Merge main + parity-add ProviderConfig token/model overrides

Brought in 12 commits from origin/main, including CLI bumps to
1.0.41-0 and 1.0.41-1, plus upstream PR #966 ("Add provider model
and token limit overrides to ProviderConfig"). One trivial codegen
diff (single doc-comment update on `CustomAgentsUpdatedAgent.tools`
for the new "or null when all tools are available" semantics).

PR #966 added four new fields to ProviderConfig across all SDKs:
- `model_id: Option<String>` (well-known model ID for agent config
  + token limit lookup; falls back to SessionConfig::model)
- `wire_model: Option<String>` (model name sent to provider API for
  inference; falls back to model_id, then to SessionConfig::model)
- `max_prompt_tokens: Option<i64>` (overrides resolved model's
  default max prompt tokens; triggers compaction)
- `max_output_tokens: Option<i64>` (overrides resolved model's
  default max output tokens; truncates response)

Plus matching `with_*` builders. Wire-shape: camelCase
(`modelId`/`wireModel`/`maxPromptTokens`/`maxOutputTokens`),
skip_serializing_if when unset.

Extended `provider_config_builder_composes` test to exercise all
four fields and assert their wire shape (camelCase + omission).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: tclem

.gitignore

@@ -9,3 +9,6 @@ test/scenarios/**/rust/Cargo.lock
 
 # Visual Studio
 .vs/
+
+# C# Dev Kit
+*.csproj.lscache

docs/auth/byok.md

@@ -475,16 +475,10 @@ When using BYOK, be aware of these limitations:
 
 ### Identity Limitations
 
-BYOK authentication uses **static credentials only**. The following identity providers are NOT supported:
-
-- ❌ **Microsoft Entra ID (Azure AD)** - No support for Entra managed identities or service principals
-- ❌ **Third-party identity providers** - No OIDC, SAML, or other federated identity
-- ❌ **Managed identities** - Azure Managed Identity is not supported
+BYOK authentication uses **static credentials only**. 
 
 You must use an API key or static bearer token that you manage yourself.
 
-**Why not Entra ID?** While Entra ID does issue bearer tokens, these tokens are short-lived (typically 1 hour) and require automatic refresh via the Azure Identity SDK. The `bearerToken` option only accepts a static string—there is no callback mechanism for the SDK to request fresh tokens. For long-running workloads requiring Entra authentication, you would need to implement your own token refresh logic and create new sessions with updated tokens.
-
 ### Feature Limitations
 
 Some Copilot features may behave differently with BYOK:

dotnet/src/Client.cs

@@ -226,30 +226,46 @@ async Task<Connection> StartCoreAsync(CancellationToken ct)
             _logger.LogDebug("Starting Copilot client");
             _disconnected = false;
 
-            Task<Connection> result;
+            Connection? connection = null;
+            Process? cliProcess = null;
 
-            if (_optionsHost is not null && _optionsPort is not null)
-            {
-                // External server (TCP)
-                _actualPort = _optionsPort;
-                result = ConnectToServerAsync(null, _optionsHost, _optionsPort, null, ct);
-            }
-            else
+            try
             {
-                // Child process (stdio or TCP)
-                var (cliProcess, portOrNull, stderrBuffer) = await StartCliServerAsync(_options, _effectiveConnectionToken, _logger, ct);
-                _actualPort = portOrNull;
-                result = ConnectToServerAsync(cliProcess, portOrNull is null ? null : "localhost", portOrNull, stderrBuffer, ct);
-            }
+                if (_optionsHost is not null && _optionsPort is not null)
+                {
+                    // External server (TCP)
+                    _actualPort = _optionsPort;
+                    connection = await ConnectToServerAsync(null, _optionsHost, _optionsPort, null, ct);
+                }
+                else
+                {
+                    // Child process (stdio or TCP)
+                    var (startedProcess, portOrNull, stderrBuffer) = await StartCliServerAsync(_options, _effectiveConnectionToken, _logger, ct);
+                    cliProcess = startedProcess;
+                    _actualPort = portOrNull;
+                    connection = await ConnectToServerAsync(cliProcess, portOrNull is null ? null : "localhost", portOrNull, stderrBuffer, ct);
+                }
 
