roblourens

Verify SSH host keys for remote agent host connections (#329462) * agentHost: Verify SSH host keys for remote agent host connections The ssh2 ConnectConfig had no hostVerifier, which makes ssh2 accept any host key from any server ("Host accepted by default (no verification)"). Every remote agent host SSH connection was therefore open to impersonation, including harvesting the password typed into our own keyboard-interactive prompt and, with agentForward, access to the user's SSH agent. hostVerifier runs during key exchange, before authentication, so declining now guarantees no credentials ever reach an unverified server. Trust is kept in our own IStorageService-backed store; the user's known_hosts files are read as an additional trust source but are never written to. A changed or revoked key hard-fails with no click-through, recoverable only via the new "Forget SSH Host Key" command, and StrictHostKeyChecking is honored from the user's real SSH config rather than a parallel setting. Host keys a server proves it owns via OpenSSH's UpdateHostKeys extension are learned silently, so legitimate rotations do not surface as failures. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: Allow time to answer the SSH host key prompt ssh2's readyTimeout covers the whole handshake and keeps running while hostVerifier awaits a verdict, so the existing 30s window would abort the connection out from under a user doing exactly what the host key dialog asks: going to compare the fingerprint against another source. Verified against a live server that readyTimeout does fire while a verdict is pending. Waiting longer is safe here because these prompts only occur after the server has proven responsive (we are holding its host key), so this window is not what guards against an unreachable host. Background reconnects never prompt, so they keep the short window and still abandon a stalled handshake promptly. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: Harden SSH host key verification after review Fixes found by code review and confirmed against OpenSSH 9.9: - Revoked host keys were accepted when StrictHostKeyChecking was no/off, because the opt-out was evaluated before the revocation check. Real ssh still reports "REVOKED HOST KEY DETECTED" under that setting and disables password auth, keyboard-interactive auth and agent forwarding. Disabling host key checking means "I accept unknown keys", never "I accept keys I have explicitly revoked". - An UpdateHostKeys announcement could overwrite a genuine stored key from a session that was never verified (StrictHostKeyChecking=no), so an impostor's key would be trusted once strict checking was restored. ssh2 proves announced keys belong to whoever we are talking to, which says nothing about whether that party is the real host. Announcements are now honored only when the key that authenticated the session is itself trusted, matching OpenSSH's documented rule. - A clean mid-handshake close left the connect promise pending forever: ssh2 emits only end/close with no error and clears its own timeout. Verified with a server that drops the connection after the banner. - A connection dying while known_hosts was being read could register a verification for an already-dead connect, leaking a pending entry and prompting about a connection that was gone. - Replaces the previous blunt 5 minute readyTimeout, which made an unreachable host take minutes to fail. The handshake deadline is now ours (ssh2's is disabled, verified that readyTimeout:0 does so) and is widened only for the interval a prompt is actually outstanding. Also corrects doc comments that said "main process" for a service that runs in the shared process. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: Document and cover the stale host key dialog case IDialogService.confirm accepts no CancellationToken and offers no programmatic dismissal, so a host key modal opened for a connection that subsequently dies stays on screen. That is cosmetic rather than unsafe: the caller re-checks cancellation before acting on the answer, so a late "Connect" can neither persist trust nor revive a dead connect attempt. Documents the limitation and adds a test that locks in the safety property. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: Dismiss the SSH host key prompt when the connection dies I previously concluded this was not fixable because IDialogService.confirm takes no CancellationToken. That was wrong: the token lives on the options object (IBaseDialogOptions), not the method signature. It only applies to custom dialogs, which is why the existing precedent for a dismissable confirmation pairs `custom` with `token`. So the prompt now tears itself down when the connection drops instead of stranding the user with a question about a connection that no longer exists. Answering late was already inert, and the test now asserts both properties rather than just the latter. Also fixes doc comments that described the old ordering in the host key policy and referred to ssh2's readyTimeout, which we no longer use. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: Report a refused SSH host key without ssh2 jargon Declining a host key surfaced "Failed to connect via SSH to macbook-air: Error: Host denied (verification failed)" — ssh2's internal wording, and redundant on top of the host key UI, which has already either been dismissed by the user or shown a specific error with a recovery action. A refused key now rejects with SSHHostKeyDeniedError, which the connect UI treats like a cancellation and does not report again. The guard matches on the error name because the error is raised in the shared process and inspected in the renderer, where only name/message survive IPC serialization. Only a verdict from the renderer is treated this way. Node-side fail-closed paths (a malformed key, or an error while reading known_hosts) still surface a visible error, since nothing else would tell the user the connection went nowhere. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agentHost: stream rich tool call progress (#327765) * agentHost: stream Copilot tool call arguments Render tool invocations while their arguments are still being generated, preserving final tool metadata and client-tool execution semantics.\n\n(Written by Copilot)\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chat: sequence streamed client tool updates Ensure partial-input handlers finish in order before client tool execution, and release pending streams when protocol completion wins the race. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: finalize streamed tool metadata at ready Allow Ready actions to replace provisional contributor and intention metadata so MCP tools can stream immediately while retaining correct execution, rendering, and telemetry semantics. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: simplify streamed tool call lifecycle Limit partial streaming to server-owned tools, preserve client execution ownership, and separate telemetry attribution from invocation timing. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: harden partial tool input display Fall back to raw streaming input for empty partial objects and avoid exposing cached parser objects. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: enrich streamed edit messages Compute progressive file and line-count messages in Agent Host while keeping incremental tool arguments off the AHP wire. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: stream rich Claude edit progress Share rich edit progress formatting across Copilot and Claude while preserving client-tool identity through live and replay lifecycles. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: test streamed tool progress end to end Add deterministic Copilot and Claude coverage for rich message-only file progress and client-tool ownership. Flush Claude's final progress update at the content-block boundary so line counts do not remain stale below the geometric checkpoint. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: normalize streamed file E2E line endings Compare replay-created file content with normalized LF line endings so the streaming progress scenario passes on Windows while retaining EOL-aware line-count coverage. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: sync merged AHP protocol Regenerate the vendored protocol from agent-host-protocol main at 8e0a9bbf after the Ready metadata refinement merged. Keep JSON-RPC parse-error typing in the VS Code transport shim rather than the generated protocol surface. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: throttle streamed tool progress on time only The geometric growth gate required each update to add 25% more input, so streamed edits updated less and less often and appeared to stall on large arguments. Throttle on a shared 50ms interval instead, and suppress updates whose rendered message is unchanged so the steadier cadence does not re-send identical rows. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: raise streamed tool display interval to 100ms Derive the streaming test waits from the shared interval constant so they do not silently fall back to asserting the final force-flush when the interval changes. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add Agent Host E2E coverage and expand protocol scenarios (#326493) * Add Agent Host E2E coverage and scenarios (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Stabilize Agent Host E2E tests across platforms (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Gate macOS-recorded Agent Host snapshots on Windows (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Use behavior snapshots for Agent Host scenarios (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add Agent Host settings commands to editor window (#325187) * Add Agent Host settings commands to editor window (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Use Agent Host enablement context key (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Use camelCase in Agent Host config editor (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agentHost: Track host and client topology (#329323) * agentHost: Track host and client topology Add launch, connection, transport, and initiating-client telemetry across local and remote Agent Host paths. Also ignore expected Windows shutdown statuses when deciding whether to restart the host.\n\n(Written by Copilot)\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: Harden client reconnect tracking Expire disconnected-client history with the protocol grace retention window and roll back reconnect state when synchronous setup fails.