Anthony Kim

Persist full Copilot shell output with its chat session (#335016) * chat: open full terminal output in a read-only editor Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: clean up replay fixtures after failed assertions Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chat: align full terminal output links and filenames Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Improve full terminal output experience Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add provider-neutral full terminal output support Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Format Claude replay full-output fixture Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Use terminal resources for historical output Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Sync Agent Host Protocol terminal documentation * Keep Codex terminal output streaming and replay identity consistent * Scope terminal full output to Copilot Claude and Codex support moves to separate follow-up pull requests. * Remove unused alwaysWrap content URI option The full-output editor now reads through the terminal resource, so no caller needs to force local content refs through the owning connection. * Keep background shell output live and never replay truncated previews as full output Only detach a completed non-PTY card from its live output once it has an exit code and either a preview or a truncated result, so background shell hand-offs keep streaming until the turn ends. On replay, retain a non-PTY preview only when it is complete. A truncated preview without a saved file is not the full output. * Keep terminal full output changes minimal - Only load a closed chat for full-output editors; tool I/O resources keep resolving from loaded chats only, as before. - Keep the non-PTY shell URI builder in copilotNonPtyShellTerminals.ts instead of moving it to a shared file. - Drop terminalConnectionAuthority; the chat session resource already identifies the owning Agent Host connection. - Drop unused isPty and supportsCommandDetection from retained terminals, and an unused parameter in getTerminalOutput. - Remove the unused notice text sanitizer and an unrelated focus style. - Make the accessibility help describe only what the UI does. * Retire completed shell channels and bound saved output reads Keep only artifact-backed output descriptors. Publish static results before retiring ordinary channels, and clear descriptors on SDK disconnect or missing artifacts. Use existing resource metadata/read requests with byte limits instead of relying on cached terminal state. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Gate saved shell output on availability and simplify preview actions Check artifact metadata before replacing the completion-text fallback or exposing the read-only action. Read authoritative output through existing resource APIs, preserve short-output attachment cleanup, and keep the header, Enter, and Accessible View actions. Remove whole-preview click handling and unrelated terminal snapshot changes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Keep saved-path hints when output exceeds the read limit Only enable the full-output action and swap the preview when the artifact also fits the existing host transfer bound. Cover the exact limit and one byte above it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Capture resolved artifact size in terminal test fixtures Keep the narrowed metadata value outside the nested mock class initializer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Persist full shell output with its chat session Store bounded output bytes in the session database before publishing completion. Reuse existing resource content references for cold reads, cascade output cleanup with turns, and remove temporary-path retention. Restore the inline output link without broad preview click handling. Addresses Connor's storage feedback in discussion_r4084901768. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Remove redundant terminal output size check * Use terminal subscriptions for retained output * Clean up retained terminal output lifecycles * Fix terminal output model type checking * Chat: Show terminal output subscription errors Addresses review thread https://github.com/microsoft/vscode/pull/335016#discussion_r4086889272. Empty output models now show a localized late subscription error without replacing retained output. * Chat: Update terminal output models incrementally Addresses review thread https://github.com/microsoft/vscode/pull/335016#discussion_r4086897268. Track the final content part and append only unseen terminal data, falling back to full reconciliation for snapshots, clears, and replacements. * Test terminal output with normalized line endings * Chat: Simplify terminal output model updates Addresses review thread https://github.com/microsoft/vscode/pull/335016#discussion_r4087676533. Append known terminal deltas directly and use full replacement only for reconciliation paths. * Chat: Synchronize full output affordances Show the inline full-output link before exposing the header action so both affordances become available together. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Activate Python environments in Agent Host shell commands with shell init scripts (#332593) * Add shell init snippet generators for the SDK shell tool The SDK built-in shell tool spawns a fresh no-rc shell per command, so the user's Python environment and shell hooks are absent. Add the generators that produce the init script text later sourced via ShellOptions.initScripts. Three runtime behaviors shape the generated text: only the final exit status is observed (so every script ends in a statement that always succeeds), bash init-script stderr is discarded (so diagnostics go to stdout), and PowerShell scripts are dot-sourced under $ErrorActionPreference = 'Stop' (so the body is wrapped in try/catch/finally). The profile snippet sources ~/.bashrc and then replays marker-delimited managed blocks that did not take effect. Stock rc files early-return in non-interactive shells and tools such as conda append their init block below that guard, so sourcing alone never reaches it. Replaying recovers shell functions such as conda activate, which are never exported and so cannot arrive through the inherited environment. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add the shellInitSnippets session config key Carries generated shell init script text from the client to the agent host as per-session config. Values are pushed rather than user-authored, so the property is readOnly; the selected Python environment can change while a session is live, so it is sessionMutable. The property deliberately has no default and is not added to the defaults passed to validateOrDefault: an absent value means "nothing to apply", which must stay distinguishable from an explicit empty array, which clears previously applied scripts. readOnly keeps the property out of the session settings file but does not suppress the generic chat-input chip, so the key is also added to WELL_KNOWN_PICKER_PROPERTIES. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Let buildSandboxConfigForSdk grant extra readonly paths Host-generated files that the SDK shell tool must read, such as a session's shell init scripts, live under the user data path, which no existing grant covers. Add an optional extraReadonlyPaths parameter routed through the same precedence sets as user-supplied paths, so an explicit denyRead still wins and a path already granted readwrite is not downgraded. The SDK treats init script readability as a caller obligation and fails silently when a script cannot be read, so the doc comment records that every producer of a session sandboxConfig must pass the same paths. Call sites are updated in a later change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Apply shell init scripts to SDK built-in shell tool sessions Materializes the shell init snippets configured on a session and registers their paths through options.update, so the SDK sources them before every built-in shell tool command. Both producers of a session sandbox policy now grant read access to the session's script directory. CopilotAgentSession re-pushes sandboxConfig on every turn, so granting it only at launch would silently revoke the grant on the first turn, and the SDK reports nothing when it cannot read an init script. The apply lives on the session rather than the launcher so it can re-run on a mid-session config change and on a cold resume: the runtime does not persist its init-script list, but the host's session config values are persisted. Paths are derived from the snippet shape, so an unchanged list skips the RPC and changed content takes effect through the rewritten file, which the runtime re-reads before each command. Writes are atomic where the provider supports it so a command running during a rewrite cannot source a half-written file. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Publish Python activation and profile scripts for agent shell commands Adds the workbench half: a synchronizer that resolves what a session's shell tool needs and publishes it as script text on the session's config, which the agent host then materializes and registers with the SDK. Python activation is read from the environment-variable collection the Python Environments extension publishes, scoped to the workspace folder that owns the session. Only that extension may supply the value, since it becomes an executable script. On POSIX the zsh variable is accepted as a fallback for bash: the extension emits identical text for both, and the tool shell is always bash. Fish and cmd are never used because their syntax would not parse. Worktree-isolated sessions resolve through their originating project, since a worktree path is not a workspace folder and activation commands carry absolute paths. Config is dispatched only when the value actually changes, and an empty list is never published to a session that never had one. Session config is shared across windows, so an unconditional write would let two windows overwrite each other indefinitely. Both snippets are behind experimental settings, on by default. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Reduce shell init integration to one script Collapse profile loading and Python activation into one generated init script behind one setting. Inline file ownership in CopilotAgentSession, remove the generic materializer/source/index machinery, and scope publication to local workspace windows. Also apply live config changes serially, verify conda is a shell function before skipping hook replay, and clean up the SDK-session-scoped file on session disposal. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address shell init review feedback Restrict publishing to the workspace window that owns the session and skip remote hosts whose OS can differ from the renderer. Serialize live script updates, require conda to be a shell function, and add missing handler test dependencies. Inline SDK-session-scoped file ownership so cleanup cannot use a host configuration ID, and format the schema test flagged by CI. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address latest shell init review Publish synchronously before the first turn, ensure the sandbox grants access before SDK registration, and serialize final cleanup behind pending script synchronization. Limit publication to the workspace window that owns the session and trim the shell-init contract JSDoc. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Make shell init test paths platform-neutral Build expected sandbox and init-script paths through URI.fsPath so the session tests pass on Windows as well as POSIX platforms. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Only the owning window clears shell init; scope script files per instance * Load pwsh profiles under Continue; prune empty shell init session dirs * Drop the conda-specific rc replay from the shell init script * Read only the shell-matching activation variable; add SDK shell init e2e * Default Agent Host shell init scripts off Keep the setting experimental and require an explicit true value before publishing profile/Python activation scripts. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Correct Agent Host shell profile sourcing Keep profile loading before Python activation, but do not infer a Bash profile failure from the status of its final command. Clarify the exact Bash and PowerShell profiles loaded and cover non-interactive guards and rc files ending nonzero. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Keep Agent Host shell init state transient Exclude workspace-derived executable shell init text from session persistence, strip legacy persisted values during restore, and make the application-scoped disabled setting authoritative from any local window. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Prevent shell init config update loops After session schema hydration, publish only from local inputs and explicit pre-turn reconciliation instead of reacting to shared config echoes. Add a two-window convergence regression test. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Encode PowerShell shell init payloads safely Embed arbitrary multiline activation text as UTF-8 base64 and decode it in PowerShell instead of using a terminable here-string. Add round-trip and Windows execution coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Reject malformed shell init config safely Distinguish invalid shell init state from an explicit empty-list clear so malformed client or inherited config cannot remove the last valid SDK registration. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Restrict shell init config to editor clients Reject executable shell init config writes from non-editor clients and preserve the current value across their wholesale config replacements. Add acceptance, rejection, and replacement coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Document shell init script approval behavior Explain that direct script commands may require explicit approval while the experimental init-script integration is enabled, without changing VS Code or runtime approval policy. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Cover first-turn shell init ordering Wait for the shell-init config echo before an Editor Window dispatches its first turn. Exercise the raw AHP path with an Editor Window identity, unique client sequences, and no explicit echo wait before the turn. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Allow clients to clear shell init config Keep non-empty executable config restricted to Editor Window clients, while allowing any local client to submit the capability-reducing empty-list clear. Preserve the value when an unauthorized replacement merely omits it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Apply shell init config before resumed turns Reconcile before both new and resumed turns, wait for the matching server echo, and fail preparation when the host rejects the config instead of proceeding with stale shell initialization. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Run the PowerShell shell init test on Windows Move the Windows-only execution suite out of the non-Windows Bash suite so CI can exercise base64 decoding and activation in a real PowerShell process. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Close shell init config authorization bypasses Reject the session-only executable config from root state and apply the shared Editor Window policy during session creation as well as later updates. Keep explicit empty-list clears available to all clients. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Wait for pending shell init publication Track in-flight shell init actions and compare pre-turn state against the server-confirmed snapshot. Reconciliation now waits for the matching acknowledgement when the desired value is only optimistic. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Serialize shell init config publications Queue each publication through a per-session sequencer, retain its acknowledgement until completion, and make pre-turn reconciliation wait when the desired value is only optimistic or supersedes an earlier update. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Bound shell init publication acknowledgements Prevent a lost connection echo from occupying the publication sequencer forever, and let cancellation release a pre-turn reconcile queued behind an unacknowledged background update. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Make shell init sandbox grants conditional Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Test shell init file and activation updates Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Clean up in-flight shell init writes on dispose Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Clear stale shell init sandbox grants Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Clean up failed shell init writes Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Finish failed shell init cleanup Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Preserve registered shell init revisions Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Document local shell init support Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Test shell init timeout and PowerShell profiles Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Fix shell init tests on Windows Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Preserve shell init in Agents settings saves Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Retain shell init revisions until disconnect Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Fail closed on shell init preflight errors Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Bound shell init publication to one deadline Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13 * Reduce Agent Host shell init to the core integration Keep the generated script, the session config key, the workbench synchronizer, and the host-side materialize, grant, register, and cleanup