feat: add granular per-session flags for multitenancy hardening by MackinnonBuck · Pull Request #1474 · github/copilot-sdk

MackinnonBuck · 2026-05-27T23:53:17Z

Summary

Add 8 new optional fields to SessionConfigBase across all 6 SDK languages (Node.js, Go, Python, .NET, Rust, Java) for granular per-session control of host-level features in multitenant deployments.

Fixes https://github.com/github/copilot-agent-runtime/issues/7156

New fields

Field	Type	Purpose
`skipEmbeddingRetrieval`	`boolean?`	Prevent cross-session info leakage via shared embedding cache
`organizationCustomInstructions`	`string?`	Inject org-level custom instructions into system prompt
`enableOnDemandInstructionDiscovery`	`boolean?`	Control instruction file discovery after file views
`enableFileHooks`	`boolean?`	Control loading of file-based hooks from `.github/hooks/`
`enableHostGitOperations`	`boolean?`	Control git operations on host filesystem
`enableSessionStore`	`boolean?`	Control cross-session store for search/retrieval
`enableSkills`	`boolean?`	Control skill loading (builtin + discovered)
`embeddingCacheStorage`	`string?`	Control embedding cache storage strategy (`"persistent"` or `"in-memory"`)

Design decisions

All fields are optional -- undefined/nil/null/None means "use runtime default"
No SDK-side default coercion -- values pass through directly to the runtime
Empty mode applies restrictive defaults (skipEmbeddingRetrieval: true, all enable*: false, embeddingCacheStorage: "in-memory") for secure multitenant deployments
organizationCustomInstructions has no empty-mode default (it's host-supplied content, not a toggle)

Changes per language

Node.js: types.ts (interface), client.ts (wire + empty defaults), toolSet.test.ts (5 new tests)
Go: types.go (structs), client.go (wire), mode_empty.go (defaults), toolset_test.go (3 new tests)
Python: client.py (params + wire), _mode.py (defaults), test_tool_set.py (tests)
.NET: Types.cs (properties), Client.cs (wire + defaults), ClientOptionsE2ETests.cs (tests)
Rust: types.rs (structs + builders), wire.rs (wire structs), session.rs (mapping)
Java: SessionConfig.java, CreateSessionRequest.java, ResumeSessionRequest.java, ResumeSessionConfig.java, SessionRequestBuilder.java (wiring), CopilotClient.java (empty-mode defaults)

Testing

All 6 SDKs compile cleanly
Go unit tests pass
Node.js, .NET, Python validated via compilation/import checks

Add 7 new optional fields to SessionConfigBase across all 6 SDK languages (Node.js, Go, Python, .NET, Rust, Java): - skipEmbeddingRetrieval: prevent cross-session info leakage via embedding cache - organizationCustomInstructions: inject org-level instructions into system prompt - enableOnDemandInstructionDiscovery: control instruction file discovery after file views - enableFileHooks: control loading of file-based hooks from .github/hooks/ - enableHostGitOperations: control git operations on host filesystem - enableSessionStore: control cross-session store for search/retrieval - enableSkills: control skill loading (builtin + discovered) All fields are optional and pass through to the runtime without SDK-side default coercion. Empty mode applies restrictive defaults for multitenancy. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Adds a set of optional, per-session “granular multitenancy” flags across all SDKs to let hosts selectively disable host-level features (embedding retrieval, instruction discovery, file hooks, git ops, session store, skills) and to optionally inject organization-scoped instructions, with restrictive safe-defaults applied in “empty” mode.

Changes:

Introduces 7 new session config fields and wires them through session.create / session.resume payloads across Node.js, Go, Python, .NET, Rust, and Java.
Applies “empty” mode restrictive defaults for the new flags (skip embeddings on; enable* off) while preserving caller overrides.
Adds/extends tests (notably Node/Go/.NET/Java) to validate defaulting and wire propagation.

