /// Informational message.
-    #[serde(rename = "info")]
-    Info,
-    /// Warning message that may require attention.
-    #[serde(rename = "warning")]
-    Warning,
-    /// Error message describing a failure.
-    #[serde(rename = "error")]
-    Error,
-    /// Unknown variant for forward compatibility.
-    #[default]
-    #[serde(other)]
-    Unknown,
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(untagged)]
+pub enum McpOauthPendingRequestResponse {
+    Token(McpOauthPendingRequestResponseToken),
+    Cancelled(McpOauthPendingRequestResponseCancelled),
 }
 
-/// Allowed values for the `McpAppsHostContextDetailsAvailableDisplayMode` enumeration.
+/// OAuth grant type override for this login.
 ///
 /// <div class="warning">
 ///
@@ -27686,23 +29724,20 @@ pub enum SessionLogLevel {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpAppsHostContextDetailsAvailableDisplayMode {
-    /// Rendered inline within the host conversation surface
-    #[serde(rename = "inline")]
-    Inline,
-    /// Rendered as a fullscreen overlay
-    #[serde(rename = "fullscreen")]
-    Fullscreen,
-    /// Rendered as a picture-in-picture floating panel
-    #[serde(rename = "pip")]
-    Pip,
+pub enum McpOauthLoginGrantType {
+    /// Interactive browser-based OAuth flow using an authorization code, typically with PKCE.
+    #[serde(rename = "authorization_code")]
+    AuthorizationCode,
+    /// Headless OAuth flow where a confidential client authenticates directly with a client secret.
+    #[serde(rename = "client_credentials")]
+    ClientCredentials,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Current display mode (SEP-1865)
+/// Why a passive MCP OAuth probe determined authentication is needed.
 ///
 /// <div class="warning">
 ///
@@ -27711,23 +29746,55 @@ pub enum McpAppsHostContextDetailsAvailableDisplayMode {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpAppsHostContextDetailsDisplayMode {
-    /// Rendered inline within the host conversation surface
-    #[serde(rename = "inline")]
-    Inline,
-    /// Rendered as a fullscreen overlay
-    #[serde(rename = "fullscreen")]
-    Fullscreen,
-    /// Rendered as a picture-in-picture floating panel
-    #[serde(rename = "pip")]
-    Pip,
+pub enum McpOauthProbeNeedsAuthReason {
+    /// No token was sent and the server requires authentication.
+    #[serde(rename = "initial")]
+    Initial,
+    /// A cached token was sent and rejected.
+    #[serde(rename = "refresh")]
+    Refresh,
+    /// The server returned a 403 insufficient_scope challenge, indicating additional scopes or audience are needed.
+    #[serde(rename = "upscope")]
+    Upscope,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Platform type for responsive design
+/// Probe outcome variant discriminator.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum McpOauthProbeResultNoAuthRequiredStatus {
+    #[serde(rename = "no-auth-required")]
+    #[default]
+    NoAuthRequired,
+}
+
+/// Probe outcome variant discriminator.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum McpOauthProbeResultAuthenticatedStatus {
+    #[serde(rename = "authenticated")]
+    #[default]
+    Authenticated,
+}
+
+/// Probe outcome variant discriminator.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum McpOauthProbeResultNeedsAuthStatus {
+    #[serde(rename = "needs-auth")]
+    #[default]
+    NeedsAuth,
+}
+
+/// Probe outcome variant discriminator.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum McpOauthProbeResultFailedStatus {
+    #[serde(rename = "failed")]
+    #[default]
+    Failed,
+}
+
+/// Passive MCP OAuth probe result. `authenticated` means the server accepted the probe request while an OAuth-origin access token was attached; it does not prove the server required or independently validated that token. The probe does not make a second unauthenticated request. Failed is an expected probe-domain outcome; JSON-RPC errors are reserved for API-call failures.
 ///
 /// <div class="warning">
 ///
@@ -27735,24 +29802,16 @@ pub enum McpAppsHostContextDetailsDisplayMode {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpAppsHostContextDetailsPlatform {
-    /// Host runs in a web browser
-    #[serde(rename = "web")]
-    Web,
-    /// Host runs as a desktop application
-    #[serde(rename = "desktop")]
-    Desktop,
-    /// Host runs on a mobile device
-    #[serde(rename = "mobile")]
-    Mobile,
-    /// Unknown variant for forward compatibility.
-    #[default]
-    #[serde(other)]
-    Unknown,
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(untagged)]
+pub enum McpOauthProbeResult {
+    NoAuthRequired(McpOauthProbeResultNoAuthRequired),
+    Authenticated(McpOauthProbeResultAuthenticated),
+    NeedsAuth(McpOauthProbeResultNeedsAuth),
+    Failed(McpOauthProbeResultFailed),
 }
 
-/// UI theme preference per SEP-1865
+/// Discriminator for an enumerated required value
 ///
 /// <div class="warning">
 ///
@@ -27761,45 +29820,25 @@ pub enum McpAppsHostContextDetailsPlatform {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpAppsHostContextDetailsTheme {
-    /// Light UI theme
-    #[serde(rename = "light")]
-    Light,
-    /// Dark UI theme
-    #[serde(rename = "dark")]
-    Dark,
+pub enum McpPlanEnumValueType {
+    /// One of a fixed, non-empty set of permitted values.
+    #[serde(rename = "enum")]
+    Enum,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Allowed values for the `McpAppsSetHostContextDetailsAvailableDisplayMode` enumeration.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpAppsSetHostContextDetailsAvailableDisplayMode {
-    /// Rendered inline within the host conversation surface
-    #[serde(rename = "inline")]
-    Inline,
-    /// Rendered as a fullscreen overlay
-    #[serde(rename = "fullscreen")]
-    Fullscreen,
-    /// Rendered as a picture-in-picture floating panel
-    #[serde(rename = "pip")]
-    Pip,
-    /// Unknown variant for forward compatibility.
+/// Discriminator: a plan was computed and nothing was changed
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum McpPlanInstallPlannedKind {
+    #[serde(rename = "planned")]
     #[default]
-    #[serde(other)]
-    Unknown,
+    Planned,
 }
 
-/// Current display mode (SEP-1865)
+/// Discriminator for a candidate-backed install-plan source
 ///
 /// <div class="warning">
 ///
@@ -27808,23 +29847,17 @@ pub enum McpAppsSetHostContextDetailsAvailableDisplayMode {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpAppsSetHostContextDetailsDisplayMode {
-    /// Rendered inline within the host conversation surface
-    #[serde(rename = "inline")]
-    Inline,
-    /// Rendered as a fullscreen overlay
-    #[serde(rename = "fullscreen")]
-    Fullscreen,
-    /// Rendered as a picture-in-picture floating panel
-    #[serde(rename = "pip")]
-    Pip,
+pub enum McpPlanInstallSourceCandidateKind {
+    /// Plan from a candidate returned by catalog search.
+    #[serde(rename = "candidate")]
+    Candidate,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Platform type for responsive design
+/// Discriminator for a URL-backed MCP server card
 ///
 /// <div class="warning">
 ///
@@ -27833,23 +29866,17 @@ pub enum McpAppsSetHostContextDetailsDisplayMode {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpAppsSetHostContextDetailsPlatform {
-    /// Host runs in a web browser
-    #[serde(rename = "web")]
-    Web,
-    /// Host runs as a desktop application
-    #[serde(rename = "desktop")]
-    Desktop,
-    /// Host runs on a mobile device
-    #[serde(rename = "mobile")]
-    Mobile,
+pub enum McpServerCardUrlKind {
+    /// Retrieve the card from its URL.
+    #[serde(rename = "url")]
+    Url,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// UI theme preference per SEP-1865
+/// Discriminator for an embedded MCP server card
 ///
 /// <div class="warning">
 ///
@@ -27858,20 +29885,32 @@ pub enum McpAppsSetHostContextDetailsPlatform {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpAppsSetHostContextDetailsTheme {
-    /// Light UI theme
-    #[serde(rename = "light")]
-    Light,
-    /// Dark UI theme
-    #[serde(rename = "dark")]
-    Dark,
+pub enum McpServerCardEmbeddedKind {
+    /// Use the embedded card document.
+    #[serde(rename = "embedded")]
+    Embedded,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Structured MCP elicitation mode.
+/// A card supplied directly by the caller. Exactly one of a URL or embedded data, encoded structurally so neither both nor neither can be expressed.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(untagged)]
+pub enum McpServerCardReference {
+    Url(McpServerCardUrl),
+    Embedded(McpServerCardEmbedded),
+}
+
+/// Discriminator for a caller-supplied-card install-plan source
 ///
 /// <div class="warning">
 ///
@@ -27880,32 +29919,32 @@ pub enum McpAppsSetHostContextDetailsTheme {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpElicitationFormMode {
-    #[serde(rename = "form")]
-    Form,
+pub enum McpPlanInstallSourceCardKind {
+    /// Plan directly from a caller-supplied card.
+    #[serde(rename = "card")]
+    Card,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Headers-refresh response variant discriminator.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpHeadersHandlePendingHeadersRefreshRequestHeadersKind {
-    #[serde(rename = "headers")]
-    #[default]
-    Headers,
-}
-
-/// Headers-refresh response variant discriminator.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpHeadersHandlePendingHeadersRefreshRequestNoneKind {
-    #[serde(rename = "none")]
-    #[default]
-    None,
+/// What an install plan is computed from: a candidate handle from a previous search, or a card supplied directly.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(untagged)]
+pub enum McpPlanInstallSource {
+    Candidate(McpPlanInstallSourceCandidate),
+    Card(McpPlanInstallSourceCard),
 }
 
