The HMAC key auth method (CAPI_HMAC_KEY / COPILOT_HMAC_KEY) should not be
documented publicly; it was re-added by doc automation. Removes it from the
authentication priority list in authenticate.md and the summary in README.md.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add opaque metadata passthrough to SDK tool definitions

Add an optional, opaque `metadata` bag to tool definitions across all SDK
languages and forward it verbatim over the session.create/resume RPC. This
lets hosts attach namespaced metadata to tools without expanding the typed
public contract; the runtime may recognize specific keys to inform
host-specific behavior. Unknown keys are round-tripped untouched.

Languages: nodejs (Tool.metadata + defineTool), python (Tool.metadata +
define_tool), go (Tool.Metadata), rust (Tool.metadata + with_metadata),
java (ToolDefinition.metadata + createWithMetadata), dotnet
(CopilotToolOptions.Metadata + wire ToolDefinition.Metadata). Tests added
per language for wire/serialization forwarding and omission when unset.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Address review feedback on tool metadata passthrough

- dotnet: change Metadata value type to IDictionary<string, JsonNode?> for
  NativeAOT-safe serialization (CopilotToolOptions + wire ToolDefinition,
  FromAIFunction cast, unit test); drop redundant [JsonPropertyName("metadata")]
  since the Web camelCase policy already maps it; remove the <remarks> block
  from the Metadata property.
- Reword metadata doc comments across nodejs/python/go/rust/java to describe
  the bag opaquely without the SDK-vs-runtime/CLI distinction.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: bf2bf0dd-ec9f-42f5-a6e1-4f2a9e562d5f

* Java: enable tool metadata for @copilotTool + compat constructor

Address Java SME feedback so annotation-based tools reach parity with the
programmatic API and existing constructor call sites keep compiling.

- ToolDefinition: add a backward-compatible 7-arg constructor delegating to
  the canonical 8-arg with metadata=null.
- CopilotTool: add metadata() plus nested MetadataEntry/MetadataValue/
  MetadataFlag annotations (@target({})) with a shallow bool|str|flag-map
  representation, documenting the programmatic API for richer values.
- CopilotToolProcessor: generate the metadata constructor argument
  (Map.<String, Object>of(...) with an explicit type witness) instead of a
  hardcoded null; null when no metadata is present.
- Tests: processor generation cases (nested flags, absent, combined flags),
  ToolDefinition 7-arg/.metadata(...) copy/flag-chaining cases, and a
  fromObject metadata assertion; extend the SimpleTools fixture pair to emit
  a safeForTelemetry metadata map.
- ADR-005: update the generated snippet to the 8-arg shape and document the
  @copilotTool(metadata = ...) syntax and emitted shape.

Note: mvn verify / spotless:apply not run locally (no JDK/Maven in the dev
environment); relies on PR CI.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: bf2bf0dd-ec9f-42f5-a6e1-4f2a9e562d5f

* Apply spotless formatting to Java metadata changes

Reflow javadoc and wrap annotation/constructor args per the Eclipse
formatter (mvn spotless:apply). No behavioral change.

Verified locally: mvn spotless:check clean; ToolDefinitionTest (8),
ToolDefinitionFromObjectTest (31), CopilotToolProcessorTest (37) all pass on
JDK 26.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: bf2bf0dd-ec9f-42f5-a6e1-4f2a9e562d5f

* test: assert null metadata arg in generated tool definition

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ab2c14cd-d2e1-4524-a6dc-e9c10899343c

* docs: describe the metadata-less ToolDefinition overload by its steady state

Reword the 7-arg constructor's Javadoc to describe what the overload is (a
convenience constructor equivalent to the canonical one with metadata=null)
rather than its relationship to a specific change ("backward-compatible",
"retained so ... keep compiling after metadata was added"), which is only
meaningful in the context of the PR that introduced it.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: bf2bf0dd-ec9f-42f5-a6e1-4f2a9e562d5f

* rust: use IndexMap for tool metadata to serialize deterministically

HashMap serializes keys in a randomized order, unlike the sibling `parameters`
field (IndexMap) and the other SDKs (nodejs/python insertion order, Go sorted).
Switch the tool `metadata` bag to IndexMap<String, Value> so key order is
deterministic and consistent, avoiding non-reproducible wire output. No new
dependency; indexmap is already used by this struct.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: bf2bf0dd-ec9f-42f5-a6e1-4f2a9e562d5f

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Ed Burns <edburns@microsoft.com>

* Instrument Node in-process test stalls

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6e902b9a-5527-4a32-a5a3-e0bf5bfef3f7

* Trace runtime and proxy during Node stalls

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6e902b9a-5527-4a32-a5a3-e0bf5bfef3f7

* Create focused Windows in-process stress run

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6e902b9a-5527-4a32-a5a3-e0bf5bfef3f7

* Measure Windows test resource pressure

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6e902b9a-5527-4a32-a5a3-e0bf5bfef3f7

