Anthony Kim

Activate Python environments in Agent Host shell commands with shell init scripts (#332593) * Add shell init snippet generators for the SDK shell tool The SDK built-in shell tool spawns a fresh no-rc shell per command, so the user's Python environment and shell hooks are absent. Add the generators that produce the init script text later sourced via ShellOptions.initScripts. Three runtime behaviors shape the generated text: only the final exit status is observed (so every script ends in a statement that always succeeds), bash init-script stderr is discarded (so diagnostics go to stdout), and PowerShell scripts are dot-sourced under $ErrorActionPreference = 'Stop' (so the body is wrapped in try/catch/finally). The profile snippet sources ~/.bashrc and then replays marker-delimited managed blocks that did not take effect. Stock rc files early-return in non-interactive shells and tools such as conda append their init block below that guard, so sourcing alone never reaches it. Replaying recovers shell functions such as conda activate, which are never exported and so cannot arrive through the inherited environment. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add the shellInitSnippets session config key Carries generated shell init script text from the client to the agent host as per-session config. Values are pushed rather than user-authored, so the property is readOnly; the selected Python environment can change while a session is live, so it is sessionMutable. The property deliberately has no default and is not added to the defaults passed to validateOrDefault: an absent value means "nothing to apply", which must stay distinguishable from an explicit empty array, which clears previously applied scripts. readOnly keeps the property out of the session settings file but does not suppress the generic chat-input chip, so the key is also added to WELL_KNOWN_PICKER_PROPERTIES. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Let buildSandboxConfigForSdk grant extra readonly paths Host-generated files that the SDK shell tool must read, such as a session's shell init scripts, live under the user data path, which no existing grant covers. Add an optional extraReadonlyPaths parameter routed through the same precedence sets as user-supplied paths, so an explicit denyRead still wins and a path already granted readwrite is not downgraded. The SDK treats init script readability as a caller obligation and fails silently when a script cannot be read, so the doc comment records that every producer of a session sandboxConfig must pass the same paths. Call sites are updated in a later change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Apply shell init scripts to SDK built-in shell tool sessions Materializes the shell init snippets configured on a session and registers their paths through options.update, so the SDK sources them before every built-in shell tool command. Both producers of a session sandbox policy now grant read access to the session's script directory. CopilotAgentSession re-pushes sandboxConfig on every turn, so granting it only at launch would silently revoke the grant on the first turn, and the SDK reports nothing when it cannot read an init script. The apply lives on the session rather than the launcher so it can re-run on a mid-session config change and on a cold resume: the runtime does not persist its init-script list, but the host's session config values are persisted. Paths are derived from the snippet shape, so an unchanged list skips the RPC and changed content takes effect through the rewritten file, which the runtime re-reads before each command. Writes are atomic where the provider supports it so a command running during a rewrite cannot source a half-written file. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Publish Python activation and profile scripts for agent shell commands Adds the workbench half: a synchronizer that resolves what a session's shell tool needs and publishes it as script text on the session's config, which the agent host then materializes and registers with the SDK. Python activation is read from the environment-variable collection the Python Environments extension publishes, scoped to the workspace folder that owns the session. Only that extension may supply the value, since it becomes an executable script. On POSIX the zsh variable is accepted as a fallback for bash: the extension emits identical text for both, and the tool shell is always bash. Fish and cmd are never used because their syntax would not parse. Worktree-isolated sessions resolve through their originating project, since a worktree path is not a workspace folder and activation commands carry absolute paths. Config is dispatched only when the value actually changes, and an empty list is never published to a session that never had one. Session config is shared across windows, so an unconditional write would let two windows overwrite each other indefinitely. Both snippets are behind experimental settings, on by default. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Reduce shell init integration to one script Collapse profile loading and Python activation into one generated init script behind one setting. Inline file ownership in CopilotAgentSession, remove the generic materializer/source/index machinery, and scope publication to local workspace windows. Also apply live config changes serially, verify conda is a shell function before skipping hook replay, and clean up the SDK-session-scoped file on session disposal. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address shell init review feedback Restrict publishing to the workspace window that owns the session and skip remote hosts whose OS can differ from the renderer. Serialize live script updates, require conda to be a shell function, and add missing handler test dependencies. Inline SDK-session-scoped file ownership so cleanup cannot use a host configuration ID, and format the schema test flagged by CI. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address latest shell init review Publish synchronously before the first turn, ensure the sandbox grants access before SDK registration, and serialize final cleanup behind pending script synchronization. Limit publication to the workspace window that owns the session and trim the shell-init contract JSDoc. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Make shell init test paths platform-neutral Build expected sandbox and init-script paths through URI.fsPath so the session tests pass on Windows as well as POSIX platforms. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Only the owning window clears shell init; scope script files per instance * Load pwsh profiles under Continue; prune empty shell init session dirs * Drop the conda-specific rc replay from the shell init script * Read only the shell-matching activation variable; add SDK shell init e2e * Default Agent Host shell init scripts off Keep the setting experimental and require an explicit true value before publishing profile/Python activation scripts. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Correct Agent Host shell profile sourcing Keep profile loading before Python activation, but do not infer a Bash profile failure from the status of its final command. Clarify the exact Bash and PowerShell profiles loaded and cover non-interactive guards and rc files ending nonzero. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Keep Agent Host shell init state transient Exclude workspace-derived executable shell init text from session persistence, strip legacy persisted values during restore, and make the application-scoped disabled setting authoritative from any local window. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Prevent shell init config update loops After session schema hydration, publish only from local inputs and explicit pre-turn reconciliation instead of reacting to shared config echoes. Add a two-window convergence regression test. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Encode PowerShell shell init payloads safely Embed arbitrary multiline activation text as UTF-8 base64 and decode it in PowerShell instead of using a terminable here-string. Add round-trip and Windows execution coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Reject malformed shell init config safely Distinguish invalid shell init state from an explicit empty-list clear so malformed client or inherited config cannot remove the last valid SDK registration. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Restrict shell init config to editor clients Reject executable shell init config writes from non-editor clients and preserve the current value across their wholesale config replacements. Add acceptance, rejection, and replacement coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Document shell init script approval behavior Explain that direct script commands may require explicit approval while the experimental init-script integration is enabled, without changing VS Code or runtime approval policy. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Cover first-turn shell init ordering Wait for the shell-init config echo before an Editor Window dispatches its first turn. Exercise the raw AHP path with an Editor Window identity, unique client sequences, and no explicit echo wait before the turn. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Allow clients to clear shell init config Keep non-empty executable config restricted to Editor Window clients, while allowing any local client to submit the capability-reducing empty-list clear. Preserve the value when an unauthorized replacement merely omits it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Apply shell init config before resumed turns Reconcile before both new and resumed turns, wait for the matching server echo, and fail preparation when the host rejects the config instead of proceeding with stale shell initialization. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Run the PowerShell shell init test on Windows Move the Windows-only execution suite out of the non-Windows Bash suite so CI can exercise base64 decoding and activation in a real PowerShell process. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Close shell init config authorization bypasses Reject the session-only executable config from root state and apply the shared Editor Window policy during session creation as well as later updates. Keep explicit empty-list clears available to all clients. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Wait for pending shell init publication Track in-flight shell init actions and compare pre-turn state against the server-confirmed snapshot. Reconciliation now waits for the matching acknowledgement when the desired value is only optimistic. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Serialize shell init config publications Queue each publication through a per-session sequencer, retain its acknowledgement until completion, and make pre-turn reconciliation wait when the desired value is only optimistic or supersedes an earlier update. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Bound shell init publication acknowledgements Prevent a lost connection echo from occupying the publication sequencer forever, and let cancellation release a pre-turn reconcile queued behind an unacknowledged background update. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Make shell init sandbox grants conditional Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Test shell init file and activation updates Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Clean up in-flight shell init writes on dispose Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Clear stale shell init sandbox grants Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Clean up failed shell init writes Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Finish failed shell init cleanup Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Preserve registered shell init revisions Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Document local shell init support Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Test shell init timeout and PowerShell profiles Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Fix shell init tests on Windows Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Preserve shell init in Agents settings saves Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Retain shell init revisions until disconnect Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Fail closed on shell init preflight errors Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Bound shell init publication to one deadline Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Reduce Agent Host shell init to the core integration Keep the generated script, the session config key, the workbench synchronizer, and the host-side materialize, grant, register, and cleanup path, and drop the layers that accumulated during review: - No renderer-side acknowledgement barrier. Dispatch is ordered per connection and the host applies session config before it starts a turn, so reconcile publishes synchronously again. - No client-type authorization for the config key. Connected clients can already run shell commands through the agent; readOnly plus transient state is the model. This also removes the Agents-window settings-save rejection and its carry-forward patch. - No script revisions. One file per instance is rewritten atomically in place and deleted only on dispose after the SDK session disconnects, so a command that already captured the path can still source it. - SDK registration failures are logged and retried on the next turn rather than failing the turn. The sandbox read grant is added once a script is materialized and kept for the instance lifetime. Windows test portability, echo suppression, transient persistence, and base64 PowerShell payloads are unchanged. * Guard shell init cleanup when a session never initialized dispose() called this._wrapper.disconnect() before the base disposal so the script file is removed only after the SDK session disconnects. The wrapper is assigned midway through initializeSession, so a session that fails during launch has none, the call throws a TypeError, and the base disposal never runs. That leaked the session and its ShellManager in the resume tests, and in the launcher's fallback path the TypeError replaced the SDK's model error, which broke the stale-model E2E on every platform. Skip the disconnect-then-cleanup chain when there is no wrapper; such a session has no script to remove either. * Shorten the Agent Host shell init setting description * Enforce the shell init setting on the host and close the inherited config path CopilotAgentSession read shellInitSnippets through the effective config chain, so a value placed in root config by any connected client was inherited by every Copilot session without its own value, and the workbench setting only governed which window published. Read the session's own value only, and apply it only while the forwarded enableShellInitScript root flag is true, so the user setting is enforced by the host regardless of who published the value. The flag is forwarded next to the other Copilot CLI settings and re-applied on root config changes, unregistering a live script when it turns off. Also: the Agents window mounts the active session's folder into its workspace, so folder ownership alone qualified it as a publisher; it now only clears. Cap accepted script text at 64 KiB. Remove the generated directory on dispose even when the SDK disconnect fails. Qualify the generator note that a sourced profile can still terminate the shell. The recorded E2E enables the flag through root config before the snapshotted round and leaves the root channel so its notifications stay out of the round. * Decide the shell init off state before validating the payload The malformed-payload check ran before the forwarded flag was read, so a registered script survived turning the setting off if the session value had become malformed in between. The custom terminal tool check returned early for the same reason, leaving a dormant SDK registration when the tool was switched on mid-session. Compute the off state first: the flag is false, or the custom terminal tool has replaced the SDK's built-in shell. Either clears any registration without looking at the payload; only an enabled session validates it. * Chain shell init cleanup only for sessions that wrote a script dispose() started the SDK disconnect explicitly for every Copilot session so the script file could be removed afterwards. Sessions that never materialized a script have nothing to remove, so they now keep the plain dispose path; the disposing flag is still set synchronously so no later sync can run. * Describe the forwarded shell init flag as opt-in, not authorization * Rename the shell init session config key to shellInitScripts The key was named for an early design that published separate profile and activation snippets. The value has held one whole script since those were collapsed, and everything around it already says script: IShellInitScript, createShellInitScript, isShellInitScriptList, enableShellInitScript, and the SDK's own shell.initScripts. Rename the key, the schema property, its localization ids, and the local variables to match. Also say the script is client-generated where two comments called it host-generated; the host only writes the file. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13

