@codingame/monaco-vscode-api 37.6.1 → 38.0.0

package/vscode/src/vs/workbench/contrib/chat/browser/agentSessions/agentHost/agentHostAuth.js

@@ -0,0 +1,1014 @@
+
+import { __decorate, __param } from '../../../../../../../../../external/tslib/tslib.es6.js';
+import { fetchAuthorizationServerMetadata } from '../../../../../../base/common/oauth.js';
+import { SequencerByKey } from '../../../../../../base/common/async.js';
+import { CancellationError, isCancellationError } from '../../../../../../base/common/errors.js';
+import { match } from '../../../../../../base/common/glob.js';
+import { StopWatch } from '../../../../../../base/common/stopwatch.js';
+import { URI } from '../../../../../../base/common/uri.js';
+import { readAgentModelByokIdentifier } from '../../../../../../platform/agentHost/common/agentModelByokMeta.js';
+import { authenticationAccountMeta, authenticationAccountId } from '../../../../../../platform/agentHost/common/meta/vscode/agentAuthenticationAccount.js';
+import { deriveGitHubEndpoints } from '../../../../../../platform/github/common/githubEndpoints.js';
+import { ICommandService } from '../../../../../../platform/commands/common/commands.service.js';
+import { IConfigurationService } from '../../../../../../platform/configuration/common/configuration.service.js';
+import { copilotConnectorsScope } from '../../../../../../platform/copilotConnectors/common/copilotConnectorsRequestService.js';
+import { CustomizationMarketplaceConfiguration } from '../../../../../../platform/customizationMarketplace/common/customizationMarketplaceSources.js';
+import { ILabelService } from '../../../../../../platform/label/common/label.service.js';
+import { ILogService } from '../../../../../../platform/log/common/log.service.js';
+import { ITelemetryService } from '../../../../../../platform/telemetry/common/telemetry.service.js';
+import { localize } from '../../../../../../nls.js';
+import { IAuthenticationMcpAccessService } from '../../../../../services/authentication/browser/authenticationMcpAccessService.service.js';
+import { IAuthenticationMcpService } from '../../../../../services/authentication/browser/authenticationMcpService.service.js';
+import { IAuthenticationMcpUsageService } from '../../../../../services/authentication/browser/authenticationMcpUsageService.service.js';
+import { getDynamicAuthenticationProviderId } from '../../../../../services/authentication/common/authentication.js';
+import { IAuthenticationService } from '../../../../../services/authentication/common/authentication.service.js';
+import { IDynamicAuthenticationProviderStorageService } from '../../../../../services/authentication/common/dynamicAuthenticationProviderStorage.service.js';
+import { CHAT_SETUP_ACTION_ID } from '../../actions/chatActions.js';
+import { reportAgentHostAuthRecovery, reportAgentHostAuthSignInResult } from './agentHostAuthTelemetry.js';
+
+function agentHostMcpServerId(authority, serverName, resourceUrl) {
+    return `agent-host-mcp:${authority}/${encodeURIComponent(serverName)}/${encodeURIComponent(resourceUrl)}`;
+}
+function modelRequiresAgentAuthentication(agent, model, allowSignedOutWhenUsable = false) {
+    if (!agent?.protectedResources?.length) {
+        return false;
+    }
+    const requiresAuthentication = ( agent.protectedResources.some(resource => resource.required !== false));
+    if (!allowSignedOutWhenUsable || !( agent.models.some(candidate => readAgentModelByokIdentifier(candidate) !== undefined))) {
+        return requiresAuthentication;
+    }
+    if (!model) {
+        return true;
+    }
+    const selectedModel = agent.models.find(candidate => candidate.id === model.id);
+    return !selectedModel || readAgentModelByokIdentifier(selectedModel) === undefined;
+}
+class AgentHostAuthTokenCache {
+    constructor() {
+        this._completedTokens = ( new Map());
+        this._pendingAuthentications = ( new Map());
+        this._keyGenerations = ( new Map());
+        this._rejectedSessions = ( new Map());
+        this._globalGeneration = 0;
+    }
+    async authenticate(resource, scopes, token, authenticate, accountId) {
+        const credentialKey = JSON.stringify([token, accountId]);
+        const key = this._key(resource, scopes);
+        const globalGeneration = this._globalGeneration;
+        const keyGeneration = this._keyGenerations.get(key) ?? 0;
+        const pending = this._pendingAuthentications.get(key);
+        if (pending) {
+            if (pending.credentialKey === credentialKey) {
+                await pending.promise;
+                if (!this._isCurrentGeneration(key, globalGeneration, keyGeneration)) {
+                    throw ( new CancellationError());
+                }
+                return false;
+            }
+            try {
+                await pending.promise;
+            } catch {}
+            if (!this._isCurrentGeneration(key, globalGeneration, keyGeneration)) {
+                throw ( new CancellationError());
+            }
+            return this.authenticate(resource, scopes, token, authenticate, accountId);
+        }
+        if (this._completedTokens.get(key) === credentialKey) {
+            return false;
+        }
+        const promise = (async () => {
+            await authenticate();
+            if (!this._isCurrentGeneration(key, globalGeneration, keyGeneration)) {
+                throw ( new CancellationError());
+            }
+            this._completedTokens.set(key, credentialKey);
+        })();
+        this._pendingAuthentications.set(key, {
+            credentialKey,
+            promise
+        });
+        try {
+            await promise;
+            return true;
+        } finally {
+            if (this._pendingAuthentications.get(key)?.promise === promise) {
+                this._pendingAuthentications.delete(key);
