Forward resolved session restrictions to Chromium and Playwright, enforce isolated agent pages, and move domain settings under sandbox.network with configuration migrations.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* agentHost: scope changesets to chats
Publish independent changeset catalogues for each chat and route changes, Git state, repository operations, and review state through the owning chat workspace while preserving session-wide checkpoints, summaries, and mutation safety.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* agentHost: harden chat changeset ownership
Refresh chat and aggregate Git state concurrently, prevent session Git fallback for chats, evict removed-chat Git state, and preserve the legacy session catalogue fallback when chat catalogues are unavailable.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* sessions: scope focused changes to active chat
Read focused changes, changesets, operations, review state, and status pills from the owning chat without falling back to aggregate session state. Preserve session-wide catalogues for lists, lifecycle reporting, telemetry, and draft-session repository preparation.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* agentHost: move selectable changesets to chats
Make each chat the sole catalogue owner from draft creation onward while sessions retain only aggregate change summaries. Route chat-rooted subscriptions and operations through the containing session without duplicating selectable state.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* agentHost: restore session changes alongside chat changes
Publish cumulative session changes separately from chat-owned changesets, scope picker visibility and ordering to the active chat, and keep last-turn changes accurate across peer chat databases.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* agentHost: clarify changeset catalogue ownership
Document the final split between session-wide and chat-owned selectable changesets.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* sessions: fix changeset test fixtures
Align session test doubles and catalogue expectations with the restored session-owned Session Changes entry.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* agentHost: update changeset catalogue snapshots
Record the expected chat changeset catalogue notification in provider AHP traffic after restoring session-owned changesets.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* agentHost: scope changesets to working folders
Share Branch Changes across chats that use the same folder while retaining checkpoint-based active-chat changes. Route Git operations, blob reads, reviews, summaries, and monitoring through the owning folder and preserve the Sessions changes UI behavior.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* agentHost: harden folder-scoped changesets
Restore non-Git chat changes, folder-owned operation refreshes, stable summaries and catalogues, and multi-root review-ref lifecycle behavior. Keep changes pills and session workflow operations aligned with the active chat scope.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* agentHost: harden changeset recomputation
Keep coalesced full recomputes from inheriting incremental turn state, and distinguish non-Git scopes from transient Git failures so incomplete worktree summaries are not persisted.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* agentHost: restore chat changes across host versions
Resolve restored peer state before computing chat changes and preserve compatibility with legacy session-owned changeset catalogues. Avoid duplicate operation refreshes and remove the obsolete Branch computation path.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* agentHost: restore session changes across chats
Keep Session Changes session-owned and project it into every chat while preserving chat-scoped repository and turn changesets. Remove the obsolete host-side Chat Changes production path.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Merge origin/main into sessions chat changeset ownership
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* sessions: address changeset review and CI failures
Remove the unused session-level changeset publication and obsolete Chat Changes identity so every chat consumes the provider-projected Session Changes catalogue. Harden the affected cross-platform and asynchronous CI tests by using platform-native paths and waiting for the observable completion conditions.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* sessions: update fixtures for chat-owned changes
Component fixtures still mocked the removed session-level changes and changesets. Provide main-chat changes to session list fixtures and implement getChatChanges on agent feedback service mocks so the fixtures render again.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Serve a loopback HTTP fixture from the extension host instead of navigating to Google. Verify the returned page content and close all server connections after the test, retaining remote-proxy coverage.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This reverts commit 2302cc68e9.
Roll back #336352 after the Windows Remote integration test stalled during tunnel creation. Restore the original navigation test while resolver and DNS issues are investigated separately.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* chore: bump electron@43.4.1
* linux: align desktop name and StartupWMClass
Give DEB and RPM installs a package owned reverse DNS desktop name
so runtime wayland portal identity resolves to an installed desktop file.
Keep snap and archive runtime identities aligned with their distribution
specific desktop file behavior.
Set StartupWMClass to the same identity used by the runtime.
* linux: respect native window controls layout
Reserve both left and right WCO safe areas so custom title bar content
does not overlap controls when the desktop environment places them on
either side.
* dialogs: preserve native locations
Electron 43 defaults native dialogs without a defaultPath to the
Downloads directory instead of allowing the platform to retain its
last location. Resolve existing file or folder history before
invoking native open and save dialogs, while preserving an explicit
caller-provided URI.