-/// Host response: supply dynamic headers or decline this refresh.
+/// Outcome of an mcp.planInstall call: either a normalised plan, or one typed refusal. Nothing is written in either case.
 ///
 /// <div class="warning">
 ///
@@ -27915,12 +29954,23 @@ pub enum McpHeadersHandlePendingHeadersRefreshRequestNoneKind {
 /// </div>
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(untagged)]
-pub enum McpHeadersHandlePendingHeadersRefreshRequest {
-    Headers(McpHeadersHandlePendingHeadersRefreshRequestHeaders),
-    None(McpHeadersHandlePendingHeadersRefreshRequestNone),
+pub enum McpPlanInstallResult {
+    Planned(McpPlanInstallPlanned),
+    NegotiationRefused(CatalogNegotiationRefusedError),
+    HandleRejected(CatalogHandleRejectedError),
+    InvalidRequest(CatalogInvalidRequestError),
+    AuthenticationRequired(CatalogAuthenticationRequiredError),
+    PolicyRejected(CatalogPolicyRejectedError),
+    NetworkFailure(CatalogNetworkFailureError),
+    UnsafeRetrieval(CatalogUnsafeRetrievalError),
+    MalformedCard(CatalogMalformedCardError),
+    ContractViolation(CatalogContractViolationError),
+    UnavailableTransport(CatalogUnavailableTransportError),
+    NotInstallable(CatalogNotInstallableError),
+    Unavailable(CatalogUnavailableError),
 }
 
-/// Consumer allowed to call an MCP tool.
+/// Discriminator for a package-backed transport choice
 ///
 /// <div class="warning">
 ///
@@ -27929,36 +29979,17 @@ pub enum McpHeadersHandlePendingHeadersRefreshRequest {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpToolUiVisibility {
-    /// The model may call the tool.
-    #[serde(rename = "model")]
-    Model,
-    /// An MCP App view may call the tool.
-    #[serde(rename = "app")]
-    App,
+pub enum McpPlanPackageInstallMethod {
+    /// Install and run a local package.
+    #[serde(rename = "package")]
+    Package,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// OAuth response variant discriminator.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpOauthPendingRequestResponseTokenKind {
-    #[serde(rename = "token")]
-    #[default]
-    Token,
-}
-
-/// OAuth response variant discriminator.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpOauthPendingRequestResponseCancelledKind {
-    #[serde(rename = "cancelled")]
-    #[default]
-    Cancelled,
-}
-
-/// Host response to the pending OAuth request.
+/// Transport exposed by a locally launched package
 ///
 /// <div class="warning">
 ///
@@ -27966,14 +29997,18 @@ pub enum McpOauthPendingRequestResponseCancelledKind {
 /// and may change or be removed in future SDK or CLI releases.
 ///
 /// </div>
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(untagged)]
-pub enum McpOauthPendingRequestResponse {
-    Token(McpOauthPendingRequestResponseToken),
-    Cancelled(McpOauthPendingRequestResponseCancelled),
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum McpPlanPackageTransport {
+    /// A locally launched process spoken to over standard input and output.
+    #[serde(rename = "stdio")]
+    Stdio,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
 }
 
-/// OAuth grant type override for this login.
+/// Discriminator for a remote-endpoint transport choice
 ///
 /// <div class="warning">
 ///
@@ -27982,20 +30017,17 @@ pub enum McpOauthPendingRequestResponse {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpOauthLoginGrantType {
-    /// Interactive browser-based OAuth flow using an authorization code, typically with PKCE.
-    #[serde(rename = "authorization_code")]
-    AuthorizationCode,
-    /// Headless OAuth flow where a confidential client authenticates directly with a client secret.
-    #[serde(rename = "client_credentials")]
-    ClientCredentials,
+pub enum McpPlanRemoteInstallMethod {
+    /// Connect to a remote endpoint.
+    #[serde(rename = "remote")]
+    Remote,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Why a passive MCP OAuth probe determined authentication is needed.
+/// Transport exposed by a remote endpoint
 ///
 /// <div class="warning">
 ///
@@ -28004,55 +30036,120 @@ pub enum McpOauthLoginGrantType {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpOauthProbeNeedsAuthReason {
-    /// No token was sent and the server requires authentication.
-    #[serde(rename = "initial")]
-    Initial,
-    /// A cached token was sent and rejected.
-    #[serde(rename = "refresh")]
-    Refresh,
-    /// The server returned a 403 insufficient_scope challenge, indicating additional scopes or audience are needed.
-    #[serde(rename = "upscope")]
-    Upscope,
+pub enum McpPlanRemoteTransport {
+    /// An HTTP endpoint.
+    #[serde(rename = "http")]
+    Http,
+    /// A streamable HTTP endpoint.
+    #[serde(rename = "streamable-http")]
+    StreamableHttp,
+    /// A server-sent events endpoint.
+    #[serde(rename = "sse")]
+    Sse,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
     Unknown,
 }
 
-/// Probe outcome variant discriminator.
+/// Where a required value is applied when the planned server is launched
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpOauthProbeResultNoAuthRequiredStatus {
-    #[serde(rename = "no-auth-required")]
+pub enum McpPlanValueCategory {
+    /// Set as an environment variable on the launched process.
+    #[serde(rename = "environment-variable")]
+    EnvironmentVariable,
+    /// Passed to the runtime that launches the package.
+    #[serde(rename = "runtime-argument")]
+    RuntimeArgument,
+    /// Passed to the packaged server itself.
+    #[serde(rename = "package-argument")]
+    PackageArgument,
+    /// Sent as a request header to a remote endpoint.
+    #[serde(rename = "header")]
+    Header,
+    /// Substituted into the remote endpoint URL.
+    #[serde(rename = "url-variable")]
+    UrlVariable,
+    /// Unknown variant for forward compatibility.
     #[default]
-    NoAuthRequired,
+    #[serde(other)]
+    Unknown,
 }
 
-/// Probe outcome variant discriminator.
+/// Discriminator for a scalar required value
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpOauthProbeResultAuthenticatedStatus {
-    #[serde(rename = "authenticated")]
+pub enum McpPlanRequiredValueScalarKind {
+    /// The value uses one scalar type.
+    #[serde(rename = "scalar")]
+    Scalar,
+    /// Unknown variant for forward compatibility.
     #[default]
-    Authenticated,
+    #[serde(other)]
+    Unknown,
 }
 
-/// Probe outcome variant discriminator.
+/// Scalar type a required value must conform to
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpOauthProbeResultNeedsAuthStatus {
-    #[serde(rename = "needs-auth")]
+pub enum McpPlanScalarValueType {
+    /// Free text.
+    #[serde(rename = "string")]
+    String,
+    /// A number.
+    #[serde(rename = "number")]
+    Number,
+    /// A boolean.
+    #[serde(rename = "boolean")]
+    Boolean,
+    /// A filesystem path.
+    #[serde(rename = "path")]
+    Path,
+    /// Unknown variant for forward compatibility.
     #[default]
-    NeedsAuth,
+    #[serde(other)]
+    Unknown,
 }
 
-/// Probe outcome variant discriminator.
+/// Discriminator for an enumerated required value
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum McpOauthProbeResultFailedStatus {
-    #[serde(rename = "failed")]
+pub enum McpPlanRequiredValueEnumKind {
+    /// The value uses a fixed non-empty enumeration.
+    #[serde(rename = "enum")]
+    Enum,
+    /// Unknown variant for forward compatibility.
     #[default]
-    Failed,
+    #[serde(other)]
+    Unknown,
 }
 
-/// Passive MCP OAuth probe result. `authenticated` means the server accepted the probe request while an OAuth-origin access token was attached; it does not prove the server required or independently validated that token. The probe does not make a second unauthenticated request. Failed is an expected probe-domain outcome; JSON-RPC errors are reserved for API-call failures.
+/// One non-secret value a transport choice needs, represented as a scalar or enumerated variant so enum values cannot be missing or attached to another type.
 ///
 /// <div class="warning">
 ///
@@ -28062,11 +30159,9 @@ pub enum McpOauthProbeResultFailedStatus {
 /// </div>
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(untagged)]
-pub enum McpOauthProbeResult {
-    NoAuthRequired(McpOauthProbeResultNoAuthRequired),
-    Authenticated(McpOauthProbeResultAuthenticated),
-    NeedsAuth(McpOauthProbeResultNeedsAuth),
-    Failed(McpOauthProbeResultFailed),
+pub enum McpPlanRequiredValue {
+    Scalar(McpPlanRequiredValueScalar),
+    Enum(McpPlanRequiredValueEnum),
 }
 
