Clarify permission failure diagnostics

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: joshspicer

nodejs/src/session.ts

@@ -703,7 +703,11 @@ export class CopilotSession {
             if (this.disconnected) {
                 return;
             }
-            console.error("Permission handler failed", error);
+            console.error("Permission handler failed", {
+                sessionId: this.sessionId,
+                requestId,
+                error,
+            });
             try {
                 await this.rpc.permissions.handlePendingPermissionRequest({
                     requestId,

python/README.md

@@ -857,7 +857,7 @@ session events.
 | `PermissionDecisionApproveOnce()`             | Allow this single request                                                                   |
 | `PermissionDecisionReject(feedback="…")`      | Deny the request (optional feedback string forwarded to the LLM)                            |
 | `PermissionDecisionUserNotAvailable()`        | Deny the request because no user is available to confirm it (the default)                   |
-| `PermissionNoResult()`                        | Suppress this SDK client's response so another connected client can answer the pending request |
+| `PermissionNoResult()`                        | During event-based dispatch, suppress this SDK client's response so another connected client can answer the pending request; legacy direct callbacks cannot abstain |
 
 Several richer variants (``PermissionDecisionApproveForSession``,
 ``PermissionDecisionApproveForLocation``, ``PermissionDecisionApprovePermanently``,

python/copilot/session.py

@@ -342,10 +342,11 @@ class SystemMessageCustomizeConfig(TypedDict, total=False):
 
 @dataclass
 class PermissionNoResult:
-    """Sentinel returned by a permission handler to leave the request unanswered.
+    """Sentinel that leaves an event-dispatched permission request unanswered.
 
-    The SDK suppresses its response so another connected client, such as a
-    human-facing host, can answer the pending request.
+    During event-based permission dispatch, the SDK suppresses its response so
+    another connected client, such as a human-facing host, can answer the pending
+    request. Legacy direct callbacks require a concrete decision and cannot abstain.
     """
 
     kind: Literal["no-result"] = "no-result"