@codingame/monaco-vscode-api 37.6.1 → 38.0.0

package/vscode/src/vs/platform/agentHost/common/remoteAgentHostService.js

@@ -311,8 +311,24 @@ var RemoteAgentHostInputValidationError;
 class NullRemoteAgentHostService {
     constructor() {
         this.onDidChangeConnections = Event.None;
+        this.onDidChangeDisplayName = Event.None;
+        this.onDidChangePendingConnections = Event.None;
+        this.pendingConnections = [];
         this.connections = [];
         this.configuredEntries = [];
+        this.onDidChangeConfiguredEntries = Event.None;
+    }
+    getConnectionDiagnostics() {
+        return [];
+    }
+    getDisplayNameOverride() {
+        return undefined;
+    }
+    setDisplayName() {
+        throw ( new Error("Remote agent host display names are not supported in this environment."));
+    }
+    registerDisplayName() {
+        throw ( new Error("Remote agent host display names are not supported in this environment."));
     }
     registerConnectionFactory() {
         throw ( new Error("Remote agent host connections are not supported in this environment."));

package/vscode/src/vs/platform/agentHost/common/remoteAgentHostService.service.d.ts

@@ -1,7 +1,9 @@
 import { IDisposable } from "../../../base/common/lifecycle.js";
+import { IObservable } from "../../../base/common/observable.js";
 import { Event } from "../../../sessions/sessions.web.main.internal.js";
 import { IAgentConnection } from "./agentService.js";
-import { IRemoteAgentHostConnectionInfo, IRemoteAgentHostEntry, IRemoteAgentHostConnectionFactory } from "./remoteAgentHostService.js";
+import { IRemoteConnectionDiagnosticEvent } from "./connectionDiagnostics.js";
+import { IRemoteAgentHostPendingConnection, IRemoteAgentHostConnectionInfo, IRemoteAgentHostEntry, IRemoteAgentHostConnectionFactory } from "./remoteAgentHostService.js";
 import { IVscodeUpgradeResult } from "./state/protocolUpgrade.js";
 export declare const IRemoteAgentHostService: import("../../instantiation/common/instantiation.js").ServiceIdentifier<IRemoteAgentHostService>;
 /**
@@ -10,8 +12,21 @@ export declare const IRemoteAgentHostService: import("../../instantiation/common
 */
 export interface IRemoteAgentHostService {
     readonly _serviceBrand: undefined;
-    /** Fires when a remote connection is established or lost. */
+    getConnectionDiagnostics(): readonly IRemoteConnectionDiagnosticEvent[];
+    /** In-flight setup and protocol connection attempts for enabled, configured hosts; excludes removed or disposed hosts even if setup has not settled. */
+    readonly pendingConnections: readonly IRemoteAgentHostPendingConnection[];
+    /** Signals that consumers should re-read pendingConnections, including after configuration reconciliation; the catalog may be unchanged. */
+    readonly onDidChangePendingConnections: Event<void>;
+    /** Fires when remote connections change; client-local renames only fire {@link onDidChangeDisplayName}. */
     readonly onDidChangeConnections: Event<void>;
+    /** Fires with the normalized address when its client-local display name changes. */
+    readonly onDidChangeDisplayName: Event<string>;
+    /** Gets the client-local display-name override, or undefined to use the configured or discovered name. */
+    getDisplayNameOverride(address: string): string | undefined;
+    /** Sets a machine-local display-name override. An empty or undefined name restores the default. */
+    setDisplayName(address: string, name: string | undefined): void;
+    /** Delegates local labels to an inventory owner with its own account/profile persistence. */
+    registerDisplayName(address: string, name: IObservable<string | undefined>, setName: (name: string | undefined) => void): IDisposable;
     /**
     * Known remote addresses with metadata. This is a status catalog, not a
     * liveness list: an entry is retained after a failed dial so its
@@ -22,6 +37,8 @@ export interface IRemoteAgentHostService {
     readonly connections: readonly IRemoteAgentHostConnectionInfo[];
     /** All remote agent host entries exposed by registered factories, regardless of connection status. */
     readonly configuredEntries: readonly IRemoteAgentHostEntry[];
+    /** Fires when the configured entries change, independently of connection attempts. */
+    readonly onDidChangeConfiguredEntries: Event<void>;
     /** Registers a factory for one connection kind. Throws if that kind already has one. */
     registerConnectionFactory(factory: IRemoteAgentHostConnectionFactory): IDisposable;
     /**

