sdk: Forward decisionContext on permission replies across languages by aymenfurter · Pull Request #2294 · github/copilot-sdk

aymenfurter · 2026-08-07T15:08:55Z

Why

The runtime records attribution for an auto-approval decision only when the client supplies an
explicit decisionContext alongside its permission reply. The wire schema and the runtime side
already support this, and the generated types in this repo already carry the field.

The SDKs' hand-written permission-reply paths never populated it, so every host that answers
permissions through an SDK produces decisions the runtime cannot attribute. There is currently
no way for a permission handler to supply the context at all.

What

Let a permission handler attach optional provenance, forwarded to the runtime as a sibling of
result on session.permissions.handlePendingPermissionRequest. The change is additive across
all six SDKs. Existing handlers compile and behave unchanged:

Node: createAttributedPermissionResult(result, ctx)
Python: copilot.create_attributed_permission_result(result, ctx)
Go: copilot.NewAttributedPermissionResult(result, ctx)
.NET: new PermissionDecisionApproveOnce { DecisionContext = ctx }
Java: PermissionRequestResult.approveOnce().setDecisionContext(ctx)
Rust: implement AttributedPermissionHandler and return
PermissionResult::approve_once().with_context(ctx)

Each helper follows the conventions already present in that SDK rather than using one
cross-language spelling. The decision types are generated in Node, Python, Go, and Rust, so they
cannot carry a hand-written field and attribution is applied by wrapping. .NET's generated class
is partial, and Java's type is hand-written, so both take a member directly.

Rust keeps the existing PermissionResult enum and PermissionHandler trait unchanged. This
preserves compatibility for clients that match PermissionResult exhaustively. Clients that
need attribution use the new AttributedPermissionHandler trait and configure it with
with_attributed_permission_handler. They implement one handler method, while existing clients
continue to use PermissionHandler and with_permission_handler.

decisionContext describes how a decision was reached, not what it was, so it is never nested
inside result. With no context supplied, the emitted JSON is byte-identical to today's format:
three keys, with no decisionContext key rather than decisionContext: null.

No schema change and no generated code touched. The gap was only in the hand-written layer.

Testing

Unit tests in all six SDKs cover context present, context absent with the exact key set, context
on a no-result decision, and reapplying context replacing rather than nesting
Node and Rust E2E verified against a real CLI carrying the runtime-side support (1.0.79-5);
CI runs the repo-pinned ^1.0.79-6
Rust: 230 unit tests and 25 doctests pass; Clippy and formatting are clean
Node: 17 E2E tests pass; lint and type checking are clean
Python: 11 tests pass
Go: tests, vet, and gofmt are clean
.NET: 198 unit tests pass; dotnet format is clean
Go also covers the value form of the wrapper, which satisfies the decision interface through
method promotion and must be unwrapped like the pointer form

The CLI does not validate this field. A nested decisionContext or an invalid outcome enum is
accepted silently, so E2E cannot verify the wire shape. The Node E2E test asserts the outgoing RPC
params directly and was mutation-tested: nesting or dropping the key makes the test fail. Rust
shape coverage is in the permission_response_params unit test, which also catches nesting.

Release note

Backward-compatible and opt-in. Hosts that do not attach context are unaffected.

The runtime emits `auto_approval_decision` telemetry only when a client supplies an explicit `decisionContext` alongside its permission reply. The generated wire types already carry the optional field, but the hand-written reply path built a fixed three-key JSON literal and had no way for a PermissionHandler to attribute its decision. Add `PermissionResult::AttributedDecision` plus a `with_context` builder, and forward the context as a top-level sibling of `result`. When no context is supplied the emitted params are byte-identical to before, so legacy behavior is preserved exactly. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Permission handlers can now attach optional provenance describing how and where a decision was reached. The SDK forwards it to the runtime as a sibling of `result` -- never nested inside it -- so auto-approval decisions made programmatically can be attributed. The wire schema and every language's generated types already accepted the field; only the hand-written reply paths never populated it. No schema, codegen, or protocol version change is required. Fully additive: handlers returning a plain decision emit a payload byte-identical to before, with no `decisionContext` key at all. No-result suppression is preserved in every language. Per CONTRIBUTING.md, the feature is implemented in sync across all six SDKs: - Rust: PermissionResult::AttributedDecision + with_context() - Node: AttributedPermissionResult + withDecisionContext() - Python: AttributedPermissionResult + with_decision_context() - Go: AttributedPermissionResult + WithDecisionContext() - .NET: PermissionDecision.WithContext() - Java: PermissionRequestResult.withContext() Each language gains focused unit tests asserting the sibling placement, the byte-identical legacy payload, replace-not-nest on re-application, and preserved no-result suppression. Node and Rust add end-to-end coverage against a CLI carrying the runtime-side support. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 79152db2-4cc7-4777-983a-655fae5b68c9

github-actions

Generated by SDK Consistency Review Agent for #2294 · sonnet46 53.2 AIC · ⌖ 5.69 AIC · ⊞ 6.6K

