Forward enableManagedSettings in session.create (all SDKs)

dotnet/src/Client.cs

@@ -1091,6 +1091,7 @@ public async Task<CopilotSession> CreateSessionAsync(SessionConfig config, Cance
                 Models: config.Models,
                 ToolFilterPrecedence: toolFilter.ToolFilterPrecedence,
                 ExpAssignments: config.ExpAssignments,
+                EnableManagedSettings: config.EnableManagedSettings,
                 EnableGitHubTelemetryForwarding: _options.OnGitHubTelemetry != null ? true : null);
 
             var rpcTimestamp = Stopwatch.GetTimestamp();
@@ -1301,6 +1302,7 @@ public async Task<CopilotSession> ResumeSessionAsync(string sessionId, ResumeSes
                 Models: config.Models,
                 ToolFilterPrecedence: toolFilter.ToolFilterPrecedence,
                 ExpAssignments: config.ExpAssignments,
+                EnableManagedSettings: config.EnableManagedSettings,
                 EnableGitHubTelemetryForwarding: _options.OnGitHubTelemetry != null ? true : null);
 
             var rpcTimestamp = Stopwatch.GetTimestamp();
@@ -2624,6 +2626,7 @@ internal record CreateSessionRequest(
         IList<ProviderModelConfig>? Models = null,
         OptionsUpdateToolFilterPrecedence? ToolFilterPrecedence = null,
         [property: JsonPropertyName("expAssignments")] JsonElement? ExpAssignments = null,
+        [property: JsonPropertyName("enableManagedSettings")] bool? EnableManagedSettings = null,
         bool? EnableGitHubTelemetryForwarding = null);
 #pragma warning restore GHCP001
 
@@ -2724,6 +2727,7 @@ internal record ResumeSessionRequest(
         IList<ProviderModelConfig>? Models = null,
         OptionsUpdateToolFilterPrecedence? ToolFilterPrecedence = null,
         [property: JsonPropertyName("expAssignments")] JsonElement? ExpAssignments = null,
+        [property: JsonPropertyName("enableManagedSettings")] bool? EnableManagedSettings = null,
         bool? EnableGitHubTelemetryForwarding = null);
 #pragma warning restore GHCP001
 

dotnet/src/Types.cs

@@ -2841,6 +2841,7 @@ protected SessionConfigBase(SessionConfigBase? other)
         GitHubToken = other.GitHubToken;
         RemoteSession = other.RemoteSession;
         ExpAssignments = other.ExpAssignments;
+        EnableManagedSettings = other.EnableManagedSettings;
 #pragma warning disable GHCP001
         Canvases = other.Canvases is not null ? [.. other.Canvases] : null;
         RequestCanvasRenderer = other.RequestCanvasRenderer;
@@ -3265,6 +3266,16 @@ protected SessionConfigBase(SessionConfigBase? other)
     [EditorBrowsable(EditorBrowsableState.Never)]
     public JsonElement? ExpAssignments { get; set; }
 
+    /// <summary>
+    /// Opt-in: when <c>true</c>, the runtime self-fetches enterprise managed
+    /// settings (bypass-permissions policy) at session bootstrap using the
+    /// session's <see cref="GitHubToken"/>. Requires <see cref="GitHubToken"/> to
+    /// be set; if omitted, the runtime is expected to reject session creation
+    /// (fail-closed). When unset, behaves exactly as before. Serialized on the
+    /// wire as <c>enableManagedSettings</c>.
+    /// </summary>
+    public bool? EnableManagedSettings { get; set; }
+
 #pragma warning disable GHCP001
     /// <summary>
     /// Canvas declarations advertised by this connection. The runtime forwards

go/client.go

@@ -732,6 +732,7 @@ func (c *Client) CreateSession(ctx context.Context, config *SessionConfig) (*Ses
 	req.ExtensionSDKPath = config.ExtensionSDKPath
 	req.ExtensionInfo = config.ExtensionInfo
 	req.ExpAssignments = config.ExpAssignments
+	req.EnableManagedSettings = config.EnableManagedSettings
 