Show a summary per file

File	Description
rust/src/wire.rs	Extends Rust create/resume wire structs with the new optional fields (camelCase on the wire).
rust/src/types.rs	Adds new config fields, defaults, builders, and wires them into `into_wire` for create/resume.
rust/src/session.rs	Applies “empty” mode restrictive defaults for the new flags during create/resume.
python/test_tool_set.py	Updates test imports for new empty-mode default helpers (currently introduces unused imports).
python/copilot/client.py	Adds new kwargs, empty-mode defaulting, and JSON payload fields for create/resume.
python/copilot/_mode.py	Factors out a generic empty-mode default helper and adds new defaulting functions.
nodejs/test/toolSet.test.ts	Adds tests covering empty-mode defaults, overrides, pass-through, and resume behavior.
nodejs/src/types.ts	Adds new `SessionConfigBase` fields and JSDoc describing the flags.
nodejs/src/client.ts	Applies empty-mode defaults and forwards new fields on create/resume requests.
java/src/test/java/com/github/copilot/SessionRequestBuilderTest.java	Adds tests verifying propagation of new fields into create/resume requests.
java/src/test/java/com/github/copilot/OptionalApiAndJacksonTest.java	Adds tests validating Optional/null behavior for the new config fields.
java/src/test/java/com/github/copilot/ConfigCloneTest.java	Adds tests ensuring clone preserves the new fields.
java/src/main/java/com/github/copilot/SessionRequestBuilder.java	Wires new config fields into create/resume request builders.
java/src/main/java/com/github/copilot/rpc/SessionConfig.java	Adds new config fields + fluent accessors/clearers, and clone support.
java/src/main/java/com/github/copilot/rpc/ResumeSessionConfig.java	Adds new resume config fields + fluent accessors/clearers, and clone support.
java/src/main/java/com/github/copilot/rpc/CreateSessionRequest.java	Adds new wire fields with Jackson annotations + accessors.
java/src/main/java/com/github/copilot/rpc/ResumeSessionRequest.java	Adds new wire fields with Jackson annotations + accessors.
go/types.go	Adds new config fields and wire request fields for create/resume.
go/toolset_test.go	Adds tests for empty-mode defaults, override precedence, and non-empty mode behavior.
go/mode_empty.go	Applies empty-mode defaults for the new flags on create and resume configs.
go/client.go	Forwards new config fields into the create/resume wire requests.
dotnet/test/E2E/ClientOptionsE2ETests.cs	Adds E2E assertions for create/resume wire propagation and empty-mode defaults.
dotnet/src/Types.cs	Adds new per-session config properties and copy-constructor propagation.
dotnet/src/Client.cs	Applies empty-mode defaults and forwards new fields into create/resume request records.

Copilot's findings

Files reviewed: 24/24 changed files
Comments generated: 7

github-actions

Generated by SDK Consistency Review Agent for issue #1474 · ● 5.1M

SteveSandersonMS

Great! Thanks for getting all these in.

Some of the CCR comments look valid - approving now to keep things unblocked.

- Go: change OrganizationCustomInstructions to *string for cross-SDK consistency - Go: clarify *bool field docs (nil = runtime default, non-nil = forwarded) - Rust: redact organization_custom_instructions in Debug impls - Node.js: clarify JSDoc defaults apply only in empty mode - Python: replace unused imports with parametrized tests Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Merge origin/main into feature branch. Conflicts resolved in: - dotnet/src/Types.cs: added EnableMcpApps alongside our 7 new fields - go/types.go: merged wire structs with new fields from both sides (ReasoningSummary, PluginDirectories, LargeOutput, RequestMcpApps from main) - rust/src/types.rs: merged enable_mcp_apps field and builder methods alongside our 7 granular multitenancy fields - java SessionRequestBuilderTest: kept both our new tests and main's new tests Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Adds embeddingCacheStorage field ("persistent" | "in-memory") to session create and resume across all 6 SDKs. In empty mode, defaults to "in-memory" for multitenant isolation. Companion to runtime PR #8388. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…nular-multitenancy-flags # Conflicts: # dotnet/src/Client.cs # go/mode_empty.go # go/toolset_test.go # go/types.go # java/src/main/java/com/github/copilot/CopilotClient.java # java/src/test/java/com/github/copilot/SessionRequestBuilderTest.java # nodejs/src/client.ts # python/copilot/_mode.py # python/copilot/client.py

