Tyler James Leonhardt

Claude agent — Phase 7: tool permission round-trip + interactive tools (#315399) * Claude agent — Phase 7: tool permission round-trip + interactive tools Wires the Claude SDK's canUseTool callback through to the host. ExitPlanMode = permission gate; AskUserQuestion = user-input prompt. Adds cross-message tool_use to tool_result correlation in ClaudeMapperState with defense-in-depth cleanup on result. * Address PR review comments - Localize TOOL_DISPLAY display names + MCP fallback (claudeToolDisplay) - Symmetric id derivation in flattenAskUserAnswers / buildAskUserSessionInputQuestions for empty-header questions - Await Query.setPermissionMode in ClaudeAgentSession.setPermissionMode and at the sendMessage callsite so the SDK acks the mode change before the next prompt yields - Guard JSON.stringify trace serialization behind getLevel() <= LogLevel.Trace - Observe options.signal in _handleCanUseTool: deny on already-aborted, race the parked permission/user-input prompt with the abort listener - Add unit tests covering the empty-header round-trip and both abort paths

Add CopilotAPI service for a future Claude agent (#313553) * Add CopilotAPI service & plan for Claude This service can be used to send requests to CAPI which we will need as we shim requests from agents to CAPI. * Add CopilotAPI service & plan for Claude This service can be used to send requests to CAPI which we will need as we shim requests from agents to CAPI. * Clarify signal propagation behavior in ICopilotApiServiceRequestOptions documentation

claude: Phase 10 — workbench client tools via in-process MCP server (#317685)

agentHost/claude: extract Materializer, MetadataStore, FileEditObserver (#315915)

agentHost/claude: Phase 9 — abort + steering + changeModel + crash recovery (#316292) * agentHost/claude: Phase 9 — abort + steering + changeModel + crash recovery Implements the runtime mutation surface for live Claude sessions: - abortSession via _abortController.abort() (mirrors production reference) - setPendingMessages steering via priority:'now' SDKUserMessage with steering_consumed signal on iterable yield - changeModel hot-swap via Query.setModel + Query.applyFlagSettings, with 'max' effort runtime clamp to 'xhigh' (single seam in claudeModelConfig) - Yield-restart primitive: ClaudeMaterializer gains 'fresh'|'resume' start modes and a sibling materializeResume() for crash/abort recovery without re-firing onDidMaterializeSession - Subprocess crash recovery without permanent _fatalError latch — sessions stay reusable across aborts and crashes via _rebindQuery + bijective state replay (model + effort + permissionMode) Refactored claudeAgentSession into three focused units: - ClaudePromptQueue — owns the SDKUserMessage iterable handed to query(), parks/wakes via DeferredPromise, batches turn completion at full drain (M10), fires steering_consumed on yield - ClaudeSdkMessageRouter — dispatches each SDK message through the per-turn mapper, swallowing handler failures - ClaudeSdkPipeline — orchestrates the WarmQuery + AbortController + queue + router lifecycle, including rebind on abort/crash with bijective state replay Each new class has standalone unit test coverage: - claudePromptQueue.test.ts (13 tests) - claudeSdkMessageRouter.test.ts (5 tests) - claudeSdkPipeline.test.ts (10 tests, synchronous lifecycle surface) Plus 10 new Phase 9 integration tests in claudeAgent.test.ts covering abort/resend, steering preempt + consumed signal, changeModel provisional + materialized + 'max' clamp + id-only paths, crash recovery via resume, and bijective state survival across restart. Live E2E (smoke.md Scenarios A-D) verified 2026-05-13. See src/vs/platform/agentHost/node/claude/phase9-plan.md for the full contract, decisions, deviations, and risks. * feedback

