Add managed permission settings to session startup

CHANGELOG.md

@@ -5,6 +5,43 @@ All notable changes to the Copilot SDK are documented in this file.
 This changelog is automatically generated by an AI agent when stable releases are published.
 See [GitHub Releases](https://github.com/github/copilot-sdk/releases) for the full list.
 
+## [Unreleased]
+
+### Feature: host-injected managed settings permissions
+
+Session create and resume accept a new optional `managedSettings` option that injects an enterprise permissions policy at session startup, alongside the existing `enableManagedSettings` self-fetch flag. The current contract is permissions-only: `disableBypassPermissionsMode` (the literal `"disable"`), plus `deny`, `ask`, and `allow` rule lists. The layer composes restrictively with any server- or device-level managed settings (deny/ask are unioned, every present allow list must admit a tool, and `disableBypassPermissionsMode` is deny-wins).
+
+This layer is startup-only and is not persisted with the session, so it must be re-supplied on resume to remain in effect; omitting it on resume clears the previously injected layer. It can be combined with `enableManagedSettings`. Host injection requires Copilot CLI `1.0.79-5` or later and does not require an SDK protocol version bump.
+
+The generated session-event types also expose truthful injected-policy provenance: `session.managed_settings_resolved` can report `source` as `client` or `mixed`, with optional `clientManaged` metadata.
+
+```ts
+const session = await client.createSession({
+    managedSettings: {
+        permissions: {
+            disableBypassPermissionsMode: "disable",
+            deny: ["shell(rm*)"],
+            ask: ["write"],
+        },
+    },
+});
+```
+
+```cs
+var session = await client.CreateSessionAsync(new SessionConfig
+{
+    ManagedSettings = new ManagedSettings
+    {
+        Permissions = new ManagedSettingsPermissions
+        {
+            DisableBypassPermissionsMode = DisableBypassPermissionsMode.Disable,
+            Deny = ["shell(rm*)"],
+            Ask = ["write"],
+        },
+    },
+});
+```
+
 ## [v1.0.7](https://github.com/github/copilot-sdk/releases/tag/v1.0.7) (2026-07-16)
 
 ### Feature: in-process (FFI) transport

dotnet/src/Client.cs

@@ -785,7 +785,7 @@ private CopilotSession InitializeSession(
         session.RegisterTools(config.Tools ?? []);
         session.RegisterPermissionHandler(
             config.OnPermissionRequest,
-            config.EnableManagedSettings is true);
+            config.EnableManagedSettings is true || config.ManagedSettings is not null);
         session.RegisterMcpAuthHandler(config.OnMcpAuthRequest);
         session.RegisterCommands(config.Commands);
         session.RegisterElicitationHandler(config.OnElicitationRequest);
@@ -1205,6 +1205,7 @@ public async Task<CopilotSession> CreateSessionAsync(SessionConfig config, Cance
                 ExpAssignments: config.ExpAssignments,
                 EnableManagedSettings: config.EnableManagedSettings,
                 GitHubMcpToolConfig: config.GitHubMcpToolConfig,
+                ManagedSettings: config.ManagedSettings,
                 EnableGitHubTelemetryForwarding: _options.OnGitHubTelemetry != null ? true : null,
                 AdditionalDirectories: config.AdditionalDirectories);
 
@@ -1425,6 +1426,7 @@ public async Task<CopilotSession> ResumeSessionAsync(string sessionId, ResumeSes
                 ExpAssignments: config.ExpAssignments,
                 EnableManagedSettings: config.EnableManagedSettings,
                 GitHubMcpToolConfig: config.GitHubMcpToolConfig,
+                ManagedSettings: config.ManagedSettings,
                 EnableGitHubTelemetryForwarding: _options.OnGitHubTelemetry != null ? true : null,
                 AdditionalDirectories: config.AdditionalDirectories);
 
@@ -2781,6 +2783,7 @@ internal record CreateSessionRequest(
         OptionsUpdateToolFilterPrecedence? ToolFilterPrecedence = null,
         [property: JsonPropertyName("expAssignments")] CopilotExpAssignmentResponse? ExpAssignments = null,
         [property: JsonPropertyName("enableManagedSettings")] bool? EnableManagedSettings = null,
+        [property: JsonPropertyName("managedSettings")] ManagedSettings? ManagedSettings = null,
         bool? EnableGitHubTelemetryForwarding = null,
         [property: JsonPropertyName("githubMcpToolConfig")] GitHubMcpToolConfig? GitHubMcpToolConfig = null,
         IList<string>? AdditionalDirectories = null);
@@ -2895,6 +2898,7 @@ internal record ResumeSessionRequest(
         OptionsUpdateToolFilterPrecedence? ToolFilterPrecedence = null,
         [property: JsonPropertyName("expAssignments")] CopilotExpAssignmentResponse? ExpAssignments = null,
         [property: JsonPropertyName("enableManagedSettings")] bool? EnableManagedSettings = null,
+        [property: JsonPropertyName("managedSettings")] ManagedSettings? ManagedSettings = null,
         bool? EnableGitHubTelemetryForwarding = null,
         [property: JsonPropertyName("githubMcpToolConfig")] GitHubMcpToolConfig? GitHubMcpToolConfig = null,
         IList<string>? AdditionalDirectories = null);