@@ -1,6 +1,6 @@
 const fs = require("node:fs");
 const path = require("node:path");
-const { spawnSync } = require("node:child_process");
+const { spawn, spawnSync } = require("node:child_process");
 
 const secrets = new Set([process.env.GITHUB_TOKEN]);
 const report = { cliVersion: "1.0.104", inferenceRequests: 0, attempts: [] };
@@ -104,6 +104,8 @@ async function discoverTools(config) {
   }
   const headers = { ...config.headers };
   keepHeaderSecrets(headers);
+  // Listing omits runtime-injected credentials; test this token explicitly.
+  headers.Authorization = `Bearer ${process.env.GITHUB_TOKEN}`;
   const initialized = await rpc(
     url,
     headers,
@@ -116,6 +118,7 @@ async function discoverTools(config) {
     1,
   );
   const result = {
+    authentication: "explicit Actions GITHUB_TOKEN",
     endpoint: `${url.origin}${url.pathname}`,
     headerNames: Object.keys(headers).filter(
       (name) => name.toLowerCase() !== "mcp-session-id",
@@ -150,6 +153,143 @@ async function discoverTools(config) {
   return result;
 }
 
+async function inspectSession(config) {
+  const child = spawn("copilot", [...flags, "--server", "--stdio"], {
+    stdio: ["pipe", "pipe", "pipe"],
+  });
+  let buffer = Buffer.alloc(0);
+  let nextId = 0;
+  const pending = new Map();
+  const result = { stderr: "" };
+  report.session = result;
+  child.stderr.setEncoding("utf8").on("data", (chunk) => {
+    result.stderr += chunk;
+  });
+  function send(message) {
+    const body = JSON.stringify(message);
+    child.stdin.write(
+      `Content-Length: ${Buffer.byteLength(body)}\r\n\r\n${body}`,
+    );
+  }
+  child.stdout.on("data", (chunk) => {
+    try {
+      buffer = Buffer.concat([buffer, chunk]);
+      while (true) {
+        const end = buffer.indexOf("\r\n\r\n");
+        if (end < 0) return;
+        const length = Number(
+          /Content-Length:\s*(\d+)/i.exec(
+            buffer.subarray(0, end).toString(),
+          )?.[1],
+        );
+        if (!Number.isFinite(length))
+          throw new Error("Missing JSON-RPC frame length");
+        if (buffer.length < end + 4 + length) return;
+        const message = JSON.parse(
+          buffer.subarray(end + 4, end + 4 + length).toString(),
+        );
+        buffer = buffer.subarray(end + 4 + length);
+        if (message.method && message.id !== undefined) {
+          send({
+            jsonrpc: "2.0",
+            id: message.id,
+            error: { code: -32601, message: "No client callbacks installed" },
+          });
+        } else if (pending.has(message.id)) {
+          const request = pending.get(message.id);
+          pending.delete(message.id);
+          clearTimeout(request.timer);
+          if (message.error)
+            request.reject(new Error(JSON.stringify(message.error)));
+          else request.resolve(message.result);
+        }
+      }
+    } catch (error) {
+      rejectPending(error);
+    }
+  });
+  function rejectPending(error) {
+    for (const request of pending.values()) {
+      clearTimeout(request.timer);
+      request.reject(error);
+    }
+    pending.clear();
+  }
+  child.on("error", rejectPending);
+  child.stdin.on("error", rejectPending);
+  child.on("exit", (code) =>
+    rejectPending(new Error(`CLI server exited with ${code}`)),
+  );
+  function request(method, params) {
+    if (
+      ![
+        "ping",
+        "session.create",
+        "session.mcp.list",
+        "session.mcp.listTools",
+        "session.destroy",
+      ].includes(method)
+    ) {
+      throw new Error("Refusing non-discovery RPC");
+    }
+    return new Promise((resolve, reject) => {
+      const id = ++nextId;
+      const timer = setTimeout(() => {
+        pending.delete(id);
+        reject(new Error(`Timed out waiting for ${method}`));
+      }, 90000);
+      pending.set(id, { resolve, reject, timer });
+      send({ jsonrpc: "2.0", id, method, params });
+    });
+  }
+  try {
+    result.ping = await request("ping", { message: "no-inference-diagnostic" });
+    const session = await request("session.create", {
+      model: "gpt-6.1-terra",
+      workingDirectory: process.cwd(),
+      availableTools: [
+        "apply_patch",
+        "bash",
+        "glob",
+        "rg",
+        "view",
+        "web_fetch",
+        "web_search",
+      ],
+      mcpServers: config.mcpServers,
+      disabledMcpServers: ["githubiq"],
+    });
+    result.sessionId = session.sessionId;
+    const listed = await request("session.mcp.list", {
+      sessionId: session.sessionId,
+    });
+    result.servers = listed.servers.map((server) => ({
+      name: server.name,
+      status: server.status,
+      error: server.error,
+      toolCount: server.toolCount,
+    }));
+    const tools = await request("session.mcp.listTools", {
+      sessionId: session.sessionId,
+      serverName: "github-mcp-server",
+    });
+    result.toolNames = tools.tools.map((tool) => tool.name).sort();
+    result.webSearchPresent = result.toolNames.includes("web_search");
+    await request("session.destroy", { sessionId: session.sessionId });
+    result.complete = true;
+  } catch (error) {
+    result.complete = false;
+    result.error = error.stack;
+    throw error;
+  } finally {
+    const exited = new Promise((resolve) => child.once("exit", resolve));
+    child.kill("SIGTERM");
+    const timer = setTimeout(() => child.kill("SIGKILL"), 3000);
+    if (child.exitCode === null) await exited;
+    clearTimeout(timer);
+  }
+}
+
 function logFiles(directory) {
   if (!fs.existsSync(directory)) return [];
   return fs.readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
@@ -163,6 +303,7 @@ function logFiles(directory) {
 }
 
 async function main() {
+  let lastConfig;
   for (let attempt = 1; attempt <= 2; attempt++) {
     const child = spawnSync("copilot", [...flags, "mcp", "list", "--json"], {
       cwd: process.cwd(),
@@ -175,6 +316,7 @@ async function main() {
     if (child.error) throw child.error;
     if (child.status !== 0) throw new Error("copilot mcp list failed");
     const config = JSON.parse(child.stdout);
+    lastConfig = config;
     for (const server of Object.values(config.mcpServers || {}))
       keepHeaderSecrets(server.headers);
     result.servers = Object.fromEntries(
@@ -185,13 +327,16 @@ async function main() {
           type: server.type,
           source: server.source,
           selectedTools: server.tools,
+          configurationKeys: Object.keys(server),
+          toolSelector: server.headers?.["X-MCP-Tools"],
         },
       ]),
     );
     const github = config.mcpServers?.["github-mcp-server"];
     if (github && github.enabled !== false)
       result.github = await discoverTools(github);
   }
+  await inspectSession(lastConfig);
   report.complete = true;
 }