Add managed permission settings to session startup

Regenerate RPC and session-event mirrors from @github/copilot 1.0.79-5 and serialize permissions-only managed settings on create and resume across all six SDKs.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: c85d8afb-8b62-4636-9408-7a3ba6a82931

Author: joshspicer

dotnet/src/Client.cs

@@ -785,7 +785,7 @@ private CopilotSession InitializeSession(
         session.RegisterTools(config.Tools ?? []);
         session.RegisterPermissionHandler(
             config.OnPermissionRequest,
-            config.EnableManagedSettings is true);
+            config.EnableManagedSettings is true || config.ManagedSettings is not null);
         session.RegisterMcpAuthHandler(config.OnMcpAuthRequest);
         session.RegisterCommands(config.Commands);
         session.RegisterElicitationHandler(config.OnElicitationRequest);
@@ -1204,6 +1204,7 @@ public async Task<CopilotSession> CreateSessionAsync(SessionConfig config, Cance
                 ToolFilterPrecedence: toolFilter.ToolFilterPrecedence,
                 ExpAssignments: config.ExpAssignments,
                 EnableManagedSettings: config.EnableManagedSettings,
+                ManagedSettings: config.ManagedSettings,
                 GitHubMcpToolConfig: config.GitHubMcpToolConfig,
                 EnableGitHubTelemetryForwarding: _options.OnGitHubTelemetry != null ? true : null,
                 AdditionalDirectories: config.AdditionalDirectories);
@@ -1424,6 +1425,7 @@ public async Task<CopilotSession> ResumeSessionAsync(string sessionId, ResumeSes
                 ToolFilterPrecedence: toolFilter.ToolFilterPrecedence,
                 ExpAssignments: config.ExpAssignments,
                 EnableManagedSettings: config.EnableManagedSettings,
+                ManagedSettings: config.ManagedSettings,
                 GitHubMcpToolConfig: config.GitHubMcpToolConfig,
                 EnableGitHubTelemetryForwarding: _options.OnGitHubTelemetry != null ? true : null,
                 AdditionalDirectories: config.AdditionalDirectories);
@@ -2781,6 +2783,7 @@ internal record CreateSessionRequest(
         OptionsUpdateToolFilterPrecedence? ToolFilterPrecedence = null,
         [property: JsonPropertyName("expAssignments")] CopilotExpAssignmentResponse? ExpAssignments = null,
         [property: JsonPropertyName("enableManagedSettings")] bool? EnableManagedSettings = null,
+        [property: JsonPropertyName("managedSettings")] ManagedSettings? ManagedSettings = null,
         bool? EnableGitHubTelemetryForwarding = null,
         [property: JsonPropertyName("githubMcpToolConfig")] GitHubMcpToolConfig? GitHubMcpToolConfig = null,
         IList<string>? AdditionalDirectories = null);
@@ -2895,6 +2898,7 @@ internal record ResumeSessionRequest(
         OptionsUpdateToolFilterPrecedence? ToolFilterPrecedence = null,
         [property: JsonPropertyName("expAssignments")] CopilotExpAssignmentResponse? ExpAssignments = null,
         [property: JsonPropertyName("enableManagedSettings")] bool? EnableManagedSettings = null,
+        [property: JsonPropertyName("managedSettings")] ManagedSettings? ManagedSettings = null,
         bool? EnableGitHubTelemetryForwarding = null,
         [property: JsonPropertyName("githubMcpToolConfig")] GitHubMcpToolConfig? GitHubMcpToolConfig = null,
         IList<string>? AdditionalDirectories = null);

dotnet/src/Generated/Rpc.cs

@@ -3044,6 +3044,30 @@ public sealed class GitHubMcpToolConfig
     public bool? DisableFormDeferral { get; set; }
 }
 
+/// <summary>Enterprise permission policy injected by an SDK host at session startup.</summary>
+public sealed class ManagedSettingsPermissions
+{
+    /// <summary>When set to <c>"disable"</c>, prevents bypass permission modes.</summary>
+    [JsonPropertyName("disableBypassPermissionsMode")]
+    public string? DisableBypassPermissionsMode { get; set; }
+
+    /// <summary>Permission rules that block matching operations.</summary>
+    public IList<string>? Deny { get; set; }
+
+    /// <summary>Permission rules that require explicit approval.</summary>
+    public IList<string>? Ask { get; set; }
+
+    /// <summary>Permission rules that allow matching operations.</summary>
+    public IList<string>? Allow { get; set; }
+}
+
+/// <summary>Permissions-only managed settings injected by an SDK host.</summary>
+public sealed class ManagedSettings
+{
+    /// <summary>Gets or sets the managed permission policy.</summary>
+    public ManagedSettingsPermissions? Permissions { get; set; }
+}
+
 /// <summary>
 /// Shared configuration properties for creating or resuming a Copilot session.
 /// Use <see cref="SessionConfig"/> when creating a new session, or
@@ -3136,6 +3160,7 @@ protected SessionConfigBase(SessionConfigBase? other)
         RemoteSession = other.RemoteSession;
         ExpAssignments = other.ExpAssignments;
         EnableManagedSettings = other.EnableManagedSettings;
+        ManagedSettings = other.ManagedSettings;
 #pragma warning disable GHCP001
         Canvases = other.Canvases is not null ? [.. other.Canvases] : null;
         RequestCanvasRenderer = other.RequestCanvasRenderer;
@@ -3601,6 +3626,13 @@ protected SessionConfigBase(SessionConfigBase? other)
     /// </summary>
     public bool? EnableManagedSettings { get; set; }
 