Java accepted null as a "clear" operation while .NET rejects it and the other SDKs disallow it at the type level. Since null is Java's default, an uninitialized variable would have silently dropped the context -- producing exactly the unattributed telemetry this feature removes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 79152db2-4cc7-4777-983a-655fae5b68c9

Copilot

Pull request overview

Adds optional permission-decision provenance forwarding across all six SDKs while preserving the legacy wire shape when absent.

Changes:

Adds language-specific APIs for attaching decisionContext.
Forwards context beside result in permission RPCs.
Adds unit and E2E coverage plus compatibility documentation.

Show a summary per file

File	Description
`test/snapshots/permissions/should_honor_a_decision_annotated_with_decisioncontext.yaml`	Adds shared permission E2E fixture.
`rust/tests/e2e/permissions.rs`	Tests attributed rejection end to end.
`rust/src/types.rs`	Re-exports generated context types.
`rust/src/session.rs`	Builds attributed permission RPC parameters.
`rust/src/handler.rs`	Adds attributed permission results.
`python/test_permission_decision_context.py`	Tests Python serialization behavior.
`python/copilot/session.py`	Adds and forwards attributed results.
`python/copilot/__init__.py`	Exports the new Python API.
`nodejs/test/e2e/permissions.e2e.test.ts`	Verifies live RPC shape and behavior.
`nodejs/test/client.test.ts`	Tests Node.js attribution handling.
`nodejs/src/types.ts`	Defines attributed result helpers and types.
`nodejs/src/session.ts`	Forwards context in permission replies.
`nodejs/src/index.ts`	Exports the new Node.js API.
`java/src/test/java/com/github/copilot/rpc/PermissionRequestResultDecisionContextTest.java`	Tests Java result serialization.
`java/src/main/java/com/github/copilot/rpc/PermissionRequestResult.java`	Stores optional decision context.
`java/src/main/java/com/github/copilot/CopilotSession.java`	Passes context to the generated RPC.
`go/types.go`	Exposes generated decision-context types.
`go/session.go`	Unwraps and forwards attributed decisions.
`go/permissions.go`	Adds the Go attribution wrapper.
`go/permission_context_test.go`	Tests raw Go JSON-RPC output.
`dotnet/test/Unit/ClientSessionLifetimeTests.cs`	Tests .NET forwarding and omission.
`dotnet/src/Session.cs`	Passes context through the RPC client.
`dotnet/src/PermissionDecision.cs`	Adds fluent context attachment.
`docs/troubleshooting/compatibility.md`	Documents optional attribution support.

Review details

Files reviewed: 24/24 changed files
Comments generated: 5
Review effort level: Balanced

Go embedded the decision interface in AttributedPermissionResult, which promotes the interface methods to the value type. A handler returning `*WithDecisionContext(...)` therefore satisfied rpc.PermissionDecision but slipped past the pointer-only type assertion: the wrapper itself was sent as `result` and the context was silently dropped. Both the unwrap in the session and the replace-not-nest check now accept either form, with regression tests that fail against the pointer-only code. Rust PermissionResult gains #[non_exhaustive], matching the convention used throughout this crate, so downstream exhaustive matches keep compiling as variants are added. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 79152db2-4cc7-4777-983a-655fae5b68c9

The hand-written .NET SDK has no other fluent `With*` builders, so adding one here introduced a pattern that exists nowhere else in the surface. Java and Rust keep their fluent forms because those match long-standing convention in each of those SDKs. Callers now set the public `DecisionContext` property through an object initializer, which is what the class documentation already recommends for richer decisions. The wire format is unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 79152db2-4cc7-4777-983a-655fae5b68c9

