@@ -1256,7 +1256,6 @@ export class CopilotAgent extends Disposable implements IAgent {
 		this._sandboxCertificate = this._instantiationService.createInstance(CopilotSandboxCertificate);
 		this._customizationInstallations = this._register(new CopilotCustomizationInstallations(
 			() => this._ensureClient(),
-			session => this._findSessionChat(session)?.sessionId,
 			async (client, sessionId) => {
 				const copilotClient = client as CopilotClient;
 				const createSession = () => this._sessionLauncher.createCustomizationPolicySession(
@@ -2837,24 +2836,26 @@ export class CopilotAgent extends Disposable implements IAgent {
 		}));
 	}
 
-	searchCustomizationMarketplace(session: URI, request: IAgentCustomizationMarketplaceSearchRequest): Promise<IAgentCustomizationMarketplaceSearchResult> {
-		return this._customizationInstallations.search(session, request);
+	// SDK customization operations always bind to the hidden, credential-verified
+	// policy session rather than the session's chat; see CopilotCustomizationInstallations.
+	searchCustomizationMarketplace(_session: URI, request: IAgentCustomizationMarketplaceSearchRequest): Promise<IAgentCustomizationMarketplaceSearchResult> {
+		return this._customizationInstallations.search(request);
 	}
 
-	listCustomizationInstallations(session: URI): Promise<readonly IAgentCustomizationInstallation[]> {
-		return this._customizationInstallations.list(session);
+	listCustomizationInstallations(_session: URI): Promise<readonly IAgentCustomizationInstallation[]> {
+		return this._customizationInstallations.list();
 	}
 
-	prepareCustomizationInstallation(session: URI, request: IAgentCustomizationInstallationRequest | { readonly installationId: string }): Promise<IAgentCustomizationInstallationReview> {
-		return this._customizationInstallations.prepare(session, request);
+	prepareCustomizationInstallation(_session: URI, request: IAgentCustomizationInstallationRequest | { readonly installationId: string }): Promise<IAgentCustomizationInstallationReview> {
+		return this._customizationInstallations.prepare(request);
 	}
 
 	applyCustomizationInstallation(operationId: string): Promise<void> {
 		return this._customizationInstallations.apply(operationId);
 	}
 
-	recoverCustomizationInstallations(session: URI): Promise<readonly IAgentCustomizationInstallation[]> {
-		return this._customizationInstallations.recover(session);
+	recoverCustomizationInstallations(_session: URI): Promise<readonly IAgentCustomizationInstallation[]> {
+		return this._customizationInstallations.recover();
 	}
 
 	addMcpServerConfiguration(name: string, config: IMcpServerConfiguration): Promise<void> {
 
@@ -155,7 +155,12 @@ class PendingCustomizationInstallation extends Disposable {
 		readonly id: string,
 		readonly client: ICopilotCustomizationInstallationClient,
 		readonly sdkOperationId: string,
-		readonly policySessionId: string,
+		/**
+		 * The hidden policy session the SDK planned this operation in and must
+		 * apply it in, or `undefined` for configuration-only operations that do
+		 * not use a policy session.
+		 */
+		readonly policySessionId: string | undefined,
 		readonly review: IAgentCustomizationInstallationReview,
 		readonly validatesConfirmation: (request: InstallationConfirmationRequest) => boolean,
 		readonly apply: () => Promise<ISdkResult | undefined>,
@@ -186,27 +191,31 @@ export class CopilotCustomizationInstallations extends Disposable {
 		return operation?.approved && operation.validatesConfirmation(request) ? 'confirm' : 'cancel';
 	};
 
+	/**
+	 * @param createPolicySession Creates the hidden policy session that binds
+	 * every SDK catalog, inventory, and installation request. The runtime admits
+	 * these requests only when the policy session's GitHub credential was
+	 * verified through `gitHubAuth.setCredentials`; a credential supplied at
+	 * session creation is never verified. Chat sessions are only verified if a
+	 * token change reaches them while live, so they are not guaranteed to have a
+	 * verified credential and must not be used as the policy session.
+	 */
 	constructor(
 		private readonly getClient: () => Promise<ICopilotCustomizationInstallationClient>,
-		private readonly getPolicySessionId: (session: URI) => string | undefined,
-		private readonly createPolicySession?: (client: ICopilotCustomizationInstallationClient, sessionId: string) => Promise<ICopilotCustomizationPolicySession>,
+		private readonly createPolicySession: (client: ICopilotCustomizationInstallationClient, sessionId: string) => Promise<ICopilotCustomizationPolicySession>,
 	) {
 		super();
 	}
 