+            }
+        }
+    }
+    clear(resource, scopes) {
+        if (resource !== undefined) {
+            if (scopes !== undefined) {
+                const key = this._key(resource, scopes);
+                this._invalidateKey(key);
+                this._completedTokens.delete(key);
+                this._pendingAuthentications.delete(key);
+                return;
+            }
+            const prefix = `${resource}\x00`;
+            const keys = ( new Set([...( this._completedTokens.keys()), ...( this._pendingAuthentications.keys()), ...( this._keyGenerations.keys())]));
+            for (const key of keys) {
+                if (key.startsWith(prefix)) {
+                    this._invalidateKey(key);
+                    this._completedTokens.delete(key);
+                    this._pendingAuthentications.delete(key);
+                }
+            }
+        } else {
+            this._globalGeneration++;
+            this._completedTokens.clear();
+            this._pendingAuthentications.clear();
+            this._keyGenerations.clear();
+            this._rejectedSessions.clear();
+        }
+    }
+    rejectSession(resource, scopes, session) {
+        this._rejectedSessions.set(this._key(resource, scopes), {
+            id: session.id,
+            accessToken: session.accessToken,
+            accountId: session.account.id
+        });
+    }
+    getRejectedSession(resource, scopes) {
+        return this._rejectedSessions.get(this._key(resource, scopes));
+    }
+    clearRejectedSession(resource, scopes) {
+        this._rejectedSessions.delete(this._key(resource, scopes));
+    }
+    _invalidateKey(key) {
+        this._keyGenerations.set(key, (this._keyGenerations.get(key) ?? 0) + 1);
+    }
+    _isCurrentGeneration(key, globalGeneration, keyGeneration) {
+        return this._globalGeneration === globalGeneration && (this._keyGenerations.get(key) ?? 0) === keyGeneration;
+    }
+    _key(resource, scopes) {
+        return `${resource}\x00${scopes ? [...( new Set(scopes))].sort().join("\u0000") : ""}`;
+    }
+}
+function isSameAuthenticationSession(session, rejectedSession) {
+    return session.id === rejectedSession.id && session.accessToken === rejectedSession.accessToken;
+}
+function isAuthenticationSessionCandidate(session, rejectedSession) {
+    return rejectedSession === null || (session.account.id === rejectedSession.accountId && !isSameAuthenticationSession(session, rejectedSession));
+}
+function protectedResourceAuthenticationKey(resource) {
+    return JSON.stringify([resource.resource, [...( new Set(resource.scopes_supported ?? []))].sort(), resource.authorization_servers ?? []]);
+}
+let AgentHostAuthenticationRecovery = class AgentHostAuthenticationRecovery {
+    constructor(_telemetryService) {
+        this._telemetryService = _telemetryService;
+        this._resentTokens = ( new Map());
+        this._pendingRecoveries = ( new Map());
+    }
+    clear() {
+        this._resentTokens.clear();
+        this._pendingRecoveries.clear();
+    }
+    recover(accessor, resource, options) {
+        const key = protectedResourceAuthenticationKey(resource);
+        const pendingRecovery = this._pendingRecoveries.get(key);
+        if (pendingRecovery) {
+            return pendingRecovery;
+        }
+        const recovery = this._recover(accessor, key, resource, resolveAuthenticationOptions(accessor, options)).finally(() => {
+            if (this._pendingRecoveries.get(key) === recovery) {
+                this._pendingRecoveries.delete(key);
+            }
+        });
+        this._pendingRecoveries.set(key, recovery);
+        return recovery;
+    }
+    async _recover(accessor, key, resource, options) {
+        throwIfAuthenticationStale(options);
+        const logService = accessor.get(ILogService);
+        if (options.renewAuthentication) {
+            await options.renewAuthentication(resource);
+            throwIfAuthenticationStale(options);
+            logService.info(
+                `${options.logPrefix} Renewed authentication for resource: ${resource.resource}`
+            );
+            return;
+        }
+        const authenticationService = accessor.get(IAuthenticationService);
+        const commandService = accessor.get(ICommandService);
+        const scopes = resource.scopes_supported ?? [];
+        const quarantinePresent = options.authTokenCache?.getRejectedSession(resource.resource, scopes) !== undefined;
+        const resolution = await resolveSessionForProtectedResource(authenticationService, logService, resource, options, null);
+        throwIfAuthenticationStale(options);
+        if (resolution.kind === "signedOut") {
+            this._resentTokens.delete(key);
+        }
+        if (resolution.kind !== "resolved") {
+            logAuthenticationSessionResolution(logService, options.logPrefix, resource.resource, resolution);
+            reportAgentHostAuthRecovery(this._telemetryService, {
+                trigger: "hostChallenge",
+                action: resolution.kind === "signedOut" ? "noSession" : "defer",
+                initialSessionMatch: resolution.kind === "signedOut" ? "none" : "unavailable",
+                quarantinePresent
+            });
+            return;
+        }
+        const currentSession = resolution.session;
+        const previousToken = this._resentTokens.get(key);
+        const rejectedSession = options.authTokenCache?.getRejectedSession(resource.resource, scopes);
+        const isQuarantined = rejectedSession !== undefined && isSameAuthenticationSession(currentSession, rejectedSession);
+        let candidateResolution = resolution;
+        if (isQuarantined || previousToken === currentSession.accessToken) {
+            candidateResolution = await resolveSessionForProtectedResource(authenticationService, logService, resource, options, {