Stream built-in shell output over AHP terminal channel (#327067) * Stream output for SDK built-in shell tool * better todo comment * Bump Copilot SDK to 1.0.8 preview Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5083fb1f-34d7-44bf-82a1-c4582e57683b * Exclude unused Koffi native modules Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5083fb1f-34d7-44bf-82a1-c4582e57683b * Adopt AHP terminal completion changes and stream built-in shell output over the terminal channel - Re-vendor agent-host-protocol: terminalComplete removed, exitCode/preview/truncated fold into terminal.result (TerminalCommandResult), isPty added to ToolResultTerminalContent and TerminalState - shell_exit now lands on the tool call's terminal block; history replay synthesizes a non-pty block keyed by toolCallId - Stream tool.execution_partial_result into an output-only agenthost-terminal channel (isPty false) instead of replacing Text content - Normalize LF to CRLF in AgentHostPty when the channel is plain text - Re-apply local CompletionItem.label extension clobbered by the protocol sync (still needs upstreaming) * Track last emitted snapshot for non-pty shell streaming The runtime emits cumulative plain-text snapshots (ANSI-stripped, throttled) that are capped to the leading ~10KB with a growing truncation marker, so a length-based delta goes stale once output exceeds the cap. Track the last emitted snapshot and prefix-check it: extend in place while the snapshot grows, reset the channel and rewrite when it was rewritten. * Normalize output terminal data to CRLF in the terminal manager Pty-backed channels already carry CRLF because the pty converts output line endings; do the same for output-only channels at the point data enters the channel, so terminal frontends render both identically and AgentHostPty needs no isPty-specific handling. Reverts the client-side normalization. * no need to complicate too much with lf crlf * Fix output-only shell command lifecycle rendering * keep non pty output handling scoped to agent hsot * fix output only terminal completion state * simplify agent host output terminal lifecycle * leave unnncessary background stuff out * scope non pty shell terminals by session * change ahp version to be proper * agentHost: regenerate AHP completion types --------- Copilot-Session: 5083fb1f-34d7-44bf-82a1-c4582e57683b

Dispose AgentHostPty on terminal shutdown, exit, and detach (#331908) * Dispose AgentHostPty on terminal exit * Dispose AgentHostPty with its terminal instance * Align AgentHostPty disposal with terminal precedent * Let reconnect supersede a pending AgentHostPty startup

fix sliced last row in inline chat terminal output (#328592) * fix slicing of last row in chat terminal output * address feedback * add more test