-	async search(session: URI, request: IAgentCustomizationMarketplaceSearchRequest): Promise<IAgentCustomizationMarketplaceSearchResult> {
+	async search(request: IAgentCustomizationMarketplaceSearchRequest): Promise<IAgentCustomizationMarketplaceSearchResult> {
 		if (!request.query.trim()) {
 			if (request.mediaType && request.mediaType !== copilotPluginMediaType) {
 				return { kind: 'page', items: [] };
 			}
 			return this.browseFeaturedPlugins(await this.getClient(), request);
 		}
-		const visiblePolicySessionId = this.getPolicySessionId(session);
-		if (!visiblePolicySessionId && !this.createPolicySession) {
-			return { kind: 'unavailable', reason: 'session' };
-		}
 		const client = await this.getClient();
-		const policySessionId = visiblePolicySessionId ?? await this.getOrCreatePolicySessionId(client);
+		const policySessionId = await this.getOrCreatePolicySessionId(client);
 		const retainedCursor = request.cursor ? this.catalogCursors.deleteAndLeak(request.cursor) : undefined;
 		if (request.cursor && (!retainedCursor || retainedCursor.client !== client || retainedCursor.policySessionId !== policySessionId)) {
 			retainedCursor?.dispose();
@@ -291,10 +300,9 @@ export class CopilotCustomizationInstallations extends Disposable {
 		};
 	}
 
-	async list(session: URI): Promise<readonly IAgentCustomizationInstallation[]> {
-		const visiblePolicySessionId = this.getVisiblePolicySessionId(session);
+	async list(): Promise<readonly IAgentCustomizationInstallation[]> {
 		const client = await this.getClient();
-		const policySessionId = visiblePolicySessionId ?? await this.getOrCreatePolicySessionId(client);
+		const policySessionId = await this.getOrCreatePolicySessionId(client);
 		const [listedSkills, listedMcp, configured] = await Promise.all([
 			client.rpc.skills.installations.list({ contract: skillInstallationContract, policySessionId }),
 			client.rpc.mcp.installations.list({ contract: mcpInstallationContract, policySessionId }),
@@ -314,10 +322,9 @@ export class CopilotCustomizationInstallations extends Disposable {
 		];
 	}
 
-	async recover(session: URI): Promise<readonly IAgentCustomizationInstallation[]> {
-		const visiblePolicySessionId = this.getVisiblePolicySessionId(session);
+	async recover(): Promise<readonly IAgentCustomizationInstallation[]> {
 		const client = await this.getClient();
-		const policySessionId = visiblePolicySessionId ?? await this.getOrCreatePolicySessionId(client);
+		const policySessionId = await this.getOrCreatePolicySessionId(client);
 		const [skills, mcp, configured] = await Promise.all([
 			client.rpc.skills.installations.recover({ contract: skillInstallationContract, policySessionId }),
 			client.rpc.mcp.installations.recover({ contract: mcpInstallationContract, policySessionId }),
@@ -336,10 +343,9 @@ export class CopilotCustomizationInstallations extends Disposable {
 		await client.rpc.mcp.config.add({ name, config: toCopilotMcpServerConfiguration(config) });
 	}
 