\n\n(Written by Copilot)\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agentHost: Sync session read state across all connected clients (#327950) * agentHost: Sync session read state across all connected clients Read/unread for an Agent Host session is now a single host-owned fact that every connected client agrees on. The host had two parallel representations: the `SessionStatus.IsRead` bit (persisted under the `isRead` session-database key) and separate `isRead`/`isArchived` booleans on the local `IAgentSessionMetadata` IPC shape. Different paths read different ones and they could disagree, so the booleans are gone and `status` is the sole carrier. The database values now fold into `status` once, in `AgentService.listSessions()`/`restoreSession()`, and the redundant re-folds in `protocolServerHandler` and `remoteAgentHostProtocolClient` are removed. Persistence of both flags moves onto the existing `onDidEmitEnvelope` observer, which sees client- and server-dispatched actions alike and skips rejected envelopes. Previously each dispatch path wrote the database itself, so any new server-side dispatch would silently skip persistence. The editor window had its own disconnected read model while the agent window was already wired to the host, so the two windows disagreed. It now shares the same state through a bridge mirroring the archive one: `IChatSessionItem.isRead`, `IChatSessionItemController.setChatSessionItemRead`, and `canSetChatSessionItemRead`/`setChatSessionItemRead` on `IChatSessionsService`. `AgentSessionsModel` delegates to it when the provider owns read state; its local timestamp heuristics now apply only to providers that do not. `migrateReadStateToProvider` performs a one-time, additive hand-off of existing local read state so sessions do not resurface as unread on upgrade, deferring until the provider has actually reported so a stale startup cache cannot consume the one-shot flag. Neither the Copilot SDK nor Claude/Codex track read state, and the host drives it from provider-neutral turn signals, so this works identically for all three agents. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: Trim read-state comments and docs Cut restatement and over-explanation from the comments added in the previous commit, keeping only what isn't already obvious from the code. Condenses the SESSIONS_LIST.md read/unread section to the user-visible behaviour rather than the implementation detail behind it. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: Only report sessions known to be unread Address PR feedback on #327950. Folding the read flag into `status` accidentally widened the `unread` semantics in the session server tools: `isSessionStatusRead(undefined)` is `false`, so a session with no status was treated as unread. The previous code required an explicit `isRead === false`. This is reachable and common — `ClaudeSessionMetadataStore.project()` returns no `status`, so every cold Claude session would have matched an `unread: true` listing and serialized as unread. `sessionIsUnread` now requires a known status, restoring the original semantics. Also hoists the duplicated read-timestamp comparison out of `isRead` and `migrateReadStateToProvider` into `localReadDateCoversActivity`, so the grace window and baseline fallback live in one place. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: Don't infer read state from a synthesized status Address GPT-5.6 review feedback on #327950. Neither `CopilotAgent.listSessions` nor `ClaudeSessionMetadataStore.project` projects a `status`, so every cold session that has never been marked read or archived reaches clients without one. `SessionSummary.status` is required, so the session-list store synthesized `Idle` — and the editor window then read the absent `IsRead` bit off that synthesized value and reported the session as unread, while the agents window treats an absent status as read. The two windows disagreed on the most common cold session, which is exactly what this change set out to fix. The list entry now records whether the status came from the host, and the controller leaves `IChatSessionItem.isRead` unset when it did not. That keeps all three surfaces consistent (agents window, editor window, and the `sessionIsUnread` server-tool helper) and stops the migration from consuming its one-shot flag for a session whose real state was never reported. The flag is resolved as soon as a summary carries a status, or when a client mutation establishes one. Also moves the migration ledger from workspace to application scope. The state it hands off to is host-global, so a second workspace that can see the same session — an empty window lists them all — would otherwise migrate it again and re-promote a session the user had deliberately marked unread elsewhere. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Increase Agent Host end-to-end test coverage (#328733) * test: increase agent host e2e coverage Add coverage for server tools, customization discovery, persistence, peer chats, and changesets. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: fix agent host e2e CI failures Make persistence assertions path-identity safe on Windows, remove timing-based restart waits, wait deterministically for server tool advertisement, preserve teardown tracking through assertions, and clarify the addComment range contract. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: serialize agent session release and restore Track in-flight provider releases so restoration cannot race provider shutdown. Strengthen persistence coverage to prove complete durable transcript reconstruction before restarting the host. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: fix persistence oracle typing Read optional response-part IDs through Reflect so both the TypeScript compiler and hygiene rules accept the durable reconstruction oracle. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: stabilize server tool catalog assertion Read the authoritative session snapshot with bounded retry so the test handles server-tool advertisement that occurs before or after the client begins observing actions. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agentHost: Start local Agent Host earlier (#326768) * agentHost: start local host earlier Prewarm the local Agent Host during the Ready phase, react to cached startup enablement, and keep late local/remote initialization surfaces coherent. Add startup timing instrumentation for process connection, provider registration, authentication, proxy discovery, and initial session listing. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: respect AI feature opt-out Prevent the Agent Host process from launching when chat.disableAIFeatures is enabled, even if Agent Host enablement is otherwise true. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chat: share AI disabled setting id Use one platform-owned identifier for chat.disableAIFeatures across Agent Host, chat, sessions, extension management, layout, and tests. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: fix enablement browser tests Inject the runtime platform into the testable enablement implementation and register the AI opt-out test at suite scope. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: update remote client test enablement Adapt the merged remote Agent Host client test to observable enablement and stable relayed client surfaces. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: respect masked AI opt-out (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: keep Agents setup behavior unchanged (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: simplify lifecycle optimization (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: clean up formatting (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: add startup performance marks (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agentHost: Attribute telemetry to initiating window (#327417) * agentHost: Attribute telemetry to initiating window Identify editor and Agents window AHP clients and propagate the initiating client type onto existing Agent Host and Copilot CTS telemetry. Preserve attribution for queued turns and reconnect with a fresh initialize when the host no longer remembers the client.\n\n(Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: Address telemetry attribution feedback Share initialize-result application, index Copilot SDK sessions for constant-time telemetry attribution, and clarify the protocol server test parameter.\n\n(Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: Clarify Copilot session maps Document the root AHP session ownership map separately from the flat SDK session telemetry index.\n\n(Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * tweak names --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agentHost: centralize and type-check AHP `_meta` access (#322304) * agentHost: centralize and type-check AHP `_meta` access The Agent Host Protocol uses an open `_meta` bag (`Record<string, unknown>`) on many protocol/state messages to carry well-known extra data between server and client. This was read in an ad-hoc, untyped way in many places. This change makes all `_meta` access type-safe and centralized: - Add typed reader/builder functions per well-known slot, grouped under `platform/agentHost/common/meta/`, so nothing reads `_meta` untyped. - Readers take their parent object (e.g. `ToolCallState`, `AgentCustomization`, `RootState`, `ErrorInfo`, `UsageInfo`) and read `source._meta` internally, so passing the wrong slot's bag is a compile error. `readSessionGitState` stays a raw-value reader (the sessions provider holds a detached `_meta` snapshot). - De-duplicate the feedback-annotation slot: the sessions browser layer now maps the shared validated wire shape into its client view instead of re-declaring and re-validating it. - Replace a serialize-then-reparse round-trip in the Claude subagent signal path with a direct typed builder. - Add a syntactic local ESLint rule `code-no-untyped-meta-access` that flags member access off / casts of `x._meta`, scoped to the agent host surface. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: address Copilot review on `_meta` type-safety PR - protocolUpgrade: `readUnsupportedProtocolVersionErrorMeta` now returns `undefined` (not an empty `{}`) when `_meta` has no validated fields, matching its documented contract so presence checks stay correct. - code-no-untyped-meta-access: update the rule's header comment and diagnostic messages to recommend the new parent-object reader form (`readToolCallMeta(toolCall)`) instead of the old bag form. - stateToProgressAdapter: drop unreachable `resourceUri.length === 0` / `channel.length === 0` guards — `readToolCallMeta().ui` already guarantees a non-empty `resourceUri` and only sets `channel` when non-empty. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Reorganize Agent Host integration tests (#326531) * Reorganize Agent Host integration tests Separate protocol, provider E2E, mocked-LLM, and direct SDK test families, and split shared provider scenarios into focused suites.\n\n(Written by Copilot)\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address Agent Host test review feedback Keep coverage scope metadata and replay fixture documentation aligned with the reorganized suites.\n\n(Written by Copilot)\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Limit Agent Host coverage to provider E2E tests Exclude mock-agent and mocked-LLM suites so the report measures only the real server and bundled provider stacks with replayed model traffic.\n\n(Written by Copilot)\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Clarify Agent Host E2E test boundaries Move synthetic-LLM suites into provider integration, flatten E2E captures, and simplify the checked-in coverage summary path without changing tests or fixture contents.\n\n(Written by Copilot)\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