-            var connection = await result;
+                // Verify protocol version compatibility
+                await VerifyProtocolVersionAsync(connection, ct);
+                await ConfigureSessionFsAsync(ct);
 
-            // Verify protocol version compatibility
-            await VerifyProtocolVersionAsync(connection, ct);
-            await ConfigureSessionFsAsync(ct);
+                _logger.LogInformation("Copilot client connected");
+                return connection;
+            }
+            catch
+            {
+                if (connection is not null)
+                {
+                    await CleanupConnectionAsync(connection, errors: null);
+                }
+                else if (cliProcess is not null)
+                {
+                    await CleanupCliProcessAsync(cliProcess, errors: null, _logger);
+                }
 
-            _logger.LogInformation("Copilot client connected");
-            return connection;
+                throw;
+            }
         }
     }
 
@@ -353,11 +369,27 @@ private async Task CleanupConnectionAsync(List<Exception>? errors)
             return;
         }
 
-        var ctx = await _connectionTask;
+        var connectionTask = _connectionTask;
         _connectionTask = null;
 
+        Connection ctx;
+        try
+        {
+            ctx = await connectionTask;
+        }
+        catch (Exception ex)
+        {
+            _logger.LogDebug(ex, "Ignoring failed Copilot client startup during cleanup");
+            return;
+        }
+
+        await CleanupConnectionAsync(ctx, errors);
+    }
+
+    private async Task CleanupConnectionAsync(Connection ctx, List<Exception>? errors)
+    {
         try { ctx.Rpc.Dispose(); }
-        catch (Exception ex) { errors?.Add(ex); }
+        catch (Exception ex) { AddCleanupError(errors, ex, _logger); }
 
         // Clear RPC and models cache
         _serverRpc = null;
@@ -366,17 +398,47 @@ private async Task CleanupConnectionAsync(List<Exception>? errors)
         if (ctx.NetworkStream is not null)
         {
             try { await ctx.NetworkStream.DisposeAsync(); }
-            catch (Exception ex) { errors?.Add(ex); }
+            catch (Exception ex) { AddCleanupError(errors, ex, _logger); }
         }
 
         if (ctx.CliProcess is { } childProcess)
+        {
+            await CleanupCliProcessAsync(childProcess, errors, _logger);
+        }
+    }
+
+    private static async Task CleanupCliProcessAsync(Process childProcess, List<Exception>? errors, ILogger? logger)
+    {
+        try
         {
             try
             {
-                if (!childProcess.HasExited) childProcess.Kill();
+                if (!childProcess.HasExited)
+                {
+                    childProcess.Kill(entireProcessTree: true);
+                    await childProcess.WaitForExitAsync();
+                }
+            }
+            finally
+            {
                 childProcess.Dispose();
             }
-            catch (Exception ex) { errors?.Add(ex); }
+        }
+        catch (Exception ex)
+        {
+            AddCleanupError(errors, ex, logger);
+        }
+    }
+
+    private static void AddCleanupError(List<Exception>? errors, Exception ex, ILogger? logger)
+    {
+        if (errors is not null)
+        {
+            errors.Add(ex);
+        }
+        else
+        {
+            logger?.LogDebug(ex, "Error while cleaning up Copilot CLI connection");
         }
     }
 
@@ -1090,7 +1152,7 @@ internal static async Task<T> InvokeRpcAsync<T>(JsonRpc rpc, string method, obje
 
             if (!string.IsNullOrEmpty(stderrOutput))
             {
-                throw new IOException($"CLI process exited unexpectedly.\nstderr: {stderrOutput}", ex);
+                throw new IOException(FormatCliExitedMessage("CLI process exited unexpectedly.", stderrOutput), ex);
             }
             throw new IOException($"Communication error with Copilot CLI: {ex.Message}", ex);
         }
@@ -1100,6 +1162,24 @@ internal static async Task<T> InvokeRpcAsync<T>(JsonRpc rpc, string method, obje
         }
     }
 