github-actions

Generated by SDK Consistency Review Agent for issue #1474 · ● 5.4M

… improve tests - Run formatters across all SDKs (prettier, gofmt, ruff, cargo fmt, spotless, dotnet format) - Convert EmbeddingCacheStorage from string to EmbeddingCacheStorageMode enum in .NET - Rename test methods to avoid temporal wording - Expand EnableFileHooks doc comment in Go ResumeSessionConfig - Add embeddingCacheStorage test coverage in Go, Java Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Simplify doc comments across all SDKs to focus on user-facing behavior rather than SDK-to-runtime interaction details. Removes boilerplate like 'When nil, the runtime default is used. When non-nil, the value is passed through to the runtime.' in favor of concise, behavior-focused docs that match the existing style of other properties. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Rename to use 'granularMultitenancyFields' instead of 'newSessionFields' for consistency with .NET and Node.js test naming. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions

Generated by SDK Consistency Review Agent for issue #1474 · ● 7.2M

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The Cross-SDK Consistency Review identified that Java was only applying embeddingCacheStorage and mcpOAuthTokenStorage in empty mode, but missing the 6 boolean flags (skipEmbeddingRetrieval, enableOnDemandInstructionDiscovery, enableFileHooks, enableHostGitOperations, enableSessionStore, enableSkills). Also adds embeddingCacheStorage assertion to Node.js empty-mode test for coverage parity with Go and .NET. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions

Generated by SDK Consistency Review Agent for issue #1474 · ● 7.5M

@return

* feat: add granular per-session flags for multitenancy hardening Add 7 new optional fields to SessionConfigBase across all 6 SDK languages (Node.js, Go, Python, .NET, Rust, Java): - skipEmbeddingRetrieval: prevent cross-session info leakage via embedding cache - organizationCustomInstructions: inject org-level instructions into system prompt - enableOnDemandInstructionDiscovery: control instruction file discovery after file views - enableFileHooks: control loading of file-based hooks from .github/hooks/ - enableHostGitOperations: control git operations on host filesystem - enableSessionStore: control cross-session store for search/retrieval - enableSkills: control skill loading (builtin + discovered) All fields are optional and pass through to the runtime without SDK-side default coercion. Empty mode applies restrictive defaults for multitenancy. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * address PR review feedback - Go: change OrganizationCustomInstructions to *string for cross-SDK consistency - Go: clarify *bool field docs (nil = runtime default, non-nil = forwarded) - Rust: redact organization_custom_instructions in Debug impls - Node.js: clarify JSDoc defaults apply only in empty mode - Python: replace unused imports with parametrized tests Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * feat: add embeddingCacheStorage per-session option across all SDKs Adds embeddingCacheStorage field ("persistent" | "in-memory") to session create and resume across all 6 SDKs. In empty mode, defaults to "in-memory" for multitenant isolation. Companion to runtime PR #8388. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: apply formatting, convert EmbeddingCacheStorage to enum in .NET, improve tests - Run formatters across all SDKs (prettier, gofmt, ruff, cargo fmt, spotless, dotnet format) - Convert EmbeddingCacheStorage from string to EmbeddingCacheStorageMode enum in .NET - Rename test methods to avoid temporal wording - Expand EnableFileHooks doc comment in Go ResumeSessionConfig - Add embeddingCacheStorage test coverage in Go, Java Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: remove runtime implementation details from property docs Simplify doc comments across all SDKs to focus on user-facing behavior rather than SDK-to-runtime interaction details. Removes boilerplate like 'When nil, the runtime default is used. When non-nil, the value is passed through to the runtime.' in favor of concise, behavior-focused docs that match the existing style of other properties. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: rename Java test methods to remove temporal 'new' wording Rename to use 'granularMultitenancyFields' instead of 'newSessionFields' for consistency with .NET and Node.js test naming. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: resolve Python SDK test failures Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: add missing Java empty-mode defaults for granular flags The Cross-SDK Consistency Review identified that Java was only applying embeddingCacheStorage and mcpOAuthTokenStorage in empty mode, but missing the 6 boolean flags (skipEmbeddingRetrieval, enableOnDemandInstructionDiscovery, enableFileHooks, enableHostGitOperations, enableSessionStore, enableSkills). Also adds embeddingCacheStorage assertion to Node.js empty-mode test for coverage parity with Go and .NET. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(rust): add embedding_cache_storage to Debug impls and builder API Add the missing embedding_cache_storage field to: - SessionConfig custom Debug impl - ResumeSessionConfig custom Debug impl - SessionConfig fluent builder (with_embedding_cache_storage) - ResumeSessionConfig fluent builder (with_embedding_cache_storage) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: .NET empty-mode tests and Java enableConfigDiscovery docs - Add BaseDirectory and AvailableTools to .NET empty-mode default tests so they don't throw at client construction time - Fix enableConfigDiscovery Javadoc in ResumeSessionConfig: use Optional.empty() instead of null in @return, remove null from @param (setter takes primitive boolean) - Fix stale 'runtime default' wording in SessionConfig.java getter Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

