@@ -14,7 +14,7 @@ jobs:
   check-paths:
     name: "No remove-before-merge directories"
     if: github.event_name == 'pull_request' && github.base_ref == 'main'
-    runs-on: ubuntu-26.04-2core-agent-runtime
+    runs-on: ubuntu-slim
     steps:
       - uses: actions/checkout@v7
         with:
 
@@ -30,7 +30,9 @@ jobs:
       fail-fast: false
       matrix:
         os: ${{ fromJSON(inputs.platform == 'linux-x64' && '["ubuntu-26.04-2core-agent-runtime"]' || inputs.platform == 'darwin-arm64' && '["macos-26-xlarge-agent-runtime"]' || inputs.platform == 'win32-x64' && '["windows-2025-4core-agent-runtime"]' || '["ubuntu-26.04-2core-agent-runtime","macos-26-xlarge-agent-runtime","windows-2025-4core-agent-runtime"]') }}
-    runs-on: ${{ matrix.os }}
+    # Staged runtimes plus multiple Cargo feature builds exhaust the standard
+    # Linux runner disk during in-process linking. Keep the existing check names.
+    runs-on: ${{ matrix.os == 'ubuntu-26.04-2core-agent-runtime' && 'ubuntu-26.04-16core-agent-runtime' || matrix.os }}
     defaults:
       run:
         shell: bash
@@ -45,6 +47,12 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
+      - name: Report initial Linux disk capacity
+        if: runner.os == 'Linux'
+        working-directory: .
+        run: |
+          df -h . "$RUNNER_TEMP"
+          df -i . "$RUNNER_TEMP"
       - uses: ./.github/actions/download-sdk-runtime
         with:
           artifact-name: ${{ runner.os == 'Linux' && format('executable-sdk-{0}-{1}-gnu', runner.os, runner.arch) || format('executable-sdk-{0}-{1}', runner.os, runner.arch) }}
@@ -92,18 +100,6 @@ jobs:
           COPILOT_HMAC_KEY: ${{ secrets.COPILOT_DEVELOPER_CLI_INTEGRATION_HMAC_KEY }}
           RUST_E2E_CONCURRENCY: 4
         run: cargo test --no-default-features --features runtime,test-support,derive -- --test-threads=4 --nocapture
-      - name: Report Linux Rust build resources
-        if: failure() && runner.os == 'Linux'
-        run: |
-          echo "::group::Rust SDK build resources"
-          df -h . "$RUNNER_TEMP"
-          df -i . "$RUNNER_TEMP"
-          free -h
-          if [ -d target ]; then
-            du -sh target
-          fi
-          echo "::endgroup::"
-
       - name: Test in-process smoke
         id: inprocess
         if: ${{ !cancelled() && (steps.subprocess.outcome == 'success' || steps.subprocess.outcome == 'failure') }}
@@ -123,6 +119,20 @@ jobs:
           cargo test --no-default-features --features test-support,local-runtime,derive
           --test e2e client::should_use_configured_github_host_for_authentication
           -- --exact --test-threads=1 --nocapture
+      - name: Report Linux Rust build resources
+        if: always() && runner.os == 'Linux'
+        working-directory: .
+        run: |
+          echo "::group::Rust SDK build resources"
+          df -h . "$RUNNER_TEMP"
+          df -i . "$RUNNER_TEMP"
+          free -h
+          for directory in "$SDK_HOME/rust/target" "$RUNNER_TEMP/copilot-sdk-runtime" dist-cli dist-bin; do
+            if [ -d "$directory" ]; then
+              du -sh "$directory"
+            fi
+          done
+          echo "::endgroup::"
 
   rust-musl-x64:
     name: "Rust (Alpine x64)"
 
@@ -169,7 +169,7 @@ jobs:
     name: "Detect SDK layout"
     needs: detect-sdk-changes
     if: ${{ !cancelled() && (needs.detect-sdk-changes.result != 'success' || needs.detect-sdk-changes.outputs.has_sdk_changes == 'true') }}
-    runs-on: ubuntu-26.04-2core-agent-runtime
+    runs-on: ubuntu-slim
     outputs:
       runtime-source: ${{ steps.detect.outputs.runtime-source }}
       sdk-home: ${{ steps.detect.outputs.sdk-home }}
@@ -574,6 +574,9 @@ jobs:
         working-directory: ${{ needs.detect-layout.outputs.sdk-home }}/nodejs
       - run: npm ci
         working-directory: ${{ needs.detect-layout.outputs.sdk-home }}/scripts/codegen
+      - name: Test all six source generators
+        run: npm run test:codegen
+        working-directory: ${{ needs.detect-layout.outputs.sdk-home }}
       - if: needs.detect-layout.outputs.runtime-source == 'published'
         run: npm ci
         working-directory: ${{ needs.detect-layout.outputs.sdk-home }}/java/scripts/codegen
 