+    private static string FormatCliExitedMessage(string message, string stderrOutput)
+    {
+        return string.IsNullOrEmpty(stderrOutput)
+            ? message
+            : $"{message}\nstderr: {stderrOutput}";
+    }
+
+    private static IOException CreateCliExitedException(string message, StringBuilder stderrBuffer)
+    {
+        string stderrOutput;
+        lock (stderrBuffer)
+        {
+            stderrOutput = stderrBuffer.ToString().Trim();
+        }
+
+        return new IOException(FormatCliExitedMessage(message, stderrOutput));
+    }
+
     private Task<Connection> EnsureConnectedAsync(CancellationToken cancellationToken)
     {
         if (_connectionTask is null && !_options.AutoStart)
@@ -1152,7 +1232,7 @@ private async Task VerifyProtocolVersionAsync(Connection connection, Cancellatio
                 connection.Rpc, "connect", [new ConnectRequest { Token = _effectiveConnectionToken }], connection.StderrBuffer, cancellationToken);
             serverVersion = (int)connectResponse.ProtocolVersion;
         }
-        catch (RemoteRpcException ex) when (ex.ErrorCode == RemoteRpcException.MethodNotFoundErrorCode)
+        catch (IOException ex) when (ex.InnerException is RemoteRpcException remoteEx && IsUnsupportedConnectMethod(remoteEx))
         {
             // Legacy server without `connect`; fall back to `ping`. A token, if any,
             // is silently dropped — the legacy server can't enforce one.
@@ -1180,6 +1260,12 @@ private async Task VerifyProtocolVersionAsync(Connection connection, Cancellatio
         _negotiatedProtocolVersion = serverVersion.Value;
     }
 
+    private static bool IsUnsupportedConnectMethod(RemoteRpcException ex)
+    {
+        return ex.ErrorCode == RemoteRpcException.MethodNotFoundErrorCode
+            || string.Equals(ex.Message, "Unhandled method connect", StringComparison.Ordinal);
+    }
+
     private static async Task<(Process Process, int? DetectedLocalhostTcpPort, StringBuilder StderrBuffer)> StartCliServerAsync(CopilotClientOptions options, string? connectionToken, ILogger logger, CancellationToken cancellationToken)
     {
         // Use explicit path, COPILOT_CLI_PATH env var (from options.Environment or process env), or bundled CLI - no PATH fallback
@@ -1277,18 +1363,24 @@ private async Task VerifyProtocolVersionAsync(Connection connection, Cancellatio
             if (telemetry.CaptureContent is { } capture) startInfo.Environment["OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT"] = capture ? "true" : "false";
         }
 
-        var cliProcess = new Process { StartInfo = startInfo };
-        cliProcess.Start();
-
-        // Capture stderr for error messages and forward to logger
-        var stderrBuffer = new StringBuilder();
-        _ = Task.Run(async () =>
+        Process? cliProcess = null;
+        try
         {
-            while (cliProcess != null && !cliProcess.HasExited)
+            cliProcess = new Process { StartInfo = startInfo };
+            cliProcess.Start();
+
+            // Capture stderr for error messages and forward to logger
+            var stderrBuffer = new StringBuilder();
+            var stderrReader = Task.Run(async () =>
             {
-                var line = await cliProcess.StandardError.ReadLineAsync(cancellationToken);
-                if (line != null)
+                while (true)
                 {
+                    var line = await cliProcess.StandardError.ReadLineAsync(cancellationToken);
+                    if (line is null)
+                    {
+                        break;
+                    }
+
                     lock (stderrBuffer)
                     {
                         stderrBuffer.AppendLine(line);
@@ -1299,28 +1391,43 @@ private async Task VerifyProtocolVersionAsync(Connection connection, Cancellatio
                         logger.LogDebug("[CLI] {Line}", line);
                     }
                 }
-            }
-        }, cancellationToken);
+            }, cancellationToken);
 