agentHost/claude: add CAPI-backed local Anthropic proxy service (#313677) * agentHost/claude: add CAPI-backed local Anthropic proxy service Nothing wires this up yet — this lands the proxy + supporting helpers in preparation for the Claude Agent integration. No callers; no behavior changes for existing agents. Introduces ClaudeProxyService — a refcounted local HTTP proxy that speaks the Anthropic Messages API on the inbound side and CopilotApiService on the outbound side. Lets a Claude Agent SDK subprocess (future work) connect via ANTHROPIC_BASE_URL + ANTHROPIC_AUTH_TOKEN and see this as a real Anthropic endpoint while we route through CAPI. Surfaces: - GET / health check (unauthenticated) - GET /v1/models filtered to Anthropic-vendor + /v1/messages - POST /v1/messages non-streaming + SSE streaming pass-through - POST /v1/messages/count_tokens 501 (CAPI does not support it) Other modules: - claudeModelId.ts parse/format SDK <-> CAPI model IDs (e.g. claude-opus-4-6 <-> claude-opus-4-6-20250929) - anthropicBetas.ts filter inbound anthropic-beta headers to a CAPI- supported allowlist - anthropicErrors.ts proxy-authored Anthropic error envelopes (uses Anthropic.ErrorType from @anthropic-ai/sdk) - claudeProxyAuth.ts parse Bearer <nonce>.<sessionId> auth header Phase 1.5 contract changes in CopilotApiService: - introduce CopilotApiError carrying Anthropic.ErrorResponse envelope - COPILOT_API_ERROR_STATUS_STREAMING (520) sentinel for mid-stream errors that have no upstream HTTP status; the proxy coerces this to 502 when surfacing the error before SSE headers are sent. Lifecycle: - ClaudeProxyService is a Disposable registered on the agent host main disposable store. Start() returns refcounted handles; the listener binds lazily on first start and tears down when refcount reaches 0 (or dispose() is called). - Concurrent start() calls share an in-flight bind via a _starting promise to avoid orphaned servers; if dispose() runs while binding, the just-bound server is torn down and the awaiting caller's promise rejects. Tests cover model ID round-trips, beta-header filtering, auth parsing, the full proxy request lifecycle (non-streaming, streaming, error mapping, refcounting, concurrent start/dispose, late-binding token update), and the Phase 1.5 CopilotApiService contract additions. Subprocess ownership invariant: callers that hand baseUrl + nonce to a Claude SDK subprocess MUST kill the subprocess before disposing the handle. After dispose() the proxy may rebind on a different port and the subprocess would silently lose its endpoint. * agentHost/claude: defer request handler attach until runtime is built Address PR review: the http.createServer handler closed over `runtime` before it was assigned. There's a narrow microtask window between `server.listen()` resolving and runtime construction completing, in which an incoming request would hit a temporal-dead-zone ReferenceError on `runtime`. Fix: pass no handler to `createServer()`, build runtime fully (it can now be `const`), then `server.on('request', ...)` afterwards. Node's single-threaded event loop guarantees no `request` event is parsed and dispatched between `listen` resolving and the synchronous `server.on('request', ...)` registration, so the handler safely closes over `runtime` with no TDZ window and no `let` indirection.

feat(auth): Enhance GitHub session handling with detailed prompts (#4778) - Updated `getGitHubSession` method to require `StrictAuthenticationPresentationOptions` for `createIfNone` and `forceNewSession` parameters, ensuring meaningful context is provided to users. - Modified various service implementations to include localized detail messages for authentication prompts, improving user experience during sign-in. - Added a comprehensive usage guide for the `IAuthenticationService`, detailing session types, overloads, and constraints. - GH MCP Feature doesn't bother user over and over for auth - Introduced a new `AGENTS.md` file to document authentication service usage and best practices.

Adopt Claude Agent SDK session APIs for session management (#4472) * Refactor Claude session handling to use native APIs * lint * Handle prompt resolving differently * Feedback

agentHost/claude: Phase 3 reference grounding + Phase 4 ClaudeAgent skeleton (#313780)

Adopt InputState in Claude (#310924) * Adopt InputState in Claude Gets rid of the old options API Co-authored-by: Copilot <copilot@github.com> * agents.md * Address PR review comments - Fix _rebuildInputState to branch on existing vs new sessions, preserving locked groups for existing sessions - Fix permissionModes type from ReadonlySet<string> to ReadonlySet<PermissionMode> - Fix disposable leak: track onDidChange subscriptions alongside WeakRefs, sweep on refresh, and dispose all on provider teardown - Avoid strong state capture in onDidChange closure (use WeakRef deref) --------- Co-authored-by: Copilot <copilot@github.com>