@@ -208,6 +208,67 @@ matrices. Their remaining E2E tests should exercise handwritten SDK behavior
 such as connection lifecycle, session orchestration, callbacks, custom tools,
 configuration, and language-specific integrations.
 
+### Testing source generators
+
+All six SDK generators have direct schema-to-source tests in
+`nodejs/test/*-codegen.test.ts`, alongside shared schema and legacy-parameter
+tests. From the **SDK root**, install only the Node dependencies and run:
+
+```bash
+npm --prefix nodejs ci
+npm --prefix scripts/codegen ci
+npm run test:codegen
+```
+
+This command bypasses runtime preparation and SDK generation. It excludes E2E
+files during discovery so the shared Vitest setup doesn't build the replay
+harness. The tests call
+the production in-memory renderers, including Python's Quicktype pipeline;
+they need no running CLI, network schema downloads, or target-language
+compilers or formatters. They also run with the Node unit suite and in the
+SDK freshness job. Java's schema-fetch tooling tests remain separate in
+`java/scripts/codegen`; compiler-dependent regressions such as
+`scripts/codegen/csharp-dictionary-roundtrip.test.ts` also run separately.
+
+Use fresh schemas from `nodejs/test/codegen-fixtures.ts` for the common baseline
+and contract matrix. Coverage includes required/optional and nullable fields
+across scalars, objects, arrays, and maps; multi-hop references shared by
+requests and results; nested unions and additive variants; wire-name escaping;
+RPC scopes, metadata, and internal methods; and multiple event payload shapes.
+All six exercise complete event rendering, including discovery and registration
+where the language emits them. Each language also checks `A -> B -> A` rendering
+for both RPC and event output to catch leaked generator state.
+Keep assertions scoped to the affected declaration, method, or codec, and
+check absence where widening or duplication would be a regression.
+
+Keep language-specific expectations and historical regressions in each language's
+test file rather than forcing identical output policies. Callback registration
+is covered for TypeScript, C#, Go, and Python; Java and Rust don't emit that
+surface. Java uses boxed record components across presence/nullability
+combinations and JSON-compatible fallbacks for some nested unions. Internal
+methods and internal-only types and namespaces are package-private; definitions
+also used by public methods remain public. The shared boolean-union
+fixture uses the published `EnqueueCommandResult` names supported by Rust's
+allowlist. Python tests exercise union postprocessing and legacy keyword-only
+parameters through Quicktype; RPC fixtures include the MCP and filesystem capability types
+required by its production postprocessor.
+
+Java's known boolean-wire defect has five separate `it.fails` assertions.
+Rendering and file lookup run in ordinary setup, outside expected-failure checks.
+Fixing any assertion makes its test fail until `fails` is removed.
+
+Each language has a small RPC and event source snapshot under
+`nodejs/test/__snapshots__/`. Pair snapshots with explicit contract assertions,
+and review generated source against the schema before accepting an update:
+
+```bash
+npm run test:codegen -- --update
+```
+
+These tests check emission correctness. Generation-freshness checks only detect
+stale committed output; generated-artifact tests and runtime E2Es check different
+boundaries and are not substitutes for generator tests.
+
 ### Testing an unreleased runtime API
 
 In `github/copilot-agent-runtime`, Rust contracts under
 
@@ -313,6 +313,8 @@ With `model: "auto"`, the optional `capi.autoTier` setting selects an Auto routi
 
 When the runtime's default-off `DYNAMIC_AUTO_TIERS` feature is enabled, the session's `model.list` RPC also returns optional `auto` metadata from the provider's `/meta` endpoint. Use the enabled descriptors with `type: "auto"` to discover additional supported tier identifiers, their display names, descriptions, and ordering. The existing selection methods and JSON fields accept these identifiers. A discovery failure does not fall back to `/models`, and a successful response without `auto` metadata provides no selectable Auto tiers.
 
