Upstream sync: clientName, deny-by-default permissions, PermissionHandler.APPROVE_ALL

[Copilot]

Ports 13 upstream commits from github/copilot-sdk (5016587→c263dfc), covering two behavioral changes and one new API.

Breaking: Deny permissions by default

requestPermission: true is now unconditionally sent in every session.create / session.resume call (including null-config). The server will always callback for permissions; the SDK returns a deny result when no handler is registered.

Migration: Any test or code that invokes shell/file tools without an explicit permission handler must now pass PermissionHandler.APPROVE_ALL:

// Before
client.createSession().get();

// After (if using built-in tools)
client.createSession(new SessionConfig().setOnPermissionRequest(PermissionHandler.APPROVE_ALL)).get();

envValueMode: "direct" is also now sent unconditionally (previously skipped for null config).

New: PermissionHandler.APPROVE_ALL

Convenience constant on the PermissionHandler interface that approves every request. Use in dev/test or non-security-sensitive contexts.

new SessionConfig().setOnPermissionRequest(PermissionHandler.APPROVE_ALL)

New: clientName on session configs

Identifies the calling application in the User-Agent header. Available on both SessionConfig and ResumeSessionConfig.

new SessionConfig().setClientName("my-app");
new ResumeSessionConfig().setClientName("my-app");

clientName is forwarded in CreateSessionRequest / ResumeSessionRequest and preserved through clone().

New tests

• testShouldDenyToolOperationsByDefaultWhenNoHandlerIsProvided — verifies tool.execution_complete carries a Permission denied error when no handler is set.
• testShouldDenyToolOperationsByDefaultWhenNoHandlerIsProvidedAfterResume — same, on a resumed session.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• checkstyle.org
  • Triggering command: /opt/hostedtoolcache/CodeQL/2.24.0/x64/codeql/tools/linux64/java/bin/java /opt/hostedtoolcache/CodeQL/2.24.0/x64/codeql/tools/linux64/java/bin/java -jar /opt/hostedtoolcache/CodeQL/2.24.0/x64/codeql/xml/tools/xml-extractor.jar --fileList=/home/REDACTED/work/copilot-sdk-java/.codeql-scratch/dbs/java/working/files-to-index12954213091878310284.list --sourceArchiveDir=/home/REDACTED/work/copilot-sdk-java/.codeql-scratch/dbs/java/src --outputDir=/home/REDACTED/work/copilot-sdk-java/.codeql-scratch/dbs/java/trap/java which /home/REDACTED/.cargo/bin/which git bash ache/Java_Temurif4d1f2e6bb96ed95b7bab0e84b919e86950f9621:src/main/java/com/github/copilot/sdk/json/ResumeSessionConfig.java which git ess/node_modules/@github/copilot-linux-x64/copilot which /home/REDACTED/.local/bin/which rgo/bin/which ess/node_modulesshow .0.18-8/x64/bin/f4d1f2e6bb96ed95b7bab0e84b919e86950f9621:src/test/java/com/github/copilot/sdk/ToolsTest.java which (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[upstream-sync] Upstream sync: 13 new commits (2026-02-19)</issue_title>
<issue_description>## Upstream Changes Detected

Commit Range: 5016587...c263dfc

Commit Count: 13 new commits since last merge

Recent Commits

• c263dfc Add E2E scenario tests/examples for all SDK languages (#512)
• 886e5aa Fix flaky abort test: approve permissions to avoid race with deny-by-default
• 970db18 If running under bun, fall back on finding node from path
• 397ef66 feat: add clientName to SessionConfig across all SDKs (#510)
• 3e2d2b2 Breaking change: deny all permissions by default (#509)
• 19d8cea docs: Add Azure Managed Identity guide for BYOK (#498)
• 8a9f992 Fix formatting and update SDK table in README
• 2f2bcf7 Bump CLI dep to 0.0.411 (#497)
• 6003273 Fix MCP env vars: send envValueMode direct across all SDKs (#484)
• df23ff4 Add CopilotSkipCliDownload option to .NET SDK (#494)
• ed51ab8 Add minimal chat samples for all SDK languages (#492)
• e22d235 Fix .NET SDK CLI download timeout (#493)
• 3c5368a Update @github/copilot to 0.0.411-0 (#491)

---

Action Required: Follow the agentic-merge-upstream prompt to port these changes to the Java SDK.

Important: Create a Pull Request with the upstream-sync label when ready.

AI generated by Weekly Upstream Sync Agentic Workflow

• expires on Feb 25, 2026, 8:12 PM UTC

Comments on the Issue (you are @copilot in this section)

• Fixes [upstream-sync] Upstream sync: 13 new commits (2026-02-19) #143

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.