path, and drop the layers that accumulated during review: - No renderer-side acknowledgement barrier. Dispatch is ordered per connection and the host applies session config before it starts a turn, so reconcile publishes synchronously again. - No client-type authorization for the config key. Connected clients can already run shell commands through the agent; readOnly plus transient state is the model. This also removes the Agents-window settings-save rejection and its carry-forward patch. - No script revisions. One file per instance is rewritten atomically in place and deleted only on dispose after the SDK session disconnects, so a command that already captured the path can still source it. - SDK registration failures are logged and retried on the next turn rather than failing the turn. The sandbox read grant is added once a script is materialized and kept for the instance lifetime. Windows test portability, echo suppression, transient persistence, and base64 PowerShell payloads are unchanged. * Guard shell init cleanup when a session never initialized dispose() called this._wrapper.disconnect() before the base disposal so the script file is removed only after the SDK session disconnects. The wrapper is assigned midway through initializeSession, so a session that fails during launch has none, the call throws a TypeError, and the base disposal never runs. That leaked the session and its ShellManager in the resume tests, and in the launcher's fallback path the TypeError replaced the SDK's model error, which broke the stale-model E2E on every platform. Skip the disconnect-then-cleanup chain when there is no wrapper; such a session has no script to remove either. * Shorten the Agent Host shell init setting description * Enforce the shell init setting on the host and close the inherited config path CopilotAgentSession read shellInitSnippets through the effective config chain, so a value placed in root config by any connected client was inherited by every Copilot session without its own value, and the workbench setting only governed which window published. Read the session's own value only, and apply it only while the forwarded enableShellInitScript root flag is true, so the user setting is enforced by the host regardless of who published the value. The flag is forwarded next to the other Copilot CLI settings and re-applied on root config changes, unregistering a live script when it turns off. Also: the Agents window mounts the active session's folder into its workspace, so folder ownership alone qualified it as a publisher; it now only clears. Cap accepted script text at 64 KiB. Remove the generated directory on dispose even when the SDK disconnect fails. Qualify the generator note that a sourced profile can still terminate the shell. The recorded E2E enables the flag through root config before the snapshotted round and leaves the root channel so its notifications stay out of the round. * Decide the shell init off state before validating the payload The malformed-payload check ran before the forwarded flag was read, so a registered script survived turning the setting off if the session value had become malformed in between. The custom terminal tool check returned early for the same reason, leaving a dormant SDK registration when the tool was switched on mid-session. Compute the off state first: the flag is false, or the custom terminal tool has replaced the SDK's built-in shell. Either clears any registration without looking at the payload; only an enabled session validates it. * Chain shell init cleanup only for sessions that wrote a script dispose() started the SDK disconnect explicitly for every Copilot session so the script file could be removed afterwards. Sessions that never materialized a script have nothing to remove, so they now keep the plain dispose path; the disposing flag is still set synchronously so no later sync can run. * Describe the forwarded shell init flag as opt-in, not authorization * Rename the shell init session config key to shellInitScripts The key was named for an early design that published separate profile and activation snippets. The value has held one whole script since those were collapsed, and everything around it already says script: IShellInitScript, createShellInitScript, isShellInitScriptList, enableShellInitScript, and the SDK's own shell.initScripts. Rename the key, the schema property, its localization ids, and the local variables to match. Also say the script is client-generated where two comments called it host-generated; the host only writes the file. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bef9b9c0-98f2-4b26-8b8b-18119efe7b13

Stream built-in shell output over AHP terminal channel (#327067) * Stream output for SDK built-in shell tool * better todo comment * Bump Copilot SDK to 1.0.8 preview Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5083fb1f-34d7-44bf-82a1-c4582e57683b * Exclude unused Koffi native modules Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5083fb1f-34d7-44bf-82a1-c4582e57683b * Adopt AHP terminal completion changes and stream built-in shell output over the terminal channel - Re-vendor agent-host-protocol: terminalComplete removed, exitCode/preview/truncated fold into terminal.result (TerminalCommandResult), isPty added to ToolResultTerminalContent and TerminalState - shell_exit now lands on the tool call's terminal block; history replay synthesizes a non-pty block keyed by toolCallId - Stream tool.execution_partial_result into an output-only agenthost-terminal channel (isPty false) instead of replacing Text content - Normalize LF to CRLF in AgentHostPty when the channel is plain text - Re-apply local CompletionItem.label extension clobbered by the protocol sync (still needs upstreaming) * Track last emitted snapshot for non-pty shell streaming The runtime emits cumulative plain-text snapshots (ANSI-stripped, throttled) that are capped to the leading ~10KB with a growing truncation marker, so a length-based delta goes stale once output exceeds the cap. Track the last