@return

* feat: add granular per-session flags for multitenancy hardening Add 7 new optional fields to SessionConfigBase across all 6 SDK languages (Node.js, Go, Python, .NET, Rust, Java): - skipEmbeddingRetrieval: prevent cross-session info leakage via embedding cache - organizationCustomInstructions: inject org-level instructions into system prompt - enableOnDemandInstructionDiscovery: control instruction file discovery after file views - enableFileHooks: control loading of file-based hooks from .github/hooks/ - enableHostGitOperations: control git operations on host filesystem - enableSessionStore: control cross-session store for search/retrieval - enableSkills: control skill loading (builtin + discovered) All fields are optional and pass through to the runtime without SDK-side default coercion. Empty mode applies restrictive defaults for multitenancy. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * address PR review feedback - Go: change OrganizationCustomInstructions to *string for cross-SDK consistency - Go: clarify *bool field docs (nil = runtime default, non-nil = forwarded) - Rust: redact organization_custom_instructions in Debug impls - Node.js: clarify JSDoc defaults apply only in empty mode - Python: replace unused imports with parametrized tests Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * feat: add embeddingCacheStorage per-session option across all SDKs Adds embeddingCacheStorage field ("persistent" | "in-memory") to session create and resume across all 6 SDKs. In empty mode, defaults to "in-memory" for multitenant isolation. Companion to runtime PR #8388. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: apply formatting, convert EmbeddingCacheStorage to enum in .NET, improve tests - Run formatters across all SDKs (prettier, gofmt, ruff, cargo fmt, spotless, dotnet format) - Convert EmbeddingCacheStorage from string to EmbeddingCacheStorageMode enum in .NET - Rename test methods to avoid temporal wording - Expand EnableFileHooks doc comment in Go ResumeSessionConfig - Add embeddingCacheStorage test coverage in Go, Java Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: remove runtime implementation details from property docs Simplify doc comments across all SDKs to focus on user-facing behavior rather than SDK-to-runtime interaction details. Removes boilerplate like 'When nil, the runtime default is used. When non-nil, the value is passed through to the runtime.' in favor of concise, behavior-focused docs that match the existing style of other properties. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: rename Java test methods to remove temporal 'new' wording Rename to use 'granularMultitenancyFields' instead of 'newSessionFields' for consistency with .NET and Node.js test naming. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: resolve Python SDK test failures Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: add missing Java empty-mode defaults for granular flags The Cross-SDK Consistency Review identified that Java was only applying embeddingCacheStorage and mcpOAuthTokenStorage in empty mode, but missing the 6 boolean flags (skipEmbeddingRetrieval, enableOnDemandInstructionDiscovery, enableFileHooks, enableHostGitOperations, enableSessionStore, enableSkills). Also adds embeddingCacheStorage assertion to Node.js empty-mode test for coverage parity with Go and .NET. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(rust): add embedding_cache_storage to Debug impls and builder API Add the missing embedding_cache_storage field to: - SessionConfig custom Debug impl - ResumeSessionConfig custom Debug impl - SessionConfig fluent builder (with_embedding_cache_storage) - ResumeSessionConfig fluent builder (with_embedding_cache_storage) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: .NET empty-mode tests and Java enableConfigDiscovery docs - Add BaseDirectory and AvailableTools to .NET empty-mode default tests so they don't throw at client construction time - Fix enableConfigDiscovery Javadoc in ResumeSessionConfig: use Optional.empty() instead of null in @return, remove null from @param (setter takes primitive boolean) - Fix stale 'runtime default' wording in SessionConfig.java getter Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings May 27, 2026 23:53

