Feature: MCP OAuth host token callbacks

When a Copilot session connects to an OAuth-protected MCP server, the SDK now calls back to your application to supply OAuth tokens. Register an onMcpAuthRequest handler in the session config to provide tokens or cancel the request. (#1669)

const session = await client.startSession({
  onMcpAuthRequest: async (request) => {
    const token = await myOAuthFlow(request.serverUrl, request.reason);
    return token ? { kind: "token", accessToken: token } : { kind: "cancelled" };
  },
});

var session = await client.StartSessionAsync(new SessionConfig
{
    OnMcpAuthRequest = async (ctx) =>
    {
        var token = await MyOAuthFlow(ctx.ServerUrl, ctx.Reason);
        return token is not null
            ? McpAuthResult.FromToken(new McpAuthToken { AccessToken = token })
            : McpAuthResult.Cancel();
    },
});

Feature: sessionId in BYOK bearer-token callback; field renamed to bearerTokenProvider

The BYOK config field has been renamed from getBearerToken to bearerTokenProvider across all SDKs. The callback now also receives a sessionId, so a single callback shared across multiple sessions can scope token acquisition or caching per session. (#1796)

const client = new CopilotClient({
  provider: {
    bearerTokenProvider: async ({ providerName, sessionId }) => {
      return await getTokenForSession(sessionId);
    },
  },
});

var client = new CopilotClient(new CopilotClientConfig
{
    Provider = new ProviderConfig
    {
        BearerTokenProvider = async (args) => await GetTokenForSession(args.SessionId),
    },
});

Feature: Java @CopilotTool annotation-based tool definition

Java applications can now define Copilot tools by annotating methods with @CopilotTool and @CopilotToolParam instead of building ToolDefinition objects manually. A compile-time annotation processor generates the metadata, and ToolDefinition.fromObject() registers all annotated methods at once. (#1792)

`@CopilotTool`("Get the current weather for a given city")
public String getWeather(
        `@CopilotToolParam`(value = "The city", required = true) String city,
        `@CopilotToolParam`(value = "Unit: celsius or fahrenheit", defaultValue = "celsius") String unit) {
    return fetchWeather(city, unit);
}

List<ToolDefinition> tools = ToolDefinition.fromObject(new WeatherTools());

Other changes

• feature: [Java] @CopilotTool methods can declare ToolInvocation as a hidden injected parameter to access runtime context such as sessionId (#1832)
• feature: [Java] rename @Param annotation to @CopilotToolParam (#1838)
• feature: [Rust] add 9 GitHub-anchored variants to the Attachment enum (GitHubCommit, GitHubRelease, GitHubActionsJob, GitHubRepository, GitHubFileDiff, GitHubTreeComparison, GitHubUrl, GitHubFile, GitHubSnippet) (#1823)

New contributors

• @pallaviraiturkar0 made their first contribution in #1823
• @roji made their first contribution in #1827

Generated by Release Changelog Generator · sonnet46 1.5M

What's Changed

• Fix flaky C# permission E2E assertions by @roji in #1827
• Update @github/copilot to 1.0.66-2 by @github-actions[bot] in #1828
• [Java] Support hidden ToolInvocation injection in @CopilotTool methods by @edburns with @Copilot in #1832
• Rename Param annotation to CopilotToolParam in Java SDK by @edburns with @Copilot in #1838
• Add SDK MCP OAuth host token handlers by @roji in #1669

New Contributors

• @roji made their first contribution in #1827

Full Changelog: rust/v1.0.5-preview.0...rust/v1.0.5-preview.1

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central]((central.sonatype.com/redacted)

📖 [Documentation]((github.github.io/redacted) · [Javadoc]((github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.5</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.5")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.5'

Feature: annotation-based tool API (@CopilotTool)

The Java SDK now includes a high-level, annotation-driven tool API. Annotate methods with @CopilotTool and parameters with @CopilotToolParam to define tools — a JSR-269 annotation processor generates metadata at compile time with no runtime reflection. Use ToolDefinition.fromObject() to register tools with minimal boilerplate. (#1792)

public class WeatherTools {
    `@CopilotTool`("Get the current weather for a given city")
    public String getWeather(
            `@CopilotToolParam`(value = "The city to get weather for", required = true) String city,
            `@CopilotToolParam`(value = "Temperature unit: celsius or fahrenheit", defaultValue = "celsius") String unit) {
        // implementation
    }
}

List<ToolDefinition> tools = ToolDefinition.fromObject(new WeatherTools());
SessionConfig config = new SessionConfig().setTools(tools);