-	async prepare(session: URI, request: IAgentCustomizationInstallationRequest | { readonly installationId: string }): Promise<IAgentCustomizationInstallationReview> {
-		const visiblePolicySessionId = this.getVisiblePolicySessionId(session);
+	async prepare(request: IAgentCustomizationInstallationRequest | { readonly installationId: string }): Promise<IAgentCustomizationInstallationReview> {
 		const client = await this.getClient();
-		const policySessionId = visiblePolicySessionId ?? await this.getOrCreatePolicySessionId(client);
+		const policySessionId = await this.getOrCreatePolicySessionId(client);
 		return hasKey(request, { installationId: true })
 			? this.prepareUninstall(client, policySessionId, request.installationId)
 			: this.prepareInstall(client, policySessionId, request);
@@ -350,7 +356,10 @@ export class CopilotCustomizationInstallations extends Disposable {
 		if (!operation) {
 			throw new Error(localize('copilot.customizationInstallation.expired', "This customization installation review expired. Start the operation again."));
 		}
-		if (operation.client !== await this.getClient()) {
+		const client = await this.getClient();
+		// A token change, telemetry revocation, or idle timeout deletes the hidden
+		// policy session; the SDK cannot apply a plan bound to a deleted session.
+		if (operation.client !== client || (operation.policySessionId !== undefined && operation.policySessionId !== this.policySession?.sessionId)) {
 			this.operations.deleteAndDispose(operationId);
 			throw new Error(localize('copilot.customizationInstallation.runtimeChanged', "The customization runtime restarted. Start the operation again."));
 		}
@@ -513,7 +522,7 @@ export class CopilotCustomizationInstallations extends Disposable {
 		}
 		const configuration = planned.plan.configurationChanges[planned.plan.transportChoices.indexOf(choice)];
 		if (source.kind === 'card') {
-			return this.prepareMcpCardConfiguration(client, policySessionId, request, planned.plan, choice, configuration);
+			return this.prepareMcpCardConfiguration(client, request, planned.plan, choice, configuration);
 		}
 		const prepared = await client.rpc.mcp.prepareInstall({
 			contract: mcpInstallationContract,
@@ -573,7 +582,6 @@ export class CopilotCustomizationInstallations extends Disposable {
 	/** Provisional direct-card fallback until https://github.com/github/copilot-agent-runtime/issues/26495 is available. */
 	private prepareMcpCardConfiguration(
 		client: ICopilotCustomizationInstallationClient,
-		policySessionId: string,
 		request: IAgentCustomizationInstallationRequest,
 		plan: Extract<Awaited<ReturnType<CopilotClient['rpc']['mcp']['planInstall']>>, { readonly kind: 'planned' }>['plan'],
 		choice: Extract<typeof plan.transportChoices[number], { readonly installMethod: 'remote' }>,
@@ -607,7 +615,7 @@ export class CopilotCustomizationInstallations extends Disposable {
 			operationId,
 			client,
 			generateUuid(),
-			policySessionId,
+			undefined,
 			review,
 			() => false,
 			async () => {
@@ -634,7 +642,7 @@ export class CopilotCustomizationInstallations extends Disposable {
 			if (!Object.hasOwn(configured.servers, serverName)) {
 				throw new Error(localize('copilot.customizationInstallation.notFound', "The SDK no longer owns this customization installation."));
 			}
-			return this.prepareConfiguredMcpUninstall(client, policySessionId, serverName);
+			return this.prepareConfiguredMcpUninstall(client, serverName);
 		}
 		const inventory = await this.listWithClient(client, policySessionId);
 		const installation = inventory.find(candidate => candidate.installationId === installationId);
@@ -712,7 +720,7 @@ export class CopilotCustomizationInstallations extends Disposable {
 		return review;
 	}
 
-	private prepareConfiguredMcpUninstall(client: ICopilotCustomizationInstallationClient, policySessionId: string, serverName: string): IAgentCustomizationInstallationReview {
+	private prepareConfiguredMcpUninstall(client: ICopilotCustomizationInstallationClient, serverName: string): IAgentCustomizationInstallationReview {
 		const operationId = generateUuid();
 		const review: IAgentCustomizationInstallationReview = {
 			operationId,
@@ -730,7 +738,7 @@ export class CopilotCustomizationInstallations extends Disposable {
 			operationId,
 			client,
 			generateUuid(),
-			policySessionId,
+			undefined,
 			review,
 			() => false,
 			async () => {
@@ -909,17 +917,6 @@ export class CopilotCustomizationInstallations extends Disposable {
 		this.operations.set(operation.id, operation);
 	}
 
-	private getVisiblePolicySessionId(session: URI): string | undefined {
-		const policySessionId = this.getPolicySessionId(session);
-		if (policySessionId) {
-			return policySessionId;
-		}
-		if (!this.createPolicySession) {
-			throw new Error(localize('copilot.customizationInstallation.sessionRequired', "Start a Copilot agent session before managing SDK installations."));
-		}
-		return undefined;
-	}
-
 	private async getOrCreatePolicySessionId(client: ICopilotCustomizationInstallationClient): Promise<string> {
 		let current = this.policySession;
 		if (current?.client === client) {
@@ -934,7 +931,7 @@ export class CopilotCustomizationInstallations extends Disposable {
 			const generation = ++this.policySessionGeneration;
 			const sessionId = generateUuid();
 			this.policySessionIds.add(sessionId);
-			creating = this.createPolicySession!(client, sessionId).then(async created => {
+			creating = this.createPolicySession(client, sessionId).then(async created => {
 				if (created.sessionId !== sessionId || generation !== this.policySessionGeneration) {
 					try {
 						await created.dispose();
 