 	if len(config.Commands) > 0 {
 		cmds := make([]wireCommand, 0, len(config.Commands))
@@ -1095,6 +1096,7 @@ func (c *Client) ResumeSessionWithOptions(ctx context.Context, sessionID string,
 	req.ExtensionSDKPath = config.ExtensionSDKPath
 	req.ExtensionInfo = config.ExtensionInfo
 	req.ExpAssignments = config.ExpAssignments
+	req.EnableManagedSettings = config.EnableManagedSettings
 	if config.OnPermissionRequest != nil {
 		req.RequestPermission = Bool(true)
 	}

go/types.go

@@ -1247,6 +1247,12 @@ type SessionConfig struct {
 	// intended for trusted out-of-process integrators, and is not intended for
 	// general external use.
 	ExpAssignments any
+	// EnableManagedSettings, when set to true, opts the runtime into
+	// self-fetching enterprise managed settings (bypass-permissions policy) at
+	// session bootstrap using the session's GitHubToken. Requires GitHubToken to
+	// be set; if omitted, the runtime is expected to reject session creation
+	// (fail-closed). Unset behaves exactly as before.
+	EnableManagedSettings *bool
 }
 
 // ToolDefer controls whether a tool may be deferred (loaded lazily via tool
@@ -1668,6 +1674,10 @@ type ResumeSessionConfig struct {
 	// intended for trusted out-of-process integrators, and is not intended for
 	// general external use.
 	ExpAssignments any
+	// EnableManagedSettings injects the same opt-in flag on resume. See
+	// SessionConfig.EnableManagedSettings. Re-supply on resume so the runtime
+	// re-applies the managed-settings self-fetch after a CLI process restart.
+	EnableManagedSettings *bool
 }
 
 // ProviderTokenArgs carries the context passed to a [BearerTokenProvider] callback
@@ -2122,6 +2132,7 @@ type createSessionRequest struct {
 	ExtensionSDKPath                   *string                                `json:"extensionSdkPath,omitempty"`
 	ExtensionInfo                      *ExtensionInfo                         `json:"extensionInfo,omitempty"`
 	ExpAssignments                     any                                    `json:"expAssignments,omitempty"`
+	EnableManagedSettings           *bool                                  `json:"enableManagedSettings,omitempty"`
 	Traceparent                        string                                 `json:"traceparent,omitempty"`
 	Tracestate                         string                                 `json:"tracestate,omitempty"`
 }
@@ -2211,6 +2222,7 @@ type resumeSessionRequest struct {
 	ExtensionSDKPath                   *string                                `json:"extensionSdkPath,omitempty"`
 	ExtensionInfo                      *ExtensionInfo                         `json:"extensionInfo,omitempty"`
 	ExpAssignments                     any                                    `json:"expAssignments,omitempty"`
+	EnableManagedSettings           *bool                                  `json:"enableManagedSettings,omitempty"`
 	Traceparent                        string                                 `json:"traceparent,omitempty"`
 	Tracestate                         string                                 `json:"tracestate,omitempty"`
 }

java/src/main/java/com/github/copilot/SessionRequestBuilder.java

@@ -185,6 +185,7 @@ static CreateSessionRequest buildCreateRequest(SessionConfig config, String sess
         request.setRemoteSession(config.getRemoteSession());
         request.setCloud(config.getCloud());
         request.setExpAssignments(config.getExpAssignments());
+        config.getEnableManagedSettings().ifPresent(request::setEnableManagedSettings);
 
         return request;
     }
@@ -306,6 +307,7 @@ static ResumeSessionRequest buildResumeRequest(String sessionId, ResumeSessionCo
         request.setGitHubToken(config.getGitHubToken());
         request.setRemoteSession(config.getRemoteSession());
         request.setExpAssignments(config.getExpAssignments());
+        config.getEnableManagedSettings().ifPresent(request::setEnableManagedSettings);
 
         return request;
     }

java/src/main/java/com/github/copilot/rpc/CreateSessionRequest.java

@@ -212,6 +212,10 @@ public final class CreateSessionRequest {
     @JsonProperty("expAssignments")
     private JsonNode expAssignments;
 