Restore user/workspace terminal bash auto-approve actions for Agent Host Copilot (#327947) * Bring back terminal auto approval edit settings.json * Scope terminal auto-approve actions to rule-eligible Agent Host Copilot confirmations * Tighten auto-approve rule eligibility and evaluate persisted rules only * Add gate coverage for canFutureRuleSuppressPrompt * Extend auto-approve rule test coverage and drop a dead guard * Preserve focus when chat confirmation buttons update * Carlify terminal auto-approve rule eligibility

agent host pwsh tool should use pwsh grammar for terminal auto-approval (#328133) * Add powershell support * use powershell grammar for agent host terminal approval * match pwsh command line deny rules case insensitive * restrict pwsh redirect sink * betteer comment * derive shell lanaguage from tracked tool * refactor: improve command line rule matching and add tests for PowerShell grammar * test: add normalization for custom terminal permissions in shell auto-approval * comment * comment * unknown shell tool require explicit confirmation, * test

Dispose Agents Window terminals when sessions are archived (#331886) * Dispose archived Agents terminals Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix worktree terminal test narrowing Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Guard late archive terminal cleanup Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * comments --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

bump @github/copilot-sdk to 1.0.13-preview.0 and @github/copilot to 1.0.81-12 (#332803) * fix: migrate agentHost to SDK assisted-approval permission API SDK 1.0.12-preview.0 renamed setAllowAll->setMode, autoApproval->assistedApproval, PermissionAllowAllMode->PermissionMode (on/auto/off -> allow-all/assisted/manual), and added the extension-env-access permission kind. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * build: drop stale libm GLIBC_2.27 rpm dep after SDK/CLI bump Bumped @github/copilot native payload no longer requires libm.so.6(GLIBC_2.27) on x86_64/aarch64; the reference rpm dep lists diverged from generated deps, failing 'Prepare rpm package' per product build 467750. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: elide runtime-authored change-notice preamble in capi-replay projection CLI 1.0.81-10 now prepends a `<tools_changed_notice>` block to the user message when tools change between turns (e.g. `exit_plan_mode` is dropped after plan approval). The Agent Host E2E capture for planning-mode auto-approve predates this behavior, so capi-replay's request #5 no longer matched a live run against the newer CLI even though the host composed an identical turn. These change-notice blocks (`<tools_changed_notice>`, `<mode_changed_notice>`, `<working_directory_changed>`, `<additional_directories_changed>`) are composed by the `@github/copilot` runtime from session state, not host-authored prompt structure, so they belong in the projection's symmetric elision set alongside the model id and tool_result payload. Elision runs before path elision so the intact `</…>` closing tag is matched rather than being rewritten into a path placeholder first. Fixtures are not edited; the model-changes fixture that records a `<tools_changed_notice>` model-switch block strips symmetrically on both sides and still matches. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: bump @github/copilot-sdk to 1.0.12-preview.0 and @github/copilot to 1.0.81-12 Pin root and remote to the signed SDK 1.0.12-preview.0 / CLI 1.0.81-12 pair. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: retarget @github/copilot-sdk to 1.0.13-preview.0 Keep @github/copilot at 1.0.81-12. Same permission, rpm, and replay fixes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: handle Copilot MCP sampling requests Register sampling event interest, reject pending requests through the SDK UI RPC, and release the registration with the session lifecycle. This restores the canonical MCP cancellation behavior with runtime 1.0.81-12. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: route AgentService provider lookups through the provider service Turn resume and the failed-turn test still called removed AgentService helpers after providers moved to IAgentHostProviderService. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: gate Copilot failed-turn resume E2Es on 1.0.81-12 Try Again accepts resume but never emits turnComplete. Live re-record hits the same hang, so this is not a stale fixture. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: update Copilot snapshots for SDK bump Refresh prompt baselines for @github/copilot 1.0.81-12 and align user instruction discovery expectations with the new runtime behavior. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: vs-code-engineering[bot] <122617954+vs-code-engineering[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Aaron Munger <aamunger@microsoft.com>

Reuse terminals when replacing new session drafts (#327225) * Reuse terminal when replacing new session draft * Rehome terminals from replaced drafts Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1a04e86b-2cdc-4f83-bf8b-d48f57d47727 --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1a04e86b-2cdc-4f83-bf8b-d48f57d47727

Respect chat.tools.terminal.autoApprove for agent host (#322774) * Respect chat.tools.terminal.autoApprove for agent host * Make things cleaner * address copilot feedback to cache to avoid rebuilding regex * Add terminal auto-approve fallback removal TODO and source-of-truth tests * align order with workbench