Feature: ToolInvocation injection in @CopilotTool methods

@CopilotTool methods can now declare a ToolInvocation parameter to receive runtime context such as the session ID, without it appearing in the LLM-visible JSON schema. The annotation processor injects it automatically. (#1832)

`@CopilotTool`("Reports progress for the current tool call")
public String reportProgress(
        `@CopilotToolParam`("Current phase") String phase,
        ToolInvocation invocation) {
    return "phase=" + phase + ", session=" + invocation.getSessionId();
}

Feature: MCP OAuth host token handlers

Applications can now register a callback to service MCP OAuth token requests, enabling SDK-managed authentication flows when connecting to OAuth-protected MCP servers. (#1669)

Other changes

• improvement: @Param annotation renamed to @CopilotToolParam to free the name for an upcoming tool-as-lambda API variant (#1838)
• improvement: BYOK bearer-token callback field renamed from getBearerToken to bearerTokenProvider; sessionId is now surfaced in the callback args for per-session token scoping (#1796)

New contributors

• @pallaviraiturkar0 made their first contribution in #1823
• @roji made their first contribution in #1827

Generated by Release Changelog Generator · sonnet46 1.2M

Feature: BYOK bearer-token provider gets sessionId and is renamed to bearerTokenProvider

The BYOK bearer-token provider callback now receives a sessionId parameter, enabling per-session token scoping or caching. The configuration field has been renamed from getBearerToken to bearerTokenProvider across all six SDKs (and the callback type to BearerTokenProvider), aligning with the existing *Provider naming convention. (#1796)

const client = new CopilotClient({
  bearerTokenProvider: async ({ sessionId }) => getTokenForSession(sessionId),
});

var client = new CopilotClient(new CopilotClientOptions {
    BearerTokenProvider = async (args) => await GetTokenForSessionAsync(args.SessionId),
});

Feature: @CopilotTool annotation for ergonomic Java tool registration

Java applications can now declare tools using the @CopilotTool and @Param annotations. The SDK's annotation processor generates the necessary metadata at compile time; use ToolDefinition.fromObject(...) to register an entire object's annotated methods without manual JSON schema construction. (#1792)

Note: This API is currently @CopilotExperimental.

`@CopilotTool`("Get the current weather for a city")
public String getWeather(
        `@Param`(value = "City name", required = true) String city,
        `@Param`(value = "Unit: celsius or fahrenheit", required = false, defaultValue = "celsius") String unit) {
    // implementation
}

// Registration:
List<ToolDefinition> tools = ToolDefinition.fromObject(new WeatherTools());

Feature: GitHub-anchored attachment variants added to Rust SDK

The Rust Attachment enum now includes all 9 GitHub-anchored reference types that the CLI can deliver — GitHubCommit, GitHubRelease, GitHubActionsJob, GitHubRepository, GitHubFileDiff, GitHubTreeComparison, GitHubUrl, GitHubFile, and GitHubSnippet. Previously these variants were silently dropped at the SDK boundary when received. (#1823)

New contributors

• @pallaviraiturkar0 made their first contribution in #1823

Generated by Release Changelog Generator · sonnet46 1.1M

What's Changed

• Add sessionId to BYOK provider-token callback; rename to bearerTokenProvider by @SteveSandersonMS in #1796
• Fix block-remove-before-merge workflow failing on merge_group events by @edburns with @Copilot in #1798
• Sunbrye/fix azure managed identity tabs by @sunbrye in #1801
• Make abort E2E snapshots tolerate timing variants by @stephentoub in #1808
• Java: Implement @CopilotTool ergonomics by @edburns in #1792
• [changelog] Add changelog for java/v1.0.4 by @github-actions[bot] in #1795
• Update @github/copilot to 1.0.66-1 by @github-actions[bot] in #1819
• Add GitHub-anchored attachment variants to Attachment enum by @pallaviraiturkar0 in #1823

