,
}
-/// Session event "session.managed_settings_resolved". Enterprise managed-settings resolution: the effective managed settings the session applied and which channels contributed, so SDK clients can show users what is enterprise-managed. Fires whenever managed policy is (re)applied — at session start, on resume, and on account switch. This is an ephemeral live snapshot (delivered to subscribers but not persisted to the session event log), because at session start it resolves before `session.start` is emitted. Device values take precedence over server values per ordinary key, while permissions compose restrictively across device, server, and SDK-client layers. The account-scoped `getManagedSettings()` API does not include session-local client injection. Marked experimental while the managed-settings surface stabilizes.
+/// Session event "session.managed_settings_resolved". Enterprise managed-settings resolution: the effective managed settings the session applied and which channels contributed, so SDK clients can show users what is enterprise-managed. Fires whenever managed policy is (re)applied — at session start, on resume, and on account switch. This is an ephemeral live snapshot (delivered to subscribers but not persisted to the session event log), because at session start it resolves before `session.start` is emitted. Device values take precedence over server values, then the policy helper, per ordinary key, while permissions compose restrictively across device, server, policy-helper, and SDK-client layers. The account-scoped `getManagedSettings()` API does not include session-local client injection. Marked experimental while the managed-settings surface stabilizes.
///
///
///
@@ -5736,6 +5751,9 @@ pub struct SessionManagedSettingsResolvedData {
/// Whether at least two managed sources supplied permission allowlists, so enforcement intersects them and the flattened settings payload omits `permissions.allow`.
#[serde(skip_serializing_if = "Option::is_none")]
pub permissions_allow_intersected: Option,
+ /// Whether the policy-helper managed-settings layer was present. The policy helper is the weakest channel: it fills keys no enterprise source set and can never replace one.
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub policy_helper_managed: Option,
/// Whether the effective sandbox policy forces the sandbox on *only* because managed policy could not be determined, rather than because the policy requires it. Lets clients tell a user whose `--no-sandbox` was overridden that the sandbox stayed on as a fail-closed fallback, instead of attributing it to an administrator who set no such policy.
#[serde(skip_serializing_if = "Option::is_none")]
pub sandbox_enabled_by_undetermined_policy: Option,
@@ -5744,7 +5762,7 @@ pub struct SessionManagedSettingsResolvedData {
/// The effective (resolved) managed settings values, so clients can render exactly what is enforced. Absent when no managed policy is in force.
#[serde(skip_serializing_if = "Option::is_none")]
pub settings: Option,
- /// Channel summary: `server`, `device`, or `client` when exactly one channel contributed; `mixed` when multiple channels contributed; otherwise `none`. Consult the per-channel booleans for exact provenance.
+ /// Channel summary: `server`, `device`, `client`, or `policyHelper` when exactly one channel contributed; `mixed` when multiple channels contributed; otherwise `none`. Consult the per-channel booleans for exact provenance.
pub source: ManagedSettingsResolvedSource,
}
@@ -8158,7 +8176,10 @@ pub enum ManagedSettingsResolvedSource {
/// Only session-local SDK-host injection contributed.
#[serde(rename = "client")]
Client,
- /// More than one channel contributed. Ordinary keys resolve device over server per key, while permissions compose restrictively across all present layers.
+ /// A policy helper registered by device or server policy contributed. Device registration takes priority when present.
+ #[serde(rename = "policyHelper")]
+ PolicyHelper,
+ /// More than one channel contributed. Ordinary keys resolve device over server over policy helper per key, while permissions compose restrictively across all present layers.