emitted snapshot and prefix-check it: extend in place while the snapshot grows, reset the channel and rewrite when it was rewritten. * Normalize output terminal data to CRLF in the terminal manager Pty-backed channels already carry CRLF because the pty converts output line endings; do the same for output-only channels at the point data enters the channel, so terminal frontends render both identically and AgentHostPty needs no isPty-specific handling. Reverts the client-side normalization. * no need to complicate too much with lf crlf * Fix output-only shell command lifecycle rendering * keep non pty output handling scoped to agent hsot * fix output only terminal completion state * simplify agent host output terminal lifecycle * leave unnncessary background stuff out * scope non pty shell terminals by session * change ahp version to be proper * agentHost: regenerate AHP completion types --------- Copilot-Session: 5083fb1f-34d7-44bf-82a1-c4582e57683b

Dispose AgentHostPty on terminal shutdown, exit, and detach (#331908) * Dispose AgentHostPty on terminal exit * Dispose AgentHostPty with its terminal instance * Align AgentHostPty disposal with terminal precedent * Let reconnect supersede a pending AgentHostPty startup

Use VS Code GitHub auth for private plugin marketplaces (#337586) * Use VS Code GitHub auth for private plugin marketplaces * Git: Normalize trace environment variable names Addresses review thread https://github.com/microsoft/vscode/pull/337586#discussion_r4088416670.\n\nAuthenticated Git retries now remove trace variables case-insensitively so lowercase Windows variants cannot expose authorization headers. * Git: Scope marketplace auth to the actual remote Addresses review threads https://github.com/microsoft/vscode/pull/337586#discussion_r4088416703 and https://github.com/microsoft/vscode/pull/337586#discussion_r4088416730.\n\nAuthenticated retries now resolve pull and fetch from the repository's actual origin, remove inherited extra-header configuration, and scope the reset and editor credential to the exact remote URL. * Git: Recognize HTTP authentication failures Addresses review thread https://github.com/microsoft/vscode/pull/337586#discussion_r4088416763.\n\nNative Git 401 and 403 status errors now trigger the existing VS Code GitHub authentication retry. * Git: Preserve updates without an origin remote Addresses review thread https://github.com/microsoft/vscode/pull/337586#discussion_r4096049729.\n\nPull and fetch now continue through the native path when an origin URL cannot be resolved. * Git: Keep cancellation out of error logs Addresses review thread https://github.com/microsoft/vscode/pull/337586#discussion_r4096049744.\n\nCancellation now propagates before authentication classification or error logging. * Git: Defer editor auth lookup until fallback Addresses review thread https://github.com/microsoft/vscode/pull/337586#discussion_r4096049757.\n\nCanonical Git operations now start with native Git immediately and look up the VS Code session only after a classified authentication failure. * Git: Cover unsupported authentication retries Addresses review thread https://github.com/microsoft/vscode/pull/337586#discussion_r4096049767.\n\nNegative tests now require unsupported origins and non-authentication failures to stop after the native attempt without cleanup or editor credentials. * Git: Cover bare credential redaction Addresses review thread https://github.com/microsoft/vscode/pull/337586#discussion_r4096049776.\n\nThe redaction test now exercises stderr containing only the encoded credential value rather than the complete authorization header. * Git: Reduce marketplace authentication log noise Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix sliced last row in inline chat terminal output (#328592) * fix slicing of last row in chat terminal output * address feedback * add more test

Enforce managed plugin enablement in the model and UI (#337209) * Enforce managed plugin enablement policy * Preserve managed plugin policy documentation * Reuse shared collision enablement model * Render effective plugin state after toggle Addresses review comment 4072817584. Read the enablement model after each write so collision-rejected changes are rendered using the effective state. * Inject plugin editor notification service Addresses review comment 4072817668. Declare INotificationService in the editor constructor instead of resolving it through IInstantiationService.

Retain full Claude Bash output across chat reloads (#337389) * Retain full Claude Bash output with its chat session When Claude saves a large Bash result to disk, copy that output into the owning chat's session database before the result is published and attach a non-PTY terminal resource to it, so "Open Full Output" works for Claude the same way it does for Copilot. Restored transcripts get the same resource back when the database has the output. No terminal is kept alive: subscribers get exited terminal state rebuilt from the database. Output is dropped when the turn is cancelled before its result is published, and truncation removes it with its turn. * Cover Bash and PowerShell commands in Claude output retention Clarify that Claude's Bash tool is its generic shell command surface, so commands that invoke Bash or PowerShell use the same retained-output path. Keep provider output unchanged unless Claude supplies persistedOutputPath, and restrict capture to the command tool rather than its output and kill lifecycle tools. * Agent Host: clean up retained output on cancellation Addresses review thread https://github.com/microsoft/vscode/pull/337389#discussion_r4091944870.