+                id: currentSession.id,
+                accessToken: currentSession.accessToken,
+                accountId: currentSession.account.id
+            });
+            throwIfAuthenticationStale(options);
+        }
+        if (isQuarantined && candidateResolution.kind === "unavailable") {
+            logAuthenticationSessionResolution(logService, options.logPrefix, resource.resource, candidateResolution);
+            reportAgentHostAuthRecovery(this._telemetryService, {
+                trigger: "hostChallenge",
+                action: "defer",
+                initialSessionMatch: resolution.match,
+                quarantinePresent
+            });
+            return;
+        }
+        if (candidateResolution.kind === "resolved" && (!isQuarantined || candidateResolution.session.accessToken !== previousToken)) {
+            const session = candidateResolution.session;
+            const isNewAlternative = session !== currentSession && !isQuarantined;
+            if (isNewAlternative) {
+                options.authTokenCache?.rejectSession(resource.resource, scopes, currentSession);
+            }
+            options.authTokenCache?.clear(resource.resource, isNewAlternative ? scopes : resource.scopes_supported);
+            if (await forwardAuthenticationToken(
+                options,
+                resource.resource,
+                scopes,
+                session,
+                candidateResolution.providerId
+            )) {
+                this._resentTokens.set(key, session.accessToken);
+                logService.info(`${options.logPrefix} Authenticating for resource: ${resource.resource}`);
+                reportAgentHostAuthRecovery(this._telemetryService, {
+                    trigger: "hostChallenge",
+                    action: session === currentSession ? "forwardCurrent" : "forwardAlternative",
+                    initialSessionMatch: resolution.match,
+                    quarantinePresent
+                });
+            }
+            return;
+        }
+        options.authTokenCache?.clear(resource.resource, resource.scopes_supported);
+        reportAgentHostAuthRecovery(this._telemetryService, {
+            trigger: "hostChallenge",
+            action: "prompt",
+            initialSessionMatch: resolution.match,
+            quarantinePresent
+        });
+        const challengedToken = candidateResolution.kind === "resolved" ? candidateResolution.session.accessToken : currentSession.accessToken;
+        const interactiveSession = await forceAuthenticationInteractively(
+            authenticationService,
+            commandService,
+            logService,
+            this._telemetryService,
+            resource,
+            options,
+            "hostChallenge",
+            challengedToken
+        );
+        throwIfAuthenticationStale(options);
+        if (!interactiveSession) {
+            return;
+        }
+        this._resentTokens.set(key, interactiveSession.accessToken);
+        if (interactiveSession.accessToken === challengedToken) {
+            logService.info(
+                `${options.logPrefix} Interactive authentication completed without a new token for ${resource.resource}`
+            );
+        }
+    }
+};
+AgentHostAuthenticationRecovery = ( __decorate([( __param(0, ITelemetryService))], AgentHostAuthenticationRecovery));
+async function resolveSessionForResource(
+    resourceServer,
+    authorizationServers,
+    scopes,
+    authenticationService,
+    logService,
+    logPrefix
+) {
+    const resolution = await resolveAuthenticationSessionForResource(
+        resourceServer,
+        authorizationServers,
+        scopes,
+        authenticationService,
+        logService,
+        logPrefix
+    );
+    return resolution.kind === "resolved" ? resolution.session : undefined;
+}
+async function resolveAuthenticationSessionForResource(
+    resourceServer,
+    authorizationServers,
+    scopes,
+    authenticationService,
+    logService,
+    logPrefix,
+    rejectedSession = null,
+    preferredSessionId
+) {
+    let hasUnavailableProvider = false;
+    const requestedSet = ( new Set(scopes));
+    for (const server of authorizationServers) {
+        const serverUri = ( URI.parse(server));
+        let providerId;
+        try {
+            providerId = await authenticationService.getOrActivateProviderIdForServer(serverUri, resourceServer);
+        } catch (error) {
+            hasUnavailableProvider = true;
+            logService.trace(
+                `${logPrefix} Authentication provider is not ready for server: ${server}`,
+                error
+            );
+            continue;
+        }
+        if (!providerId) {
+            const declaredProvider = authenticationService.declaredProviders.find(
+                provider => !authenticationService.isAuthenticationProviderRegistered(provider.id) && provider.authorizationServerGlobs?.some(glob => match(glob, ( serverUri.toString(true)), {
+                    ignoreCase: true
+                }))
+            );
+            if (declaredProvider) {
+                hasUnavailableProvider = true;
+                logService.trace(
+                    `${logPrefix} Authentication provider '${declaredProvider.id}' is not ready for server: ${server}`
+                );
+            } else {
+                logService.trace(`${logPrefix} No authentication provider resolved for server: ${server}`);
+            }
+            continue;
+        }
+        logService.trace(
+            `${logPrefix} Resolved auth provider '${providerId}' for server: ${server}`
+        );
+        let sessions;
+        try {
+            sessions = await authenticationService.getSessions(providerId, [...scopes], {