+    @JsonProperty("enableManagedSettings")
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private Boolean enableManagedSettings;
+
     /** Gets the model name. @return the model */
     public String getModel() {
         return model;
@@ -966,4 +970,27 @@ public JsonNode getExpAssignments() {
     public void setExpAssignments(JsonNode expAssignments) {
         this.expAssignments = expAssignments;
     }
+
+    /**
+     * Gets the self-fetch managed settings flag. @return the flag, or {@code null}
+     * if not set
+     */
+    public Boolean getEnableManagedSettings() {
+        return enableManagedSettings;
+    }
+
+    /**
+     * Sets the self-fetch managed settings flag. @param enableManagedSettings the
+     * flag
+     */
+    public void setEnableManagedSettings(boolean enableManagedSettings) {
+        this.enableManagedSettings = enableManagedSettings;
+    }
+
+    /**
+     * Clears the enableManagedSettings setting, reverting to the default behavior.
+     */
+    public void clearEnableManagedSettings() {
+        this.enableManagedSettings = null;
+    }
 }

java/src/main/java/com/github/copilot/rpc/ResumeSessionConfig.java

@@ -102,6 +102,7 @@ public class ResumeSessionConfig {
     private String gitHubToken;
     private String remoteSession;
     private JsonNode expAssignments;
+    private Boolean enableManagedSettings;
 
     /**
      * Gets the AI model to use.
@@ -1745,6 +1746,36 @@ public ResumeSessionConfig setExpAssignments(JsonNode expAssignments) {
         return this;
     }
 
+    /**
+     * Gets whether the runtime self-fetches enterprise managed settings at session
+     * bootstrap on resume.
+     *
+     * @return an {@link java.util.Optional} containing {@code true} to opt into
+     *         self-fetching managed settings, or {@link java.util.Optional#empty()}
+     *         to use the default behavior
+     */
+    @JsonIgnore
+    public Optional<Boolean> getEnableManagedSettings() {
+        return Optional.ofNullable(enableManagedSettings);
+    }
+
+    /**
+     * Opts the runtime into self-fetching enterprise managed settings on resume.
+     * <p>
+     * See {@link SessionConfig#setEnableManagedSettings(boolean)} for details.
+     * Re-supply on resume so the runtime re-applies the managed-settings self-fetch
+     * after a CLI process restart. Serialized on the wire as
+     * {@code enableManagedSettings}.
+     *
+     * @param enableManagedSettings
+     *            {@code true} to opt into self-fetching managed settings
+     * @return this config for method chaining
+     */
+    public ResumeSessionConfig setEnableManagedSettings(boolean enableManagedSettings) {
+        this.enableManagedSettings = enableManagedSettings;
+        return this;
+    }
+
     /**
      * Creates a shallow clone of this {@code ResumeSessionConfig} instance.
      * <p>
@@ -1819,6 +1850,7 @@ public ResumeSessionConfig clone() {
         copy.gitHubToken = this.gitHubToken;
         copy.remoteSession = this.remoteSession;
         copy.expAssignments = this.expAssignments;
+        copy.enableManagedSettings = this.enableManagedSettings;
         return copy;
     }
 }

java/src/main/java/com/github/copilot/rpc/ResumeSessionRequest.java

@@ -214,6 +214,10 @@ public final class ResumeSessionRequest {
     @JsonProperty("expAssignments")
     private JsonNode expAssignments;
 