#[serde(rename = "mixed")]
Mixed,
/// No managed policy is in force (no channel contributed).
diff --git a/test/harness/package-lock.json b/test/harness/package-lock.json
index a83d73d0a9..274e70f675 100644
--- a/test/harness/package-lock.json
+++ b/test/harness/package-lock.json
@@ -9,7 +9,7 @@
"version": "1.0.0",
"license": "ISC",
"devDependencies": {
- "@github/copilot": "^1.0.83-0",
+ "@github/copilot": "^1.0.83-1",
"@modelcontextprotocol/sdk": "^1.26.0",
"@types/node": "^25.3.3",
"@types/node-forge": "^1.3.14",
@@ -472,8 +472,8 @@
}
},
"node_modules/@github/copilot": {
- "version": "1.0.83-0",
- "integrity": "sha512-Nv4IsqsveMgghwaBhgvSBZyIyvsqNBZTqnbVnv69+9+Suyq20vJcv6aB74UcJ7VPCMxIGJJUaJkugEtkMNv6wA==",
+ "version": "1.0.83-1",
+ "integrity": "sha512-7rhgbgSx7IgfFYXrTx2/2+qowv6MZjC6BN0mhba37RuGQxsca9Zk2ucAeIX3GbQTp91AhvnN0aHCxabX36xADQ==",
"dev": true,
"license": "SEE LICENSE IN LICENSE.md",
"dependencies": {
@@ -483,19 +483,19 @@
"copilot": "npm-loader.js"
},
"optionalDependencies": {
- "@github/copilot-darwin-arm64": "1.0.83-0",
- "@github/copilot-darwin-x64": "1.0.83-0",
- "@github/copilot-linux-arm64": "1.0.83-0",
- "@github/copilot-linux-x64": "1.0.83-0",
- "@github/copilot-linuxmusl-arm64": "1.0.83-0",
- "@github/copilot-linuxmusl-x64": "1.0.83-0",
- "@github/copilot-win32-arm64": "1.0.83-0",
- "@github/copilot-win32-x64": "1.0.83-0"
+ "@github/copilot-darwin-arm64": "1.0.83-1",
+ "@github/copilot-darwin-x64": "1.0.83-1",
+ "@github/copilot-linux-arm64": "1.0.83-1",
+ "@github/copilot-linux-x64": "1.0.83-1",
+ "@github/copilot-linuxmusl-arm64": "1.0.83-1",
+ "@github/copilot-linuxmusl-x64": "1.0.83-1",
+ "@github/copilot-win32-arm64": "1.0.83-1",
+ "@github/copilot-win32-x64": "1.0.83-1"
}
},
"node_modules/@github/copilot-darwin-arm64": {
- "version": "1.0.83-0",
- "integrity": "sha512-0KQjKS9vd4QGxLAbFJcvyv/zsC5kivrtDe0UZhHt/43nUGqoS61DFcsM596/kg75vNE6c9J4gmZ5fUPYef+0hw==",
+ "version": "1.0.83-1",
+ "integrity": "sha512-gxYJEd4yoIBIQHRmJw6ZegSkR6VuNm7AJVdAdARcU0SS68VZjtZFT29luThAp75Pxp37S5w+3A/jQNtxGyHizw==",
"cpu": [
"arm64"
],
@@ -510,8 +510,8 @@
}
},
"node_modules/@github/copilot-darwin-x64": {
- "version": "1.0.83-0",
- "integrity": "sha512-fiyW+hy4c8AI7ONxN623f9cmJGRpbqTztc0jSVXc9z9WwzcWi39X0nxUprRM2l2Dq6YQ3guPCqGl/g1T5bQfQg==",
+ "version": "1.0.83-1",
+ "integrity": "sha512-PL63+Ib1RH+Bpu2UYJ9E8tmD4NZD/YlhD25F1Q9Rb86AdgLEoRYlxjNxXXF9P9dMmJ/u5zm0rUtWIRxv/FRbPg==",
"cpu": [
"x64"
],
@@ -526,8 +526,8 @@
}
},
"node_modules/@github/copilot-linux-arm64": {
- "version": "1.0.83-0",