+                authorizationServer: serverUri
+            }, true);
+        } catch (error) {
+            hasUnavailableProvider = true;
+            logService.trace(
+                `${logPrefix} Authentication provider '${providerId}' is not ready to resolve sessions for server: ${server}`,
+                error
+            );
+            continue;
+        }
+        const exactSession = sessions.find(
+            session => isAuthenticationSessionCandidate(session, rejectedSession) && (!preferredSessionId || session.id === preferredSessionId)
+        );
+        if (exactSession) {
+            return {
+                kind: "resolved",
+                providerId,
+                session: exactSession,
+                match: exactSession.scopes.every(scope => ( requestedSet.has(scope))) ? "exact" : "superset"
+            };
+        }
+        let allSessions;
+        try {
+            allSessions = await authenticationService.getSessions(providerId, undefined, {
+                authorizationServer: serverUri
+            }, true);
+        } catch (error) {
+            hasUnavailableProvider = true;
+            logService.trace(
+                `${logPrefix} Authentication provider '${providerId}' is not ready to resolve sessions for server: ${server}`,
+                error
+            );
+            continue;
+        }
+        const preferredAccountId = preferredSessionId ? allSessions.find(session => session.id === preferredSessionId)?.account.id : undefined;
+        if (preferredSessionId && !preferredAccountId) {
+            logService.trace(
+                `${logPrefix} Preferred authentication session '${preferredSessionId}' is unavailable for server: ${server}`
+            );
+            continue;
+        }
+        let bestSession;
+        let bestExtraScopes = Infinity;
+        for (const session of allSessions) {
+            if (!isAuthenticationSessionCandidate(session, rejectedSession) || preferredAccountId && session.account.id !== preferredAccountId) {
+                continue;
+            }
+            const sessionScopes = ( new Set(session.scopes));
+            let isSuperset = true;
+            for (const scope of requestedSet) {
+                if (!( sessionScopes.has(scope))) {
+                    isSuperset = false;
+                    break;
+                }
+            }
+            if (isSuperset) {
+                const extraScopes = sessionScopes.size - requestedSet.size;
+                if (extraScopes < bestExtraScopes) {
+                    bestExtraScopes = extraScopes;
+                    bestSession = session;
+                }
+            }
+        }
+        if (bestSession) {
+            return {
+                kind: "resolved",
+                providerId,
+                session: bestSession,
+                match: bestExtraScopes === 0 ? "exact" : "superset"
+            };
+        }
+    }
+    return hasUnavailableProvider ? {
+        kind: "unavailable"
+    } : {
+        kind: "signedOut"
+    };
+}
+function resolveAuthenticationOptions(accessor, options) {
+    return {
+        ...options,
+        preferConnectorScopedSession: accessor.get(IConfigurationService).getValue(CustomizationMarketplaceConfiguration.CopilotConnectorsEnabled) === true
+    };
+}
+async function forwardAuthenticationToken(options, resource, scopes, session, providerId) {
+    throwIfAuthenticationStale(options);
+    const token = session?.accessToken ?? "";
+    const rejectedSession = options.authTokenCache?.getRejectedSession(resource, scopes);
+    if (rejectedSession && rejectedSession.id === session?.id && rejectedSession.accessToken === token) {
+        throw ( new CancellationError());
+    }
+    const expiresAfter = session?.expiresAfter;
+    const account = providerId && session?.account?.id ? {
+        providerId,
+        accountId: session.account.id,
+        ...(session.authorizationServer ? {
+            authorizationServer: ( session.authorizationServer.toString())
+        } : {})
+    } : undefined;
+    const request = {
+        resource,
+        scopes,
+        token,
+        ...(expiresAfter !== undefined && Number.isInteger(expiresAfter) && expiresAfter > 0 ? {
+            expiresIn: Math.ceil(expiresAfter / 1000)
+        } : {}),
+        ...(account ? {
+            _meta: authenticationAccountMeta(account)
+        } : {})
+    };
+    if (options.authTokenCache) {
+        return options.authTokenCache.authenticate(
+            resource,
+            scopes ?? [],
+            token,
+            () => options.authenticate(request),
+            authenticationAccountId(account)
+        );
+    }
+    await options.authenticate(request);
+    return true;
+}
+function throwIfAuthenticationStale(options) {
+    if (options.isCurrent?.() === false) {
+        throw ( new CancellationError());
+    }
+}
+async function authenticateProtectedResources(accessor, agents, options) {
+    const authenticationService = accessor.get(IAuthenticationService);
+    const logService = accessor.get(ILogService);
+    const resolvedOptions = resolveAuthenticationOptions(accessor, options);
+    for (const agent of agents) {
+        for (const resource of agent.protectedResources ?? []) {
+            await authenticateProtectedResourceWithServices(authenticationService, logService, resource, resolvedOptions);
+        }
+    }
+}
+async function authenticateAgentProtectedResourcesWithToken(agents, token, options) {
+    for (const agent of agents) {
+        await authenticateProtectedResourcesWithToken(agent.protectedResources ?? [], token, options);
+    }
+}
+async function authenticateProtectedResourcesWithToken(protectedResources, token, options) {
+    for (const resource of protectedResources) {