+    @JsonProperty("enableManagedSettings")
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private Boolean enableManagedSettings;
+
     /** Gets the session ID. @return the session ID */
     public String getSessionId() {
         return sessionId;
@@ -981,4 +985,27 @@ public JsonNode getExpAssignments() {
     public void setExpAssignments(JsonNode expAssignments) {
         this.expAssignments = expAssignments;
     }
+
+    /**
+     * Gets the self-fetch managed settings flag. @return the flag, or {@code null}
+     * if not set
+     */
+    public Boolean getEnableManagedSettings() {
+        return enableManagedSettings;
+    }
+
+    /**
+     * Sets the self-fetch managed settings flag. @param enableManagedSettings the
+     * flag
+     */
+    public void setEnableManagedSettings(boolean enableManagedSettings) {
+        this.enableManagedSettings = enableManagedSettings;
+    }
+
+    /**
+     * Clears the enableManagedSettings setting, reverting to the default behavior.
+     */
+    public void clearEnableManagedSettings() {
+        this.enableManagedSettings = null;
+    }
 }

java/src/main/java/com/github/copilot/rpc/SessionConfig.java

@@ -103,6 +103,7 @@ public class SessionConfig {
     private String remoteSession;
     private CloudSessionOptions cloud;
     private JsonNode expAssignments;
+    private Boolean enableManagedSettings;
 
     /**
      * Gets the custom session ID.
@@ -1876,6 +1877,38 @@ public SessionConfig setExpAssignments(JsonNode expAssignments) {
         return this;
     }
 
+    /**
+     * Gets whether the runtime self-fetches enterprise managed settings at session
+     * bootstrap.
+     *
+     * @return an {@link java.util.Optional} containing {@code true} to opt into
+     *         self-fetching managed settings, or {@link java.util.Optional#empty()}
+     *         to use the default behavior
+     */
+    @JsonIgnore
+    public Optional<Boolean> getEnableManagedSettings() {
+        return Optional.ofNullable(enableManagedSettings);
+    }
+
+    /**
+     * Opts the runtime into self-fetching enterprise managed settings
+     * (bypass-permissions policy) at session bootstrap.
+     * <p>
+     * When {@code true}, the runtime self-fetches enterprise managed settings using
+     * the session's {@link #getGitHubToken() gitHubToken}. Requires
+     * {@code gitHubToken} to be set; if omitted, the runtime is expected to reject
+     * session creation (fail-closed). When unset, behaves exactly as before.
+     * Serialized on the wire as {@code enableManagedSettings}.
+     *
+     * @param enableManagedSettings
+     *            {@code true} to opt into self-fetching managed settings
+     * @return this config instance for method chaining
+     */
+    public SessionConfig setEnableManagedSettings(boolean enableManagedSettings) {
+        this.enableManagedSettings = enableManagedSettings;
+        return this;
+    }
+
     /**
      * Creates a shallow clone of this {@code SessionConfig} instance.
      * <p>
@@ -1955,6 +1988,7 @@ public SessionConfig clone() {
         copy.remoteSession = this.remoteSession;
         copy.cloud = this.cloud;
         copy.expAssignments = this.expAssignments;
+        copy.enableManagedSettings = this.enableManagedSettings;
         return copy;
     }
 }

nodejs/src/client.ts

@@ -1472,6 +1472,7 @@ export class CopilotClient {
                 remoteSession: config.remoteSession,
                 cloud: config.cloud,
                 expAssignments: config.expAssignments,
+                enableManagedSettings: config.enableManagedSettings,
             });
 
             const {
@@ -1683,6 +1684,7 @@ export class CopilotClient {
                 remoteSession: config.remoteSession,
                 openCanvases: config.openCanvases,
                 expAssignments: config.expAssignments,
+                enableManagedSettings: config.enableManagedSettings,
             });
 
             const { workspacePath, capabilities, openCanvases } = response as {

nodejs/src/types.ts

@@ -2189,6 +2189,14 @@ export interface SessionConfigBase {
      */
     gitHubToken?: string;
 
+    /**
+     * Opt-in: when true, the runtime self-fetches enterprise managed settings
+     * (bypass-permissions policy) at session bootstrap using the session's
+     * `gitHubToken`. Requires {@link SessionConfigBase.gitHubToken} to be set;
+     * if omitted, the runtime is expected to reject session creation (fail-closed).
+     */
+    enableManagedSettings?: boolean;
+
     /**
      * When true, skips embedding-based retrieval for this session.
      * Use in multitenant deployments to prevent cross-session information leakage