deps: Bump GitHub.Copilot.SDK from 1.0.13 to 1.0.14

[dependabot]

Updated GitHub.Copilot.SDK from 1.0.13 to 1.0.14.

Release notes

Sourced from GitHub.Copilot.SDK's releases.

1.0.14

Feature: typed message provenance for user, system, and agent sources

Messages sent through the SDK can now carry typed source provenance, distinguishing human user input, internal system injections, and identified agent- senders, so recipients can reliably tell agent input from human authorization. (#​2573)

await session.send("Looks good to me.", { source: "agent-reviewer" });

await session.send("Looks good to me.", source=AgentMessageSource("reviewer"))

Feature: Auto model routing Fast tier

Sessions using auto model routing can now select the fast tier alongside the existing efficiency, balance, and intelligence tiers, giving integrators a latency-focused routing preset across all six SDKs. (#​2669)

await session.setAutoTier("fast");

Feature: force-refresh managed settings cache

The new managedSettings.clearCache RPC method wipes the persistent server-policy cache and drops the runtime's in-memory retained policy, giving hosts a primitive for a "force refresh account policy" action. (#​2438)

await client.rpc.managedSettings.clearCache();

await client.Rpc.ManagedSettings.ClearCacheAsync();

Feature: Rust SDK model allowlists

SessionConfig and ResumeSessionConfig in the Rust SDK now accept an optional allowed_models list, letting hosts restrict which model IDs a session may use without duplicating runtime validation. (#​2512)

let config = SessionConfig::default().with_allowed_models(["gpt-4o", "claude-3.7-sonnet"]);

Other changes

• feature: [Core] add factory pause checkpoints for the Node.js Agent Factories API, letting a paused run resume without losing invocation limits or execution identity (#​2537)
• feature: forward the optional host OAuth client metadata URL across all six SDKs on session create and resume (#​2258)
• feature: [TypeScript] add max_output_tokens to the model capabilities override, previously unreachable without an unsafe cast (#​2569)
• bugfix: [.NET] include Copilot CLI runtime assets in PackAsTool packages so dotnet pack --no-build produces a working tool (#​2557)
• bugfix: apply the runtime's connection_close callback-quiescence contract consistently across all six in-process C ABI adapters, preventing races with freed callback state during disposal (#​2610, #​2622)
• bugfix: [Rust] fix codegen for CLI 1.0.84 schemas, correctly mapping the CatalogTrustEligibility unknown value and re-exporting shared session-event types (#​2631)
• bugfix: [C#] fix codegen for runtime schema unions, unblocking single-variant anyOf/oneOf handling (#​2656)
• bugfix: [Rust] isolate the hostless in-process runtime cache from the bundled CLI cache to prevent cross-deletion of a shared executable (#​2659)
  ... (truncated)

1.0.14-preview.1

Feature: pause and resume durable factory runs at checkpoints

Agent Factories can now pause deliberately instead of only stopping at hard limits. Call ctx.pause(key) inside a factory body to register a durable, one-shot checkpoint that ends the current attempt; resuming replays the journal and returns from that checkpoint instead of redoing prior work. Callers can also pause a running attempt from outside the factory body. (#​2537)

await ctx.step("prepare", prepareInput);
await ctx.pause("review-ready");
await ctx.agent("Review the prepared input");

const paused = await session.factory.pause(runId);

[!WARNING]

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by Release Changelog Generator · copilot · auto · 52.5 AIC · ⌖ 5.57 AIC · ⊞ 10.3K

1.0.14-preview.0

Feature: typed message provenance across all SDKs

Sending a message can now declare its source as user, system, or an identified agent (serialized as agent-<id>), so recipients can reliably distinguish human input from system injections and forwarded agent output. Ordinary sends remain unaffected: source stays omitted unless the caller opts in. (#​2573)

await session.send({ prompt: "Reviewed and approved.", source: "agent-reviewer" });

await session.send(prompt="Reviewed and approved.", source=AgentMessageSource("reviewer"))

session.Send(ctx, copilot.SendOptions{Source: copilot.MessageSourceAgent("reviewer")})

• C#: Source = MessageSource.Agent("reviewer")
• Java: .setSource(MessageSource.agent("reviewer"))
• Rust: .with_source(MessageSource::Agent("reviewer".into()))

Feature: force-refresh enterprise managed settings

A new managedSettings.clearCache RPC wipes the persistent server-policy cache and drops the runtime's in-memory retained policy, so hosts can wire up a "sync account policy" action (for example VS Code's Developer: Sync Account Policy command). It's available in TypeScript, C#, Python, Go, and Rust; Java support follows once the underlying CLI release is pinned. (#​2438)

await client.rpc.managedSettings.clearCache();

Other changes

• feature: [TypeScript] allow setting max_output_tokens on model capability overrides (#​2569)
• feature: forward an optional host OAuth client metadata document URL across all six SDKs (#​2258)
• bugfix: [.NET] include Copilot CLI runtime assets in PackAsTool publish output so packed tools install correctly (#​2557)
• bugfix: [Rust] isolate GitHub token callbacks from the request-routing loop so a callback panic can no longer stall session requests (#​2567)
• bugfix: [Python, Node.js] serialize concurrent client startup so racing callers reuse the same connection instead of launching duplicate runtimes (#​2570)
• bugfix: [.NET] fix a vulnerable transitive SourceLink dependency (#​2587)
• bugfix: fix in-process callback reclamation and FFI close responsiveness across all six SDKs to prevent use-after-free races and event-loop stalls during disposal (#​2610, #​2622)
• bugfix: [Rust] fix codegen for CLI 1.0.84 schemas (#​2631)

[!WARNING]

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[DeDuva]

Approved — merging. Head SHA: f44ab07a89824910ef0e86f3fe19d2ca7d3c0f0d

GitHub.Copilot.SDK 1.0.13 → 1.0.14 (patch, single package).

Scope: one line in src/Squad.Agents.AI/Squad.Agents.AI.csproj. No other file touched.

CI evidence: .NET ubuntu-latest SUCCESS and .NET windows-latest SUCCESS — both required for these paths, and they have diverged before. claude-md and changes also SUCCESS.

Local validation: unavailable. The dotnet SDK is not installed on this runner, so this merge rests on CI evidence alone.

One note for the record: this is the solo-SDK shape that .github/dependabot.yml warns about — GitHub.Copilot.SDK is grouped with Microsoft.* precisely so it does not arrive alone. The documented failure mode is a loud one (both .NET jobs red on CS0012, as on #124), and it did not occur here: both jobs are green, and Microsoft.Extensions.AI is unchanged at 10.9.0, so the SDK/MAF pairing is not moving this week.