 /// Outcome of the sampling inference. 'success' produced a response; 'failure' encountered an error (including agent-side rejection by content filter or criteria); 'cancelled' the caller cancelled this execution via cancelSamplingExecution.
@@ -28962,9 +31057,9 @@ pub enum PermissionDecisionOutcome {
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub enum PermissionDecisionSource {
-    /// The response followed the auto-approval judge recommendation.
-    #[serde(rename = "judge_recommendation")]
-    JudgeRecommendation,
+    /// The response followed the assisted-approval judge recommendation.
+    #[serde(rename = "assisted_approval")]
+    AssistedApproval,
     /// A human supplied the response through an interactive prompt.
     #[serde(rename = "human_response")]
     HumanResponse,
@@ -29142,6 +31237,34 @@ pub enum PermissionLocationType {
     Unknown,
 }
 
+/// Optional source for permission-mode telemetry. Defaults to `rpc` when omitted for SDK callers.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum PermissionModeSource {
+    /// The mode was set from a CLI command-line flag.
+    #[serde(rename = "cli_flag")]
+    CliFlag,
+    /// The mode was set by a slash command.
+    #[serde(rename = "slash_command")]
+    SlashCommand,
+    /// The mode was set by confirming autopilot behavior.
+    #[serde(rename = "autopilot_confirmation")]
+    AutopilotConfirmation,
+    /// The mode was set through an RPC caller.
+    #[serde(rename = "rpc")]
+    Rpc,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
 /// Allowed values for the `PermissionsConfigureAdditionalContentExclusionPolicyScope` enumeration.
 ///
 /// <div class="warning">
@@ -29186,34 +31309,6 @@ pub enum PermissionsModifyRulesScope {
     Unknown,
 }
 
-/// Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers.
-///
-/// <div class="warning">
-///
-/// **Experimental.** This type is part of an experimental wire-protocol surface
-/// and may change or be removed in future SDK or CLI releases.
-///
-/// </div>
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum PermissionsSetAllowAllSource {
-    /// Allow-all was enabled from a CLI command-line flag.
-    #[serde(rename = "cli_flag")]
-    CliFlag,
-    /// Allow-all was enabled by a slash command.
-    #[serde(rename = "slash_command")]
-    SlashCommand,
-    /// Allow-all was enabled by confirming autopilot behavior.
-    #[serde(rename = "autopilot_confirmation")]
-    AutopilotConfirmation,
-    /// Allow-all was enabled through an RPC caller.
-    #[serde(rename = "rpc")]
-    Rpc,
-    /// Unknown variant for forward compatibility.
-    #[default]
-    #[serde(other)]
-    Unknown,
-}
-
 /// Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers.
 ///
 /// <div class="warning">
diff --git a/rust/src/generated/rpc.rs b/rust/src/generated/rpc.rs
index 06e9a8fb7c..1e3d559baa 100644
--- a/rust/src/generated/rpc.rs
+++ b/rust/src/generated/rpc.rs
@@ -43,6 +43,13 @@ impl<'a> ClientRpc<'a> {
         }
     }
 
+    /// `catalog.*` sub-namespace.
+    pub fn catalog(&self) -> ClientRpcCatalog<'a> {
+        ClientRpcCatalog {
+            client: self.client,
+        }
+    }
+
     /// `commands.*` sub-namespace.
     pub fn commands(&self) -> ClientRpcCommands<'a> {
         ClientRpcCommands {
@@ -501,6 +508,42 @@ impl<'a> ClientRpcAgents<'a> {
     }
 }
 
+/// `catalog.*` RPCs.
+#[derive(Clone, Copy)]
+pub struct ClientRpcCatalog<'a> {
+    pub(crate) client: &'a Client,
+}
+
+impl<'a> ClientRpcCatalog<'a> {
+    /// Requests a bounded catalog search. This host-implemented server method is available through SDK/TUI hosts; standalone and C-ABI runtimes whose host does not implement server-method dispatch return JSON-RPC MethodNotFound. A runtime with search available returns inert candidate summaries, each with an opaque single-use handle scoped to this runtime instance; a runtime without it returns the typed search-unavailable result. Public authorities may be searched anonymously, while an authority that requires credentials yields the typed authentication-required result. All returned text, URLs, and package metadata are untrusted external data and can never trigger instructions, tools, or installation. Read-only: nothing is installed, configured, or persisted.
+    ///
+    /// Wire method: `catalog.search`.
+    ///
+    /// # Parameters
+    ///
+    /// * `params` - A bounded catalog search. Both the query length and the result count are capped by the schema so a caller cannot request an unbounded scan.
+    ///
+    /// # Returns
+    ///
+    /// Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal. Never a partial success.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This API is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases. Pin both the
+    /// SDK and CLI versions if your code depends on it.
+    ///
+    /// </div>
+    pub async fn search(&self, params: CatalogSearchRequest) -> Result<CatalogSearchResult, Error> {
+        let wire_params = serde_json::to_value(params)?;
+        let _value = self
+            .client
+            .call(rpc_methods::CATALOG_SEARCH, Some(wire_params))
+            .await?;
+        Ok(serde_json::from_value(_value)?)
+    }
+}
+
 /// `commands.*` RPCs.
 #[derive(Clone, Copy)]
 pub struct ClientRpcCommands<'a> {
@@ -859,6 +902,37 @@ impl<'a> ClientRpcMcp<'a> {
             .await?;
         Ok(serde_json::from_value(_value)?)
     }
+
+    /// Requests a side-effect-free MCP install plan from a catalog candidate handle or a caller-supplied card. This host-implemented server method is available through SDK/TUI hosts; standalone and C-ABI runtimes whose host does not implement server-method dispatch return JSON-RPC MethodNotFound. A runtime with planning available returns a normalised plan and opaque single-use plan handle; a runtime without it returns the typed planning-unavailable result. A completed plan reports resource identity, provenance, eligible transport choices, the user-scope target, required typed values and secret placeholders, the policy result, the configuration changes installing would make, and whether a reload would be needed. Planning never writes configuration, stores a secret, or reloads MCP servers, so abandoning a plan needs no call and leaves nothing behind.
+    ///
+    /// Wire method: `mcp.planInstall`.
+    ///
+    /// # Parameters
+    ///
+    /// * `params` - A side-effect-free request for an MCP install plan. Computing a plan never writes configuration, stores a secret, or reloads MCP servers.
+    ///
+    /// # Returns
+    ///
+    /// Outcome of an mcp.planInstall call: either a normalised plan, or one typed refusal. Nothing is written in either case.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This API is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases. Pin both the
+    /// SDK and CLI versions if your code depends on it.
+    ///
+    /// </div>
+    pub async fn plan_install(
+        &self,
+        params: McpPlanInstallRequest,
+    ) -> Result<McpPlanInstallResult, Error> {
+        let wire_params = serde_json::to_value(params)?;
+        let _value = self
+            .client
+            .call(rpc_methods::MCP_PLANINSTALL, Some(wire_params))
+            .await?;
+        Ok(serde_json::from_value(_value)?)
+    }
 }
 
 /// `mcp.config.*` RPCs.
@@ -5921,6 +5995,36 @@ impl<'a> SessionRpcMcp<'a> {
         Ok(())
     }
 
+    /// Releases any turns waiting on an in-flight MCP load without cancelling the load, letting the agent proceed while MCP servers finish connecting in the background. No-op when no MCP load is in flight or waiting turns were already released.
+    ///
+    /// Wire method: `session.mcp.moveLoadingToBackground`.
+    ///
+    /// # Returns
+    ///
+    /// Result of moving in-flight MCP loading to the background.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This API is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases. Pin both the
+    /// SDK and CLI versions if your code depends on it.
+    ///
+    /// </div>
+    pub async fn move_loading_to_background(
+        &self,
+    ) -> Result<MoveMcpLoadingToBackgroundResult, Error> {
+        let wire_params = serde_json::json!({ "sessionId": self.session.id() });
+        let _value = self
+            .session
+            .client()
+            .call(
+                rpc_methods::SESSION_MCP_MOVELOADINGTOBACKGROUND,
+                Some(wire_params),
+            )
+            .await?;
+        Ok(serde_json::from_value(_value)?)
+    }
+
     /// Reloads MCP server connections for the session with an explicit host-provided configuration.
     ///
     /// Wire method: `session.mcp.reloadWithConfig`.
@@ -7667,17 +7771,17 @@ impl<'a> SessionRpcPermissions<'a> {
         Ok(serde_json::from_value(_value)?)
     }
 