New Contributors

• @pallaviraiturkar0 made their first contribution in #1823

Full Changelog: rust/v1.0.4...rust/v1.0.5-preview.0

What's Changed

• Add experimental multi-provider BYOK registry config across all six SDKs by @stephentoub in #1718
• [changelog] Add changelog for v1.0.2 by @github-actions[bot] in #1714
• edburns/java-add-spotless-to-java-coding-skill by @edburns in #1723
• Add Java low-level tool definition E2E test and skill [1/6] by @edburns in #1721
• Add Node.js low-level tool-definition E2E test [3/6] by @edburns in #1725
• Add Go low-level tool-definition E2E test [2/6] by @edburns in #1724
• Add Python low-level tool-definition E2E test [4/6] by @edburns in #1726
• Add .NET low-level tool-definition E2E test [6/6] by @edburns in #1728
• Add Rust low-level tool-definition E2E test [5/6] by @edburns in #1727
• Fix codegen schema resolution for new @github/copilot package layout by @stephentoub in #1738
• Update @github/copilot to 1.0.64-1 by @github-actions[bot] in #1739
• Bump undici from 6.24.1 to 6.27.0 in /scripts/corrections in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1742
• Add capi.enableWebSocketResponses and provider.transport session options by @dereklegenzoff in #1711
• Python: switch from bundled CLI wheels to downloading explicitly or at runtime by @SteveSandersonMS in #1744
• Update @github/copilot to 1.0.64-3 by @github-actions[bot] in #1752
• HTTP request callback support by @SteveSandersonMS in #1689
• fix(rust): backdate extracted CLI mtime to stop build.rs self-invalidation by @redsun82 in #1776
• Address stephentoub review feedback on HTTP request callback support (+ cross-SDK parity) by @SteveSandersonMS in #1775
• Strong-name sign .NET SDK by @stephentoub in #1778
• Harden bundled Copilot CLI extraction against corrupt/partial installs by @jmoseley in #1635
• Clean up HTTP passthrough API by @SteveSandersonMS in #1784
• Document Java memory section and add Copilot Memory links across SDK READMEs by @Morabbin in #1783
• Add preamble section and preserve action to SDKs by @MackinnonBuck in #1713
• fix(nodejs): handle stdio stdin errors by @sjh9714 in #1584
• docs: add system message customization section to Python README by @Halcyonhal9 in #1066
• Add embeddedcli.Path() accessor for the resolved CLI path by @tbrady77 in #1677
• normalize-sharing-prompts-during-iteration by @edburns in #1729
• Expose exp_assignments injection on session create/resume across all SDKs by @ellismg in #1750
• Update @github/copilot to 1.0.65 by @github-actions[bot] in #1793
• Add getBearerToken callback for BYOK providers (Managed Identity) by @SteveSandersonMS in #1748

New Contributors

• @dereklegenzoff made their first contribution in #1711
• @redsun82 made their first contribution in #1776
• @sjh9714 made their first contribution in #1584
• @Halcyonhal9 made their first contribution in #1066
• @tbrady77 made their first contribution in #1677
• @ellismg made their first contribution in #1750

Full Changelog: v1.0.2...v1.0.4

What's Changed

• Add experimental multi-provider BYOK registry config across all six SDKs by @stephentoub in #1718
• [changelog] Add changelog for v1.0.2 by @github-actions[bot] in #1714
• edburns/java-add-spotless-to-java-coding-skill by @edburns in #1723
• Add Java low-level tool definition E2E test and skill [1/6] by @edburns in #1721
• Add Node.js low-level tool-definition E2E test [3/6] by @edburns in #1725
• Add Go low-level tool-definition E2E test [2/6] by @edburns in #1724
• Add Python low-level tool-definition E2E test [4/6] by @edburns in #1726
• Add .NET low-level tool-definition E2E test [6/6] by @edburns in #1728
• Add Rust low-level tool-definition E2E test [5/6] by @edburns in #1727
• Fix codegen schema resolution for new @github/copilot package layout by @stephentoub in #1738
• Update @github/copilot to 1.0.64-1 by @github-actions[bot] in #1739
• Bump undici from 6.24.1 to 6.27.0 in /scripts/corrections in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1742
• Add capi.enableWebSocketResponses and provider.transport session options by @dereklegenzoff in #1711
• Python: switch from bundled CLI wheels to downloading explicitly or at runtime by @SteveSandersonMS in #1744
• Update @github/copilot to 1.0.64-3 by @github-actions[bot] in #1752
• HTTP request callback support by @SteveSandersonMS in #1689
• fix(rust): backdate extracted CLI mtime to stop build.rs self-invalidation by @redsun82 in #1776
• Address stephentoub review feedback on HTTP request callback support (+ cross-SDK parity) by @SteveSandersonMS in #1775
• Strong-name sign .NET SDK by @stephentoub in #1778
• Harden bundled Copilot CLI extraction against corrupt/partial installs by @jmoseley in #1635
• Clean up HTTP passthrough API by @SteveSandersonMS in #1784
• Document Java memory section and add Copilot Memory links across SDK READMEs by @Morabbin in #1783
• Add preamble section and preserve action to SDKs by @MackinnonBuck in #1713
• fix(nodejs): handle stdio stdin errors by @sjh9714 in #1584
• docs: add system message customization section to Python README by @Halcyonhal9 in #1066
• Add embeddedcli.Path() accessor for the resolved CLI path by @tbrady77 in #1677
• normalize-sharing-prompts-during-iteration by @edburns in #1729
• Expose exp_assignments injection on session create/resume across all SDKs by @ellismg in #1750
• Update @github/copilot to 1.0.65 by @github-actions[bot] in #1793
• Add getBearerToken callback for BYOK providers (Managed Identity) by @SteveSandersonMS in #1748

