Osvaldo Ortega

sessions: Support GitHub sandbox creation in vscode.dev (#337387) * sessions: Support GitHub sandbox creation in vscode.dev Reuse the Copilot draft and sandbox provisioning lifecycle for repository-backed web sessions. Share the existing repository picker between extension-backed sessions and browser creation, and scope the composer to the selected creation host. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * sessions: Preserve auth scopes and honor AI entitlement hiding Keep existing unscoped GitHub authentication callers on their original fallback and request repository scopes only for explicit repository access. Tear down sandbox hosts and providers when chat entitlement policy hides AI, and rediscover when restored. Add regression tests for both review findings. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * sessions: Fix host-filter setup in accessibility tests Provide the host-filter service required by the sandbox creation help in existing accessibility fixtures. Add coverage for creation-host guidance and browser repository help. This fixes the same 16 test failures in all browser and Electron unit-test CI jobs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot cloud sandbox sessions over a live Agent Host Protocol relay (#328097) * Add Copilot cloud sandbox sessions over a live AHP relay Copilot cloud sessions whose tasks run in a Mission Control sandbox (agent slug `copilot-developer-cli`) are rendered by polling REST logs today, so they have no slash commands and no steering. Connect to the sandbox instead: `copilotd` runs inside it and speaks the Agent Host Protocol, so once a relay is open the existing agent-host stack renders the session natively — history, live output, steering and slash commands. The sandbox is not directly addressable, so both sides connect outward to an Azure Web PubSub relay brokered by Mission Control. Credentials are minted per connection, and the user's GitHub token is forwarded only as a sealed envelope the relay cannot read. Everything runs in the renderer, so this also works in VS Code Web, where no Copilot extension host is available. Mission Control is reached over the Copilot API host: `api.github.com/agents/*` omits CORS headers on authenticated responses, so a renderer fetch receives the reply and then discards it. The AHP `initialize` now advertises every protocol version this client can negotiate rather than only the newest, so a sandbox running an older `copilotd` can negotiate down instead of being rejected. Gated behind `chat.agentHost.cloudSandbox.enabled`, off by default. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address PR review feedback for cloud sandbox sessions - Subscribe to host state by the backend URI. Session output, changesets and last-turn changes still rebuilt the URI from the UI scheme, so an aliased sandbox session subscribed to a URI the host's registry does not know. - Apply the session-scheme alias on the live `SessionAdded` path too. Only the refresh and persistence paths adopted, so a session created while connected kept the host's scheme and never routed to a content provider. - Report discovery completeness instead of a bare list. A failed or partial scan read as "these sessions no longer exist", so a transient request failure could tear down live providers and cancel the auth retry. Only a complete scan is reconciled against. - Cancel in-flight work when the feature is disabled. Discovery and connect ran with `CancellationToken.None` and did not recheck enablement after their awaits, so either could commit state — including a live relay — after teardown. - Document why publish acks are not tracked, and why the feature is gated on a setting: sandbox tasks carry a slug the Copilot extension's cloud provider does not list today, but that is expected to change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Reuse the shared Copilot API host constant The cloud sandbox service declared its own copy of `https://api.githubcopilot.com` alongside the one in `githubEndpoints.ts`. Export the existing constant and use it, noting that it is distinct from `IGitHubEndpoints.apiBaseUri` (`api.github.com`). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

chat: Discover cloud sandbox sessions in the Editor Window (#337189) * chat: Discover cloud sandbox sessions in the Editor Window Share sandbox discovery and remote chat integration between the Editor and Agents windows while keeping their session-list adapters separate. Preserve existing session identity, activity status, feature gating, and offline history without provisioning replacement sessions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chat: Keep sandbox activity consistent across windows Refresh cached sandbox activity from discovery without replacing host snapshots or user flags. Keep reported activity independent of connection availability in both windows. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chat: Cover sandbox discovery compatibility after rebase Add regression coverage for account-scoped restoration, incremental discovery, authentication retries, and cached activity after #337354. Clarify discovery field ownership and align the moved API code with lint rules. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chat: Remove the redundant sandbox session description Keep the original discovery and environment descriptions while removing the repeated session-row description. Include the approved optional-package lockfile metadata changes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chat: Fix sandbox reconnect readiness and Editor host scoping Reset authentication readiness for replacement connections without allowing an older attempt to settle the new connection. Publish session-row updates when sandbox connection availability changes, and keep configured WebSocket hosts out of Editor windows. Add regression tests for reconnect authentication, disconnected row flags, and on-demand sandbox connections. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Implement Ctrl+F find widget support for chat panes and editors (#330340) * Agent Host changes for osortega/agents/ctrl-f-find-widget-support * chat: address Find review feedback and scope down transcript search Fix three bounded-work bugs found in review: - Enforce the global match cap per segment, so two large segments can no longer expose roughly twice MAX_FIND_MATCHES. - Count code-block matches toward the highlight cap; previously an all-code result set left both range arrays empty and rescanned every match on each repaint. - Repaint after the debounced recompute. The row rerender lands before the 200ms pass, so streamed matches were counted but not highlighted. Scope Find down to content it can actually reveal. Reasoning bodies are built lazily by ChatCollapsibleContentPart on first expansion and are not <details> elements, so a match inside collapsed reasoning could be counted but never revealed. Reasoning is now excluded from the index and the help text, Find help dialog and SESSIONS.md no longer promise it. The remaining gaps (a typed expansion API, and extraction for warning/info/confirmation and other rendered kinds) are documented for a follow-up. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

sessions: Restore sandbox sessions promptly on reload (#337354) * sessions: Restore sandbox sessions promptly on reload Restore account-scoped sandbox inventory before network discovery and refresh incrementally with cached task details. Publish cached sessions when providers register, reconcile provider removal, and cover reload, cancellation, and account changes with focused tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * sessions: Preserve session state during sandbox discovery refreshes Refresh the catalog without deletion notifications when providers disappear. Update discovery-owned metadata and provider labels while preserving live host fields and activity timestamps. Persist independent inventory entries so stale windows do not overwrite newly provisioned sessions, and report confirmed binding loss while retaining failed tasks for retry. Add regression coverage for lifecycle, metadata, reload, cross-window storage races, and incremental reconciliation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * sessions: Mark automation test provider catalogue ready The provider lifecycle regression test creates an Automation draft. Newer main requires the provider's Automation catalogue to be ready, so declare that state in this fixture without weakening the readiness guard or lifecycle assertions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Prompt timeline rail for the Agents window (#324131) * Add prompt timeline rail to the Agents window Introduce a right-edge "prompt timeline" rail in the Agents window that lets users scan and jump between the prompts they have sent in a chat session, adapted from GitHub's "jump to your messages" affordance. - Self-contained contrib under src/vs/sessions/contrib/promptTimeline, attached per-widget via IChatWidgetContrib (no vs/workbench changes). - Recency-bucketed ticks (pure, unit-tested budgetBucketPrompts) capped so each tick keeps a >=24px hit target (WCAG 2.5.8). - Dense marks at rest that expand on hover/focus, with green/red per-turn diff magnitude and a solid-blue active mark. - Interactive hover card: prompt text, clickable +/- diff stats that open the per-request diff, and per-file drill-down rows. - Per-request diffs via provider-agnostic IChatResponseFileChangesService (agent-host server-computed turn changeset) with editing-session fallback; diff sides are probed so missing checkpoint blobs render as a pure add/delete instead of crashing the multi-diff editor. - Keyboard-first commands: Go to Next/Previous Prompt, Go to Prompt... (quick pick), Review Changes for Prompt, with ARIA announcements. - Gated behind the new sessions.promptTimeline.enabled setting and ChatContextKeys.enabled; rail is created/disposed reactively. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Prompt timeline: quiet gray-dense rail with single-mark accordion Replace the whole-rail expand-on-engage behavior with a per-mark accordion. The rail now stays quiet, gray and dense at all times; only the mark under the pointer (or keyboard focus) expands to a >=24px pill and reveals its green/red diff, so the rail no longer becomes a column of slim pills with large gaps when interacted with. - CSS: drop the `.engaged` whole-rail slot expansion and the transform fisheye; expand only `:hover`/`:focus-visible` marks (8px -> 24px slot, fat pill, diff colors). Active mark stays solid blue in every state. - Rail: remove the fisheye magnify, the engaged-state tracking, and the magnitude width buckets; capacity now reserves headroom for a single expanded mark over the dense 8px rhythm, so more prompts fit. - Drop the now-unused --tick-scale/--tick-scale-y custom properties. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Prompt timeline: open per-file diff inside the multi-diff, revealed at that file Clicking a file row in the hover card previously opened a standalone single-file diff. Route it through the same multi-file diff we already build for "Review Changes", passing viewState.revealData so it opens revealed at the clicked file. Per-file and whole-prompt review now share one multi-diff experience (and open in the modal editor when enabled), reusing the existing MultiDiffEditorInput without any new UI. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Prompt timeline: show per-turn diffs against the frozen after-turn snapshot The per-prompt diff was rendering before-turn vs the live working file, so it showed the combined changes of all later turns. The per-turn changeset already carries a frozen "after" snapshot; surface it and diff against it. - Add optional `modifiedContentURI` to IEditSessionEntryDiff: the frozen after-state RHS content, distinct from `modifiedURI` (the live file used for identity / go-to-file). Opt-in, so existing consumers (e.g. the chat "Changed N files" summary) keep their current behavior unchanged. - Populate it in AgentHostResponseFileChangesProvider from the changeset's after-content; extend its test to assert the mapping. - PromptTimelineModel now diffs originalURI (frozen before) against the frozen after snapshot, so review shows only that turn's changes, while go-to-file still opens the live working file. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Prompt timeline: add an overview-ruler style selectable by setting Introduce a second rail style and let users choose via the new sessions.promptTimeline.style setting ('compact' | 'overview'). - Extract IPromptTimelineRail as the seam the contrib consumes, and a shared PromptTimelineCard (hover preview) used by both styles. - Rename the existing rail to PromptTimelinePillRail (dense pills). - Add PromptTimelineRulerRail: the session compressed into the rail like the editor overview ruler — proportional marks at their transcript scroll positions, a scrollbar-slider you-are-here thumb, one green "changed code" signal (editorOverviewRuler.addedForeground), focusBorder active, >=24px hit targets. Detail stays in the shared hover card. - Model exposes getScrollLayout()/onDidChangeScrollLayout for proportional positions (per-request offsets via currentRenderedHeight + scrollTop). - Contrib picks the rail class reactively and reuses the enablement swap pattern, wiring setScrollLayout only for rails that support it. All colors come from real theme tokens. Validated: typecheck, eslint, layers, hygiene, unit tests (12 passing). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Prompt timeline: position overview-ruler marks from the list layout model The overview-ruler rail placed each mark by accumulating chat items' `currentRenderedHeight`, which the virtualized tree only sets for rows it has actually rendered. Off-screen prompts reported `undefined` (treated as 0), so every not-yet-rendered mark collapsed onto the same position and only spread out as the user scrolled and rows rendered. Read each prompt's top from the list's layout height model instead, the same virtualization-safe source the scrollbar uses (all items have a height via the delegate's `currentRenderedHeight ?? defaultElementHeight`). Threaded a read-only accessor through the layers, all in the list's content-pixel space so the viewport thumb stays aligned: - AbstractTree.getElementTop(location): absolute top (works off-screen), sibling of getRelativeTop. - ChatListWidget.getElementTop / ChatWidget.getElementTop + ChatWidget.scrollHeight. - PromptTimelineModel.getScrollLayout() and _updateActive() now use these instead of accumulating currentRenderedHeight. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Prompt timeline: color ruler marks by the turn's add/remove split Ruler marks were a single green "edited" signal, so a delete-heavy turn still showed green. Render the mark as a two-tone bar instead (a green added segment and a red removed segment sized by flexGrow from the turn's diff stat), reusing the pill rail's seg-add/seg-del pattern. Only the non-zero side is appended, so a pure-add turn is fully green and a pure-delete turn fully red, and a 1px min-width keeps the minority color visible on a lopsided split. Segments go transparent while the mark is active so the focusBorder you-are-here color wins. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Prompt timeline: fall back to the live file when a turn snapshot is unreadable Per-turn review diffed the frozen before/after turn-checkpoint snapshots so only that turn's changes show. But those checkpoint blobs can be absent (an added file's original, or a pruned/restored session where whole turn checkpoints are gone). When both sides were unreadable every item was dropped and reviewChanges opened nothing at all. _readableSides now still prefers the frozen snapshots but falls back to the live working file for the modified side when the checkpoint blob is unreadable, so review always opens with the best available fidelity. An unreadable side is still dropped so the file renders as a clean add/delete instead of crashing the diff editor. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Prompt timeline: drop the pill style, keep only the overview ruler The rail shipped with two selectable styles (dense pills vs overview ruler) behind sessions.promptTimeline.style. We're standardizing on the overview-ruler UX, so remove the pill style and the setting entirely (the on/off sessions.promptTimeline.enabled setting stays). - Delete promptTimelinePillRail.ts and the PROMPT_TIMELINE_STYLE_SETTING / PromptTimelineStyle enum. - The contribution always builds the ruler rail; drop the style-based swap, the capacity->display-budget wiring, and the optional setScrollLayout indirection (now required on the interface). - Model no longer tracks a dynamic display budget; ticks bucket against the constant MAX_TICKS (still caps very long sessions). - Remove the pill-only CSS; the overflow rule now hides the ruler marks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Prompt timeline: address review feedback on grouped-tick diffs and read probes Two fixes from a council review: - getRequestFiles: when a grouped tick edits the same file in more than one prompt, advance the merged entry's diffModifiedURI to the later prompt's after-snapshot (keeping the earliest originalURI) so the opened multi-diff spans the whole tick instead of only the first edit. - _canRead: probe availability with readFile(resource, { length: 1 }) instead of reading whole (potentially large) file contents just to test whether a diff side is readable. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Prompt timeline: refresh comments left over from earlier iterations Comment-only cleanup after removing the pill style and the display-budget mechanism: drop the stale "or budget", "(like the pill rail)", and "visual density" references so the docs match the single overview-ruler implementation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Prompt timeline: gate the enabled setting behind an experiment Put sessions.promptTimeline.enabled behind the experimentation service via the `experiment: { mode: 'startup' }` property (the sanctioned way for core TS-registered settings; the registry auto-adds the onExP tag). Default is now false so the rail is off until the experiment (or the user) turns it on. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Prompt timeline: address PR review feedback and fix class-field init order Review fixes: - Remove the redundant GoToNext/GoToPrevious commands: they duplicated and collided with the built-in chat nextUserPrompt/previousUserPrompt keybindings (same chord, weight, when). Drop the two actions, their command ids, contrib.navigate(), and model.getSiblingTick(). GoToPrompt and ReviewChanges stay. - Fix the active-mark fallback: when scrolled above the oldest prompt, highlight the oldest tick (ticks.at(0)), not the newest (ticks.at(-1)). - Replace the getComputedStyle probe + unreverted host `position` mutation with a lifecycle-scoped `.prompt-timeline-host` class removed on teardown. - Give the overview-ruler toolbar a proper keyboard model: aria-orientation, roving tabindex (a single Tab stop) and Arrow/Home/End navigation between marks. Also assign `_sessionResource` in the constructor instead of a field initializer: it reads `this.widget`, which under useDefineForClassFields is not yet assigned when field initializers run (fixes the define-class-fields-check / TS2729). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Prompt timeline: stop showing the unreliable per-prompt timestamp Agent-host sessions don't record per-turn timestamps; the transcript is reconstructed via ChatModel.addRequest(), which stamps Date.now(), so every prompt showed ~the current time. Since the real send times aren't available to recover, drop the absolute time from the hover card and the "Go to Prompt" picker. Grouped ticks still show their prompt count; the prompt text and diff stats (both reliable) are unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Prompt timeline: act on PR review (remove ReviewChanges action; rename modifiedContentURI) - Remove the ReviewPromptChangesAction command: per-prompt review is already available from the hover card, so the palette/keyboard entry point was redundant. Drops the command id and the now-unused contrib.getActiveTick() / contrib.reviewChanges() bridge (model.reviewChanges stays, wired to the card). - Rename IEditSessionEntryDiff.modifiedContentURI -> modifiedSnapshotURI: it's the frozen after-turn snapshot content, and "snapshot" reads clearer next to modifiedURI (the live file) than "content". - Clarify in comments that this field is distinct from the agent-host checkpoint- ref readability fix (#323932): that made the snapshot blobs readable; this carries which snapshot to diff against so a per-turn review shows only that turn's changes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Support session configuration controls on remote AHP hosts (#335599) * Agent Host changes for agents/diagnostic-logging-session-permissions * Fix remote session config recovery and option fallback Recover early configuration subscriptions when the host announces the session, and retain schema options when dynamic lookups fail. Preserve cancellation and stale-target handling, with regression coverage for both paths. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add Sandbox checkbox for Cloud Sessions (#330576) * Agent Host changes for osortega/agents/show-new-worktree-checkbox * sessions: add Sandbox option for new cloud sessions Adds a "Sandbox" checkbox beside the cloud session config, shown when `chat.agentHost.cloudSandbox.enabled` is on. When checked, sending the first message provisions a GitHub-managed sandbox and drives it over the Agent Host Protocol relay instead of using the server-run cloud agent. Creation is the same `POST /agents/tasks` as a regular cloud task plus `environment_id: "github-sandbox"` — a sentinel that asks Mission Control to provision a fresh VM. The concrete environment comes back on the created session and is the only id the relay can address. From the seed onward, provisioning reuses the discovery path (`_ensureProvider` -> `seedSessions` -> `connect`), so a created task is just a discovered one we happen to know about first and a later discovery pass reconciles with it instead of duplicating it. Mission Control starts no run for environment-bound tasks, so the first turn is dispatched by the client. Also extracts the checkbox chip that was inline in BranchPicker into a shared CheckboxChip, now used by both the worktree and sandbox chips. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * sessions: derive sandbox repo NWO without the workspace ref A browsed GitHub workspace root carries a ref (`/<owner>/<repo>/HEAD`, see `_browseForRepo`), so stripping only the leading slash produced `owner/repo/HEAD`. `parseNwo` then split on the first separator and sent `{owner, name: "repo/HEAD"}` to Mission Control — an invalid repository. Reuse the existing `githubRemoteRepoLabel`, which already takes the first two path segments for exactly this reason, instead of a second derivation that got it wrong. The tests now use realistic `/HEAD` workspace roots. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * sessions: page sandbox discovery and drop dead baseRef Discovery read a single page of 100 tasks but reported the scan as `complete`, which is what authorizes negative reconciliation. On an account with more tasks than that, sandbox sessions outside the window looked deleted and were torn down. Page through the task list up to a bounded ceiling, and report `partial` whenever the scan was cut short — by the ceiling, a failed later page, or cancellation — so callers keep existing sessions instead of reconciling against a list that was never authoritative. Also remove `baseRef`, which no production caller set, and flag that `isCloudSandboxTask` requires both the agent slug and the compute provider: the expected slug migration would silently return zero sessions, so that must be resolved before the setting is enabled. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * sessions: trim cloud sandbox comments The comments had grown into design notes, recording why decisions were made and how the subsystem fits together rather than what the code does. Cut them back to what is not visible from the code itself, keeping the notes that describe real traps: that a dormant environment reads `offline` whether or not it can wake, and that registering a second content provider for one session type throws. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * sessions: detect further task pages from the Link header Discovery inferred the end of the task list from a short page, but Mission Control can return fewer rows than requested and still advertise `rel="next"` — page 3 of a real account returns 99 of 100 with a next link. That page count also made an exact multiple of the page size look truncated, pinning the result to `partial` and permanently suppressing reconciliation. Read the `Link` header instead, which states outright whether another page exists. Matches how dotcom's agent-sessions client paginates the same endpoint. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

chat: fix Find reporting matches it cannot reveal, and navigate newest first (#331723) * Agent Host changes for osortega/agents/review-chatfindmodel-widget-editor * chat: index only the text a response renders in Find Find counted matches that had no DOM node to land on, so the result count overstated the total and navigation walked past positions it could never reach. Three separate causes, each fixed where the text is indexed rather than compensated for during navigation: - Markdown link targets were indexed. `renderAsPlaintext` emitted a list item's raw source instead of parsing its tokens, so a link kept its target: a response listing its edits as `[src/](/some/path)` indexed the path, of which only the label renders. Adds an opt-in `parseListItemTokens` so the 90+ existing callers are unaffected. - Filtered responses were indexed. The renderer drops the references slot, the body and the citations for a filtered response, keeping only the error message, which also shifted every predicted part index for the row. - Parts merged into one block were fused. Plaintext is trimmed per part and then concatenated, so `See ` + `foo.ts` + ` for details` was indexed as `Seefoo.tsfor details`, hiding text that is plainly on screen. Removes `dropActiveMatch`, which existed to correct the count after the fact and made the total change as the user navigated. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chat: name the plaintext option for what it guarantees `parseListItemTokens` described marked's data model rather than the output, and named only the case that surfaced the bug: the option also reduces bold, emphasis and code spans, and swaps the block-level text renderer. `omitMarkdownSyntax` states what the caller gets, so a future leak fixed in another renderer folds in without a second option. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chat: address Find review feedback - Only schedule a debounced search when the query or options differ from what the model last searched. An option toggle reaches `_onInputChanged` after the base state listener has already run `findFirst`, so the second, identical search left Enter flushing it instead of advancing a match. - Keep a segment's *last* `limit` matches. The per-segment cap was applied before the array was reversed, so a single over-limit segment retained its oldest occurrences and dropped the newest ones navigation reaches first. - Yield once before the result count snapshots state. `FindInput.onDidChange` fires before the `onInput` handler that schedules the search, so the waiter saw nothing pending and reported the previous query's matches. - Condense multi-line method-body comments to one line. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chat: separate a nested list from the item holding it Verified `renderAsPlaintext` against the vendored marked and found two things wrong with the list-item change. Parsing a tight item's tokens with `top = false` skips the paragraph treatment that gives block content a boundary, so an item holding a nested list ran straight into it: `- outer\n - inner [link](/t)` produced `outerinner link`. Parsing as top-level restores the break and also drops a redundant blank line from loose lists. The two new assertions expected a single newline between list items where marked emits two; `renderer.list` joins items that already end in one. Default output is unchanged in every case, including the pre-existing plaintext suite. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Serve cloud sandbox history when the environment is gone (#329292) * sessions: serve cloud sandbox history when the environment is gone A managed sandbox's compute can be deleted, and once it is the AHP relay to it is gone for good. Opening such a session refused to open at all: the only path to its history ran over that relay, so the user was left with a session that would not load and no stated reason. Mission Control mirrors every ActionEnvelope it relays, so the same history can be rebuilt from `GET /agents/tasks/<id>/events` without the sandbox. `taskEventReplay` folds those frames back into session and chat state using the very same reducers the live subscriptions use, so a replayed session and a live one cannot drift. Opening a session no longer waits for `/connect` to give up before it can render. Mission Control blocks on the compute resume before replying, so that call can occupy its whole budget — measured at ~9s of waiting on a deleted sandbox while the transcript already sat ready. The connect and the history fetch now overlap, and whichever lands first decides what the user sees: the session renders as soon as history arrives (~500ms) and is settled read-only only once the connect has actually failed. Read-only is an observable, so a session already on screen loses its composer in place rather than needing a reopen. `/connect` is also no longer retried. Mission Control's answer already reflects the resume it just attempted, so re-asking only repeats the wait; `202 waking` remains the one polled case, against its own Retry-After. `ICloudSandboxCredentialsService` is renamed to `ICloudSandboxApiService`: it now also reads environment and task records, discovers sessions, and replays history, so "credentials" no longer described it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * sessions: address review feedback on cloud sandbox history - Guard against registering a second content provider for a session type. The connect can register the live handler at any await between starting it and observing its outcome, so the history race could resume after that registration and throw, failing the open entirely. The check and the registration are synchronous, so nothing can interleave. - `_settleReadOnly` now no-ops unless we actually own the stand-in, so it cannot force a live host read-only. - Preserve truncation across a mirror restart: replacing the reassembler discarded the knowledge that the previous epoch ended mid-action, so a lost action reported `truncated: false`. Covered by a test that fails without the fix. - Surface truncation in the conversation itself rather than only in the log, so a partial transcript cannot read as a complete one. - Document the provider-level read-only producer in SESSIONS.md, which previously described subagent chats as the only one. - Fix a test comment describing retry behaviour that no longer exists. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>