Initial framework of Claude sessions in the Agents app (#311532) * Initial framework of Claude sessions in the Agents app This is barely functional, but it _is_ possible to chat with Claude through it. Bugs: First sent message from the welcome chat behavior is VERY strange. The chat is shown completely blank. Then I see the chat under "Unknown" section in the sessions list. I click it, it disappears after a second and reappears in the "Unknown" section. I click it again, it re-appears in the correct place... then I can start chatting with it. Secondly, no dropdowns show in the existing chat so you can't change the permission mode once you start. I put all of this behind a setting since it's not really ready yet.. but I wanted to get more eyes on these bugs. Co-authored-by: Copilot <copilot@github.com> * feedback Co-authored-by: Copilot <copilot@github.com> --------- Co-authored-by: Copilot <copilot@github.com>

Claude agent host: Phase 8.5 — rich tool-call rendering (#317184) * Claude agent host: roadmap status sync + Phase 8.5 (rich tool-call rendering) - Mark Phases 5, 6, 7, 8 as DONE (implementations have shipped; just catching the headings up to reality). - Insert Phase 8.5 — Rich tool-call rendering parity with Copilot. Today the Claude permission card for Bash reads 'Run shell command' with no command shown; Bash/Grep/Glob rows render in the generic renderer instead of the dedicated terminal/search renderers. This phase ports Copilot's getInvocationMessage / getPastTenseMessage / getToolKind / getShellLanguage / getToolInputString shape into claudeToolDisplay.ts and wires them through the permission, mapper, and replay paths. Phase 6.5 (Fork) intentionally stays Deferred. * Claude agent host: Phase 8.5 plan (super-planner + grilling) Adds phase8.5-plan.md alongside roadmap.md's Phase 8.5 section. Synthesized from a 3-model council (GPT-5.5, Claude Opus 4.6, GPT-5.3-Codex) and refined through a grill-with-docs session. Locked decisions: - D1: getClaudeToolKind is a TOOL_ROWS column (single source of truth). - D2: add Agent row to TOOL_ROWS; delete SUBAGENT_TOOL_NAMES. - D3: defensive Record<string, unknown> access; no per-tool exported types. - D4: pastTenseMessage is success-aware (tool_result.is_error). - D5: live mapper mirrors Copilot's stash-on-start/reuse-on-complete pattern, with state encapsulated in a new ClaudeToolCallRegistry class (replaces today's bare maps on ClaudeMapperState). - D6: _meta single-write on Start; reducer carries to Complete; replay emits on its single terminal action (asymmetry by design). - D7: MCP tools get toolKind: undefined. - D8: one big per-tool snapshot table covering all 5 helpers. - D9: getClaudeInvocationMessage('Task', ...) owns the Task description fallback; Phase 12's site reduces to a plain helper call. - D10: _meta stays flat (no per-kind namespacing). Steps cover claudeToolDisplay (helpers + columns), claudeCanUseTool (permission card rich invocation + _meta), sessionPermissions (forward _meta through pending->ready), claudeMapSessionEvents (registry migration + _meta on Start + success-aware past tense), claudeReplayMapper (parity), claudeSubagentSignals (inner tool parity), and the snapshot + behavior tests. * Claude agent host: Phase 8.5 implementation (rich tool-call rendering) Brings tool-call rendering parity with Copilot: - Rich invocation/past-tense messages per tool (Bash 'Running `git status`' → 'Ran `git status`', Read 'Reading [README.md](...)' → 'Read [README.md](...)', Grep/Glob with patterns, file links for path-bearing tools, subagent descriptions for Task/Agent). - `_meta.toolKind` ('terminal'/'search'/'subagent') stamped at the tool-open seam to drive the workbench's specialized renderers; reducer carries it forward through every state transition (D6 in plan). - New `ClaudeToolCallRegistry` encapsulates per-session tool-call attribution + input accumulation + computed start-info, mirroring Copilot's 'stash on start, reuse on complete' pattern. Critical bug fix bundled in: - Emit `SessionToolCallReady` at `content_block_stop` so auto-allowed tools (which the Claude SDK runs without invoking `canUseTool`) transition Streaming → Running and the subsequent `SessionToolCallComplete` is accepted by the reducer instead of dropped. Without this, every auto-allowed tool widget rendered empty after completion. D6 parity fix for inner subagent tools: - `claudeSubagentSignals` now calls `registry.seedParsedInput()` for inner tool_use blocks (which arrive pre-parsed on synthesized assistant messages rather than via input_json_delta), so the live tool_result handler emits rich past-tense text matching the replay path instead of falling back to '{displayName} finished'. Also fixes a pre-existing Phase 10 stub: - `ClaudeAgent.onClientToolCallComplete` is now a benign no-op. The AgentSideEffects autorun fires this hook for EVERY server-dispatched SessionToolCallComplete envelope (including normal SDK tool completions), so the previous `throw new Error('TODO: Phase 10')` corrupted every tool flow. Client (MCP) tool registration via `setClientTools` still throws since Phase 10 hasn't landed. Tests: - New: `claudeToolCallRegistry.test.ts` (lifecycle + seedParsedInput coverage). - Snapshot: `claudeToolDisplay.test.ts` covers every tool row × all helpers. - Mapper: `claudeMapSessionEvents.test.ts` Test 9.5 asserts the new content_block_stop Ready emission. - Subagent: `claudeSubagentSignals.test.ts` extended to assert rich past-tense for inner-tool completion (D6 parity). - Agent: `claudeAgent.test.ts` asserts onClientToolCallComplete is a no-op. Verified live in the Agents window: NEW Claude [Local] chat with 'Run `git status` and then read README.md' produces both tool widgets in the expanded thinking block with command + output visible. * Address PR review feedback - claudeCanUseTool: drop the redundant '?? JSON.stringify(input)' fallback. getClaudeToolInputString already wraps stringify in try/catch and returns undefined on failure; the outer call was re-running the same stringify that just failed (would throw on non-serializable input). - sessionPermissions.createToolReadyAction: drop the state._meta forwarding. The reducer's SessionToolCallReady branch derives _meta via tcBase(tc) from the prior state, so the action-level _meta was never read. - claudeToolCallRegistry.finalize: preserve the raw inputBuffer as toolInput when JSON.parse fails or yields a non-object. Without this, malformed payloads rendered an empty input section in the UI. Test updated to assert raw-buffer preservation. - claudeToolDisplay.formatPathAsMarkdownLink + WebFetch link: escape the link label via escapeMarkdownLinkLabel. File names containing ']' or '\\' would otherwise break out of the [...] label and could cause malformed rendering / injection. - claudeAgent.integrationTest (Phase 7 §5.3 Read tool round-trip): expected signal sequence updated for the Phase 8.5 mapper's new SessionToolCallReady emission at content_block_stop. The mapper-side Ready (auto-allow path) now lands between toolCallDelta and the permission card's pending_confirmation.