package/vscode/src/vs/platform/agentHost/common/serverToolNames.d.ts

@@ -15,6 +15,7 @@ export declare enum SessionServerToolName {
     ListSessions = "list_sessions",
     GetCurrentSession = "get_current_session",
     SetWorkspace = "set_workspace",
+    IsolateSession = "isolate_session",
     CreateSession = "create_session",
     CreateChat = "create_chat",
     RenameChat = "rename_chat",
@@ -22,8 +23,14 @@ export declare enum SessionServerToolName {
     GetSessionContext = "get_session_context",
     DeleteSession = "delete_session"
 }
-/** Names of the artifact server tools, shared between `common/` and `node/`. */
-export declare enum ArtifactServerToolName {
+/**
+ * Whether {@link toolName} (a tool name as seen on a tool call) refers to
+ * {@link SessionServerToolName.RenameChat}. Accepts both the bare name, as the
+ * agent sees it under Copilot, and the Claude `mcp__<server>__<name>` prefixed
+ * form — the same shape the feedback-annotation predicates accept.
+ */
+export declare function isRenameChatTool(toolName: string): boolean;
+/** Names of the artifact server tools, shared between `common/` and `node/`. */ export declare enum ArtifactServerToolName {
     AddArtifactOrReference = "add_artifact_or_reference",
     RemoveArtifactOrReference = "remove_artifact_or_reference",
     ListArtifactsAndReferences = "list_artifacts_and_references"

package/vscode/src/vs/platform/agentHost/common/serverToolNames.js

@@ -5,6 +5,7 @@ var SessionServerToolName;
     SessionServerToolName["ListSessions"] = "list_sessions";
     SessionServerToolName["GetCurrentSession"] = "get_current_session";
     SessionServerToolName["SetWorkspace"] = "set_workspace";
+    SessionServerToolName["IsolateSession"] = "isolate_session";
     SessionServerToolName["CreateSession"] = "create_session";
     SessionServerToolName["CreateChat"] = "create_chat";
     SessionServerToolName["RenameChat"] = "rename_chat";
@@ -12,7 +13,7 @@ var SessionServerToolName;
     SessionServerToolName["GetSessionContext"] = "get_session_context";
     SessionServerToolName["DeleteSession"] = "delete_session";
 })(SessionServerToolName || (SessionServerToolName = {}));
-var ArtifactServerToolName;
+ var ArtifactServerToolName;
 (function(ArtifactServerToolName) {
     ArtifactServerToolName["AddArtifactOrReference"] = "add_artifact_or_reference";
     ArtifactServerToolName["RemoveArtifactOrReference"] = "remove_artifact_or_reference";

package/vscode/src/vs/platform/agentHost/common/sessionArtifacts.d.ts

@@ -1,9 +1,8 @@
 import type { SessionSummaryMeta } from "./state/sessionState.js";
 /**
- * The kinds an agent can record on its session, as either an artifact (the
- * session produced it) or a reference (the session found it worth returning
- * to). Each kind carries the one field the client needs to open it, plus a
- * label.
+ * The kinds an agent can record for a chat, as either an artifact (the chat
+ * produced it) or a reference (the chat found it worth returning to). Each kind
+ * carries the one field the client needs to open it, plus a label.
  */
 export declare enum SessionArtifactType {
     PullRequest = "pullRequest",
@@ -14,14 +13,16 @@ export declare enum SessionArtifactType {
     Resource = "resource"
 }
 export declare const SESSION_ARTIFACT_TYPES: readonly SessionArtifactType[];
-/** A session artifact or reference as stored by the host and published to clients. */
+/** A chat artifact or reference as stored by the host and published to clients. */
 export interface ISessionArtifact {
     readonly id: string;
+    /** Chat that recorded this entry. Older entries have no owner and default to the session's main chat. */
+    readonly chat?: string;
     readonly type: SessionArtifactType;
     readonly label: string;
     /**
-     * `true` for an artifact — something this session produced — and `false` for
-     * a reference, something it only points the user at.
+     * `true` for an artifact — something this chat produced — and `false` for a
+     * reference, something it only points the user at.
      */
     readonly isArtifact: boolean;
     /** Link for pull request, issue, commit and website entries. */
@@ -34,9 +35,9 @@ export interface ISessionArtifact {
     readonly isGitHub?: boolean;
 }
 /**
- * Reserved key under {@link SessionSummaryMeta} holding the session's agent-set
- * artifacts and references. VS Code convention layered on the protocol's
- * generic `_meta` bag.
+ * Reserved key under {@link SessionSummaryMeta} holding the aggregate artifacts
+ * and references recorded across the session's chats. VS Code convention
+ * layered on the protocol's generic `_meta` bag.
  */
 export declare const SESSION_META_ARTIFACTS_KEY = "agentHost/sessionArtifacts";
 /** Reads the artifacts recorded on a session's `_meta` bag. */

package/vscode/src/vs/platform/agentHost/common/sessionArtifacts.js

@@ -35,6 +35,9 @@ function parseSessionArtifact(value) {
     }
     const artifact = {
         id: raw["id"],
+        ...(typeof raw["chat"] === "string" ? {
+            chat: raw["chat"]
+        } : {}),
         type: raw["type"],
         label: raw["label"],
         isArtifact: isArtifact ?? true