+        await forwardAuthenticationToken(options, resource.resource, resource.scopes_supported, {
+            accessToken: token
+        });
+    }
+}
+async function revokeAuthenticationForRemovedSessions(accessor, agents, providerId, removedSessions, options) {
+    const authenticationService = accessor.get(IAuthenticationService);
+    const logService = accessor.get(ILogService);
+    const resolvedOptions = resolveAuthenticationOptions(accessor, options);
+    const reconciledResources = ( new Set());
+    for (const agent of agents) {
+        for (const resource of agent.protectedResources ?? []) {
+            const scopes = resource.scopes_supported ?? [];
+            const key = protectedResourceAuthenticationKey(resource);
+            if (( reconciledResources.has(key))) {
+                continue;
+            }
+            if (!removedSessionsCouldSatisfyResource(removedSessions, scopes)) {
+                continue;
+            }
+            if (!(await resourceMatchesAuthenticationProvider(authenticationService, resource, providerId, logService, options.logPrefix))) {
+                continue;
+            }
+            throwIfAuthenticationStale(options);
+            reconciledResources.add(key);
+            const rejectedSession = options.authTokenCache?.getRejectedSession(resource.resource, scopes);
+            if (rejectedSession && ( removedSessions.some(session => session.id === rejectedSession.id))) {
+                options.authTokenCache?.clearRejectedSession(resource.resource, scopes);
+            }
+            const resolution = await resolveSessionForProtectedResource(authenticationService, logService, resource, resolvedOptions);
+            throwIfAuthenticationStale(options);
+            if (resolution.kind === "unavailable") {
+                logAuthenticationSessionResolution(logService, options.logPrefix, resource.resource, resolution);
+                continue;
+            }
+            if (resolution.kind === "resolved") {
+                if (await forwardAuthenticationToken(
+                    options,
+                    resource.resource,
+                    scopes,
+                    resolution.session,
+                    resolution.providerId
+                )) {
+                    logService.info(
+                        `${options.logPrefix} Authenticating for resource after session removal: ${resource.resource}`
+                    );
+                }
+                continue;
+            }
+            options.authTokenCache?.clear(resource.resource, scopes);
+            if (await forwardAuthenticationToken(options, resource.resource, scopes, undefined)) {
+                logService.info(
+                    `${options.logPrefix} Clearing authentication for resource after session removal: ${resource.resource}`
+                );
+            }
+        }
+    }
+}
+function removedSessionsCouldSatisfyResource(removedSessions, scopes) {
+    return ( removedSessions.some(session => {
+        const granted = ( new Set(session.scopes));
+        return scopes.every(scope => ( granted.has(scope)));
+    }));
+}
+async function resourceMatchesAuthenticationProvider(authenticationService, resource, providerId, logService, logPrefix) {
+    for (const authorizationServer of resource.authorization_servers ?? []) {
+        try {
+            if ((await authenticationService.getOrActivateProviderIdForServer(( URI.parse(authorizationServer)), ( URI.parse(resource.resource)))) === providerId) {
+                return true;
+            }
+        } catch (error) {
+            logService.trace(
+                `${logPrefix} Unable to resolve authentication provider for session removal: ${authorizationServer}`,
+                error
+            );
+        }
+    }
+    return false;
+}
+async function authenticateProtectedResourceWithServices(authenticationService, logService, resource, options) {
+    throwIfAuthenticationStale(options);
+    const resolution = await resolveSessionForProtectedResource(authenticationService, logService, resource, options);
+    throwIfAuthenticationStale(options);
+    if (resolution.kind !== "resolved") {
+        logAuthenticationSessionResolution(logService, options.logPrefix, resource.resource, resolution);
+        return false;
+    }
+    const authenticated = await forwardAuthenticationToken(
+        options,
+        resource.resource,
+        resource.scopes_supported ?? [],
+        resolution.session,
+        resolution.providerId
+    );
+    if (!authenticated) {
+        logService.trace(
+            `${options.logPrefix} Authentication state for ${resource.resource} unchanged; skipping authenticate RPC`
+        );
+        return false;
+    }
+    logService.info(`${options.logPrefix} Authenticating for resource: ${resource.resource}`);
+    return true;
+}
+async function resolveSessionForProtectedResource(
+    authenticationService,
+    logService,
+    resource,
+    options,
+    rejectedSession = options.authTokenCache?.getRejectedSession(resource.resource, resource.scopes_supported) ?? null
+) {
+    const resolution = await resolveAuthenticationSessionForResource(( URI.parse(resource.resource)), resource.authorization_servers ?? [], resource.scopes_supported ?? [], authenticationService, logService, options.logPrefix, rejectedSession, options.preferredSessionId);
+    if (!options.preferConnectorScopedSession || resource.resource !== deriveGitHubEndpoints(undefined).apiBaseUri || resolution.kind !== "resolved" || resolution.session.scopes.includes(copilotConnectorsScope)) {
+        return resolution;
+    }
+    let sessions;
+    try {
+        sessions = await authenticationService.getSessions(resolution.providerId, undefined, {
+            account: resolution.session.account,
+            silent: true
