Add Rust SDK model allowlist support

[jpbufe3]

Users need a host-controlled subset of model IDs to apply consistently when creating, resuming, and updating sessions. This adds the Rust SDK contract needed to pass that restriction to the runtime without duplicating runtime validation or policy logic.

Summary

• Add optional allowed_models fields and fluent builders to SessionConfig and ResumeSessionConfig, serialized as allowedModels and omitted when unrestricted.
• Add the generated typed session.model.setAllowedModels RPC request/result surface for replacing or clearing a running session's restriction.
• Cover defaults, Debug output, create/resume wire conversion, request serialization, method routing, and typed result deserialization.

The SDK preserves exact caller-provided IDs; the runtime remains responsible for validation, policy intersection, fallback selection, and enforcement across child, sub-agent, Auto, and remote execution paths.

Testing

• COPILOT_SKIP_CLI_DOWNLOAD=1 cargo test --all-features allowed_models
• COPILOT_SKIP_CLI_DOWNLOAD=1 cargo test --all-features wire_flags_off_without_handlers
• cargo +nightly-2026-04-14 fmt --check

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

Review tier: Lite
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	rust/​src/​types.rs — This builder will happily accept an empty iterator and serialize an explicit empty allowlist, but…

What changed in this PR

Adds Rust SDK support for a host-controlled allowlist of model IDs, enabling consistent restrictions during session create/resume and while updating a running session via a new RPC.

Changes:

• Added allowed_models to SessionConfig and ResumeSessionConfig with wire serialization as allowedModels.
• Introduced session.model.setAllowedModels RPC surface with typed request/result structs and routing constant.
• Added/updated tests covering serialization, wire conversion, method routing, and result deserialization.

File	Description
rust/​src/​types.rs	Adds allowed_models to session configs, builders, Debug/Default, and wire conversion; adds unit tests.
rust/​src/​wire.rs	Extends session create/resume wire structs to carry allowed_models.
rust/​src/​generated/​api_types.rs	Adds RPC method constant and typed request/result DTOs for setAllowedModels.
rust/​src/​generated/​rpc.rs	Adds typed SessionRpcModel::set_allowed_models method calling the new wire RPC.
rust/​tests/​session_test.rs	Adds integration-style test verifying method name, params, and deserialization for replace/clear flows.
rust/​tests/​api_types_test.rs	Adds contract/serialization tests for the new request/result types.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[SteveSandersonMS]

Thanks for the contribution! I ran this against the real pinned CLI (v1.0.83-4) to validate the runtime side:

• The real api.schema.json shipped in this CLI release has no allowedModels/setAllowedModels fields at all.
• I started copilot --server --stdio and sent a live session.model.setAllowedModels JSON-RPC request — the runtime returns {"error":{"code":-32601,"message":"Unhandled method session.model.setAllowedModels"}}.
• Setting allowedModels on session.create is silently ignored by the runtime, so SessionConfig::with_allowed_models(...) currently gives callers a false sense that a restriction is being enforced.

The addModelSetAllowedModelsRpc() function added to scripts/codegen/rust.ts hand-authors a schema fragment ahead of the real runtime contract, rather than generating from the shipped api.schema.json. That's not how this repo's codegen pipeline is meant to work, and it also means this capability is currently Rust-only rather than generated consistently for all 6 SDKs the way other schema-driven features are.

Could you hold off until the corresponding runtime contract actually ships in a released CLI, then resubmit generated purely from the real schema (and ideally across all SDKs, since this isn't Rust-specific)? For tracking, I've moved this to draft - please mark as ready to review when appropriate.

[jpbufe3]

Could you hold off until the corresponding runtime contract actually ships in a released CLI, then resubmit generated purely from the real schema (and ideally across all SDKs, since this isn't Rust-specific)?

Thanks for validating this against the pinned CLI. Agreed: this should not merge while the shipped runtime ignores the create/resume field and does not implement the live RPC. I will keep the PR in draft and retain the branch only for coordination with the paired runtime/app work. Once the contract is in a released CLI, the SDK surface should be regenerated from that shipped schema and evaluated consistently across the SDKs.