feat: add MCP Apps (SEP-1865) support

[mattdholloway]

Adds opt-in MCP Apps (SEP-1865) support across all SDKs: a new enableMcpApps session flag, Node helpers for safely sandboxing ui:// iframe rendering, and regenerated RPC/session-event types.

Changes

• enableMcpApps opt-in (SessionConfig + ResumeSessionConfig in all SDKs) — plumbed to wire field requestMcpApps. Defaults to false; hosts without an iframe renderer are unaffected.
• Capability gate warning — each SDK emits a warning when enableMcpApps was requested but capabilities.ui.mcpApps was not advertised by the runtime (feature flag unset). Node uses process.emitWarning with code: "MCPAPPS_CAPABILITY_DROPPED" and includes the session ID for correlation across multi-session hosts:

  // Warning emitted on capabilities mismatch:
  // McpAppsCapabilityDroppedWarning [MCPAPPS_CAPABILITY_DROPPED]: enableMcpApps was requested
  // but the runtime did not advertise capabilities.ui.mcpApps (sessionId: abc-123). ...
  process.on("warning", (w) => { if (w.code === "MCPAPPS_CAPABILITY_DROPPED") { ... } });

• Node iframe sandbox helpers (buildMcpAppsCspHeader, buildMcpAppsAllowAttribute) — pure functions for constructing the Content-Security-Policy header and allow attribute per SEP-1865 §UI Resource Format.
• Regenerated types across Node, Python, Go, .NET, and Rust including SessionUiCapabilities.mcpApps.

[mattdholloway]

@copilot resolve the merge conflicts in this pull request

[github-actions]

Generated by SDK Consistency Review Agent for issue #1335 · ● 793.2K

[mattdholloway]

@copilot resolve the merge conflicts in this pull request

[mattdholloway]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Merged main and resolved conflicts in 0b38358 (dotnet/src/Client.cs, go/client.go, go/types.go, nodejs/src/client.ts, nodejs/src/index.ts, nodejs/src/types.ts, python/copilot/client.py, rust/src/session.rs, rust/src/types.rs, rust/tests/e2e/elicitation.rs). Builds + targeted tests pass (Go build, Node build + mcpAppsSandbox tests, Rust cargo check/MCP Apps unit tests, .NET net8.0 build, Python syntax). The Rust enable_mcp_apps field had stale #[serde(...)] attrs (the SessionConfig/ResumeSessionConfig structs are not Serialize); removed those and fixed the wire-flag tests to use the into_wire() signature on main.

[Copilot]

Copilot's findings

• Files reviewed: 23/24 changed files
• Comments generated: 1

[mattdholloway]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Merged main and resolved the conflict in java/src/main/java/com/github/copilot/CopilotClient.java in 8929669 (took main's new com.github.copilot.rpc.* / com.github.copilot.generated.rpc.* import paths from the Java repackaging on main, and kept the SessionCapabilities import added on this branch). All other files auto-merged. Java/Node/Go builds pass; Rust cargo check failed only on the bundled-CLI download in build.rs due to a sandbox TLS issue, unrelated to the merge.

[github-actions]

Generated by SDK Consistency Review Agent for issue #1335 · ● 6.5M

[github-actions]

Minor cross-SDK inconsistency: warnIfMcpAppsDropped omits the session ID

All other SDK implementations of this warning helper accept and include the session ID in the log output, e.g.:

• Python: "Session %s: enable_mcp_apps was requested but ..." (passes session_id to logger.warning)
• Go: "[copilot-sdk] Session %s: EnableMcpApps was requested but ..." (uses sessionID in log.Printf)
• .NET: "Session {SessionId}: EnableMcpApps was requested but ..." (structured log field)
• Java: "Session " + sessionId + ": enableMcpApps was requested but ..."
• Rust: tracing::warn!(session_id = %session_id, "...")

The Node warning message says "the MCP Apps surface is unavailable for this session" without identifying which session, which makes it harder to correlate the warning to a specific session in multi-session hosts.

Suggestion: accept the sessionId as a third parameter and include it in the warning message for parity:

function warnIfMcpAppsDropped(
    requested: boolean | undefined,
    capabilities: { ui?: { mcpApps?: boolean } } | undefined,
    sessionId: string
): void {
    if (requested && !capabilities?.ui?.mcpApps) {
        process.emitWarning(
            `Session ${sessionId}: enableMcpApps was requested but the runtime did not advertise capabilities.ui.mcpApps. ...`,
            "McpAppsCapabilityDroppedWarning"
        );
    }
}

[mattdholloway]

@copilot resolve this

[github-actions]

Cross-SDK Consistency Review ✅

This PR adds enableMcpApps / enable_mcp_apps / EnableMcpApps support consistently across all six SDK implementations: Node.js, Python, Go, .NET, Java, and Rust.

Feature parity check

Feature	Node.js	Python	Go	.NET	Java	Rust
enableMcpApps on SessionConfig	✅	✅	✅	✅	✅	✅
enableMcpApps on ResumeSessionConfig	✅	✅	✅	✅	✅	✅
requestMcpApps wire field on create	✅	✅	✅	✅	✅	✅
requestMcpApps wire field on resume	✅	✅	✅	✅	✅	✅
Capability-drop warning	✅	✅	✅	✅	✅	✅
capabilities.ui.mcpApps type	✅	✅	✅	✅	✅	✅

Language-idiomatic warning mechanisms

Each SDK routes the capability-drop warning through its ecosystem-appropriate channel — process.emitWarning (Node), logger.warning (Python), log.Printf (Go), ILogger.LogWarning (.NET), java.util.logging (Java), tracing::warn! (Rust). This is correct and consistent with SDK idioms.

Node.js-specific iframe sandbox helpers

buildMcpAppsCspHeader and buildMcpAppsAllowAttribute in mcpAppsSandbox.ts are intentionally Node.js-specific — they construct HTTP headers and iframe allow attributes for web rendering contexts. Other language SDKs don't need these.

Naming conventions

All names correctly follow each language's convention:

• TypeScript: enableMcpApps (camelCase) ✅
• Python: enable_mcp_apps (snake_case) ✅
• Go: EnableMcpApps (PascalCase exported) ✅
• .NET: EnableMcpApps (PascalCase) ✅
• Java: enableMcpApps / isEnableMcpApps() (camelCase) ✅
• Rust: enable_mcp_apps (snake_case) ✅

No cross-SDK consistency issues found. 🎉

Generated by SDK Consistency Review Agent for issue #1335 · ● 3.9M · ◷