+To populate a model picker before any session exists, enable `DYNAMIC_AUTO_TIERS` in the runtime's environment (for example, the `env` client option). The server-level `models.list` RPC (`client.rpc.models.list()` in Node.js) then returns the same `auto` metadata from the same `/meta` response, with the same no-fallback behavior. The server-level listing reads the flag the runtime resolved at startup, not per-session feature flags or experiment assignments, so set the flag where you launch the runtime. With the flag disabled, `models.list` is unchanged and omits `auto`.
+
 Treat tier identifiers as extensible values, not a closed enumeration. Existing named values remain available; for additional identifiers, use strings in Node.js and Python, `AutoTier("premium-v2")` in Go, `new AutoTier("premium-v2")` in .NET, `AutoTier::Custom` in Rust, or `AutoTier.fromValue` in Java. The provider's `defaultTier` describes its default routing without creating a committed SDK preference.
 
 If a persisted tier is removed or disabled, resume preserves the explicit preference rather than replacing it with the provider's default. Select an available replacement before activating Auto routing.
 
@@ -578,7 +578,7 @@ Emitted when a tool finishes executing—successfully or with an error.
 | `model` | `string` | | Model that generated this tool call |
 | `interactionId` | `string` | | CAPI interaction ID |
 | `isUserRequested` | `boolean` | | `true` when the user explicitly requested this tool call |
-| `result` | `Result` | | Present on success (see below) |
+| `result` | `Result` | | Present on success, and on failure when the tool returned content with its error (see below) |
 | `error` | `{ message, code? }` | | Present on failure |
 | `toolTelemetry` | `object` | | Tool-specific telemetry (e.g., CodeQL check counts) |
 | `parentToolCallId` | `string` | | Deprecated. Use envelope-level `agentId` for sub-agent attribution |
 
@@ -142,6 +142,28 @@ Return `null` or `undefined` to use the prompt unchanged. Otherwise, return an o
 | `modifiedPrompt` | string | Modified prompt to use instead of original |
 | `additionalContext` | string | Extra context added to the conversation |
 | `suppressOutput` | boolean | If true, suppress the assistant's response output |
+| `decision` | `"block"` | Refuse the prompt (see [Blocking a prompt](#blocking-a-prompt)) |
+| `reason` | string | Why the prompt was blocked; required with `decision` |
+
+### Blocking a prompt
+
+Return a block decision to refuse the prompt:
+
+```json
+{
+  "decision": "block",
+  "reason": "Prompts may not include credentials."
+}
+```
+
+No model turn runs and no user message is recorded. The session emits an ephemeral `session.warning` with `warningType: "policy_blocked"` that carries the reason. The public member names follow each language's conventions:
+
+| Meaning | Node.js / Python | Go / .NET | Rust | Java |
+|---------|------------------|-----------|------|------|
+| Block the prompt | `decision: "block"` | `Decision = "block"` | `decision: Some("block".into())` | `UserPromptSubmittedHookOutput.block(reason)` |
+| Why it was blocked | `reason` | `Reason` | `reason` | the `reason` argument |
+
+In Go, an empty `Reason` is omitted from the output, and the prompt is blocked only when a reason is present.
 
 ## Examples
 
@@ -347,10 +369,10 @@ const session = await client.createSession({
     onUserPromptSubmitted: async (input) => {
       for (const pattern of BLOCKED_PATTERNS) {
         if (pattern.test(input.prompt)) {
-          // Replace the prompt with a warning message
+          // Refuse the prompt; the reason reaches the client as a session.warning
           return {
-            modifiedPrompt: "[Content blocked: Please don't include sensitive credentials in your prompts. Use environment variables instead.]",
-            suppressOutput: true,
+            decision: "block",
+            reason: "Please don't include sensitive credentials in your prompts. Use environment variables instead.",
           };
         }
       }
 
@@ -15,8 +15,8 @@ the runtime commit, not a separate `github/copilot-sdk` commit. Run SDK commands
 from `src/sdk` unless a command names another working directory.
 
