Connor Peet

agentHost: select remote endpoints from shared registry Discover and select editor or dedicated agent hosts over SSH and dev tunnels. Add structured CLI discovery and relay commands, tunnel protocol-v6 selection, and idle shutdown for remotely spawned standalone hosts. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Agent host: route session state through chat channels Move turn state and tool confirmations onto AHP chat channels so peer chats and subagents do not cross-talk. Persist draft/config metadata through side effects, harden malformed chat-channel handling, and keep subscription hydration from hanging on errors. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agentHost: give every remote connection one owner and one reconnect path Remote agent host connections were established in six different places, and reconnection was implemented five times over. Only WebSocket connections could use the protocol client's soft reconnect, so SSH, WSL, tunnel and Dev Container connections were torn down and rebuilt on every transport drop: a new clientId, no action replay, and pending tool calls cancelled by the host. This moves connection ownership into RemoteAgentHostService and gives every kind the same reconnect behaviour. - Adds ReconnectingTransport, which re-establishes an inner transport through an owner-supplied callback. Relay-backed kinds now supply a transport factory, so they get the protocol client's backoff, clientId preservation, server-side action replay and outbox draining. - Adds a reconnect policy per connection kind, replacing five hand-written backoff loops. The protocol client now honours a maximum attempt count instead of retrying forever, and reports terminal failure upward rather than running its own recovery. - Adds a `reconnecting` connection status, distinct from `connecting`. Recovery loops no longer replace a protocol client that is already restoring itself, and a send during a drop waits for the connection instead of failing. - Adds IRemoteAgentHostConnectionFactory. A factory builds an unconnected client and exposes the entries of its kind; the service performs the handshake, classifies the result, sets the status and owns retries. WebSocket and SSH use this path. - Moves entry persistence to the owning producer. The service reads entries and never writes them, so an address that moves between stores cannot be resurrected. - Moves malformed-frame protection into RelayTransport, where it now closes the transport instead of the connection, so a corrupted stream recovers through soft reconnect. SSH and WSL did not have this protection before. - Opens the SSH configuration file, instead of a setting that cannot contain the host, for an SSH host defined by an ~/.ssh/config alias. WSL, tunnel, cloud sandbox and Dev Container connections still register through addManagedConnection. Later changes move them to connection factories, after which addManagedConnection and the dialableByService flag can both be removed. (Commit message generated by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agentHost: unify local endpoint discovery Publish editor and standalone agent hosts through a shared user-data registry with cross-process locking. Update CLI discovery and management commands to work across all registered hosts without the legacy lockfile. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

sessions: connect to agent hosts through browser tunnels Move Dev Tunnels discovery and relay connections into the browser Agents window. - Builds a lazy browser-only Dev Tunnels ES module beside the sessions code. - Shares tunnel connection, gateway selection, and WebSocket-over-stream logic. - Restores the editor-versus-dedicated host choice and saves the preference. - Keeps desktop tunnel connections on the shared connector implementation. - Adds focused tests for tunnel selection, framing, cleanup, and browser discovery. (Commit message generated by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Agent host: adopt flattened SessionState protocol - Flatten SessionState (metadata inline; no state.summary); SessionSummary is the root catalog with ISO-8601 createdAt/modifiedAt. - Move model/agent off SessionState/ChatState onto Message; drop session/modelChanged, session/agentChanged, session/activeClientToolsChanged actions; default model now derives from the last turn / draft selection. - Host state manager: ISessionEntry storage, derived getSessionSummary, unified _meta, and a SessionSummaryNotifier for summary-notification bookkeeping. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agentHost: initial implementation of /btw Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agentHost: support multiple active clients per session Adopt the agent host protocol update that moves from a single active client per session to multiple active clients, and make the agent implementations model and merge them correctly. Protocol + UI/server: - SessionState.activeClient? -> activeClients[]; session/activeClientChanged is split into session/activeClientSet (upsert by clientId) and session/activeClientRemoved; session/activeClientToolsChanged carries a clientId. - The UI adds itself via session/activeClientSet and never removes itself. - The server removes a client from activeClients (and cancels its in-flight client tool calls) on unsubscribe, and on reconnect when the client does not resubscribe to a session where it was still active. Disconnect keeps the client active during the grace window; the grace timeout removes it and fails its pending tool calls if it never returns. IAgent implementations: - Replace setClientTools/setClientCustomizations with a per-client handle API: getOrCreateActiveClient(session, {clientId, displayName}) -> IActiveClient (mutable readonly-array tools/customizations accessors) and removeActiveClient(session, clientId). - Add shared node infra ActiveClientToolSet (per-session, clientId-keyed tool registry with merge-by-name + ownerOf) and adopt it in Copilot, Claude and Codex so multiple active clients' tools/customizations are stored, merged (deduped, first-inserted client wins) for the SDK, and tool calls are stamped to the owning client. - Guard teardown races: Copilot invalidates an in-flight customization sync on removeClient; Claude removes tools synchronously and serializes customization removal through the session sequencer, and prunes cached handles on session disposal. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agentHost: use AHP for local connections Route local renderer traffic through the Agent Host Protocol over MessagePort, expose a token-protected local socket endpoint, and retain a narrow IPC management surface. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agent host: enforce enablement where the SDK handoff is built Give enablement exactly one enforcement point: the place the host builds what it hands to a provider SDK. Everything is still published and still materialised, so a disabled thing appears in the UI with a reason rather than silently vanishing. The gate is shared by all three providers and derives from a single resolution call, so Claude, Copilot and Codex cannot drift apart. A disabled plugin's directory is never passed, which matters because the SDK discovers `.mcp.json` inside any directory it is given. That last point needed more than skipping disabled directories. MCP servers configured in VS Code are bundled into a synthetic plugin that is itself always enabled, and disabled servers have to stay in its `.mcp.json` -- removing them would make it impossible to enable a server for one workspace after disabling it globally. So the host now consumes `childEnablement`, recording the client's decision under each child's durable key and replacing only the global scope, leaving workspace and session decisions alone. Toggling a customization now records the decision in the enablement service rather than only mutating published state. Without this a session-scoped decision lived in the reducer while resolution read from the service, and the two disagreed -- the same fact in two places, which is the problem this feature exists to remove. A decision made before its session's working directory or stored decisions have arrived is queued and applied once they do, instead of being dropped. Resolution that has not settled yet is published truthfully, carrying no invented decision, and fails closed only at the SDK boundary. Attributing it to a scope nobody chose would have shown every customization as disabled at session scope during startup and offered to undo a decision that did not exist. Some MCP servers are discovered by the SDK from a directory and cannot be prevented from starting until the session-scoped `disabledMcpServers` option is available to us. Until then a disabled server is reported as disabled and its authentication prompts are suppressed, driven by the same resolved value as the gate. Refs: ENABLEMENT-SPEC §7 Refs: https://github.com/github/copilot-sdk/pull/2260 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>