chore(deps): bump @github/copilot-sdk from 1.0.11 to 1.0.14

[dependabot]

Bumps @github/copilot-sdk from 1.0.11 to 1.0.14.

Release notes

Sourced from @​github/copilot-sdk's releases.

v1.0.14

Feature: typed message provenance for user, system, and agent sources

Messages sent through the SDK can now carry typed source provenance, distinguishing human user input, internal system injections, and identified agent- senders, so recipients can reliably tell agent input from human authorization. (#2573)

await session.send("Looks good to me.", { source: "agent-reviewer" });

await session.send("Looks good to me.", source=AgentMessageSource("reviewer"))

Feature: Auto model routing Fast tier

Sessions using auto model routing can now select the fast tier alongside the existing efficiency, balance, and intelligence tiers, giving integrators a latency-focused routing preset across all six SDKs. (#2669)

await session.setAutoTier("fast");

Feature: force-refresh managed settings cache

The new managedSettings.clearCache RPC method wipes the persistent server-policy cache and drops the runtime's in-memory retained policy, giving hosts a primitive for a "force refresh account policy" action. (#2438)

await client.rpc.managedSettings.clearCache();

await client.Rpc.ManagedSettings.ClearCacheAsync();

Feature: Rust SDK model allowlists

SessionConfig and ResumeSessionConfig in the Rust SDK now accept an optional allowed_models list, letting hosts restrict which model IDs a session may use without duplicating runtime validation. (#2512)

let config = SessionConfig::default().with_allowed_models(["gpt-4o", "claude-3.7-sonnet"]);

Other changes

• feature: [Core] add factory pause checkpoints for the Node.js Agent Factories API, letting a paused run resume without losing invocation limits or execution identity (#2537)
• feature: forward the optional host OAuth client metadata URL across all six SDKs on session create and resume (#2258)
• feature: [TypeScript] add max_output_tokens to the model capabilities override, previously unreachable without an unsafe cast (#2569)
• bugfix: [.NET] include Copilot CLI runtime assets in PackAsTool packages so dotnet pack --no-build produces a working tool (#2557)
• bugfix: apply the runtime's connection_close callback-quiescence contract consistently across all six in-process C ABI adapters, preventing races with freed callback state during disposal (#2610, #2622)
• bugfix: [Rust] fix codegen for CLI 1.0.84 schemas, correctly mapping the CatalogTrustEligibility unknown value and re-exporting shared session-event types (#2631)
• bugfix: [C#] fix codegen for runtime schema unions, unblocking single-variant anyOf/oneOf handling (#2656)

... (truncated)

Changelog

Sourced from @​github/copilot-sdk's changelog.

v1.0.14 (2026-09-16)

Feature: typed message provenance for user, system, and agent sources

Messages sent through the SDK can now carry typed source provenance, distinguishing human user input, internal system injections, and identified agent- senders, so recipients can reliably tell agent input from human authorization. (#2573)

await session.send("Looks good to me.", { source: "agent-reviewer" });

await session.send("Looks good to me.", source=AgentMessageSource("reviewer"))

Feature: Auto model routing Fast tier

Sessions using auto model routing can now select the fast tier alongside the existing efficiency, balance, and intelligence tiers, giving integrators a latency-focused routing preset across all six SDKs. (#2669)

await session.setAutoTier("fast");

Feature: force-refresh managed settings cache

The new managedSettings.clearCache RPC method wipes the persistent server-policy cache and drops the runtime's in-memory retained policy, giving hosts a primitive for a "force refresh account policy" action. (#2438)

await client.rpc.managedSettings.clearCache();

await client.Rpc.ManagedSettings.ClearCacheAsync();

Feature: Rust SDK model allowlists

SessionConfig and ResumeSessionConfig in the Rust SDK now accept an optional allowed_models list, letting hosts restrict which model IDs a session may use without duplicating runtime validation. (#2512)

let config = SessionConfig::default().with_allowed_models(["gpt-4o", "claude-3.7-sonnet"]);

Other changes

• feature: [Core] add factory pause checkpoints for the Node.js Agent Factories API, letting a paused run resume without losing invocation limits or execution identity (#2537)
• feature: forward the optional host OAuth client metadata URL across all six SDKs on session create and resume (#2258)
• feature: [TypeScript] add max_output_tokens to the model capabilities override, previously unreachable without an unsafe cast (#2569)
• bugfix: [.NET] include Copilot CLI runtime assets in PackAsTool packages so dotnet pack --no-build produces a working tool (#2557)
• bugfix: apply the runtime's connection_close callback-quiescence contract consistently across all six in-process C ABI adapters, preventing races with freed callback state during disposal (#2610, #2622)
• bugfix: [Rust] fix codegen for CLI 1.0.84 schemas, correctly mapping the CatalogTrustEligibility unknown value and re-exporting shared session-event types (#2631)

... (truncated)

Commits

• e60d903 Complete Fast Auto-tier support across SDKs (#2669)
• db6bd6f Clarify runtime-backed SDK publishing (#2689)
• 583f8f1 Update Copilot CLI to 1.0.85 (#2688)
• 062ee60 Stabilize session lifecycle E2E tests (#2687)
• 7f86a90 Harden Rust CLI download retries (#2663)
• b47310c Add runtime-driven canary and unstable SDK publishing (#2544)
• f60f9d4 Add Rust SDK model allowlist support (#2512)
• e9df393 Publish .NET SDK to the internal feed (#2614)
• 9553d52 Isolate hostless runtime cache (#2659)
• a675b55 Stabilize C# rewind E2E initialization (#2661)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: e9addda5-7bc9-4391-a916-525b79e3bd98

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}