-    /// Sets the allow-all permission mode for the session. Used by attach-mode clients (e.g. LocalRpcSession's `/allow-all` forwarder) to flip the target session's permission state. The `on` mode swaps in unrestricted path and URL managers and emits `session.permissions_changed` on transition; the `auto` mode keeps normal prompt paths active while attaching LLM safety recommendations. The result returns the authoritative post-mutation state so callers can update their local mirrors without racing the `session.permissions_changed` notification on the same wire.
+    /// Sets the permission mode for the session. `manual` follows the normal approval flow, `assisted` attaches LLM safety recommendations, and `allow-all` automatically approves permission requests. The result returns the authoritative post-mutation mode so callers can update local state without racing the `session.permissions_changed` notification.
     ///
-    /// Wire method: `session.permissions.setAllowAll`.
+    /// Wire method: `session.permissions.setMode`.
     ///
     /// # Parameters
     ///
-    /// * `params` - Allow-all mode to apply for the session.
+    /// * `params` - Permission mode to apply for the session.
     ///
     /// # Returns
     ///
-    /// Indicates whether the operation succeeded and reports the post-mutation state.
+    /// Indicates whether the requested permission mode was applied and reports the authoritative post-mutation mode.
     ///
     /// <div class="warning">
     ///
@@ -7686,30 +7790,27 @@ impl<'a> SessionRpcPermissions<'a> {
     /// SDK and CLI versions if your code depends on it.
     ///
     /// </div>
-    pub async fn set_allow_all(
+    pub async fn set_mode(
         &self,
-        params: PermissionsSetAllowAllRequest,
-    ) -> Result<AllowAllPermissionSetResult, Error> {
+        params: PermissionsSetModeRequest,
+    ) -> Result<PermissionsSetModeResult, Error> {
         let mut wire_params = serde_json::to_value(params)?;
         wire_params["sessionId"] = serde_json::Value::String(self.session.id().to_string());
         let _value = self
             .session
             .client()
-            .call(
-                rpc_methods::SESSION_PERMISSIONS_SETALLOWALL,
-                Some(wire_params),
-            )
+            .call(rpc_methods::SESSION_PERMISSIONS_SETMODE, Some(wire_params))
             .await?;
         Ok(serde_json::from_value(_value)?)
     }
 
-    /// Returns the current allow-all permission mode for the session.
+    /// Returns the current permission mode for the session.
     ///
-    /// Wire method: `session.permissions.getAllowAll`.
+    /// Wire method: `session.permissions.getMode`.
     ///
     /// # Returns
     ///
-    /// Current allow-all permission mode.
+    /// Current permission mode.
     ///
     /// <div class="warning">
     ///
@@ -7718,15 +7819,12 @@ impl<'a> SessionRpcPermissions<'a> {
     /// SDK and CLI versions if your code depends on it.
     ///
     /// </div>
-    pub async fn get_allow_all(&self) -> Result<AllowAllPermissionState, Error> {
+    pub async fn get_mode(&self) -> Result<PermissionsGetModeResult, Error> {
         let wire_params = serde_json::json!({ "sessionId": self.session.id() });
         let _value = self
             .session
             .client()
-            .call(
-                rpc_methods::SESSION_PERMISSIONS_GETALLOWALL,
-                Some(wire_params),
-            )
+            .call(rpc_methods::SESSION_PERMISSIONS_GETMODE, Some(wire_params))
             .await?;
         Ok(serde_json::from_value(_value)?)
     }
diff --git a/rust/src/generated/session_events.rs b/rust/src/generated/session_events.rs
index f7c7261eb5..1a7ca36cbd 100644
--- a/rust/src/generated/session_events.rs
+++ b/rust/src/generated/session_events.rs
@@ -41,6 +41,13 @@ pub enum SessionEventType {
     SessionModeChanged,
     #[serde(rename = "session.session_limits_changed")]
     SessionSessionLimitsChanged,
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
     #[serde(rename = "session.permissions_changed")]
     SessionPermissionsChanged,
     #[serde(rename = "session.plan_changed")]
@@ -393,6 +400,13 @@ pub enum SessionEventData {
     SessionModeChanged(SessionModeChangedData),
     #[serde(rename = "session.session_limits_changed")]
     SessionSessionLimitsChanged(SessionSessionLimitsChangedData),
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
     #[serde(rename = "session.permissions_changed")]
     SessionPermissionsChanged(SessionPermissionsChangedData),
     #[serde(rename = "session.plan_changed")]
@@ -1086,11 +1100,18 @@ pub struct SessionSessionLimitsChangedData {
     pub session_limits: Option<SessionLimitsConfig>,
 }
 
-/// Session event "session.permissions_changed". Permissions change details carrying the aggregate allow-all transition.
+/// Session event "session.permissions_changed". Permission-mode transition details.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SessionPermissionsChangedData {
-    /// Allow-all mode after the change
+    /// Explicit LLM judge model override used by assisted mode; omitted when the provider default applies
     ///
     /// <div class="warning">
     ///
@@ -1099,10 +1120,8 @@ pub struct SessionPermissionsChangedData {
     ///
     /// </div>
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub allow_all_permission_mode: Option<PermissionAllowAllMode>,
-    /// Aggregate allow-all flag after the change
-    pub allow_all_permissions: bool,
-    /// Allow-all mode before the change
+    pub assisted_approval_model: Option<String>,
+    /// Permission mode after the change
     ///
     /// <div class="warning">
     ///
@@ -1110,10 +1129,16 @@ pub struct SessionPermissionsChangedData {
     /// and may change or be removed in future SDK or CLI releases.
     ///
     /// </div>
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub previous_allow_all_permission_mode: Option<PermissionAllowAllMode>,
-    /// Aggregate allow-all flag before the change
-    pub previous_allow_all_permissions: bool,
+    pub mode: PermissionMode,
+    /// Permission mode before the change
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
+    pub previous_mode: PermissionMode,
 }
 
 /// Session event "session.plan_changed". Plan file operation details indicating what changed
@@ -3587,7 +3612,7 @@ pub struct PermissionRequestUrl {
     pub url: String,
 }
 
-/// Auto-approval judge information attached to a permission request. Present (non-null) only when the session's allow-all mode is "auto"; its absence means auto mode was off and the judge did not evaluate the request. The `recommendation` conveys the judge's disposition for this request.
+/// Assisted-approval judge information attached to a permission request. Present only in assisted mode; its absence means the judge did not evaluate the request. The `recommendation` conveys the judge's disposition for this request.
 ///
 /// <div class="warning">
 ///
@@ -3597,18 +3622,18 @@ pub struct PermissionRequestUrl {
 /// </div>
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
-pub struct PermissionAutoApproval {
+pub struct PermissionAssistedApproval {
     /// Classified cause of an `error` recommendation. Absent for every other recommendation.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub failure_reason: Option<AutoApprovalJudgeFailureReason>,
+    pub failure_reason: Option<AssistedApprovalJudgeFailureReason>,
     /// Model id that produced the recommendation, when the judge was consulted and reported one. Absent for `excluded` (the judge was not consulted) and for failures that occurred before a model was selected.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub model: Option<String>,
     /// Human-readable reason for the judge's recommendation, when available.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub reason: Option<String>,
-    /// The auto-approval safety judge's outcome for this request.
-    pub recommendation: AutoApprovalRecommendation,
+    /// The assisted-approval safety judge's outcome for this request.
+    pub recommendation: AssistedApprovalRecommendation,
 }
 