* protocol: migrate from deprecated handlers
Replace deprecated registerFileProtocol, registerBufferProtocol,
registerHttpProtocol, and interceptFileProtocol APIs with protocol.handle().
* test: migrate unit test protocol handler
* chore: remove obsolete WebSQL preferences
Electron 43 removes WebSQL and its enableWebSQL web preference.
* fix: wco position for windows
* protocol: avoid exposing managed resource errors
* test: preserve file URLs in protocol handler
* test: adopt worker parent identifiers in CDP golden
Electron 43 target lifecycle payloads include parentId and
parentFrameId for worker targets.
* build: support V8 headers with GCC 12
* test: use platform native dialog paths
* build: install custom electron headers
* build: bootstrap electron headers in compile job
* build: bootstrap Electron headers for Alpine and web
* chore: bump electron@43.5.1
* chore: revert system fontconfig init workaround
* temp: bump distro
* chore: bump electron@43.6.0
* test: skip Dev Container agent host smoke test for exploration
The exploration update channel serves an outdated agent host server that
does not include the bundled Copilot CLI, causing the smoke test to time out.
* chore: bump distro
test: remove external DNS dependency from browser tools
Serve the web-navigation fixture over loopback HTTP and assert rendered content. Preserve remote forwarding and ensure browser, tunnel, and server cleanup.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* test: avoid browser storage test timeout
Close browser tabs before awaiting local HTTP server shutdown so Chromium keep-alive connections cannot stall cleanup.\n\n(Written by Copilot)\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* test: force-close browser test server connections
Ensure local HTTP server shutdown cannot wait on asynchronous native browser view disposal.
(Written by Copilot)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* implements rich link presentation in chats
* Allows settings to be set by experiments
* Fix rich link CI configuration
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b8949987-7bbf-43c2-a7bb-ee6450ac74c7
---------
Copilot-Session: b8949987-7bbf-43c2-a7bb-ee6450ac74c7
Codex extension surfaced a renderer forced exit after hitting EMFILE on Linux
when a webview issued very large number of concurrent local resource fetches.
Diagnosis
- Codex extension can trigger roughly 625 concurrent webview resource requests.
- Webview resource loading currently forwards each request to the host and
begins transferring the returned body immediately.
- Disk reads are chunked at 256 KiB, and Mojo uses shared-memory FDs for
payloads above 64 KiB, so each in-flight resource body can consume file
descriptors in the renderer while it is being streamed.
- The sandboxed renderer runs with RLIMIT_NOFILE=1024 on Linux.
- This is not specific to codex extensionn, any extension with enough concurrent
resource bodies can accumulate to exhaust the renderer FD budget.
This makes the problem specifically about the number of simultaneously active
host-backed response bodies. A naive limiter around WebviewElement.loadResource()
would not address the root cause because loadResource() returns as soon as the
stream is transferred, while the FD pressure persists for the lifetime of the
stream in the renderer.
Introduce a service-worker-side global concurrency limit for host-backed webview
resource response bodies.
- Add a global limit of 32 active host-backed resource bodies in the webview
service worker.
- Acquire a permit before creating/posting the load-resource request so time
spent waiting for a slot does not consume the existing 30 second
RequestStore timeout.
- Hold the permit for the full lifetime of the returned ReadableStream, and
release it only when the stream reaches EOF, errors, or is cancelled.
- Release exactly once on all non-stream results and on every early/error path,
including timeout handling.
- Preserve existing range request behavior, ETag/304 handling, CacheStorage
behavior, Safari fallback streaming, and cancellation semantics.
- For cacheable responses, keep the permit until both source transfer and the
associated cache write complete, without delaying delivery of the response
back to the webview.
- Bump the service worker version and WebviewElement expected version together
so clients pick up the updated worker.
Tests
- Add an API integration regression test that creates a webview, materializes
many local resources, fetches them concurrently from inside the webview, and
verifies the webview stays alive and all loads complete.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Default editor and panel chat to Agent Host Copilot when the agent host is enabled
Builds on the chat.editor.preferCopilotHarness behavior to make Agent Host
Copilot the computed default chat provider for both editor and panel chat
whenever the agent host is enabled, so first-time users land on Copilot instead
of Local. chat.editor.preferCopilotHarness stays scoped to the one-time
Local -> Copilot migration only.