+        }, true);
+    } catch (error) {
+        logService.trace(
+            `${options.logPrefix} Unable to resolve an already-authorized connector session; retaining Copilot authentication`,
+            error
+        );
+        return resolution;
+    }
+    let preferred = resolution.session;
+    for (const session of sessions) {
+        if (session.account.id === resolution.session.account.id && isAuthenticationSessionCandidate(session, rejectedSession) && session.scopes.includes(copilotConnectorsScope) && (resource.scopes_supported ?? []).every(scope => session.scopes.includes(scope)) && (!preferred.scopes.includes(copilotConnectorsScope) || session.scopes.length < preferred.scopes.length)) {
+            preferred = session;
+        }
+    }
+    return preferred === resolution.session ? resolution : {
+        kind: "resolved",
+        providerId: resolution.providerId,
+        session: preferred,
+        match: "superset"
+    };
+}
+function logAuthenticationSessionResolution(logService, logPrefix, resource, resolution) {
+    if (resolution.kind === "unavailable") {
+        logService.info(
+            `${logPrefix} Authentication provider is not ready for resource: ${resource}; deferring authentication`
+        );
+    } else {
+        logService.info(`${logPrefix} No signed-in session resolved for resource: ${resource}`);
+    }
+}
+async function resolveAuthenticationInteractively(accessor, protectedResources, options) {
+    const authenticationService = accessor.get(IAuthenticationService);
+    const commandService = accessor.get(ICommandService);
+    const logService = accessor.get(ILogService);
+    const telemetryService = accessor.get(ITelemetryService);
+    const resolvedOptions = resolveAuthenticationOptions(accessor, options);
+    for (const resource of protectedResources) {
+        throwIfAuthenticationStale(options);
+        const scopes = resource.scopes_supported ?? [];
+        const rejectedSession = options.authTokenCache?.getRejectedSession(resource.resource, scopes);
+        const existingSessionResolution = await resolveSessionForProtectedResource(authenticationService, logService, resource, resolvedOptions);
+        throwIfAuthenticationStale(options);
+        if (existingSessionResolution.kind === "resolved") {
+            const existingSession = existingSessionResolution.session;
+            if (await forwardAuthenticationToken(
+                options,
+                resource.resource,
+                scopes,
+                existingSession,
+                existingSessionResolution.providerId
+            )) {
+                reportAgentHostAuthRecovery(telemetryService, {
+                    trigger: "sessionCreation",
+                    action: "forwardCurrent",
+                    initialSessionMatch: existingSessionResolution.match,
+                    quarantinePresent: rejectedSession !== undefined
+                });
+            }
+            logService.info(
+                `${options.logPrefix} Interactive authentication succeeded for ${resource.resource}`
+            );
+            return true;
+        }
+        reportAgentHostAuthRecovery(telemetryService, {
+            trigger: "sessionCreation",
+            action: "prompt",
+            initialSessionMatch: existingSessionResolution.kind === "signedOut" ? "none" : "unavailable",
+            quarantinePresent: rejectedSession !== undefined
+        });
+        return (await forceAuthenticationInteractively(
+            authenticationService,
+            commandService,
+            logService,
+            telemetryService,
+            resource,
+            resolvedOptions,
+            "sessionCreation",
+            rejectedSession?.accessToken
+        )) !== undefined;
+    }
+    return false;
+}
+async function forceAuthenticationInteractively(
+    authenticationService,
+    commandService,
+    logService,
+    telemetryService,
+    resource,
+    options,
+    trigger,
+    challengedToken
+) {
+    throwIfAuthenticationStale(options);
+    const watch = StopWatch.create();
+    const data = {
+        trigger,
+        result: "failed",
+        credentialChanged: undefined,
+        sessionMatch: undefined
+    };
+    try {
+        const scopes = resource.scopes_supported ?? [];
+        const setupResult = await commandService.executeCommand(CHAT_SETUP_ACTION_ID, undefined, {
+            telemetrySource: "agentHost",
+            forceSignInDialog: true,
+            additionalScopes: scopes,
+            dialogTitle: ( localize(9602, "Sign in to use GitHub Copilot")),
+            disableChatViewReveal: true,
+            returnResult: true
+        });
+        throwIfAuthenticationStale(options);
+        if (setupResult?.success === undefined) {
+            data.result = "cancelled";
+            return undefined;
+        }
+        if (!setupResult.success) {
+            throw setupResult.error ?? ( new Error(( localize(9603, "Failed to sign in to use GitHub Copilot."))));
+        }
+        let sessionResolution = await resolveSessionForProtectedResource(authenticationService, logService, resource, options);
+        if (sessionResolution.kind === "signedOut" && options.authTokenCache?.getRejectedSession(resource.resource, scopes)) {
+            sessionResolution = await resolveSessionForProtectedResource(authenticationService, logService, resource, options, null);
+        }
+        throwIfAuthenticationStale(options);
+        if (sessionResolution.kind !== "resolved") {
+            data.sessionMatch = sessionResolution.kind === "signedOut" ? "none" : "unavailable";
+            data.result = "noSessionResolved";
+            logService.info(
+                `${options.logPrefix} Interactive authentication did not provide a token for ${resource.resource}`