 /// Memory operation permission request
@@ -3618,9 +3643,16 @@ pub struct PermissionRequestMemory {
     /// Whether this is a store or vote memory operation
     #[serde(skip_serializing_if = "Option::is_none")]
     pub action: Option<PermissionRequestMemoryAction>,
-    /// Auto-approval judge information for this request; present only when auto mode is enabled.
+    /// Assisted-approval judge information for this request; present only in assisted mode.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This type is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases.
+    ///
+    /// </div>
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub auto_approval: Option<PermissionAutoApproval>,
+    pub assisted_approval: Option<PermissionAssistedApproval>,
     /// Source references for the stored fact (store only)
     #[serde(skip_serializing_if = "Option::is_none")]
     pub citations: Option<String>,
@@ -3817,7 +3849,7 @@ pub struct PermissionRequestExtensionEnvAccess {
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct PermissionPromptRequestCommands {
-    /// Auto-approval judge information for this request; present only when auto mode is enabled.
+    /// Assisted-approval judge information for this request; present only in assisted mode.
     ///
     /// <div class="warning">
     ///
@@ -3826,7 +3858,7 @@ pub struct PermissionPromptRequestCommands {
     ///
     /// </div>
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub auto_approval: Option<PermissionAutoApproval>,
+    pub assisted_approval: Option<PermissionAssistedApproval>,
     /// Whether the UI can offer session-wide approval for this command pattern
     pub can_offer_session_approval: bool,
     /// Command identifiers covered by this approval prompt
@@ -3852,7 +3884,7 @@ pub struct PermissionPromptRequestCommands {
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct PermissionPromptRequestWrite {
-    /// Auto-approval judge information for this request; present only when auto mode is enabled.
+    /// Assisted-approval judge information for this request; present only in assisted mode.
     ///
     /// <div class="warning">
     ///
@@ -3861,7 +3893,7 @@ pub struct PermissionPromptRequestWrite {
     ///
     /// </div>
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub auto_approval: Option<PermissionAutoApproval>,
+    pub assisted_approval: Option<PermissionAssistedApproval>,
     /// Whether the UI can offer session-wide approval for file write operations
     pub can_offer_session_approval: bool,
     /// Unified diff showing the proposed changes
@@ -3887,7 +3919,7 @@ pub struct PermissionPromptRequestWrite {
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct PermissionPromptRequestRead {
-    /// Auto-approval judge information for this request; present only when auto mode is enabled.
+    /// Assisted-approval judge information for this request; present only in assisted mode.
     ///
     /// <div class="warning">
     ///
@@ -3896,7 +3928,7 @@ pub struct PermissionPromptRequestRead {
     ///
     /// </div>
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub auto_approval: Option<PermissionAutoApproval>,
+    pub assisted_approval: Option<PermissionAssistedApproval>,
     /// Human-readable description of why the file is being read
     pub intention: String,
     /// Prompt kind discriminator
@@ -3918,7 +3950,7 @@ pub struct PermissionPromptRequestMcp {
     /// Arguments to pass to the MCP tool
     #[serde(skip_serializing_if = "Option::is_none")]
     pub args: Option<serde_json::Value>,
-    /// Auto-approval judge information for this request; present only when auto mode is enabled.
+    /// Assisted-approval judge information for this request; present only in assisted mode.
     ///
     /// <div class="warning">
     ///
@@ -3927,7 +3959,7 @@ pub struct PermissionPromptRequestMcp {
     ///
     /// </div>
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub auto_approval: Option<PermissionAutoApproval>,
+    pub assisted_approval: Option<PermissionAssistedApproval>,
     /// Prompt kind discriminator
     pub kind: PermissionPromptRequestMcpKind,
     /// Advisory runtime permission recommendation. The host remains responsible for deciding the request and may reject it.
@@ -3955,7 +3987,7 @@ pub struct PermissionPromptRequestMcp {
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct PermissionPromptRequestUrl {
-    /// Auto-approval judge information for this request; present only when auto mode is enabled.
+    /// Assisted-approval judge information for this request; present only in assisted mode.
     ///
     /// <div class="warning">
     ///
@@ -3964,7 +3996,7 @@ pub struct PermissionPromptRequestUrl {
     ///
     /// </div>
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub auto_approval: Option<PermissionAutoApproval>,
+    pub assisted_approval: Option<PermissionAssistedApproval>,
     /// Human-readable description of why the URL is being accessed
     pub intention: String,
     /// Prompt kind discriminator
@@ -3995,7 +4027,7 @@ pub struct PermissionPromptRequestMemory {
     /// Whether this is a store or vote memory operation
     #[serde(skip_serializing_if = "Option::is_none")]
     pub action: Option<PermissionRequestMemoryAction>,
-    /// Auto-approval judge information for this request; present only when auto mode is enabled.
+    /// Assisted-approval judge information for this request; present only in assisted mode.
     ///
     /// <div class="warning">
     ///
@@ -4004,7 +4036,7 @@ pub struct PermissionPromptRequestMemory {
     ///
     /// </div>
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub auto_approval: Option<PermissionAutoApproval>,
+    pub assisted_approval: Option<PermissionAssistedApproval>,
     /// Source references for the stored fact (store only)
     #[serde(skip_serializing_if = "Option::is_none")]
     pub citations: Option<String>,
@@ -4033,7 +4065,7 @@ pub struct PermissionPromptRequestCustomTool {
     /// Arguments to pass to the custom tool
     #[serde(skip_serializing_if = "Option::is_none")]
     pub args: Option<serde_json::Value>,
-    /// Auto-approval judge information for this request; present only when auto mode is enabled.
+    /// Assisted-approval judge information for this request; present only in assisted mode.
     ///
     /// <div class="warning">
     ///
@@ -4042,7 +4074,7 @@ pub struct PermissionPromptRequestCustomTool {
     ///
     /// </div>
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub auto_approval: Option<PermissionAutoApproval>,
+    pub assisted_approval: Option<PermissionAssistedApproval>,
     /// Prompt kind discriminator
     pub kind: PermissionPromptRequestCustomToolKind,
     /// Tool call ID that triggered this permission request
@@ -4060,7 +4092,7 @@ pub struct PermissionPromptRequestCustomTool {
 pub struct PermissionPromptRequestPath {
     /// Underlying permission kind that needs path approval
     pub access_kind: PermissionPromptRequestPathAccessKind,
-    /// Auto-approval judge information for this request; present only when auto mode is enabled.
+    /// Assisted-approval judge information for this request; present only in assisted mode.
     ///
     /// <div class="warning">
     ///
@@ -4069,7 +4101,7 @@ pub struct PermissionPromptRequestPath {
     ///
     /// </div>
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub auto_approval: Option<PermissionAutoApproval>,
+    pub assisted_approval: Option<PermissionAssistedApproval>,
     /// Prompt kind discriminator
     pub kind: PermissionPromptRequestPathKind,
     /// File paths that require explicit approval
@@ -4083,7 +4115,7 @@ pub struct PermissionPromptRequestPath {
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct PermissionPromptRequestHook {
-    /// Auto-approval judge information for this request; present only when auto mode is enabled.
+    /// Assisted-approval judge information for this request; present only in assisted mode.
     ///
     /// <div class="warning">
     ///
@@ -4092,7 +4124,7 @@ pub struct PermissionPromptRequestHook {
     ///
     /// </div>
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub auto_approval: Option<PermissionAutoApproval>,
+    pub assisted_approval: Option<PermissionAssistedApproval>,
     /// Optional message from the hook explaining why confirmation is needed
     #[serde(skip_serializing_if = "Option::is_none")]
     pub hook_message: Option<String>,
@@ -4112,7 +4144,7 @@ pub struct PermissionPromptRequestHook {
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct PermissionPromptRequestExtensionManagement {
-    /// Auto-approval judge information for this request; present only when auto mode is enabled.
+    /// Assisted-approval judge information for this request; present only in assisted mode.
     ///
     /// <div class="warning">
     ///
@@ -4121,7 +4153,7 @@ pub struct PermissionPromptRequestExtensionManagement {
     ///
     /// </div>
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub auto_approval: Option<PermissionAutoApproval>,
+    pub assisted_approval: Option<PermissionAssistedApproval>,
     /// Name of the extension being managed
     #[serde(skip_serializing_if = "Option::is_none")]
     pub extension_name: Option<String>,
@@ -4140,7 +4172,7 @@ pub struct PermissionPromptRequestExtensionManagement {
 pub struct PermissionPromptRequestFactory {
     /// Canonical key used for scoped factory approvals
     pub approval_key: String,
-    /// Auto-approval judge information for this request; present only when auto mode is enabled.
+    /// Assisted-approval judge information for this request; present only in assisted mode.
     ///
     /// <div class="warning">
     ///
@@ -4149,7 +4181,7 @@ pub struct PermissionPromptRequestFactory {
     ///
     /// </div>
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub auto_approval: Option<PermissionAutoApproval>,
+    pub assisted_approval: Option<PermissionAssistedApproval>,
     /// Whether this factory is eligible for persistent approval
     pub can_persist_approval: bool,
     /// Factory-declared AI-credit limit before any run/resume caller override is applied.
@@ -4198,7 +4230,7 @@ pub struct PermissionPromptRequestFactory {
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct PermissionPromptRequestExtensionPermissionAccess {
-    /// Auto-approval judge information for this request; present only when auto mode is enabled.
+    /// Assisted-approval judge information for this request; present only in assisted mode.
     ///
     /// <div class="warning">
     ///
@@ -4207,7 +4239,7 @@ pub struct PermissionPromptRequestExtensionPermissionAccess {
     ///
     /// </div>
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub auto_approval: Option<PermissionAutoApproval>,
+    pub assisted_approval: Option<PermissionAssistedApproval>,
     /// Capabilities the extension is requesting
     pub capabilities: Vec<String>,
     /// Name of the extension requesting permission access
@@ -4223,7 +4255,7 @@ pub struct PermissionPromptRequestExtensionPermissionAccess {
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct PermissionPromptRequestExtensionEnvAccess {
-    /// Auto-approval judge information for this request; present only when auto mode is enabled.
+    /// Assisted-approval judge information for this request; present only in assisted mode.
     ///
     /// <div class="warning">
     ///
@@ -4232,7 +4264,7 @@ pub struct PermissionPromptRequestExtensionEnvAccess {
     ///
     /// </div>
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub auto_approval: Option<PermissionAutoApproval>,
+    pub assisted_approval: Option<PermissionAssistedApproval>,
     /// Names of the sensitive environment variables the extension is requesting. Values never appear here.
     pub environment_variables: Vec<String>,
     /// Name of the extension requesting environment variable access
@@ -5750,7 +5782,7 @@ pub enum SessionMode {
     Unknown,
 }
 