Phase 10.5: unify ClaudeAgentSession lifecycle, retire ClaudeMaterializer (#317884) * Phase 10.5: unify ClaudeAgentSession lifecycle, retire ClaudeMaterializer Collapse the dual-map session lifecycle (`_provisionalSessions` + `_sessions`) onto a single `ClaudeAgentSession` identity per `sessionId`. The session now owns its full materialize flow (SDK startup, abort gates, DB ref open, pipeline construction, rematerializer attach, metadata overlay write, bijective state seed). `ClaudeMaterializer` is gone; its pure helpers (`buildOptions`, `buildClientMcpServers`, `buildSubprocessEnv`) live in a new `claudeSdkOptions.ts` module. Why - Phase 10's race regressions (C1, C1-resume, S1) were all compensation for the dual-map split. With one object identity per session, the fixes become structurally trivial and the compensation paths delete. - `_materializeProvisional` and `_resumeSession` were ~80-line orchestrators trying to be methods on the session entity \u2014 now they are: build canUseTool + delegate to `session.materialize(ctx)`, then fire the public materialize event. Behavior preserved - `IAgent` provider surface unchanged. - Phase 10 race regression tests still cover the same races (materialize gap, resume bootstrap gap, rebind failure leaves diff dirty). - Resume path explicitly skips the overlay write (overlay is the SOURCE on resume); new test guards this. `changeModel` simplified - `session.setModel(model)` is now the single mutation entry. It stashes provisional state when no pipeline exists, queues runtime model+effort with the 'max'->'xhigh' clamp when materialized, and writes the metadata overlay in both cases. Agent's `changeModel` collapses to a sequencer + delegation. Tests - 1810/1810 agentHost unit suite passing. - 7/7 real Claude SDK integration tests passing (2 pre-existing pending). - Live workbench E2E: full tool-call round-trip end-to-end (createSession -> setClientTools(13 tools) -> materialize -> openBrowserPage request -> workbench permission UI -> approve -> workbench opens https://example.com -> tool_result returned -> session.result). 0 occurrences of legacy failure patterns. Plan + roadmap - Roadmap Phase 10.5 marked DONE. - Full plan at src/vs/platform/agentHost/node/claude/phase10.5-plan.md. * Address PR review: fix stale setModel link + document buildOptions ambient env reads