test: increase agent host e2e coverage (#329333) * test: increase agent host e2e coverage Expand stable record/replay coverage across provider, protocol, MCP, OTel, changeset, workspace, and permission scenarios.\n\n(Written by Copilot)\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: strengthen agent host e2e assertions Assert provider-bound request data and MCP results directly, verify result-confirmation pause state, and remove the unsupported multi-root scenario.\n\n(Written by Copilot)\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: gate Claude denial replay on Linux Document and skip the Linux-only Claude file-tool denial mutation while retaining coverage on unaffected platforms.\n\n(Written by Copilot)\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agentHost: Separate local resource identity (#327936) * agentHost: Separate local resource identity Keep trusted local resource access distinct from remote host addresses and give a remote host named local a collision-free authority.\n\n(Written by Copilot)\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: Type local resource identity as unique symbol Make the trusted local sentinel explicitly narrow for control-flow checks.\n\n(Written by Copilot)\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Defer the Copilot CLI client restart until every chat is idle (#327483) * Defer the Copilot CLI client restart until every chat is idle A startup-only config change (session sync, SDK log level, enterprise host, system proxy) tore down every SDK session and stopped the client immediately. A session disposed mid-turn stops producing the events that finalize its protocol turn, so the client was left with a turn that never completed, cancelled, or errored - the session spun forever with no error and no way to recover but a reload. `chat.sessionSync.enabled` is experiment- and policy-driven, so this could kill a running turn with no user action at all; that is what a reported ~2h hang turned out to be. Park the restart instead and apply it once no chat has an in-flight turn. The values are read fresh on the next client start, so applying the restart late is always correct. The CAPI proxy restart goes through the same path since it had the identical hazard. Also release the turn when `send()` rejects: nothing else closes a turn whose send never reached the SDK loop, and such a chat would look busy forever - blocking idle eviction before this change, and parking every later restart after it. Fixes #327362 (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Contain a failing onTurnEnded callback The callback runs from SDK event handling and from the `send()` failure path, where an escaping error would replace the send error we are propagating. The turn is already cleared before it runs, so log and continue rather than unwinding through the caller. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Fix empty chat widget when opening an archived worktree session (#324341) * Fix empty chat widget when opening an archived worktree session Opening a recently-archived, worktree-isolated Copilot session showed an empty chat widget. Archiving deletes the worktree (keeping the branch), but resume still required the working directory to exist to bring up the SDK session — the only path to reading the transcript — so resume and its createSession fallback both failed and the session was restored with 0 turns. - Enforce read-only for archived sessions: AgentSideEffects rejects turns dispatched to a session whose status has SessionStatus.IsArchived. - Resume history against the persisted repository root when the worktree working directory is missing, so the transcript renders read-only. - Derive read-only from the session's archived flag in the sessions provider (shared effectiveChatInteractivity helper) so every chat hides its composer. - Surface unrecoverable resume failures: throw a typed SessionWorkingDirectoryMissingError when neither the working directory nor the repository-root fallback exists, and render a clear chat error in the handler instead of a silently empty session. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address Copilot review: preserve Hidden interactivity, generic load-error message - effectiveChatInteractivity now preserves ChatInteractivity.Hidden so archiving a session doesn't reveal internal worker chats as read-only tabs; it only downgrades interactive chats to ReadOnly. - The session-load error message is now generic ("This session couldn't be loaded.") since the specific cause can't be reliably distinguished at that layer (the typed error doesn't survive the protocol boundary). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Enforce read-only turns via chat interactivity, not just archived status interactivity is the general read-only mechanism in AHP (subagent worker chats are ReadOnly), but nothing enforced it — turn rejection previously only checked the session's archived flag. Enforce off the chat's effective interactivity instead (folding archived in via effectiveChatInteractivity / isChatReadOnly), so a single check covers subagent read-only chats and archived sessions alike, and closes the pre-existing gap where turns could be dispatched to a read-only subagent chat. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Make archived read-only turn-rejection message specific and actionable When a turn is dispatched to an archived session (e.g. a queued or in-flight message, or a remote client), the rejection error now reads "This session is archived and read-only. Restore the session to continue the conversation.", matching the "Restore" action label, instead of a generic read-only message. Non-archived read-only chats keep the generic message. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Show archived-specific read-only banner with a Restore action The read-only banner shown in place of the composer now explains an archived session specifically ("This session is archived and read-only.") and offers an inline "Restore" action that unarchives the session, instead of the generic "This chat is read-only" (kept for other read-only chats such as subagent transcripts). Adds a component fixture covering both states. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Extract UNARCHIVE_SESSION_COMMAND_ID and reuse it Move the 'sessionsViewPane.unarchiveSession' command id into a shared vs/sessions/common/sessionCommands.ts so both the action registration (sessionsViewActions.ts) and the read-only banner's Restore action (sessionView.ts) reference the constant instead of a hardcoded string. The common location keeps the parts/contrib sessions layering intact. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Recreate a live session's missing worktree instead of using the source repo A worktree-isolated session can lose its worktree while still active (the user deletes it, or a cleanup tool removes it). Previously resume silently fell back to the repository root, losing the session's isolation and risking running the agent against the user's working tree. Now the repair path distinguishes archived from live sessions: - Archived (read-only): resume against the repository root for history only, as before — turns are rejected host-side so nothing runs there. - Live (non-archived): recreate the worktree from its persisted branch via the shared _recreateWorktree helper and resume there. If recreation is impossible (branch gone / git failure), surface SessionWorkingDirectoryMissingError rather than degrade to the source repository. Extracts _recreateWorktree (shared with the unarchive path) and reads the persisted archived flag via _isSessionArchived. Renames _resolveResumeWorkingDirectory to _ensureResumeWorkingDirectory to reflect the side effect. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Share the archived-flag session-metadata keys via constants The 'isArchived'/'isDone' session-database metadata keys were hardcoded string literals in the writer (AgentSideEffects), the readers (AgentService), and the new CopilotAgent resume-repair read. Introduce AH_META_IS_ARCHIVED_DB_KEY / AH_META_IS_DONE_DB_KEY constants in sessionState.ts (next to AH_META_WORKSPACELESS_DB_KEY, the same shared-key pattern) and reference them everywhere so the writer and all readers share one definition. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Recreate deleted-but-registered worktrees and surface git errors to the UI Two fixes for the "live session whose worktree was deleted" repair path: - `git worktree add` refused to recreate a worktree whose directory was removed out-of-band because git still had it registered ("missing but already registered worktree"). Use `git worktree add -f` — it's our own managed per-session worktree, so overriding git's safeguard is safe. This makes the common manual-deletion case actually recreate instead of failing. - When recreation genuinely can't happen (branch gone, other git failure), the failure reason is now carried on SessionWorkingDirectoryMissingError and shown in the chat error instead of a generic "This session couldn't be loaded". `_recreateWorktree` returns a structured `{ ok, reason }`, and the session handler unwraps the restore-wrapper prefix to show the underlying git message. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Prompt for Agent Host authentication before send (#325725) * Prompt for Agent Host authentication before send Use the standard Copilot sign-in dialog when an Agent Host request has no usable token, including eager-created sessions, then forward the resulting token and resume the pending request. Preserve underlying authentication failures and dedupe repeated token forwarding. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Harden Agent Host authentication setup Deduplicate in-flight token forwarding, preserve setup failures without moving chat focus, and resolve authentication services through the instantiation accessor. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agent host: expand file operation E2E coverage (#328644) * Expand Agent Host file operation E2E coverage Enable shell-backed Codex file scenarios and the five previously skipped Copilot variants with portable prompts, strict fixtures, and semantic AHP snapshots. Fix Codex command completion mapping when app-server drops item completion before the following response, and remove the resolved known-issue entries. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Clarify Agent Host E2E known issues Keep the inventory focused on active gaps, remove resolved history and general test guidance, and align stale source comments with the current gates. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address Codex completion feedback Restrict turn-snapshot recovery to command executions with observed outcomes, preserve response ordering around command preflights, and scope snapshot relaxation to Codex shell completion status where direct assertions prove behavior. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agent host: integrate file coverage with main Match strict tool-result assertions to each provider's file operation strategy and refresh generated Agent Host E2E coverage baselines. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agent host: address E2E review feedback Match snapshot omissions against provider tool names before normalization and add a direct execution oracle for spaced-filename reads. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agent host: preserve E2E guidance after rebase Retain newly landed prompt snapshot and cumulative-state assertion guidance while removing resolved file-operation gaps. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agent host: adapt E2E coverage to latest Codex Preserve Codex tool lifecycles across steering, adapt the spaced-path execution oracle to Codex 0.146, and refresh generated coverage baselines. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agent host: refresh E2E coverage after conflict resolution Regenerate the Agent Host E2E coverage summary after rebasing onto current main and validating the Codex steering lifecycle adaptation. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agent host: make Codex path oracle shell-neutral Correlate the Codex shell lifecycle by tool-call id and validate the semantic read command without requiring platform-identical quoting. Refresh the E2E coverage baseline. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