- "integrity": "sha512-RWbRU+KgEmtAdKp1GQVTqfdwg4Ti/OVmgZGkXq4lMYj3wnBBQcayFpSLHg5ShzDSS0RglD4b8Z27NjPrm7bXxA==",
+ "version": "1.0.83-1",
+ "integrity": "sha512-7c4RVEuXQu9zepAWoXwkizpESztUbWUR1hLPl+o+19L+D8fXm+5XQRH5E22Ia7P7/xHW3Ml2o2x5cXFq0k7/7w==",
"cpu": [
"arm64"
],
@@ -542,8 +542,8 @@
}
},
"node_modules/@github/copilot-linux-x64": {
- "version": "1.0.83-0",
- "integrity": "sha512-5COXUNT+jDfkeyqrymZMvhTogkBYUXt+wuRwKrK6ol5vaw5SoDP1DYbI2hIEfoUj4g7XTHLUCD1s3lw8eicqUA==",
+ "version": "1.0.83-1",
+ "integrity": "sha512-Be0zUVysLYV66pnOPhMxpShQ8Ox5V07qcsSOoNzG7iwpzkfZuf70U9CHk/fnI//mWwmZR+caPUfVM9BpwrdNnA==",
"cpu": [
"x64"
],
@@ -558,8 +558,8 @@
}
},
"node_modules/@github/copilot-linuxmusl-arm64": {
- "version": "1.0.83-0",
- "integrity": "sha512-7sYf364iz6s97ClviBRQusTKz3S3TgoKniyYv8+aRi5f5w6TL8NTPnGX1bXMeU0VZmk5VKQTlxVRO2yA4uFwpg==",
+ "version": "1.0.83-1",
+ "integrity": "sha512-PZNP8vZZJU8yIc3dNjGUBUCFPNjqZs8FPZLDxvL6XdHM7Ep4cLBa+QdbRsw+nZONIaG0GtQf26eqk5ymYYpUPA==",
"cpu": [
"arm64"
],
@@ -574,8 +574,8 @@
}
},
"node_modules/@github/copilot-linuxmusl-x64": {
- "version": "1.0.83-0",
- "integrity": "sha512-jze/f6Yd3Y83kxUa88kXUiwHlZmHDwAqudswdHT6f6q+K1ZEELFGEzbB6Ku4i0L8M6wHXO1EF/zaiSFWQaM4Tw==",
+ "version": "1.0.83-1",
+ "integrity": "sha512-uKMhGtg5K07nA5/pxDSq8S5F/I+sMgVhUXg90Y4BI9trOidgxpXpCVyh4TeRNj2ENNugPvATdfGc6eFPsjmlgQ==",
"cpu": [
"x64"
],
@@ -590,8 +590,8 @@
}
},
"node_modules/@github/copilot-win32-arm64": {
- "version": "1.0.83-0",
- "integrity": "sha512-93jln98UAJpslMQ7n+wAmCpoOWGEV5lXxV/DaEajySvYrCU33D2yj7d9kl8X2CgaUVBas6sNWSWKtqy+rKJxXQ==",
+ "version": "1.0.83-1",
+ "integrity": "sha512-vMxHTmv3SotBuNI4LKcIFckd+n0OvhTik27qjsqOnVqFpvmHDghSsa8YPxySyxUQIE35z5pJaivVBK3dfEAY7w==",
"cpu": [
"arm64"
],
@@ -606,8 +606,8 @@
}
},
"node_modules/@github/copilot-win32-x64": {
- "version": "1.0.83-0",
- "integrity": "sha512-+4Htk3CixO1qcOtYegjn33/8bSDdx8QXDpgVBak2D4Y5hzBWPO5IuQoICwvjaW5VOIW+I7Q62RK2pupSjxB38Q==",
+ "version": "1.0.83-1",
+ "integrity": "sha512-2l0VVTazW3/+p94ZQ5sAPCj1iH7KWxJAYh4yXWfvpsB/1JEEmyVgpLei1MeaMFVdtp/hi9bGprZ9+zWNlHh5hQ==",
"cpu": [
"x64"
],
diff --git a/test/harness/package.json b/test/harness/package.json
index c2081214ab..e293910938 100644
--- a/test/harness/package.json
+++ b/test/harness/package.json
@@ -14,7 +14,7 @@
"node": "^20.19.0 || >=22.12.0"
},
"devDependencies": {
- "@github/copilot": "^1.0.83-0",
+ "@github/copilot": "^1.0.83-1",
"@modelcontextprotocol/sdk": "^1.26.0",
"@types/node": "^25.3.3",
"@types/node-forge": "^1.3.14",