Claude agent: Phase 13 — session restoration (#316343) * Claude agent: Phase 13 — session restoration Implement IAgent.getSessionMessages for the Claude provider so the workbench can reload an existing Claude session's full transcript across agent-host restarts. Unblocks self-hosting. - claudeAgentSdkService.ts: add getSessionMessages binding - claudeReplayMapper.ts (NEW): SessionMessage[] -> readonly Turn[] per CONTEXT M7. Pure function; no by-products, no persistence. Splits SDK shape detection (parseSessionMessage adapter) from the stateful reducer (ReplayBuilder). - claudeAgent.ts: replace getSessionMessages stub with subagent URI dispatch + provisional check + SDK fetch + replay, all wrapped with the listSessions-style warn-log-and-return-[] resilience. - claudeReplayMapper.test.ts: 10 fixtures covering M7 grouping rules (text/tool_result/system, tail-Turn state, subagent markers, CLI-echo synthetic-message drop). - claudeAgent.test.ts: 4 Phase 13 integration tests (happy path, subagent URI, provisional session, SDK throw resilience). - CONTEXT.md: relax M7 notification gate to admit all priorities pending real-world data on priority: 'low' content. - phase13-plan.md (NEW) + roadmap.md: capture decisions, drift, council-review fixes, and mark Phase 13 done. * Read system subtype/content from envelope, not message Copilot review caught that on-disk JSONL system entries put `subtype` (and `content` for compact_boundary, `text` for notification) at the top level of the envelope alongside `type`, NOT nested inside `message`. The SDK's `SessionMessage` type only declares `{ type, uuid, session_id, message, parent_tool_use_id }` so the extra envelope fields aren't typed — but the production session parser fixtures (extensions/copilot/.../claudeSessionParser.spec.ts) confirm the on-disk shape. Net effect of the bug: real `compact_boundary` and `notification` entries were silently dropped even with `includeSystemMessages: true`, defeating the whole point of asking for them. - claudeReplayMapper.ts: parseSystemMessage now reads from the envelope via a single narrow cast; new readSystemEnvelopeText prefers `text` (notification) then `content` (compact_boundary). - claudeReplayMapper.test.ts: makeSystem helper now builds envelope-shaped fixtures; Fixture 4 asserts the actual text surfaces. * Revert "Read system subtype/content from envelope, not message" This reverts f77f3f0cd47. Listening to the SDK contract over the production parser's raw-JSONL fixtures: the SDK's `SessionMessage` type declares `{ type, uuid, session_id, message: unknown, parent_tool_use_id }` for ALL three discriminants. For user/assistant we already read the discriminant-specific payload (role, content, blocks) from `message.*`; doing the same for system (`message.subtype`, `message.text`) is the consistent pattern. The production session parser fixtures parse raw on-disk JSONL — a lower layer than `getSessionMessages()`, which normalizes those entries into the documented `SessionMessage` shape with payload inside `message`. The original implementation was correct.

feat(claude): add skills discovery and git action buttons for Claude sessions (#312082) * feat(copilot): Implement skills and plugins discovery for Claude sessions This goes against the idea that Claude only cares about Claude, but it's important for the Agents app where skills are added in order to actually commit stuff. Maybe we can be granular in the future if people ask for it. * feat(claude): add git action buttons and session metadata enrichment Registers commit, commitAndSync, sync, and initializeRepository commands for Claude sessions. Enriches session metadata with git repository state to drive when-clause visibility of action buttons in the Changes view. Extracts builtinSlashCommands to a shared module reused by both Claude and CopilotCLI sessions.