sessions: never select a harness the picker doesn't offer (#327428) Switching to an extension-host session and pressing New left the composer with the extension-host agent selected, even though it is hidden from the harness picker by `chat.agents.copilotCli.hideExtensionHost`. Two remembering mechanisms compounded: 1. The New Session gestures passed the active session's providerId and sessionType straight to `openNewSession`. Once the extension-host Copilot CLI stops being advertised, `_resolveProviderForNewSession` throws and `openNewSession` swallows it, so nothing is created, the folder is dropped, and the composer lands with no active session. 2. With no session, `SessionTypePicker` fell back to the stored `sessions.userSelectedSessionType` pick without validating it against the types the dropdown actually renders. Both 'carry the harness over' sites now route through a shared `inheritableSessionTarget()` helper that drops the inherited target when the folder no longer offers it, and the picker constrains the stored pick and uncommitted drafts to the offered types. A committed session still displays the harness it genuinely runs on, and an empty type list (a provider still connecting) is left alone so late discovery keeps working. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Make the deterministic shell command E2E test platform-neutral (#327642) * Normalize line endings in AHP snapshot text Snapshot normalization rewrote working directories, home directories, user names, shell ids, and `ls -l` listing columns, but did nothing about line endings. A snapshot carrying literal tool output recorded on macOS/Linux would therefore mismatch on Windows purely because the text arrived as CRLF — a failure that looks like a product bug but isn't. Collapse CRLF before the path and line-anchored passes so everything downstream sees LF-only text. The escaped form is handled too, since tool inputs are frequently embedded JSON where the carriage return survives as a literal `\r` escape. Replace the now-fixed known issue with one found while verifying this: the trailing user-name scrub is an unanchored substring replacement, so on GitHub Actions Linux (`runner`) it rewrites the ordinary English word as well as the account name. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Make the deterministic shell command test platform-neutral Prototype for porting the Windows-disabled shell tests. Pinning the command in the prompt is necessary but not sufficient — three separate things coupled this test to POSIX, only one of which was the command: - The prompt described the command instead of specifying it, so the model chose per provider and whatever it chose was frozen into the fixture (Copilot picked `echo`, Claude picked `printf`). Pin `echo`, which behaves the same under cmd/PowerShell and POSIX shells. - The AHP snapshot recorded the Copilot shell tool's platform-specific name (`bash` vs `powershell`). Normalize it to `${shell}`. - The CAPI fixture recorded the same name in the tool_use block that drives replay, so a macOS recording would tell a Windows agent to call a tool that does not exist. Store the placeholder and expand it to the running platform's name on replay. Also drop reasoning parts that never receive content: a provider can open and close one without emitting a delta, and replay rebuilds the stream from the fixture's aggregated content where that leaves no trace. Any snapshot recorded during such a turn was permanently unreplayable. Split `shellToolReplayEnabled` so the blanket Windows exclusion is separate from the provider's Linux shell-tool stability, and move this test to the portable variant. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Make shell tool name mapping injectable and cover it with a unit test The capture/replay round-trip for platform-specific shell tool names read `process.platform` at module load, so the Windows branch could not be exercised from a POSIX host — which is exactly the branch this work exists to protect. Take the platform as an optional parameter defaulting to the running one, and assert both directions for both platforms. Record what porting the prototype test actually required: pinning the command is per-test work, but the tool-name normalization on both the snapshot and capture sides, and dropping empty reasoning parts, are central fixes that should not need revisiting per test. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Port the remaining Windows-disabled shell tests Thirteen tests were disabled on Windows because their committed capture contained a POSIX-only command. Two techniques apply, and which one is needed depends on whether a file tool exists for the operation: - Steer ("use your file tools; do not run a shell command") for reads, edits, missing-file handling, and content creation. Those captures now contain no shell command at all, which is the strongest outcome since nothing is left to be platform-specific. - Pin ("run exactly this command") for rename, delete, directory creation, and listing. No file tool exists for these, so every provider reaches for the shell; steering harder made one provider skip the operation entirely rather than pick another tool. Pinned commands use `node -e`, which is guaranteed present and quotes identically under cmd and POSIX shells. Two findings while re-recording: - Reasoning traffic can never survive the capture round-trip, because `capiWireCodec` drops reasoning items when aggregating a response. The earlier filter only dropped empty parts; a partial one carrying a few characters was equally unreplayable. Drop reasoning from snapshots. - `counts lines in a file` seeded its fixture with a trailing newline, making "how many lines" genuinely ambiguous once the agent read the file instead of running `wc -l`. Remove the ambiguity from the input. `worktree session uses the resolved worktree as working directory` stays Windows-scoped: `pwd` is auto-approved as safe while a pinned `node -e` is not, so the turn stops on a permission prompt the test never answers. Its non-shell half still asserts worktree resolution on Windows. With no test left on the Windows-excluded flag, remove it and keep only the Linux shell-tool stability gate. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Reject POSIX-only shell commands when recording a fixture Porting the Windows-disabled tests fixed the captures that existed, but nothing stops the next re-record from reintroducing the problem. Nobody picks these command strings deliberately — the model produces them from a prompt that describes the goal instead of specifying the command — so a prompt that drifts will quietly produce a capture that cannot replay on Windows, and the failure appears on a CI leg the author may not run. Check the assistant's `tool_use` commands before writing the fixture and fail the recording with the two remedies spelled out. Only the response blocks are checked: those are what replay feeds back to the agent, so they are the commands that actually execute. The check throws before the write, so a rejected recording leaves the previous capture intact. The patterns are a blocklist of constructs known to fail under `cmd` rather than an allowlist of portable ones, and are anchored to command position so a coreutil name used as an argument does not trip them. A false positive would block a correct recording and push authors toward disabling the check, which is worse than missing a case. Verified by regressing a ported prompt back to `rm`: the recording fails with the expected message and the committed capture is left untouched. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix Windows temp-directory cleanup and narrow replay block rewriting Two fixes from CI feedback on the Windows leg. Clearing read-only attributes before retrying temp-directory removal. `inspects git status` now runs on Windows, and git marks the files under `.git/objects` read-only. A read-only file cannot be deleted on Windows, and `rmSync`'s `force` option only suppresses ENOENT — it does not override the attribute. The suite teardown therefore burned its full 30-second timeout and failed with an AggregateError even though every test had passed. Waiting cannot help a read-only file, so clear the attributes before the retry instead of spinning until the deadline. Reproduced locally with a read-only directory tree, which fails the same way on POSIX; verified the tree is removed after the fix. Narrowing the replay block rewrite to `tool_use`. Expanding the shell tool name was written as "not a text block" rather than "is a tool_use block". The current union has only those two members so this is not reachable today, but a future block kind would be rewritten as if it were a tool call. Match on `tool_use` explicitly and pass anything else through untouched. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

agentHost: harden bundled-provider E2E tests (#328537) * agentHost: harden bundled-provider E2E tests Strengthen test oracles, strict replay validation, cancellation, resource cleanup, and shared-server lifecycle handling across conformance and provider suites. Remove the permission scenario whose safe command is auto-approved by every provider. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: fix E2E tests on Windows Normalize Copilot shell tool names across platforms, gate shell-output assertions where Windows exposes no stable output, extend Windows cleanup timeouts, and avoid over-scoping the cd-strip completion wait. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: release E2E terminals before cleanup Dispose session-claimed terminals before deleting Windows workspaces, use extended Windows operation timeouts, improve cleanup diagnostics, and drain the single cd-strip turn without a provider-specific channel constraint. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: make cd-strip E2E shell-neutral Match the exact tool call rather than a POSIX echo spelling, then assert the stable command marker and absence of the redundant working-directory prefix. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: gate unavailable Windows E2E oracles Skip only the Windows variants whose required watch or tool-input signal is absent, while retaining descriptor, resource mutation, and other shell coverage. Document both observed limitations for reevaluation. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: apply resource-watch gate at registration Pass the Windows capability gate to the conformance test registrar rather than protocol call options. Repository typecheck now reports only the two unrelated pre-existing Copilot errors. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>