@@ -2170,6 +2170,70 @@ suite('CopilotAgent', () => {
 		}
 	});
 
+	test('customization inventory uses the verified hidden policy session while a chat is live', async () => {
+		const workingDirectory = await fs.mkdtemp(`${os.tmpdir()}/copilot-customization-policy-`);
+		const sessionId = 'visible-chat';
+		const session = AgentSession.uri('copilotcli', sessionId);
+		const chat = defaultChatUri(session);
+		const context = exactChatContext(session, chat, session);
+		const client = new TestCopilotClient([sdkSession(sessionId, workingDirectory)]);
+		const runtimes = new Map<string, MockCopilotSession>();
+		client.createSession = async config => {
+			const runtime = new MockCopilotSession(config.sessionId ?? sessionId);
+			runtimes.set(runtime.sessionId, runtime);
+			return runtime as unknown as CopilotSession;
+		};
+		client.resumeSession = async id => {
+			const runtime = new MockCopilotSession(id);
+			runtimes.set(id, runtime);
+			return runtime as unknown as CopilotSession;
+		};
+		const negotiated = { runtimeProtocolVersion: 3, grantedCapabilities: [] };
+		const inventoryRequests: string[] = [];
+		const skillInstallations: Pick<CopilotClient['rpc']['skills']['installations'], 'list'> = {
+			list: async request => {
+				inventoryRequests.push(`skills:${request.policySessionId}`);
+				return { kind: 'outcome', negotiated, outcome: { kind: 'listed', installations: [] } };
+			},
+		};
+		const mcpInstallations: Pick<CopilotClient['rpc']['mcp']['installations'], 'list'> = {
+			list: async request => {
+				inventoryRequests.push(`mcp:${request.policySessionId}`);
+				return { kind: 'outcome', negotiated, outcome: { kind: 'listed', installations: [] } };
+			},
+		};
+		const discover: CopilotClient['rpc']['mcp']['discover'] = async () => ({ servers: [] });
+		Object.assign(client.rpc.skills, { installations: skillInstallations });
+		Object.assign(client.rpc.mcp, { installations: mcpInstallations, discover });
+		const agent = createTestAgent(disposables, { copilotClient: client, useRealResumePath: true, sessionDataService: disposables.add(new TestSessionDataService()) });
+		try {
+			await agent.authenticate('https://api.github.com', 'token');
+			await agent.refreshModels();
+			await provisionSession(agent, { session, workingDirectories: [URI.file(workingDirectory)] });
+			await agent.chats.prepareTurn!(chat, 'turn-1', [URI.file(workingDirectory)], context);
+			const visibleSessionId = agent['_findSessionChat'](session)?.sessionId;
+			assert.ok(visibleSessionId);
+
+			await agent.listCustomizationInstallations(session);
+
+			const hiddenSessionIds = [...runtimes.keys()].filter(id => id !== visibleSessionId);
+			assert.deepStrictEqual({
+				hiddenSessionIds: hiddenSessionIds.length,
+				inventoryRequests,
+				hiddenCredentialHosts: runtimes.get(hiddenSessionIds[0])?.gitHubCredentialUpdates.map(update => update.credentials.host),
+				hiddenSessionIsDiscoverable: !agent['_customizationInstallations'].isPolicySessionId(hiddenSessionIds[0]),
+			}, {
+				hiddenSessionIds: 1,
+				inventoryRequests: [`skills:${hiddenSessionIds[0]}`, `mcp:${hiddenSessionIds[0]}`],
+				hiddenCredentialHosts: ['https://github.com'],
+				hiddenSessionIsDiscoverable: false,
+			});
+		} finally {
+			await disposeAgent(agent);
+			await fs.rm(workingDirectory, { recursive: true, force: true });
+		}
+	});
+
 	test('a chat may set its own approvals, mode, tool permissions and sandbox', async () => {
 		const agent = createTestAgent(disposables);
 		try {