The Go, Node, and Python helpers were named `WithDecisionContext` and friends, a shape none of those SDKs use. In Go a `WithX` function conventionally builds a functional option rather than decorating a value, and there were no `With` functions in the package at all. Node and Python had no `with`-prefixed helper either. Each now follows the constructor naming its own SDK already uses: `NewAttributedPermissionResult` alongside `NewCanvasError`, `createAttributedPermissionResult` alongside `createCanvas`, and `create_attributed_permission_result` alongside `create_session_fs_adapter`. The Node wrapper also gains a `kind: "attributed"` discriminant so it is narrowed the same way as every other union in that SDK, instead of by testing for the presence of a property. Java and Rust keep their fluent methods, which match long-standing convention in each of those SDKs. Behavior and wire format are unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 79152db2-4cc7-4777-983a-655fae5b68c9

The pointer/value type switch was duplicated verbatim in NewAttributedPermissionResult and the session permission dispatch. Embedding an interface promotes its methods to the value type too, so both forms satisfy rpc.PermissionDecision and both must be unwrapped -- missing the value case is what produced the bug caught in review. Fold both copies into splitAttribution so that hazard is stated and handled in exactly one place. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 79152db2-4cc7-4777-983a-655fae5b68c9

stephentoub · 2026-08-08T00:00:21Z

+     *             if {@code context} is {@code null}
+     * @since 1.3.0
+     */
+    public PermissionRequestResult withContext(PermissionDecisionContext context) {


Is this necessary?

Renamed to setDecisionContext to match the getter and the other setters here, and dropped the requireNonNull since null now means "no context" everywhere else.

The Java SDK uses setX for mutators (589 of them); withX appears twice and both return a copy rather than mutating in place. withContext was the odd one out on both counts, and did not match its own getter or the sibling setKind/setRules/setFeedback on this class. Also drop the requireNonNull. The other setters here do not null-check, and null now means "no context" in every other SDK, so throwing made Java the outlier rather than the consistent one. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 79152db2-4cc7-4777-983a-655fae5b68c9

Hand-written Rust here has 157 enum variants: 89 unit, 35 tuple with exactly one payload, and 33 struct-style. Every variant carrying two or more values uses the struct form, so a two-payload tuple was the only one of its kind. Name the payloads instead. Construction and both read sites now say which value they mean rather than relying on position. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 79152db2-4cc7-4777-983a-655fae5b68c9

github-actions · 2026-08-08T08:57:49Z

✅ Cross-SDK Consistency Review

This PR adds decisionContext support to all six SDK implementations consistently. No cross-language gaps found.

Feature parity: All SDKs ✅

SDK	Helper API	Pattern
Node.js	`createAttributedPermissionResult(result, ctx)`	Wrapper function, exports new types
Python	`create_attributed_permission_result(result, ctx)`	Wrapper function + `AttributedPermissionResult` dataclass
Go	`NewAttributedPermissionResult(result, ctx)`	Struct embedding `rpc.PermissionDecision`, satisfies the interface
.NET	`decision.DecisionContext = ctx`	`[JsonIgnore]` property on `PermissionDecision` base class
Java	`result.setDecisionContext(ctx)`	`@JsonIgnore` field with fluent setter on `PermissionRequestResult`
Rust	`PermissionResult::approve_once().with_context(ctx)`	New `AttributedDecision` enum variant + builder method

Key consistency properties verified ✅

Wire shape is identical across all SDKs: decisionContext is always emitted as a sibling of result, never nested inside it
Backward-compatible: omitting context produces byte-identical output to the current behavior (no decisionContext key emitted)
Re-attribution replaces, never nests: all implementations unwrap an already-attributed result before re-wrapping
No-result decisions: all SDKs correctly handle the case where NoResult suppresses the response even when context is attached
Naming conventions: each SDK follows its established idiom (camelCase for JS/Java, snake_case for Python/Rust, PascalCase for Go/C#)

Tests coverage ✅

All SDKs include unit tests covering: context present, context absent (key set verification), re-application replacing not nesting, and no-result with context. Node and Rust additionally have E2E coverage verifying the outgoing wire shape.

The changes are well-structured and maintain strong cross-language consistency.

Generated by SDK Consistency Review Agent for #2294 · sonnet46 33 AIC · ⌖ 5.48 AIC · ⊞ 6.6K · ◷

Copilot

Review details

Files reviewed: 24/24 changed files
Comments generated: 0 new
Review effort level: Balanced

Add a separate attributed permission handler path so clients can forward decision context without changing the existing PermissionResult enum or PermissionHandler contract. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 79152db2-4cc7-4777-983a-655fae5b68c9

aymenfurter · 2026-08-10T12:51:09Z

@stephentoub I moved this PR back to draft after finding that the current Rust API change breaks existing clients. Adding AttributedDecision to PermissionResult, or marking the enum #[non_exhaustive], breaks clients that match its existing variants exhaustively.

