Connor Peet

agentHost: select remote endpoints from shared registry Discover and select editor or dedicated agent hosts over SSH and dev tunnels. Add structured CLI discovery and relay commands, tunnel protocol-v6 selection, and idle shutdown for remotely spawned standalone hosts. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agentHost: give every remote connection one owner and one reconnect path Remote agent host connections were established in six different places, and reconnection was implemented five times over. Only WebSocket connections could use the protocol client's soft reconnect, so SSH, WSL, tunnel and Dev Container connections were torn down and rebuilt on every transport drop: a new clientId, no action replay, and pending tool calls cancelled by the host. This moves connection ownership into RemoteAgentHostService and gives every kind the same reconnect behaviour. - Adds ReconnectingTransport, which re-establishes an inner transport through an owner-supplied callback. Relay-backed kinds now supply a transport factory, so they get the protocol client's backoff, clientId preservation, server-side action replay and outbox draining. - Adds a reconnect policy per connection kind, replacing five hand-written backoff loops. The protocol client now honours a maximum attempt count instead of retrying forever, and reports terminal failure upward rather than running its own recovery. - Adds a `reconnecting` connection status, distinct from `connecting`. Recovery loops no longer replace a protocol client that is already restoring itself, and a send during a drop waits for the connection instead of failing. - Adds IRemoteAgentHostConnectionFactory. A factory builds an unconnected client and exposes the entries of its kind; the service performs the handshake, classifies the result, sets the status and owns retries. WebSocket and SSH use this path. - Moves entry persistence to the owning producer. The service reads entries and never writes them, so an address that moves between stores cannot be resurrected. - Moves malformed-frame protection into RelayTransport, where it now closes the transport instead of the connection, so a corrupted stream recovers through soft reconnect. SSH and WSL did not have this protection before. - Opens the SSH configuration file, instead of a setting that cannot contain the host, for an SSH host defined by an ~/.ssh/config alias. WSL, tunnel, cloud sandbox and Dev Container connections still register through addManagedConnection. Later changes move them to connection factories, after which addManagedConnection and the dialableByService flag can both be removed. (Commit message generated by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agentHost: unify local endpoint discovery Publish editor and standalone agent hosts through a shared user-data registry with cross-process locking. Update CLI discovery and management commands to work across all registered hosts without the legacy lockfile. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

sessions: connect to agent hosts through browser tunnels Move Dev Tunnels discovery and relay connections into the browser Agents window. - Builds a lazy browser-only Dev Tunnels ES module beside the sessions code. - Shares tunnel connection, gateway selection, and WebSocket-over-stream logic. - Restores the editor-versus-dedicated host choice and saves the preference. - Keeps desktop tunnel connections on the shared connector implementation. - Adds focused tests for tunnel selection, framing, cleanup, and browser discovery. (Commit message generated by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agentHost: initial implementation of /btw Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agentHost: use AHP for local connections Route local renderer traffic through the Agent Host Protocol over MessagePort, expose a token-protected local socket endpoint, and retain a narrow IPC management surface. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agent host: enforce enablement where the SDK handoff is built Give enablement exactly one enforcement point: the place the host builds what it hands to a provider SDK. Everything is still published and still materialised, so a disabled thing appears in the UI with a reason rather than silently vanishing. The gate is shared by all three providers and derives from a single resolution call, so Claude, Copilot and Codex cannot drift apart. A disabled plugin's directory is never passed, which matters because the SDK discovers `.mcp.json` inside any directory it is given. That last point needed more than skipping disabled directories. MCP servers configured in VS Code are bundled into a synthetic plugin that is itself always enabled, and disabled servers have to stay in its `.mcp.json` -- removing them would make it impossible to enable a server for one workspace after disabling it globally. So the host now consumes `childEnablement`, recording the client's decision under each child's durable key and replacing only the global scope, leaving workspace and session decisions alone. Toggling a customization now records the decision in the enablement service rather than only mutating published state. Without this a session-scoped decision lived in the reducer while resolution read from the service, and the two disagreed -- the same fact in two places, which is the problem this feature exists to remove. A decision made before its session's working directory or stored decisions have arrived is queued and applied once they do, instead of being dropped. Resolution that has not settled yet is published truthfully, carrying no invented decision, and fails closed only at the SDK boundary. Attributing it to a scope nobody chose would have shown every customization as disabled at session scope during startup and offered to undo a decision that did not exist. Some MCP servers are discovered by the SDK from a directory and cannot be prevented from starting until the session-scoped `disabledMcpServers` option is available to us. Until then a disabled server is reported as disabled and its authentication prompts are suppressed, driven by the same resolved value as the gate. Refs: ENABLEMENT-SPEC §7 Refs: https://github.com/github/copilot-sdk/pull/2260 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agent host: make scoped enablement hold across sessions Enablement was stored correctly but kept coming back on, so a disabled MCP server still reached the model. Several distinct faults produced that one symptom. A decision erased itself. Recording one fired a republish, which re-applied the client's stale global assertion, and because that value matched the default it deleted the entry that had just been written. Enablement is now an overlay: the client's published value is a base and host decisions sit on top of it, so the client can no longer write into host storage at all. Whether a decision differs from what it inherits is measured against that base rather than a fixed default, so a host decision matching the default is no longer silently dropped. A server's durable key depended on where it happened to appear. Nested under its plugin it keyed one way, published on its own another, so a fresh session looked under a key nothing had ever been written to. A server now carries the source of the plugin that contributes it, and its key is derived from that alone. Several publications skipped resolution entirely and emitted a customization with no decisions, which reads as enabled. Those paths now resolve first, and reconciliation with the provider SDK derives from the same gated view as the launch handoff, so it can no longer re-enable a server that startup deliberately skipped. A server the client contributes has its global decision owned by the client, so sending that decision to the host did nothing at all. It now follows the same ownership rule as everything else: global through the client for what the client bundles, workspace and session always through the host. Rows take their state from the session's own view when there is one, so a row and its menu can no longer disagree. Refs: ENABLEMENT-SPEC §2, §4, §5, §7 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agent host: scoped customization enablement protocol shape Replace the single `enabled` boolean on plugins and MCP servers with a list of explicit, scoped enablement decisions. A decision is recorded at one of three scopes -- global, workspace or session -- and the list is published sorted most-specific-first, so `enablement[0]` is always the winning decision and no consumer implements precedence itself. An absent or empty list means no explicit decision exists, so the customization is enabled. `session/customizationToggled` now carries the complete decision set and replaces it wholesale rather than patching one scope, so a caller changing one scope must include every decision it means to keep. Only plugins and MCP servers carry `enablement`, since they are the only things that can be keyed durably. Directories keep their plain `enabled` flag and container children are untouched. The separate `enabled` boolean is removed from the two types that gained `enablement` so the same fact cannot be recorded twice and disagree; consumers derive it through `isCustomizationEnabled()`. `getEffectiveMcpServerCustomizations()` now returns each server with its effective value, applying the container gate at the point of use rather than by overwriting a child's stored decision, so re-enabling a plugin restores each child to whatever the user chose for it. No storage, resolution, launch filtering or UI behaviour changes here. Refs: ENABLEMENT-SPEC §3 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agentHost: reconcile MCP server enablement Use reducer-backed session customizations as the single desired state for MCP and plugin enablement, and reconcile Copilot and Claude runtimes before sends. This keeps harness-provided MCP servers disabled and prevents provider updates from restoring stale enablement. Fixes #325960 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>