-        var detectedLocalhostTcpPort = (int?)null;
-        if (options.UseStdio != true)
-        {
-            // Wait for port announcement
-            using var cts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
-            cts.CancelAfter(TimeSpan.FromSeconds(30));
-
-            while (!cts.Token.IsCancellationRequested)
+            var detectedLocalhostTcpPort = (int?)null;
+            if (options.UseStdio != true)
             {
-                var line = await cliProcess.StandardOutput.ReadLineAsync(cts.Token) ?? throw new IOException("CLI process exited unexpectedly");
-                if (ListeningOnPortRegex().Match(line) is { Success: true } match)
+                // Wait for port announcement
+                using var cts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+                cts.CancelAfter(TimeSpan.FromSeconds(30));
+
+                while (!cts.Token.IsCancellationRequested)
                 {
-                    detectedLocalhostTcpPort = int.Parse(match.Groups[1].Value, CultureInfo.InvariantCulture);
-                    break;
+                    var line = await cliProcess.StandardOutput.ReadLineAsync(cts.Token);
+                    if (line is null)
+                    {
+                        await stderrReader;
+                        throw CreateCliExitedException("CLI process exited unexpectedly", stderrBuffer);
+                    }
+
+                    if (ListeningOnPortRegex().Match(line) is { Success: true } match)
+                    {
+                        detectedLocalhostTcpPort = int.Parse(match.Groups[1].Value, CultureInfo.InvariantCulture);
+                        break;
+                    }
                 }
             }
+
+            return (cliProcess, detectedLocalhostTcpPort, stderrBuffer);
         }
+        catch
+        {
+            if (cliProcess is not null)
+            {
+                await CleanupCliProcessAsync(cliProcess, errors: null, logger);
+            }
 
-        return (cliProcess, detectedLocalhostTcpPort, stderrBuffer);
+            throw;
+        }
     }
 
     private static string? GetBundledCliPath(out string searchedPath)

dotnet/src/Generated/SessionEvents.cs

@@ -1528,6 +1528,40 @@ public class ProviderConfig
     /// </summary>
     [JsonPropertyName("headers")]
     public IDictionary<string, string>? Headers { get; set; }
+
+    /// <summary>
+    /// Well-known model name used by the runtime to look up agent configuration
+    /// (tools, prompts, reasoning behavior) and default token limits. Also used
+    /// as the wire model when <see cref="WireModel"/> is not set.
+    /// Falls back to <see cref="SessionConfig.Model"/>.
+    /// </summary>
+    [JsonPropertyName("modelId")]
+    public string? ModelId { get; set; }
+
+    /// <summary>
+    /// Model name sent to the provider API for inference. Use this when the
+    /// provider's model name (e.g. an Azure deployment name or a custom
+    /// fine-tune name) differs from <see cref="ModelId"/>.
+    /// Falls back to <see cref="ModelId"/>, then <see cref="SessionConfig.Model"/>.
+    /// </summary>
+    [JsonPropertyName("wireModel")]
+    public string? WireModel { get; set; }
+
+    /// <summary>
+    /// Overrides the resolved model's default max prompt tokens. The runtime
+    /// triggers conversation compaction before sending a request when the
+    /// prompt (system message, history, tool definitions, user message) would
+    /// exceed this limit.
+    /// </summary>
+    [JsonPropertyName("maxPromptTokens")]
+    public int? MaxInputTokens { get; set; }
+
+    /// <summary>
+    /// Overrides the resolved model's default max output tokens. When hit, the
+    /// model stops generating and returns a truncated response.
+    /// </summary>
+    [JsonPropertyName("maxOutputTokens")]
+    public int? MaxOutputTokens { get; set; }
 }
 
 /// <summary>