-/// Allow-all mode for the session.
+/// Permission mode for the session.
 ///
 /// <div class="warning">
 ///
@@ -5759,16 +5791,16 @@ pub enum SessionMode {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum PermissionAllowAllMode {
+pub enum PermissionMode {
     /// Permission requests follow the normal approval flow.
-    #[serde(rename = "off")]
-    Off,
+    #[serde(rename = "manual")]
+    Manual,
+    /// Permission requests include an LLM safety recommendation; clients may automatically approve requests judged acceptable.
+    #[serde(rename = "assisted")]
+    Assisted,
     /// Tool, path, and URL permission requests are automatically approved.
-    #[serde(rename = "on")]
-    On,
-    /// Permission requests follow the normal approval flow with an LLM advisory recommendation attached; clients may choose to auto-approve requests the judge evaluated as acceptable.
-    #[serde(rename = "auto")]
-    Auto,
+    #[serde(rename = "allow-all")]
+    AllowAll,
     /// Unknown variant for forward compatibility.
     #[default]
     #[serde(other)]
@@ -6435,7 +6467,7 @@ pub enum PermissionRequestMemoryAction {
     Unknown,
 }
 
-/// Why the auto-approval judge produced no usable recommendation. Present only alongside an `error` recommendation, where the human-readable reason is a fixed string and therefore cannot distinguish these cases. Intended to make a judge failure reportable by a consumer that has no access to the host's logs.
+/// Why the assisted-approval judge produced no usable recommendation. Present only alongside an `error` recommendation, where the human-readable reason is a fixed string and therefore cannot distinguish these cases. Intended to make a judge failure reportable by a consumer that has no access to the host's logs.
 ///
 /// <div class="warning">
 ///
@@ -6444,7 +6476,7 @@ pub enum PermissionRequestMemoryAction {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AutoApprovalJudgeFailureReason {
+pub enum AssistedApprovalJudgeFailureReason {
     /// The judge model call exceeded its deadline.
     #[serde(rename = "timeout")]
     Timeout,
@@ -6466,7 +6498,7 @@ pub enum AutoApprovalJudgeFailureReason {
     Unknown,
 }
 
-/// Outcome of the auto-approval safety judge for a permission request. Present only when auto mode is enabled; its absence means the judge did not evaluate the request (auto mode was off).
+/// Outcome of the assisted-approval safety judge for a permission request. Present only in assisted mode; its absence means the judge did not evaluate the request.
 ///
 /// <div class="warning">
 ///
@@ -6475,14 +6507,14 @@ pub enum AutoApprovalJudgeFailureReason {
 ///
 /// </div>
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub enum AutoApprovalRecommendation {
+pub enum AssistedApprovalRecommendation {
     /// The judge evaluated the request and recommends automatically approving it.
     #[serde(rename = "approve")]
     Approve,
-    /// The judge evaluated the request and does not recommend auto-approving it; explicit approval is required. Whether that means prompting, denying, or something else is the consumer's decision.
+    /// The judge evaluated the request and does not recommend automatically approving it; explicit approval is required. Whether that means prompting, denying, or something else is the consumer's decision.
     #[serde(rename = "requireApproval")]
     RequireApproval,
-    /// Auto mode is enabled, but this request category is never auto-approvable (for example, sandbox-bypass requests), so the judge was not consulted.
+    /// Assisted mode is enabled, but this request category is never automatically approvable (for example, sandbox-bypass requests), so the judge was not consulted.
     #[serde(rename = "excluded")]
     Excluded,
     /// The judge was consulted but did not return a usable recommendation, so the request requires explicit approval.
@@ -7187,15 +7219,15 @@ pub enum ManagedSettingsEnforcedAction {
 /// For a `bypass_permissions_blocked` action, which permission-escalation primitive was refused
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub enum ManagedSettingsEnforcedEscalation {
-    /// Full allow-all ("/allow-all on") permissions — auto-approving tools, paths, and URLs.
+    /// Full allow-all permissions — automatically approving tools, paths, and URLs.
     #[serde(rename = "allow_all")]
     AllowAll,
-    /// Auto-approval of all tool permission requests.
+    /// Automatic approval of all tool permission requests.
     #[serde(rename = "approve_all")]
     ApproveAll,
-    /// Advisory auto-approval ("/allow-all auto") mode — keeps normal prompt paths and adds LLM-advised approval, distinct from full allow-all.
-    #[serde(rename = "auto_approval")]
-    AutoApproval,
+    /// Assisted mode — keeps normal prompt paths and adds an LLM recommendation, distinct from allow-all.
+    #[serde(rename = "assisted_approval")]
+    AssistedApproval,
     /// Unrestricted filesystem access outside the session's allowed directories.
     #[serde(rename = "unrestricted_paths")]
     UnrestrictedPaths,
diff --git a/rust/src/session.rs b/rust/src/session.rs
index dff7b4c457..2505a2377d 100644
--- a/rust/src/session.rs
+++ b/rust/src/session.rs
@@ -2612,7 +2612,7 @@ mod tests {
     fn attribution_context() -> PermissionDecisionContext {
         PermissionDecisionContext {
             outcome: PermissionDecisionOutcome::AutoApproved,
-            source: PermissionDecisionSource::JudgeRecommendation,
+            source: PermissionDecisionSource::AssistedApproval,
             surface: PermissionDecisionSurface::CopilotApp,
         }
     }
@@ -2667,7 +2667,7 @@ mod tests {
                 "result": { "kind": "approve-once" },
                 "decisionContext": {
                     "outcome": "auto_approved",
-                    "source": "judge_recommendation",
+                    "source": "assisted_approval",
                     "surface": "copilot_app",
                 },
             })
diff --git a/rust/tests/e2e/rpc_mcp_and_skills.rs b/rust/tests/e2e/rpc_mcp_and_skills.rs
index d5a295e073..8cf3efd998 100644
--- a/rust/tests/e2e/rpc_mcp_and_skills.rs
+++ b/rust/tests/e2e/rpc_mcp_and_skills.rs
@@ -9,9 +9,9 @@ use github_copilot_sdk::rpc::{
     McpAppsSetHostContextRequest, McpCancelSamplingExecutionParams, McpDisableRequest,
     McpEnableRequest, McpExecuteSamplingParams, McpExecuteSamplingRequest, McpOauthLoginRequest,
     McpResourcesReadRequest, McpSamplingExecutionAction, McpSetEnvValueModeDetails,
-    McpSetEnvValueModeParams, PermissionsAllowAllMode, PermissionsSetAllowAllRequest,
-    SkillsDisableRequest, SkillsEnableRequest,
+    McpSetEnvValueModeParams, PermissionsSetModeRequest, SkillsDisableRequest, SkillsEnableRequest,
 };
+use github_copilot_sdk::session_events::PermissionMode;
 use github_copilot_sdk::{IndexMap, McpServerConfig, McpStdioServerConfig};
 
 #[tokio::test]
@@ -361,10 +361,9 @@ async fn should_list_extensions() {
                 session
                     .rpc()
                     .permissions()
-                    .set_allow_all(PermissionsSetAllowAllRequest {
-                        enabled: None,
-                        mode: Some(PermissionsAllowAllMode::On),
-                        model: None,
+                    .set_mode(PermissionsSetModeRequest {
+                        assisted_approval_model: None,
+                        mode: PermissionMode::AllowAll,
                         source: None,
                     })
                     .await
@@ -715,10 +714,9 @@ async fn should_report_error_when_extensions_are_not_available() {
                 session
                     .rpc()
                     .permissions()
-                    .set_allow_all(PermissionsSetAllowAllRequest {
-                        enabled: None,
-                        mode: Some(PermissionsAllowAllMode::On),
-                        model: None,
+                    .set_mode(PermissionsSetModeRequest {
+                        assisted_approval_model: None,
+                        mode: PermissionMode::AllowAll,
                         source: None,
                     })
                     .await
diff --git a/rust/tests/e2e/rpc_session_state_extras.rs b/rust/tests/e2e/rpc_session_state_extras.rs
index 16d276e03f..81901d06ae 100644
--- a/rust/tests/e2e/rpc_session_state_extras.rs
+++ b/rust/tests/e2e/rpc_session_state_extras.rs
@@ -3,11 +3,12 @@ use std::collections::HashMap;
 use github_copilot_sdk::Client;
 use github_copilot_sdk::rpc::{
     CompletionsRequestRequest, MetadataContextHeaviestMessagesRequest, ModelSwitchToRequest,
-    NamedProviderConfig, PermissionsSetAllowAllRequest, ProviderAddRequest, ProviderConfigType,
+    NamedProviderConfig, PermissionsSetModeRequest, ProviderAddRequest, ProviderConfigType,
     ProviderConfigWireApi, ProviderModelConfig, SessionVisibilityStatus, SubagentSettingsEntry,
     SubagentSettingsEntryContextTier, UpdateSubagentSettingsRequest,
     UpdateSubagentSettingsRequestSubagents, VisibilitySetRequest,
 };
+use github_copilot_sdk::session_events::PermissionMode;
 
 use super::support::{assistant_message_content, with_e2e_context};
 