agent host: share real-SDK integration tests across Copilot and Claude (#316532) * agent host: share real-SDK integration tests across Copilot and Claude Refactor the real Copilot SDK integration tests so the cross-provider portion is shared with a new Claude real-SDK suite, with per-provider capability flags for behaviors that differ. - Extract `defineSharedRealSdkTests` + helpers into `realSdkTestHelpers.ts`. - Replace `toolApprovalRealSdk.integrationTest.ts` with `copilotRealSdk.integrationTest.ts` (shared suite + Copilot-only tests: usage cost, cd-prefix strip, git-driven diffs). - Fold the standalone `sessionDiffsRealSdk` test into Copilot's suite. - Add `claudeRealSdk.integrationTest.ts` gated behind `AGENT_HOST_REAL_SDK=1 AGENT_HOST_REAL_SDK_CLAUDE=1`. SDK directory is resolved from the dev dependency at `node_modules/@anthropic-ai/claude-agent-sdk`. Auth requires an OAuth token with Copilot access (a vanilla `gh auth token` does not work); the second env var ensures the suite isn't auto-enabled. - Per-test server isolation: each test gets a fresh agent host so a broken test can't poison subsequent ones (notably Claude's mid-turn dispose path). Real bugs fixed along the way: - Session URIs are now UUIDs. Claude SDK rejects non-UUID session IDs. - Dev `product.ts` stub now carries `tokenEntitlementUrl` / `mcpRegistryDataUrl`, so the out-of-sources Claude path no longer hits `Failed to parse URL from undefined` in `CopilotApiService._mintToken`. - `createRealSession` defaults to `isolation: 'folder'` so the agent runs in the test's working dir instead of silently materializing into `<wd>.worktrees/...`. - macOS `/var` <-> `/private/var` mismatch in the diff test via `realpathSync(mkdtempSync(...))`. - The shell-permission test was Copilot-shaped (assumed a pending `toolCallReady`); Claude's `default` mode auto-approves safe `Bash` at the SDK layer. Test now waits for `toolCallComplete` so it works on both providers. - Tool names parameterized per provider (`bash`/`Bash`, `task`/`Task`, `exit_plan_mode`/`ExitPlanMode`). Add a deterministic unit test for the `skipPermission: true` flag on the shell-helper tools (`read_bash` / `write_bash` / `bash_shutdown` / `list_bash`) since the original model-driven real-SDK regression test for that flag was inherently flaky. * address review: lazily probe Claude SDK path, drop console.error The module-eval-time call to resolveClaudeSdkPath() emitted console.error when the SDK directory was missing, which can fail the test runner even with the suite disabled. Probe filesystem only when the suite is opted in via env vars; return undefined silently otherwise — the suite gate itself surfaces the missing dependency by skipping.

Simplify model handling in Claude (#308589) * Simplify model handling in Claude It's gotten so complicated and now that we use the built-in model picker, we can simplify this code a lot. * refactor(claude): remove unused mock class and simplify model retrieval * Move selecting the endpoint into the IClaudeCodeModels

Implement image carousel service and integrate with chat attachments (#301587) * Implement image carousel service and integrate with chat attachments - Introduced `ChatImageCarouselService` to manage image carousels in chat. - Updated `ImageAttachmentWidget` to utilize the new carousel service for image display. - Enhanced image extraction logic to support inline references and tool invocations. - Added tests for carousel service functionality and image extraction. What's missing is pills rendered in other places like `pastTenseMessage` and `invocationMessage`... maybe more? * Support past tense & invocation message * feedback

Enhance Claude session management with message forking and UUID integration (#4537) * Enhance Claude session management with message forking and UUID integration fixes https://github.com/microsoft/vscode/issues/300501 * Move metadata handling into controller This is needed to resolve the forking properly. It's also something I've been meaning to do. * feedback

Clean up some parameters and stuff in Claude (#312946) * Clean up some parameters and stuff in Claude Just some debt. * fix tests