New Contributors

• @dereklegenzoff made their first contribution in #1711
• @redsun82 made their first contribution in #1776
• @sjh9714 made their first contribution in #1584
• @Halcyonhal9 made their first contribution in #1066
• @tbrady77 made their first contribution in #1677
• @ellismg made their first contribution in #1750

Full Changelog: rust/v1.0.2...rust/v1.0.4

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central]((central.sonatype.com/redacted)

📖 [Documentation]((github.github.io/redacted) · [Javadoc]((github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.4</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.4")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.4'

Feature: HTTP request callback support

Register a CopilotRequestHandler on the client to intercept every outbound LLM inference HTTP or WebSocket request — for both BYOK and CAPI — and mutate, replace, or fully forward it. Useful for logging, header injection, model substitution, or custom routing. (#1689, #1775, #1784)

final class MyHandler extends CopilotRequestHandler {
    `@Override`
    protected HttpResponse<InputStream> sendRequest(HttpRequest request, CopilotRequestContext ctx) throws Exception {
        HttpRequest mutated = HttpRequest.newBuilder(request, (n, v) -> true)
                .header("X-Debug-Session", ctx.sessionId() == null ? "none" : ctx.sessionId())
                .build();
        return super.sendRequest(mutated, ctx);
    }
}

CopilotClient client = new CopilotClient(
    new CopilotClientOptions().setRequestHandler(new MyHandler()));

Feature: getBearerToken callback for BYOK providers (Managed Identity)

BYOK provider configs now accept a getBearerToken callback so the SDK consumer can resolve bearer tokens (e.g. Azure Managed Identity) on demand. The SDK takes zero Azure SDK dependency — the consumer supplies the callback using any identity library. (#1748)

var provider = new ProviderConfig()
    .setType("openai")
    .setBaseUrl(baseUrl)
    .setGetBearerToken(args -> cred.getToken(ctx).map(AccessToken::getToken).toFuture());

Feature: experimental multi-provider BYOK registry

Register multiple named providers and models on a single session via NamedProviderConfig and ProviderModelConfig. Custom agents can reference provider-qualified model IDs such as "alpha/sonnet". This feature is experimental. (#1718)

Feature: preamble system message section and preserve action

Two new customization options for system message sections. SystemMessageSections.PREAMBLE targets only the identity preamble without affecting its sibling sub-sections (identity and tool_instructions are now documented as section groups). The new preserve action protects an individually-addressable section from a group-level remove. (#1713)

Other changes

• feature: add optional memory configuration (MemoryConfiguration) to session create and resume (#1617)
• feature: defer parameter on tool definitions controls eager vs. lazy tool loading ("auto" or "never") (#1632)
• feature: otlpProtocol telemetry option for configuring OTLP export transport ("http/json" or "http/protobuf") (#1648)
• feature: ModelBilling.tokenPrices surfaced on public SDK types, exposing per-tier pricing and context window limits (#1633)
• feature: CapiSessionOptions.enableWebSocketResponses and ProviderConfig.transport for WebSocket transport control on session create/resume (#1711)
• improvement: call runtime.shutdown during client stop for deterministic OTEL telemetry flush before process cleanup (#1667)
• improvement: rename SystemPromptSections → SystemMessageSections for cross-SDK consistency; old class deprecated with forRemoval=true (#1683)

New contributors

• @almaleksia made their first contribution in #1632
• @dereklegenzoff made their first contribution in #1711
• @ellismg made their first contribution in #1750

Generated by Release Changelog Generator · sonnet46 2M

Feature: opt-in memory for sessions

Sessions can now be configured with persistent memory, allowing the agent to recall information across turns. Set memory: { enabled: true } when creating or resuming a session; when omitted the runtime default applies. (#1617)

const session = await client.createSession({
    memory: { enabled: true },
});

var session = await client.CreateSessionAsync(new SessionConfig
{
    Memory = new MemoryConfiguration { Enabled = true }
});

Feature: defer parameter for tool definitions

Tools now support a defer option controlling whether they are pre-loaded eagerly or surfaced lazily through tool search. Use "auto" (the default) to allow lazy loading, or "never" to force pre-loading. (#1632)

defineTool("lookup_issue", {
    description: "Fetch issue details",
    parameters: z.object({ id: z.string() }),
    defer: "auto",
    handler: async ({ id }) => { /* ... */ },
});

var tool = CopilotTool.DefineTool(
    async ([Description("Issue ID")] string id) => { /* ... */ },
    toolOptions: new CopilotToolOptions { Defer = CopilotToolDefer.Auto });