* Preserve runtime diagnostics on failure

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6e902b9a-5527-4a32-a5a3-e0bf5bfef3f7

* Trace Windows session database locks

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6e902b9a-5527-4a32-a5a3-e0bf5bfef3f7

* Avoid perturbing runtime lock timing

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6e902b9a-5527-4a32-a5a3-e0bf5bfef3f7

* Avoid Windows in-process teardown deadlock

Do not retry removal of the in-process runtime's session home while its Vitest worker still owns a locked session database. Retrying until the hook timeout prevents the worker from exiting and releasing the lock.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6e902b9a-5527-4a32-a5a3-e0bf5bfef3f7

* Clarify Windows teardown deadlock

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6e902b9a-5527-4a32-a5a3-e0bf5bfef3f7

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Update @github/copilot to 1.0.71

- Updated nodejs and test harness dependencies
- Re-ran code generators
- Formatted generated code

* Route Python hooks.invoke through generated client-global handler

CLI 1.0.71 promoted hooks.invoke to a client-global RPC method with a
generated HooksHandler interface. The handwritten SDK still registered its
own hooks.invoke handler, which only avoided colliding with the generated
one because global handlers were skipped when no LLM/telemetry adapter was
set.

Make the wiring intentional: add _HooksAdapter implementing the generated
HooksHandler protocol (routing HookInvokeRequest.sessionId to the matching
session's dispatcher), always register the client-global handlers with the
hooks adapter, and remove the redundant handwritten hooks.invoke
registrations and dead client-level handler.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: ae226b7f-caf9-46f3-b8c5-b9a21c5d7951

* Route Node hooks.invoke through generated client-global handler

CLI 1.0.71 promoted hooks.invoke to a client-global RPC method with a
generated HooksHandler interface. The handwritten SDK registered its own
hooks.invoke handler on the connection, which the generated
registerClientGlobalApiHandlers then shadowed with an unwired handler that
threw "No hooks client-global handler registered" — so hooks never fired.

Wire the existing handleHooksInvoke routing into the generated
clientGlobalHandlers.hooks slot and drop the redundant handwritten
connection.onRequest("hooks.invoke") registration. Behavior is unchanged;
the dispatcher and its payload validation are reused as-is.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: ae226b7f-caf9-46f3-b8c5-b9a21c5d7951

* Route Go hooks.invoke through generated client-global handler

CLI 1.0.71 promoted hooks.invoke to a client-global RPC method whose
generated registration installs a hooks.invoke handler that rejects all
invocations unless the Hooks slot is populated. Whenever an LLM inference
or telemetry adapter was configured, that generated handler overrode the
handwritten hooks.invoke registration and hooks stopped firing (e.g. the
sub-agent hook test).

Always register the client-global handlers with a hooksAdapter that
delegates to the existing per-session dispatcher, and drop the redundant
handwritten hooks.invoke registration.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: ae226b7f-caf9-46f3-b8c5-b9a21c5d7951

* Fix Rust hook input deserialization for float timestamps

The Copilot CLI serializes hook input `timestamp` as a JSON float
(e.g. `1784203878038.0`). Rust's hand-authored hook input structs typed
`timestamp` as `i64`, so `serde_json::from_value` rejected the float,
`dispatch_hook` returned an error, and the session handler fell back to
an empty `{ "output": {} }` response. Hooks therefore never fired: e.g. a
preToolUse deny was dropped, the CLI executed the tool, and the replayed
conversation diverged ("No cached response" -> 500).

Other SDKs tolerate this incidentally (Go decodes `input` into `any` and
re-marshals, dropping the `.0`); Rust decodes strictly. Type the hook
input `timestamp` fields as `f64` to match the shape the runtime sends.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: ae226b7f-caf9-46f3-b8c5-b9a21c5d7951

* Fix .NET build break and float hook timestamps for hooks.invoke

CLI 1.0.71 promoted hooks.invoke to an internal client-global RPC method.
The C# codegen still emitted its internal request/result DTOs behind a public
IHooksHandler surface, producing CS0050/CS0051 inconsistent-accessibility
errors that broke the entire .NET build. It also registered a second, unwired
hooks.invoke handler that would shadow the working handwritten one.

Filter internal client-global and client-session methods in the C# code
generator so no generated interface, handler property, or RPC registration is
emitted for internal methods like hooks.invoke. The handwritten
SetLocalRpcMethod(hooks.invoke, ...) registration continues to serve hooks.
This mirrors, for .NET's static typing, the routing fixes already applied to
Node, Python, and Go.

Also tolerate hook timestamp epoch milliseconds encoded as either JSON
integers or floats in UnixMillisecondsDateTimeOffsetConverter, covering the
CLI 1.0.71 float serialization (matching the Rust fix).

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 94a20428-6b0e-4733-a354-0abf2d186320

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Steve Sanderson <SteveSandersonMS@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Stephen Toub <stoub@microsoft.com>