From 918743e368cbcc2d87684b6f15b1e168495246cd Mon Sep 17 00:00:00 2001
From: Connor Peet <connor@peet.io>
Date: Sat, 20 Jun 2026 08:18:03 -0700
Subject: [PATCH] agentHost: fix flaky write auto-approval on Windows from
 native realpath

`resolveRealPathForNonexistent` imported `realpath` from `fs/promises`,
which internally calls `fs.realpath.native`. On Windows that resolves
subst drives to their target (and normalizes differently) than the JS
`fs.realpath` implementation the tests use via `fs.realpathSync`. The
symlink-resolved path could then diverge from the working directory and
be judged outside it, so `getAutoApproval` returned `undefined` instead
of `NotNeeded`.

Use `Promises.realpath` from `vs/base/node/pfs`, which deliberately
avoids `fs.realpath.native` (see microsoft/vscode#118562), aligning
production with the test and the rest of the codebase.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 src/vs/platform/agentHost/node/sessionPermissions.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/vs/platform/agentHost/node/sessionPermissions.ts b/src/vs/platform/agentHost/node/sessionPermissions.ts
index ac205701f79..75f0e00dd5f 100644
--- a/src/vs/platform/agentHost/node/sessionPermissions.ts
+++ b/src/vs/platform/agentHost/node/sessionPermissions.ts
@@ -3,7 +3,6 @@
  *  Licensed under the MIT License. See License.txt in the project root for license information.
  *--------------------------------------------------------------------------------------------*/
 
-import { realpath } from 'fs/promises';
 import { homedir } from 'os';
 import { match as globMatch, parse as globParse, type ParsedPattern } from '../../../base/common/glob.js';
 import { untildify } from '../../../base/common/labels.js';
@@ -13,6 +12,7 @@ import { isMacintosh, isWindows } from '../../../base/common/platform.js';
 import { extUriBiasedIgnorePathCase, normalizePath } from '../../../base/common/resources.js';
 import { isDefined } from '../../../base/common/types.js';
 import { URI } from '../../../base/common/uri.js';
+import { Promises } from '../../../base/node/pfs.js';
 import { localize } from '../../../nls.js';
 import { ILogService } from '../../log/common/log.js';
 import { platformSessionSchema } from '../common/agentHostSchema.js';
@@ -150,7 +150,7 @@ function assertPathIsSafe(fsPath: string, _isWindows = isWindows): void {
  */
 async function resolveRealPathForNonexistent(fsPath: string): Promise<string> {
 	try {
-		return await realpath(fsPath);
+		return await Promises.realpath(fsPath);
 	} catch (e) {
 		if ((e as NodeJS.ErrnoException).code !== 'ENOENT') {
 			throw e;
@@ -166,7 +166,7 @@ async function resolveRealPathForNonexistent(fsPath: string): Promise<string> {
 			return fsPath;
 		}
 		try {
-			const resolved = await realpath(current);
+			const resolved = await Promises.realpath(current);
 			return path.join(resolved, ...tail);
 		} catch (e) {
 			const code = (e as NodeJS.ErrnoException).code;