Other changes

• feature: [All SDKs] add otlpProtocol telemetry option ("http/json" or "http/protobuf") for configuring OTLP export transport (#1648)
• feature: [All SDKs] surface ModelBilling.tokenPrices on public SDK types, exposing per-tier input/output/cache pricing and context window limits (#1633)
• improvement: [All SDKs] call runtime.shutdown during normal client stop for deterministic OTEL telemetry flush before process cleanup (#1667)
• improvement: [Go] thread context.Context through the JSON-RPC request path for proper cancellation support (#1643)
• improvement: [Java] add getOpenCanvases() to CopilotSession to track currently open canvas instances, matching the other SDKs (#1606)
• improvement: [Java] rename SystemPromptSections to SystemMessageSections for cross-SDK consistency; old class deprecated with forRemoval=true (#1683)
• bugfix: [Python] round sub-millisecond durations in to_timedelta_int to avoid serialization errors (#1668)
• bugfix: [Rust] skip CLI binary download in build.rs when DOCS_RS env var is set (#1660)

New contributors

• @andyfeller made their first contribution in #1631
• @almaleksia made their first contribution in #1632
• @idryzhov made their first contribution in #1668
• @scottaddie made their first contribution in #1636

Generated by Release Changelog Generator · sonnet46 1.8M

What's Changed

• Bump the java-maven-deps group in /java with 3 updates by @dependabot[bot] in #1613
• Bump the java-codegen-deps group in /java/scripts/codegen with 2 updates by @dependabot[bot] in #1614
• Add open-canvases snapshot tracking to the Java SDK by @jmoseley in #1606
• Add docs style instructions for copilot agents by @sunbrye in #1236
• docs: rename index.md to README.md in docs directories by @andyfeller in #1631
• Make exit_plan_mode E2E snapshot tolerant of reworded CLI tool result by @stephentoub in #1639
• Add defer parameter to tool definition by @almaleksia in #1632
• Make Go JSON-RPC requests context-aware by @qmuntal in #1643
• Bump esbuild from 0.27.3 to 0.28.1 in /scripts/codegen in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1647
• Add API docs column to Available SDKs table in README by @Copilot in #1662
• Update @github/copilot to 1.0.62 by @github-actions[bot] in #1672
• Add E2E test for session.providerEndpoint.get by @SteveSandersonMS in #1621
• SDK: add optional memory configuration to session create and resume by @Morabbin in #1617
• [E2E] session.todos_changed event + readSqlTodosWithDependencies (6 languages) by @SteveSandersonMS in #1622
• Add graceful runtime shutdown to SDK clients by @stephentoub in #1667
• fix(python): round sub-millisecond durations in to_timedelta_int by @idryzhov in #1668
• Add ADR-005: Ergonomic tool definition via annotation processor by @edburns in #1684
• Add OTLP protocol telemetry options by @loganrosen in #1648
• Bump esbuild from 0.28.0 to 0.28.1 in /java/scripts/codegen by @dependabot[bot] in #1649
• Bump the npm_and_yarn group across 2 directories with 2 updates by @dependabot[bot] in #1681
• Standardize README prerequisites across all SDK languages by @scottaddie in #1636
• Update .NET SDK contribution prerequisite by @scottaddie in #1678
• Update @github/copilot to 1.0.63 by @github-actions[bot] in #1686
• Fix Dependabot security alerts: bump esbuild, tsx, js-yaml by @Copilot in #1685
• Rename SystemPromptSections → SystemMessageSections for cross-SDK consistency by @edburns in #1683
• Surface ModelBilling.tokenPrices on public SDK types by @MackinnonBuck in #1633
• Port shouldUseReplacedIdentitySectionInResponse E2E test to dotnet, go, nodejs, python, and rust by @Copilot in #1691
• Generate package-info.java for generated packages by @edburns in #1695
• Update @github/copilot to 1.0.64-0 by @github-actions[bot] in #1697
• fix: skip CLI download in build.rs when DOCS_RS env var is set by @Copilot in #1660
• Update Azure managed identity setup docs by @scottaddie in #1712

New Contributors

• @andyfeller made their first contribution in #1631
• @almaleksia made their first contribution in #1632
• @idryzhov made their first contribution in #1668
• @scottaddie made their first contribution in #1636

Full Changelog: rust/v1.0.1...rust/v1.0.2