@@ -103,55 +104,55 @@ async fn should_get_and_set_allowall_permissions() {
                 let initial = session
                     .rpc()
                     .permissions()
-                    .get_allow_all()
+                    .get_mode()
                     .await
-                    .expect("get initial allow-all");
-                assert!(!initial.enabled);
+                    .expect("get initial permission mode");
+                assert_eq!(initial.mode, PermissionMode::Manual);
 
                 let enable = session
                     .rpc()
                     .permissions()
-                    .set_allow_all(PermissionsSetAllowAllRequest {
-                        enabled: Some(true),
-                        mode: None,
-                        model: None,
+                    .set_mode(PermissionsSetModeRequest {
+                        assisted_approval_model: None,
+                        mode: PermissionMode::AllowAll,
                         source: None,
                     })
                     .await
-                    .expect("enable allow-all");
+                    .expect("set allow-all mode");
                 assert!(enable.success);
-                assert!(enable.enabled);
-                assert!(
+                assert_eq!(enable.mode, PermissionMode::AllowAll);
+                assert_eq!(
                     session
                         .rpc()
                         .permissions()
-                        .get_allow_all()
+                        .get_mode()
                         .await
-                        .expect("get enabled allow-all")
-                        .enabled
+                        .expect("get allow-all mode")
+                        .mode,
+                    PermissionMode::AllowAll
                 );
 
                 let disable = session
                     .rpc()
                     .permissions()
-                    .set_allow_all(PermissionsSetAllowAllRequest {
-                        enabled: Some(false),
-                        mode: None,
-                        model: None,
+                    .set_mode(PermissionsSetModeRequest {
+                        assisted_approval_model: None,
+                        mode: PermissionMode::Manual,
                         source: None,
                     })
                     .await
-                    .expect("disable allow-all");
+                    .expect("set manual mode");
                 assert!(disable.success);
-                assert!(!disable.enabled);
-                assert!(
-                    !session
+                assert_eq!(disable.mode, PermissionMode::Manual);
+                assert_eq!(
+                    session
                         .rpc()
                         .permissions()
-                        .get_allow_all()
+                        .get_mode()
                         .await
-                        .expect("get disabled allow-all")
-                        .enabled
+                        .expect("get manual mode")
+                        .mode,
+                    PermissionMode::Manual
                 );
 
                 session.disconnect().await.expect("disconnect session");
diff --git a/rust/tests/e2e/rpc_ui_ephemeral_query.rs b/rust/tests/e2e/rpc_ui_ephemeral_query.rs
index 98199520d0..90cffae36c 100644
--- a/rust/tests/e2e/rpc_ui_ephemeral_query.rs
+++ b/rust/tests/e2e/rpc_ui_ephemeral_query.rs
@@ -1,9 +1,9 @@
 use github_copilot_sdk::rpc::UIEphemeralQueryRequest;
 
-// TODO(cli-1.0.81-2): CLI 1.0.81-2 fails session.ui.ephemeralQuery against the recorded
-// snapshot ("Failed to get response from the AI model"). Re-enable once the runtime
-// fix ships.
-#[ignore = "blocked on CLI 1.0.81-2 session.ui.ephemeralQuery regression"]
+// TODO(cli-1.0.81-2): CLI 1.0.81-4 still fails session.ui.ephemeralQuery against the
+// recorded snapshot ("Failed to get response from the AI model"). Re-enable once the
+// runtime fix ships.
+#[ignore = "blocked on CLI 1.0.81-4 session.ui.ephemeralQuery regression"]
 #[tokio::test]
 async fn should_answer_ephemeral_query() {
     super::support::with_shared_e2e_context(
diff --git a/scripts/codegen/go.ts b/scripts/codegen/go.ts
index a0c81b870e..acdea09727 100644
--- a/scripts/codegen/go.ts
+++ b/scripts/codegen/go.ts
@@ -560,6 +560,7 @@ interface GoCodegenCtx {
     discriminatedUnionRawVariantSuffix?: string;
     skipDefinitionTypeNames?: Set<string>;
     encodingBlocks?: Set<string>;
+    unionVariantMarshalers?: Set<string>;
     packageName?: string;
 }
 
@@ -1975,18 +1976,22 @@ function emitGoFlatDiscriminatedUnion(
             lines.push(`\treturn ${discGoType}(r.Discriminator)`);
         }
         lines.push(`}`);
-        pushGoEncodingBlock([
-            `func (r ${variantTypeName}) MarshalJSON() ([]byte, error) {`,
-            `\ttype alias ${variantTypeName}`,
-            `\treturn json.Marshal(struct {`,
-            `\t\t${discGoName} ${discGoType} \`json:"${discriminatorProp}"\``,
-            `\t\talias`,
-            `\t}{`,
-            `\t\t${discGoName}: r.${discriminatorMethodName}(),`,
-            `\t\talias: alias(r),`,
-            `\t})`,
-            `}`,
-        ], ctx);
+        ctx.unionVariantMarshalers ??= new Set<string>();
+        if (!ctx.unionVariantMarshalers.has(variantTypeName)) {
+            ctx.unionVariantMarshalers.add(variantTypeName);
+            pushGoEncodingBlock([
+                `func (r ${variantTypeName}) MarshalJSON() ([]byte, error) {`,
+                `\ttype alias ${variantTypeName}`,
+                `\treturn json.Marshal(struct {`,
+                `\t\t${discGoName} ${discGoType} \`json:"${discriminatorProp}"\``,
+                `\t\talias`,
+                `\t}{`,
+                `\t\t${discGoName}: r.${discriminatorMethodName}(),`,
+                `\t\talias: alias(r),`,
+                `\t})`,
+                `}`,
+            ], ctx);
+        }
     }
 