 Both runtime and SDK pin SDK protocol version 3. The standard AHP client is
-pinned to `@microsoft/agent-host-protocol@0.9.0`, matching the host's
-`rust/v0.9.0` source pin (`60706330f2f351b09f150d9a9c3c0eaedfc8e8b9`).
+pinned to `@microsoft/agent-host-protocol@0.9.0`. The host serves AHP 1.0
+and retains AHP 0.9 compatibility; the CLI client still negotiates AHP 0.9.
 The host prototype `d62d982`
 and SDK sample prototype `8fd2498` were inspected as references, not cherry-picked
 as production implementations. Their application-side TCP relay is not the
@@ -458,7 +458,19 @@ lifetime is separate from durable publication.
 `--ahp-host [--listen host:port] [--workspace directory]` serves this same backend
 in the CLI process, using normal SDK session construction, managed policy,
 hooks, authentication and telemetry. The old promotion backend and duplicate
-commands have been removed. Local-owner `/remote on|off|show` retains its independent
+commands have been removed. The CLI defaults to a random required local
+connection token. `--ahp-host-token <value>` supplies a fixed nonempty token
+(`localServer.token`); `--ahp-host-disable-token` sets
+`localServer.requireConnectionToken` to `false`. These options require
+`--ahp-host` and cannot be combined. Explicit tokens are visible in process
+arguments and may be stored in shell history. Startup prints a connectable
+`AHP 1.0 endpoint` URL with the active token URL-encoded in its `tkn` query parameter,
+not a separate token line. Disabling the token leaves the URL without that
+parameter. Treat this stdout URL as a credential; ordinary host logs retain
+the bare endpoint. GitHub authentication and resource authorization remain
+required in both modes, independently of SDK `--auth-token-env` or client-side
+`--ahp-authenticate-with-github`.
+Local-owner `/remote on|off|show` retains its independent
 Mission Control path; the old attached-AHP-client export toggle is intentionally unavailable.
 `COPILOT_AHP_SHARE_BIND` can select a wider listener for sharing;
 the CLI's managed remote-control policy still gates off-machine publication.
 
@@ -112,6 +112,18 @@ new CopilotClient(CopilotClientOptions? options = null)
 - `BaseDirectory` - Base directory for Copilot data (session state, config, etc.). Sets `COPILOT_HOME` on the spawned runtime process. When not set, the runtime defaults to `~/.copilot`. Useful in restricted environments where only specific directories are writable. Ignored when connecting via `RuntimeConnection.ForUri(...)`.
 - `EnableRemoteSessions` - Enables remote-session features.
 - `Environment` - Environment variables to pass to the runtime process.
+
+  For the native standalone runtime, set the `Environment` dictionary entry
+  `["COPILOT_GITHUB_TELEMETRY_DISABLED"] = "true"` before startup to disable direct
+  GitHub telemetry uploads for the entire host, including sessionless events.
+  Authentication, `OnGitHubTelemetry` forwarding, and user-configured
+  OpenTelemetry export remain unchanged. This is separate from
+  `EnableSessionTelemetry = false`, which disables only a session's pipeline.
+  The value must be exactly `"true"`; changing it requires a runtime restart.
+  The Node CLI host does not use this variable. In-process connections reject
+  per-client `Environment`; set the variable in the host process environment
+  before starting the runtime instead.
+
 - `Logger` - `ILogger` instance for SDK logging.
 - `GitHubToken` - GitHub token for authentication. When provided, takes priority over other auth methods.
 - `UseLoggedInUser` - Whether to use logged-in user for authentication (default: true, but false when `GitHubToken` is provided). Cannot be used with `RuntimeConnection.ForUri(...)`.
@@ -1394,7 +1406,7 @@ var session = await client.CreateSessionAsync(new SessionConfig
 - `OnPreToolUse` - Intercept tool calls before execution. Can allow/deny or modify arguments.
 - `OnPostToolUse` - Process tool results after successful execution. Can modify results or add context.
 - `OnPostToolUseFailure` - Observe failed tool executions and inject extra context to guide the model's next step.
-- `OnUserPromptSubmitted` - Intercept user prompts. Can modify the prompt before processing.
+- `OnUserPromptSubmitted` - Intercept user prompts. Can modify the prompt before processing, or return `new UserPromptSubmittedHookOutput { Decision = "block", Reason = "..." }` to refuse it: no model turn runs, no user message is recorded, and the session emits an ephemeral `session.warning` (`warningType: "policy_blocked"`) carrying the reason.
 - `OnSessionStart` - Run logic when a session starts or resumes.
 - `OnSessionEnd` - Cleanup or logging when session ends.
 - `OnErrorOccurred` - Handle errors with retry/skip/abort strategies.