+    /// <summary>
+    /// Gets or sets permissions-only managed settings injected at session
+    /// create or resume. This is independent of <see cref="EnableManagedSettings"/>
+    /// and must be re-supplied on resume because it is not persisted.
+    /// </summary>
+    public ManagedSettings? ManagedSettings { get; set; }
+
 #pragma warning disable GHCP001
     /// <summary>
     /// Canvas declarations advertised by this connection. The runtime forwards

dotnet/src/Generated/SessionEvents.cs

@@ -480,6 +480,46 @@ public async Task Generated_Session_Rpc_Throws_When_Session_Disposed()
         await Assert.ThrowsAsync<ObjectDisposedException>(() => session.Rpc.Model.GetCurrentAsync());
     }
 
+    [Fact]
+    public async Task Create_And_Resume_Serialize_ManagedSettings()
+    {
+        await using var server = await FakeCopilotServer.StartAsync();
+        await using var client = new CopilotClient(new CopilotClientOptions { Connection = RuntimeConnection.ForUri(server.Url) });
+        await client.StartAsync();
+        var settings = new ManagedSettings
+        {
+            Permissions = new ManagedSettingsPermissions
+            {
+                DisableBypassPermissionsMode = "disable",
+                Deny = ["shell(rm*)"],
+                Ask = [],
+                Allow = []
+            }
+        };
+
+        await using var created = await client.CreateSessionAsync(new SessionConfig
+        {
+            ManagedSettings = settings,
+            OnPermissionRequest = PermissionHandler.ApproveAll
+        });
+        await using var resumed = await client.ResumeSessionAsync("session-managed", new ResumeSessionConfig
+        {
+            ManagedSettings = settings,
+            OnPermissionRequest = PermissionHandler.ApproveAll,
+            OnEvent = _ => { }
+        });
+
+        foreach (var method in new[] { "session.create", "session.resume" })
+        {
+            var request = Assert.Single(server.Requests, request => request.Method == method);
+            Assert.False(request.Params.TryGetProperty("enableManagedSettings", out _));
+            var permissions = request.Params.GetProperty("managedSettings").GetProperty("permissions");
+            Assert.Equal("disable", permissions.GetProperty("disableBypassPermissionsMode").GetString());
+            Assert.Empty(permissions.GetProperty("ask").EnumerateArray());
+            Assert.Empty(permissions.GetProperty("allow").EnumerateArray());
+        }
+    }
+
     [MethodImpl(MethodImplOptions.NoInlining)]
     private static async Task<WeakReference<CopilotSession>> CreateDroppedSessionAsync(CopilotClient client)
     {

dotnet/src/Types.cs

@@ -750,6 +750,10 @@ func extractTransformCallbacks(config *SystemMessageConfig) (*SystemMessageConfi
 	return wireConfig, callbacks
 }
 
+func hasManagedSettings(enableManagedSettings *bool, managedSettings *rpc.SessionManagedSettings) bool {
+	return (enableManagedSettings != nil && *enableManagedSettings) || managedSettings != nil
+}
+
 func (c *Client) CreateSession(ctx context.Context, config *SessionConfig) (*Session, error) {
 	if config == nil {
 		config = &SessionConfig{}
@@ -833,6 +837,7 @@ func (c *Client) CreateSession(ctx context.Context, config *SessionConfig) (*Ses
 	req.ExtensionInfo = config.ExtensionInfo
 	req.ExpAssignments = config.ExpAssignments
 	req.EnableManagedSettings = config.EnableManagedSettings
+	req.ManagedSettings = config.ManagedSettings
 
 	if len(config.Commands) > 0 {
 		cmds := make([]wireCommand, 0, len(config.Commands))
@@ -917,7 +922,7 @@ func (c *Client) CreateSession(ctx context.Context, config *SessionConfig) (*Ses
 			sessionID,
 			c.client,
 			"",
-			config.EnableManagedSettings != nil && *config.EnableManagedSettings,
+			hasManagedSettings(config.EnableManagedSettings, config.ManagedSettings),
 		)
 
 		s.registerTools(config.Tools)
@@ -1215,6 +1220,7 @@ func (c *Client) ResumeSessionWithOptions(ctx context.Context, sessionID string,
 	req.ExtensionInfo = config.ExtensionInfo
 	req.ExpAssignments = config.ExpAssignments
 	req.EnableManagedSettings = config.EnableManagedSettings
+	req.ManagedSettings = config.ManagedSettings
 	if config.OnPermissionRequest != nil {
 		req.RequestPermission = Bool(true)
 	}
@@ -1250,7 +1256,7 @@ func (c *Client) ResumeSessionWithOptions(ctx context.Context, sessionID string,
 		sessionID,
 		c.client,
 		"",
-		config.EnableManagedSettings != nil && *config.EnableManagedSettings,
+		hasManagedSettings(config.EnableManagedSettings, config.ManagedSettings),
 	)
 
 	session.registerTools(config.Tools)