\n\nRecheck cancellation after capture and remove the staged output and database row before publishing the tool completion. * Agent Host: align cancellation test indentation * Agent Host: return after Claude output capture failure Fixes the Compile & Hygiene TypeScript failure by making the capture error path explicitly return no retained tool call id. * Fix cancellation cleanup for retained Claude output Preserve cancelled capture IDs for the publication barrier, cancel file reads, and avoid recreating databases during cleanup. Trace unrecognized previews and clarify native PowerShell scope, with focused regression coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Retain full Codex shell output across chat reloads (#337390) * Retain full Codex command output with its chat session Store command output longer than 20,000 characters in the owning chat's session database and publish a 2,000-character preview with a non-PTY terminal resource, so "Open Full Output" works for Codex the same way it does for Copilot. Restored chats get the same resource back when the database has the output; other output keeps its restored text. Use the Codex item id as the command's tool call id, live and on replay, so the resource survives reloads. A sandbox pre-flight coalesced with its re-run keeps the pre-flight's id on replay too, matching live. The completion is still published synchronously and no terminal is kept alive: subscribers get exited terminal state rebuilt from the database, whose queued write is ordered ahead of later reads. Reverting or rolling back turns removes the output retained for their commands. * Keep Codex command output inline up to the shell output limit Codex reports a command's complete output, so only retain output that is longer than the SHELL_COMMAND_MAX_OUTPUT_BYTES characters the agent host already surfaces for shell output, instead of the workbench's model-facing 20,000-character limit. Output at or below that size renders exactly as it did before. When output is retained, keep its end inline as the preview rather than its first 2,000 characters. The terminal card shows the end of the output, so the card keeps showing what it showed before, and Open Full Output serves the rest. * Unwrap PowerShell command executions in Codex chat Treat PowerShell and pwsh -Command wrappers like the existing Bash and zsh -c wrappers when rendering Codex command executions. Retained output remains shell-neutral; this keeps Windows command rows and restored transcripts on the same display path as POSIX shells. * Show the beginning of retained Codex command output Keep the first 80,000 characters as the inline preview when Codex output is retained, matching Claude's first-chunk presentation. Below-limit output and the complete stored terminal resource remain unchanged. * Keep the beginning visible in retained Codex previews Build a compact preview from the first three logical output lines and shorten very long lines. This keeps the beginning visible in the terminal card's fixed viewport while the complete output remains available through Open Full Output. * Keep retained Codex previews as a raw prefix Use the first 400 output characters exactly as emitted, without synthesizing ellipsis markers or rewriting lines. The bounded prefix remains visible in the terminal card while Open Full Output serves the complete stored result. * Retain Codex output recovered at turn completion Addresses review thread https://github.com/microsoft/vscode/pull/337390#discussion_r4092208196. Queue retained-output storage before recovered command completions are mapped from turn/completed, preserving the normal item/completed ordering. * Restore retained Codex output during history refresh Addresses review thread https://github.com/microsoft/vscode/pull/337390#discussion_r4092208234. Enrich changed replayed turns from the session database before publishing incremental history replacements, with a staleness guard after the async read. * Keep recovered Codex subagent output inline Preserve the PR's existing subagent exclusion while retaining parent command output recovered from turn/completed. Share the recovery predicate with the storage path and cover both parent and subagent outcomes. * Fix Codex retained-output regression test types Use the current generated protocol item shapes and narrow retained terminal content before reading its resource. This keeps the Copilot review regressions type-safe without changing production behavior. * Codex: preserve full output when retention fails Addresses review comment 4098872570. Wait for output storage before publishing completion, retain inline output on failure, and preserve per-chat progress order. * Codex: skip encoding output above the retention limit Addresses review comment 4098872582. Reject oversized strings before allocating a UTF-8 copy, and retain the exact byte check for multibyte output. * Codex: define the inline output limit in characters Addresses review comment 4098872591. Decouple the 80,000-code-unit Codex transcript limit from the shared shell tool byte limit and cover Unicode boundaries. * Codex: preserve shell flags when coalescing commands Addresses review comment 4098872600. Compare raw invocations for live and replay pre-flight identity while keeping unwrapped scripts for display and restriction checks. * Codex: share the command completion recovery predicate Addresses review comment 4098872608. Keep recovered-output retention and completion mapping on the same eligibility check. * Codex: restore retained output independently of replay length Addresses review comment 4098872611. Look up retained rows by tool-call id and recover the preview from storage when native history is short or empty. * Codex: align review regression fixtures with protocol types Complete command fixture metadata and narrow completed tool calls. npm run typecheck-client and all 307 focused Codex tests pass.

Restore user/workspace terminal bash auto-approve actions for Agent Host Copilot (#327947) * Bring back terminal auto approval edit settings.json * Scope terminal auto-approve actions to rule-eligible Agent Host Copilot confirmations * Tighten auto-approve rule eligibility and evaluate persisted rules only * Add gate coverage for canFutureRuleSuppressPrompt * Extend auto-approve rule test coverage and drop a dead guard * Preserve focus when chat confirmation buttons update * Carlify terminal auto-approve rule eligibility