MackinnonBuck requested a review from a team as a code owner May 27, 2026 23:53

Copilot started reviewing on behalf of MackinnonBuck May 27, 2026 23:53 View session

MackinnonBuck marked this pull request as draft May 27, 2026 23:55

MackinnonBuck changed the title ~~feat: add granular per-session flags for multitenancy hardening (#7156)~~ feat: add granular per-session flags for multitenancy hardening May 27, 2026

Copilot AI reviewed May 27, 2026

View reviewed changes

Comment thread python/test_tool_set.py

Comment thread rust/src/types.rs

Comment thread rust/src/types.rs

Comment thread nodejs/src/types.ts

Comment thread go/types.go Outdated

Comment thread go/types.go

Comment thread go/types.go Outdated

This comment has been minimized.

Sign in to view

github-actions Bot reviewed May 27, 2026

View reviewed changes

Comment thread go/types.go Outdated

SteveSandersonMS approved these changes May 28, 2026

View reviewed changes

MackinnonBuck marked this pull request as ready for review May 28, 2026 19:54

This comment has been minimized.

Sign in to view

MackinnonBuck and others added 2 commits May 28, 2026 13:59

This comment has been minimized.

Sign in to view

github-actions Bot reviewed May 28, 2026

View reviewed changes

Comment thread python/copilot/client.py

This comment has been minimized.

Sign in to view

MackinnonBuck and others added 2 commits May 28, 2026 15:24

test: rename Java test methods to remove temporal 'new' wording

7a12e34

Rename to use 'granularMultitenancyFields' instead of 'newSessionFields' for consistency with .NET and Node.js test naming. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

This comment has been minimized.

Sign in to view

github-actions Bot reviewed May 28, 2026

View reviewed changes

Comment thread java/src/main/java/com/github/copilot/CopilotClient.java

MackinnonBuck and others added 2 commits May 28, 2026 15:36

fix: resolve Python SDK test failures

a630379

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

MackinnonBuck requested a review from Copilot May 28, 2026 22:41

Copilot started reviewing on behalf of MackinnonBuck May 28, 2026 22:41 View session

This comment has been minimized.

Sign in to view

github-actions Bot reviewed May 28, 2026

View reviewed changes

Comment thread rust/src/types.rs

Comment thread rust/src/types.rs

This was referenced Aug 1, 2026

Bump the agents group with 6 updates ivanrdvc/aporia#69

Open

Bump GitHub.Copilot.SDK from 0.1.29 to 1.0.8 ivanrdvc/aporia#72

Open

dependabot Bot mentioned this pull request Aug 5, 2026

Bump GitHub.Copilot.SDK from 1.0.0-beta.4 to 1.0.8 tinocoh/azure-finops-agent#16

Open

Uh oh!

Conversation

MackinnonBuck commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

New fields

Design decisions

Changes per language

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

SteveSandersonMS left a comment

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment has been minimized.

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

MackinnonBuck commented May 27, 2026 •

edited

Loading