     ctx.structs.push(lines.join("\n"));
diff --git a/test/harness/package-lock.json b/test/harness/package-lock.json
index 01cf297589..76ae782aa9 100644
--- a/test/harness/package-lock.json
+++ b/test/harness/package-lock.json
@@ -9,7 +9,7 @@
       "version": "1.0.0",
       "license": "ISC",
       "devDependencies": {
-        "@github/copilot": "^1.0.81-2",
+        "@github/copilot": "^1.0.81-4",
         "@modelcontextprotocol/sdk": "^1.26.0",
         "@types/node": "^25.3.3",
         "@types/node-forge": "^1.3.14",
@@ -472,8 +472,8 @@
       }
     },
     "node_modules/@github/copilot": {
-      "version": "1.0.81-2",
-      "integrity": "sha512-FeeCKM0Pcm1mwC6uJQ/nkI5Bc33xe10dn3rtvYl3+ZzyKtAS7I8IeGvGrA773bsAgiHiyfj+KEQQlqKsBCgtPQ==",
+      "version": "1.0.81-4",
+      "integrity": "sha512-XSHSlWqDhoajHMjRouZv0gqPfG3MVJvLFCoWToT8/fbQ7rmE9rB4w0sefzmh30CrQANCWd+uiIUOe9H3QL32WA==",
       "dev": true,
       "license": "SEE LICENSE IN LICENSE.md",
       "dependencies": {
@@ -483,19 +483,19 @@
         "copilot": "npm-loader.js"
       },
       "optionalDependencies": {
-        "@github/copilot-darwin-arm64": "1.0.81-2",
-        "@github/copilot-darwin-x64": "1.0.81-2",
-        "@github/copilot-linux-arm64": "1.0.81-2",
-        "@github/copilot-linux-x64": "1.0.81-2",
-        "@github/copilot-linuxmusl-arm64": "1.0.81-2",
-        "@github/copilot-linuxmusl-x64": "1.0.81-2",
-        "@github/copilot-win32-arm64": "1.0.81-2",
-        "@github/copilot-win32-x64": "1.0.81-2"
+        "@github/copilot-darwin-arm64": "1.0.81-4",
+        "@github/copilot-darwin-x64": "1.0.81-4",
+        "@github/copilot-linux-arm64": "1.0.81-4",
+        "@github/copilot-linux-x64": "1.0.81-4",
+        "@github/copilot-linuxmusl-arm64": "1.0.81-4",
+        "@github/copilot-linuxmusl-x64": "1.0.81-4",
+        "@github/copilot-win32-arm64": "1.0.81-4",
+        "@github/copilot-win32-x64": "1.0.81-4"
       }
     },
     "node_modules/@github/copilot-darwin-arm64": {
-      "version": "1.0.81-2",
-      "integrity": "sha512-BS7LPiXvOYd8H4VoD7BCOJ/R+JGIO9JxFMYn/ICXGpL/405s8eX+QXj6GNtFIOAEXPWr0fBweIVi9ExrKMiimQ==",
+      "version": "1.0.81-4",
+      "integrity": "sha512-6XEOnrQdqdZ/tbhKU2D37tk0PGwKdNT5LGLvjjrWx+TDCFO/xZSu85+Rxl4AZP1SHKwWJRZdamDmETj4vn4VWQ==",
       "cpu": [
         "arm64"
       ],
@@ -510,8 +510,8 @@
       }
     },
     "node_modules/@github/copilot-darwin-x64": {
-      "version": "1.0.81-2",
-      "integrity": "sha512-geVSBY7KlT4je8Xct1DTiisWQmfvj2Mjf1kWim81bp9W4Z18MEsEGXFeHAeYE2ZSwhdfMZCJprDF66orrHJ92w==",
+      "version": "1.0.81-4",
+      "integrity": "sha512-o1ghvv7EUGO3CGbZyGyQJgu9mCFEyXq9FUUmvcxsBXxfjk7PR1CywK4cJVeZxac8LL//DQ/q42JzkaSfXU29Wg==",
       "cpu": [
         "x64"
       ],
@@ -526,8 +526,8 @@
       }
     },
     "node_modules/@github/copilot-linux-arm64": {
-      "version": "1.0.81-2",
-      "integrity": "sha512-uov9YOKlhyiaQfbgi6SzyAGjBLXegYRNJkgckG/7Xq/TbxF0Bmve3/lSuzve+p/EOnzPVwR1kGPDEuGU3g97Rw==",
+      "version": "1.0.81-4",
+      "integrity": "sha512-pHCwhBe+IVtliSxOEiwhS+GQXRvLuJxOQzdqAZYhbaEJKWeqWTw40LnhqaQFaGhOp1GAJF+6FodG/SfUZYAx5g==",
       "cpu": [
         "arm64"
       ],
@@ -542,8 +542,8 @@
       }
     },
     "node_modules/@github/copilot-linux-x64": {
-      "version": "1.0.81-2",
-      "integrity": "sha512-wsuXQDnMBdc0Q/hoO5+n+GaBPClzmgcxD2pVvM7i8JxgDAOm3NxHxGF9eYt1h5I+42/Y16t23n12PGARGupfAA==",
+      "version": "1.0.81-4",
+      "integrity": "sha512-icy4c4jfQzXNShlGptRiUPKpHUhGX9qBxc+118WBv3H68o38Pi//6UP/ZRq9PvcVrPwxbA9HkFASNwBiEzshdA==",
       "cpu": [
         "x64"
       ],
@@ -558,8 +558,8 @@
       }
     },
     "node_modules/@github/copilot-linuxmusl-arm64": {
-      "version": "1.0.81-2",
-      "integrity": "sha512-Wi0u31vhBqxajGqpjODhTEwzzqDnfS1mRhKJ/FflH5ieMKsS8YLVHiCUaZFNFZtN1FIFU0ixIQqgUXCvaBP+0Q==",
+      "version": "1.0.81-4",
+      "integrity": "sha512-k54g1q9Umz7eFGTpOqG5H1l1m2eNSs8jqFLuEpvGGdu7SU5g6Cz0aWq2VM27l+HcChyjp2dGenhQe/s7KxLSMw==",
       "cpu": [
         "arm64"
       ],
@@ -574,8 +574,8 @@
       }
     },
     "node_modules/@github/copilot-linuxmusl-x64": {
-      "version": "1.0.81-2",
-      "integrity": "sha512-wbb1+aM/jSTE3tDCqwiADe/aUqosGsPzQZIliG/CMsByT02nbwl0CMZGocnsYyDcoKragGmAHqHxgD6sWsJB1g==",
+      "version": "1.0.81-4",
+      "integrity": "sha512-ETjiiuMGDdO6ZdytQ3w8u7wvtkDQCLc0zSnZXXYWxnG4y9qLut8VHFoTJ+P07lBrHKXo7tZsJ6W0d1gOQTBnvw==",
       "cpu": [
         "x64"
       ],
@@ -590,8 +590,8 @@
       }
     },
     "node_modules/@github/copilot-win32-arm64": {
-      "version": "1.0.81-2",
-      "integrity": "sha512-gyONPnQf3Im0lTkC+1NW79P6p8A1F4Cs7dO3ruVBbtDG8SPFJXWNs4LkKIIN/laIa28xYQPraD+hdM/qLZ4E6w==",
+      "version": "1.0.81-4",
+      "integrity": "sha512-/Md1/LN56gORjyGwHXjZ6suY6om7NVL8+j9D/X/xb6Ar2acagyivL8Dm3tesgUMYLniLgn7dyEXPVYS/bqkpmQ==",
       "cpu": [
         "arm64"
       ],
@@ -606,8 +606,8 @@
       }
     },
     "node_modules/@github/copilot-win32-x64": {
-      "version": "1.0.81-2",
-      "integrity": "sha512-+EcwzwOmJvQ1t2HpDEe93hyMLzvQTUkINnfy/v7EIJu9i2i49m144DyHIafGPcwiEW+AzYpY+6aRqSnNwrGx7Q==",
+      "version": "1.0.81-4",
+      "integrity": "sha512-CrHbH0fRl2tlreKbDbm6+NmK/3HwMZR7BE86WTmYHJMXt3PcEWRtklU/fQuH0qjURtW4wX6PWrdmjcyVOkRJcA==",
       "cpu": [
         "x64"
       ],
diff --git a/test/harness/package.json b/test/harness/package.json
index 80a9210cbd..0ece92de45 100644
--- a/test/harness/package.json
+++ b/test/harness/package.json
@@ -14,7 +14,7 @@
     "node": "^20.19.0 || >=22.12.0"
   },
   "devDependencies": {
-    "@github/copilot": "^1.0.81-2",
+    "@github/copilot": "^1.0.81-4",
     "@modelcontextprotocol/sdk": "^1.26.0",
     "@types/node": "^25.3.3",
     "@types/node-forge": "^1.3.14",
diff --git a/test/harness/replayingCapiProxy.test.ts b/test/harness/replayingCapiProxy.test.ts
index cb9aaccc96..59f8fc6f17 100644
--- a/test/harness/replayingCapiProxy.test.ts
+++ b/test/harness/replayingCapiProxy.test.ts
@@ -546,6 +546,48 @@ Always include PINEAPPLE_COCONUT_42.
     expect(toolMessage?.content).toBe("Tool 'report_intent' does not exist.");
   });
 
+  test("normalizes aborted tool execution results", async () => {
+    const requestBody = JSON.stringify({
+      messages: [
+        { role: "user", content: "Run a slow analysis" },
+        {
+          role: "assistant",
+          tool_calls: [
+            {
+              id: "tc1",
+              type: "function",
+              function: {
+                name: "slow_analysis",
+                arguments: '{"value":"test_abort"}',
+              },
+            },
+          ],
+        },
+        {
+          role: "tool",
+          tool_call_id: "tc1",
+          content:
+            'Failed to execute `slow_analysis` tool with arguments: {"value":"test_abort"} due to error: Error: Session aborted',
+        },
+      ],
+    });
+    const responseBody = JSON.stringify({
+      choices: [{ message: { role: "assistant", content: "Done" } }],
+    });
+
+    const outputPath = await createProxy([
+      { url: "/chat/completions", requestBody, responseBody },
+    ]);
+
+    const result = await readYamlOutput(outputPath);
+    const toolMessage = result.conversations[0].messages.find(
+      (m) => m.role === "tool",
+    );
+    expect(toolMessage?.content).toBe(
+      "The execution of this tool, or a previous tool was interrupted.",
+    );
+  });
+
   test("normalizes background agent IDs and removes runtime advisories", async () => {
     const stableResult =
       "Agent started in background with agent_id: background-agent. You'll be notified when it completes. Tell the user you're waiting and end your response, or continue unrelated work until notified.";
diff --git a/test/harness/replayingCapiProxy.ts b/test/harness/replayingCapiProxy.ts
index 6ba45c3684..4ed8e06ccd 100644
--- a/test/harness/replayingCapiProxy.ts
+++ b/test/harness/replayingCapiProxy.ts
@@ -126,6 +126,7 @@ export class ReplayingCapiProxy extends CapturingHttpProxy {
   private startPromise: Promise<string> | null = null;
   private defaultToolResultNormalizers: ToolResultNormalizer[] = [
     { toolName: "*", normalizer: normalizeLargeOutputFilepaths },
+    { toolName: "*", normalizer: normalizeInterruptedToolResult },
     { toolName: "${shell}", normalizer: normalizeShellExitMarkers },
     { toolName: "*", normalizer: normalizeGhAuthMessages },
     { toolName: "*", normalizer: normalizeAvailableToolNames },
@@ -1429,6 +1430,7 @@ function normalizeStoredToolMessages(conversations: NormalizedConversation[]) {
   for (const conversation of conversations) {
     for (const message of conversation.messages) {
       if (message.role === "tool" && typeof message.content === "string") {
+        message.content = normalizeInterruptedToolResult(message.content);
         message.content = normalizeAvailableToolNames(message.content);
         message.content = normalizeBackgroundAgentStartMessage(message.content);
         message.content = normalizeReadAgentResult(message.content);
@@ -1552,6 +1554,13 @@ function normalizeAvailableToolNames(result: string): string {
   );
 }
 
+function normalizeInterruptedToolResult(result: string): string {
+  return result.replace(
+    /^Failed to execute `[^`]+` tool(?: with arguments: [\s\S]*?)? due to error: (?:Error: )?Session aborted$/,
+    "The execution of this tool, or a previous tool was interrupted.",
+  );
+}
+
 function normalizeBackgroundAgentStartMessage(result: string): string {
   return normalizeBackgroundAgentStartMessageWithId(result);
 }