+            );
+            return undefined;
+        }
+        const session = sessionResolution.session;
+        data.sessionMatch = sessionResolution.match;
+        data.credentialChanged = challengedToken === undefined ? undefined : session.accessToken !== challengedToken;
+        options.authTokenCache?.clear(resource.resource, scopes);
+        if (!(await forwardAuthenticationToken(options, resource.resource, scopes, session, sessionResolution.providerId))) {
+            data.result = "deduplicated";
+            return undefined;
+        }
+        data.result = "tokenForwarded";
+        logService.info(
+            `${options.logPrefix} Interactive authentication completed for ${resource.resource}`
+        );
+        return session;
+    } catch (error) {
+        data.result = isCancellationError(error) ? "superseded" : "failed";
+        throw error;
+    } finally {
+        reportAgentHostAuthSignInResult(telemetryService, data, watch.elapsed());
+    }
+}
+function autoAuthenticateMcpServer(accessor, connection, agentHost, serverName, auth) {
+    return resolveMcpServerAuthentication(accessor, auth.resource, {
+        allowInteraction: false,
+        logPrefix: "[AgentHost]",
+        mcpServerId: agentHostMcpServerId(agentHost.authority, serverName, auth.resource.resource),
+        mcpServerName: serverName,
+        mcpServerUrl: auth.resource.resource,
+        oauthClient: auth.oauthClient,
+        scopes: auth.requiredScopes ?? [],
+        agentHost,
+        authenticate: request => connection.authenticate(request)
+    });
+}
+async function resolveMcpServerAuthentication(accessor, protectedResource, options) {
+    const authenticationService = accessor.get(IAuthenticationService);
+    const authenticationMcpAccessService = accessor.get(IAuthenticationMcpAccessService);
+    const authenticationMcpService = accessor.get(IAuthenticationMcpService);
+    const authenticationMcpUsageService = accessor.get(IAuthenticationMcpUsageService);
+    const dynamicAuthenticationProviderStorageService = accessor.get(IDynamicAuthenticationProviderStorageService);
+    const logService = accessor.get(ILogService);
+    const agentHostMeta = options.agentHost ? {
+        authority: options.agentHost.authority,
+        label: accessor.get(ILabelService).getHostLabel(options.agentHost.scheme, options.agentHost.authority)
+    } : undefined;
+    const scopes = options.scopes.length > 0 || isGitHubMcpResource(protectedResource) ? options.scopes : protectedResource.scopes_supported ?? [];
+    const authenticationOperations = getMcpAuthenticationOperations(authenticationService);
+    for (const authorizationServer of protectedResource.authorization_servers ?? []) {
+        const authorizationServerUri = ( URI.parse(authorizationServer));
+        const providerOperationId = getDynamicAuthenticationProviderId(authorizationServerUri, protectedResource);
+        const authenticated = await authenticationOperations.queue(providerOperationId, async () => {
+            const providerId = await getOrCreateProviderForMcpResource(
+                authorizationServerUri,
+                protectedResource,
+                options.oauthClient,
+                authenticationService,
+                dynamicAuthenticationProviderStorageService,
+                logService,
+                options.logPrefix,
+                options.allowInteraction,
+                options.authorizationServerMetadataFetcher ?? fetchAuthorizationServerMetadata
+            );
+            if (!providerId) {
+                return false;
+            }
+            const oauthClientOptions = options.oauthClient ? {
+                clientId: options.oauthClient.clientId,
+                clientSecret: options.oauthClient.clientSecret
+            } : {};
+            const providerOptions = {
+                authorizationServer: authorizationServerUri,
+                resource: protectedResource.resource,
+                ...oauthClientOptions
+            };
+            const sessions = await authenticationService.getSessions(providerId, [...scopes], {
+                ...providerOptions,
+                silent: !options.allowInteraction
+            }, true);
+            const allowedSession = getAllowedMcpSession(
+                providerId,
+                sessions,
+                authenticationMcpAccessService,
+                authenticationMcpService,
+                options
+            );
+            if (allowedSession) {
+                await authenticateMcpSession(
+                    providerId,
+                    allowedSession,
+                    scopes,
+                    authenticationMcpAccessService,
+                    authenticationMcpService,
+                    authenticationMcpUsageService,
+                    logService,
+                    options,
+                    false,
+                    agentHostMeta
+                );
+                return true;
+            }
+            if (!options.allowInteraction) {
+                return false;
+            }
+            const provider = authenticationService.getProvider(providerId);
+            const session = sessions.length ? provider.supportsMultipleAccounts ? await authenticationMcpService.selectSession(
+                providerId,
+                options.mcpServerId,
+                options.mcpServerName,
+                [...scopes],
+                sessions,
+                providerOptions
+            ) : sessions[0] : await authenticationService.createSession(providerId, [...scopes], {
+                ...providerOptions,
+                activateImmediate: true
+            });
+            await authenticateMcpSession(
+                providerId,
+                session,
+                scopes,