- Thread an agentHostEnabled flag (from IAgentHostEnablementService) through the
default-session-type resolution and its callers.
- Keep Local visible and selectable; honor explicit and remembered selections.
- New Local Chat opens a local session directly: it cancels the in-flight
default-provider resolution (which would otherwise block on agent host
activation) so the local request wins immediately.
- Open a Local chat first in all chat participant API tests, since chat
participants are a Local-harness feature.
- Add a smoketest.openLocalChat command for Local panel smoke scenarios; the
sandbox reopen path reveals the existing local session to avoid a focus race.
- Register an IAgentHostEnablementService stub in the component fixtures.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* chat: honor resolved session type when starting a new chat
Fixes the New Chat drop bug (review comment #2 on #326086): when the
agent host is enabled the computed default is a non-local harness, so the
editor clear path recomputed that default and dropped explicit or
preserved local requests.
- clearChatSessionPreservingType now branches on the resolved session
type for the sidebar (non-local -> loadSession, local ->
startNewLocalSession) so a generic New Chat from a Local panel
preserves Local, consistent with contributed panels.
- The resolved type is threaded through IChatWidget.clear ->
viewOptions.clear -> chatEditor.clear -> clearChatEditor so the editor
opens a session of that type instead of recomputing the default. This
restores explicit "New Local Chat" from a non-local editor.
- clearChatEditor applies an explicit target type directly and keeps its
swap-aware default only for direct (untargeted) calls.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* chat: cancel the previous applyModel resolution before replacing it
Assigning a new CancellationTokenSource to the MutableDisposable only
disposes the previous source, and disposing a CancellationTokenSource
does not cancel it. So a re-entrant applyModel() (view render, switch
session) left the prior in-flight resolution running, racing to call
showModel with a stale result. Cancel the previous source explicitly
before replacing it.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
vscode-api-tests: use explicit "types" instead of "typeRoots"
Switches tsconfig from typeRoots-only (which only auto-includes @types/* found at the literal path ./node_modules/@types) to an explicit "types" list. Explicit types resolve via Node module resolution, so they keep working regardless of whether npm hoists @types/node to the workspace root or keeps it extension-local.
Refs microsoft/vscode-engineering#2912 — the recurring TS2591 "Cannot find name 'process'" failure on the build agent after #319389 changed the lockfile is consistent with @types/node being hoisted to a path the typeRoots-only config can't see. Matches the pattern already used by extensions/github, extensions/copilot, etc.
* adding allowRead and testing with defaults
* Rename terminal sandbox read allow list
* Remove Copilot settings change from sandbox PR
* changes
* changes
* Updating sandbox runtime package
* Updating tests
* Add macOS test cases for denyRead/allowRead behavior and ~ path handling
Agent-Logs-Url: https://github.com/microsoft/vscode/sessions/ec5cf3c2-6c7b-4577-bdbb-8ac3d42bdfb0
Co-authored-by: dileepyavan <52841896+dileepyavan@users.noreply.github.com>
* changes for readonly home dir
* skipping integrated tests for sandbox
* running srt in tmp_dir for linux
* running srt in tmp_dir for linux
* skipping failed integration test in linux
* fixing test failures
* fixing test failures
* skipping integration tests in CI pipeline
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* adding allowRead and testing with defaults
* Rename terminal sandbox read allow list
* Remove Copilot settings change from sandbox PR
* changes
* changes
* Updating sandbox runtime package
* Updating tests
* Add macOS test cases for denyRead/allowRead behavior and ~ path handling
Agent-Logs-Url: https://github.com/microsoft/vscode/sessions/ec5cf3c2-6c7b-4577-bdbb-8ac3d42bdfb0
Co-authored-by: dileepyavan <52841896+dileepyavan@users.noreply.github.com>
* changes for readonly home dir
* skipping integrated tests for sandbox
* running srt in tmp_dir for linux
* running srt in tmp_dir for linux
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Dileep YavanmandhaandCopilot
Sandeep SomavarapuandCopilot
Megan Rogge
Christof MartiandCopilot
Raymond Zhao
Dmitriy VasyuraandCopilot
Robo
roblourensandCopilot
Kyle Cutler
Henning DieterichsandCopilot
Tyler James LeonhardtandCopilot
Alex Ross
Bryan Chen
Johannes
Matt Bierner
João Moreno
Anthony Kim