I tested a backwards-compatible alternative that keeps PermissionHandler and PermissionResult unchanged. It adds a separate AttributedPermissionHandler for clients that need to provide decisionContext.

Existing clients continue to use:

impl PermissionHandler for MyHandler {
    async fn handle(...) -> PermissionResult {
        PermissionResult::approve_once()
    }
}

SessionConfig::default()
    .with_permission_handler(Arc::new(MyHandler))

Copilot App would use:

impl AttributedPermissionHandler for CopilotAppPermissionHandler {
    async fn handle(...) -> AttributedPermissionResult {
        PermissionResult::approve_once().with_context(
            PermissionDecisionContext {
                outcome: PermissionDecisionOutcome::PromptedUser,
                source: PermissionDecisionSource::HumanResponse,
                surface: PermissionDecisionSurface::CopilotApp,
            },
        )
    }
}

let client = Client::start(ClientOptions::default()).await?;

let session = client
    .create_session(
        SessionConfig::default().with_attributed_permission_handler(
            Arc::new(CopilotAppPermissionHandler),
        ),
    )
    .await?;

Existing clients compile without changes, and context-aware clients implement only one handler method. The cost is one additional handler trait and configuration method.

stephentoub · 2026-08-10T13:06:31Z

Adding AttributedDecision to PermissionResult, or marking the enum #[non_exhaustive], breaks clients that match its existing variants exhaustively.

In the past, I believe @tclem has suggested we shouldn't care about such breaking changes for rust consumers. Tim?

aymenfurter · 2026-08-11T11:39:38Z

@tclem What do you think? 👀

Aymen Furter and others added 2 commits August 7, 2026 14:30

This comment has been minimized.

Sign in to view

github-actions Bot reviewed Aug 7, 2026

View reviewed changes

Comment thread java/src/main/java/com/github/copilot/rpc/PermissionRequestResult.java

aymenfurter marked this pull request as ready for review August 7, 2026 15:21

aymenfurter requested a review from a team as a code owner August 7, 2026 15:21

Copilot AI balanced review requested due to automatic review settings August 7, 2026 15:21

Copilot started reviewing on behalf of aymenfurter August 7, 2026 15:22 View session

This comment has been minimized.

Sign in to view

Copilot AI reviewed Aug 7, 2026

View reviewed changes

Comment thread go/session.go Outdated

Comment thread rust/src/handler.rs Outdated

Comment thread java/src/main/java/com/github/copilot/CopilotSession.java

Comment thread python/copilot/session.py Outdated

Comment thread go/permissions.go Outdated

stephentoub reviewed Aug 7, 2026

View reviewed changes

Comment thread dotnet/src/PermissionDecision.cs Outdated

stephentoub reviewed Aug 7, 2026

View reviewed changes

Comment thread dotnet/src/PermissionDecision.cs

This comment has been minimized.

Sign in to view

Aymen Furter and others added 3 commits August 7, 2026 19:02

This comment has been minimized.

Sign in to view

stephentoub reviewed Aug 8, 2026

View reviewed changes

This comment has been minimized.

Sign in to view

stephentoub requested a balanced review from Copilot August 8, 2026 12:44

Copilot started reviewing on behalf of stephentoub August 8, 2026 12:44 View session

Copilot AI reviewed Aug 8, 2026

View reviewed changes

aymenfurter marked this pull request as draft August 10, 2026 12:18

github-actions Bot mentioned this pull request Aug 10, 2026

[aw] No-Op Runs #1989

Open

aymenfurter marked this pull request as ready for review August 10, 2026 13:01

aymenfurter marked this pull request as draft August 10, 2026 14:21

aymenfurter marked this pull request as ready for review August 11, 2026 13:17

Uh oh!

Conversation

aymenfurter commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What

Testing

Release note

Uh oh!

This comment has been minimized.

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment has been minimized.

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

stephentoub Aug 8, 2026

Choose a reason for hiding this comment

Uh oh!

aymenfurter Aug 8, 2026

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

github-actions Bot commented Aug 8, 2026

✅ Cross-SDK Consistency Review

Feature parity: All SDKs ✅

Key consistency properties verified ✅

Tests coverage ✅

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

aymenfurter commented Aug 10, 2026

Uh oh!

stephentoub commented Aug 10, 2026

Uh oh!

aymenfurter commented Aug 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

aymenfurter commented Aug 7, 2026 •

edited

Loading