+                authenticationMcpAccessService,
+                authenticationMcpService,
+                authenticationMcpUsageService,
+                logService,
+                options,
+                true,
+                agentHostMeta
+            );
+            return true;
+        });
+        if (authenticated) {
+            return true;
+        }
+    }
+    return false;
+}
+const mcpAuthenticationOperations = ( new WeakMap());
+function getMcpAuthenticationOperations(authenticationService) {
+    let operations = mcpAuthenticationOperations.get(authenticationService);
+    if (!operations) {
+        operations = ( new SequencerByKey());
+        mcpAuthenticationOperations.set(authenticationService, operations);
+    }
+    return operations;
+}
+function isGitHubMcpResource(resource) {
+    return resource.resource_name === "GitHub MCP Server";
+}
+async function getOrCreateProviderForMcpResource(
+    authorizationServer,
+    protectedResource,
+    oauthClient,
+    authenticationService,
+    dynamicAuthenticationProviderStorageService,
+    logService,
+    logPrefix,
+    allowCreation,
+    authorizationServerMetadataFetcher
+) {
+    const resourceUri = ( URI.parse(protectedResource.resource));
+    const dynamicProviderId = getDynamicAuthenticationProviderId(authorizationServer, protectedResource);
+    let clientId = oauthClient?.clientId;
+    let clientSecret = oauthClient?.clientSecret;
+    if (oauthClient) {
+        const isProviderActive = authenticationService.isDynamicAuthenticationProvider(dynamicProviderId);
+        const registeredClient = await dynamicAuthenticationProviderStorageService.getClientRegistration(dynamicProviderId);
+        const clientMatches = registeredClient?.clientId === oauthClient.clientId && registeredClient.clientSecret === oauthClient.clientSecret;
+        if (clientMatches) {
+            if (isProviderActive) {
+                return dynamicProviderId;
+            }
+        } else {
+            if (!allowCreation) {
+                return undefined;
+            }
+            if (isProviderActive) {
+                authenticationService.unregisterAuthenticationProvider(dynamicProviderId);
+                await dynamicAuthenticationProviderStorageService.removeDynamicProvider(dynamicProviderId);
+            }
+        }
+    } else {
+        const existing = await authenticationService.getOrActivateProviderIdForServer(authorizationServer, resourceUri);
+        if (existing) {
+            return existing;
+        }
+        const registeredClient = await dynamicAuthenticationProviderStorageService.getClientRegistration(dynamicProviderId);
+        if (!registeredClient?.clientId && !allowCreation) {
+            return undefined;
+        }
+        clientId = registeredClient?.clientId;
+        clientSecret = registeredClient?.clientSecret;
+    }
+    try {
+        const {
+            metadata
+        } = await authorizationServerMetadataFetcher(( authorizationServer.toString(true)));
+        const provider = await authenticationService.createDynamicAuthenticationProvider(authorizationServer, metadata, protectedResource, clientId, clientSecret);
+        return provider?.id;
+    } catch (err) {
+        logService.warn(`${logPrefix} Failed to create MCP auth provider for ${( authorizationServer.toString(true))}`, err);
+        return undefined;
+    }
+}
+function getAllowedMcpSession(
+    providerId,
+    sessions,
+    authenticationMcpAccessService,
+    authenticationMcpService,
+    options
+) {
+    const accountNamePreference = authenticationMcpService.getAccountPreference(options.mcpServerId, providerId);
+    if (accountNamePreference) {
+        const preferred = sessions.find(session => session.account.label === accountNamePreference);
+        if (preferred && authenticationMcpAccessService.isAccessAllowedForUrl(
+            providerId,
+            preferred.account.label,
+            options.mcpServerId,
+            options.mcpServerUrl
+        )) {
+            return preferred;
+        }
+    }
+    if (sessions.length === 1 && authenticationMcpAccessService.isAccessAllowedForUrl(
+        providerId,
+        sessions[0].account.label,
+        options.mcpServerId,
+        options.mcpServerUrl
+    )) {
+        return sessions[0];
+    }
+    return undefined;
+}
+async function authenticateMcpSession(
+    providerId,
+    session,
+    scopes,
+    authenticationMcpAccessService,
+    authenticationMcpService,
+    authenticationMcpUsageService,
+    logService,
+    options,
+    updateAccess,
+    agentHost
+) {
+    await forwardAuthenticationToken(options, options.mcpServerUrl, scopes, session);
+    if (updateAccess) {
+        authenticationMcpAccessService.updateAllowedMcpServers(providerId, session.account.label, [{
+            id: options.mcpServerId,
+            name: options.mcpServerName,
+            allowed: true,
+            url: options.mcpServerUrl,
+            agentHost
+        }]);
+        authenticationMcpService.updateAccountPreference(options.mcpServerId, providerId, session.account);
+    }
+    authenticationMcpUsageService.addAccountUsage(
+        providerId,
+        session.account.label,
+        scopes,
+        options.mcpServerId,
+        options.mcpServerName
+    );
+    logService.info(
+        `${options.logPrefix} MCP authentication succeeded for ${options.mcpServerName}`
+    );
+}
+
+export { AgentHostAuthTokenCache, AgentHostAuthenticationRecovery, agentHostMcpServerId, authenticateAgentProtectedResourcesWithToken, authenticateProtectedResources, authenticateProtectedResourcesWithToken, autoAuthenticateMcpServer, modelRequiresAgentAuthentication, resolveAuthenticationInteractively, resolveMcpServerAuthentication, resolveSessionForResource, revokeAuthenticationForRemovedSessions };