package/vscode/src/vs/platform/agentHost/common/sessionConfigKeys.d.ts

@@ -16,7 +16,7 @@ export declare enum SessionConfigKey {
     AutoApprove = "autoApprove",
     /** `'permissions'` — per-tool session allow/deny lists. */
     Permissions = "permissions",
-    /** Persisted session sandbox selection; omitted or `default` follows the host default. */
+    /** Session sandbox selection; persistence records the successfully applied value. */
     SandboxEnabled = "sandboxEnabled",
     /** `'isolation'` — host-owned `'folder'` or `'worktree'` selection. */
     Isolation = "isolation",
@@ -26,20 +26,30 @@ export declare enum SessionConfigKey {
     Mode = "mode",
     /** `'worktreeBranchPrefix'` — host-owned prefix for the worktree branch name. */
     WorktreeBranchPrefix = "worktreeBranchPrefix",
-    /** `'worktreeIncludeFiles'` — host-owned glob patterns for files copied into a new worktree. */
+    /** `'worktreeIncludeFiles'` — host-owned `.gitignore`-syntax patterns for git-ignored files copied into a new worktree. */
     WorktreeIncludeFiles = "worktreeIncludeFiles",
-    /** `'worktreeBranchTrack'` — host-owned branch tracking preference for programmatic session creation. */
-    WorktreeBranchTrack = "worktreeBranchTrack",
-    /** `'worktreeCreateNewBranch'` — host-owned choice to create a branch instead of checking out the selected branch. */
-    WorktreeCreateNewBranch = "worktreeCreateNewBranch",
+    /** `'worktreeSymlinkFolders'` — host-owned `.gitignore`-syntax patterns for git-ignored folders symlinked into a new worktree. */
+    WorktreeSymlinkFolders = "worktreeSymlinkFolders",
+    /** `'pullRequestUrl'` — host-owned pull request the session is created from; implies worktree isolation. */
+    PullRequestUrl = "pullRequestUrl",
     /** `'agentMerge'` — client-owned Agent Merge enablement and session overrides. */
     AgentMerge = "agentMerge",
     /** `'agentMerge.controller'` — host-owned Agent Merge lifecycle state. */
     AgentMergeController = "agentMerge.controller",
+    /** `'agentMerge.folders'` — client-owned Agent Merge enablement and overrides per working-directory key. */
+    AgentMergeFolders = "agentMerge.folders",
+    /** `'agentMerge.controller.folders'` — host-owned Agent Merge lifecycle state per working-directory key. */
+    AgentMergeControllerFolders = "agentMerge.controller.folders",
+    /** `'agentMerge.injectedConfiguration'` — host-owned session-wide elevated configuration applied while any Agent Merge folder runs. */
+    AgentMergeInjectedConfiguration = "agentMerge.injectedConfiguration",
     /** `'shellInitScripts'` — scripts a client generated for the session, sourced before built-in shell tool commands. */
-    ShellInitScripts = "shellInitScripts"
+    ShellInitScripts = "shellInitScripts",
+    /** `'sensitiveEditLocations'` — workspace-relative client customization locations that must always require edit confirmation. */
+    SensitiveEditLocations = "sensitiveEditLocations"
 }
 export type SessionSandboxEnabled = "default" | "on" | "off";
+/** Returns the {@link SessionConfigKey.PullRequestUrl} a session is created from, if any. */
+export declare function getSessionPullRequestUrl(values: Readonly<Record<string, unknown>> | undefined): string | undefined;
 /**
  * The set of enum values the unified permission picker *tolerates* for the
  * {@link SessionConfigKey.AutoApprove} property when deciding whether a
@@ -61,7 +71,12 @@ export declare const KNOWN_MODE_VALUES: ReadonlySet<string>;
  * survive an Agent Host restart.
  */
 export declare function omitTransientSessionConfigValues<T>(values: Record<string, T>): Record<string, T>;
-/** Removes values owned by a concrete session or target rather than a reusable Automation template. */
+/** Persists confirmed sandbox enablement, retaining the stored selection until runtime confirmation is available. */
+export declare function getPersistedSessionConfigValues(values: Record<string, unknown>, appliedSandboxEnabled: boolean | undefined, persistedValues?: string): Record<string, unknown>;
+/**
+ * Removes values owned by a concrete session or target rather than a reusable Automation template.
+ * Sandbox selection stays so a saved preference survives reopening, and managed policy can still force it on at run time.
+ */
 export declare function omitAutomationSessionTemplateConfigValues<T>(values: Record<string, T>): Record<string, T>;
 /** Retains definition-owned values while an editor-facing Automation template is written back. */
 export declare function pickAutomationDefinitionOwnedConfigValues<T>(values: Readonly<Record<string, T>> | undefined): Record<string, T>;

package/vscode/src/vs/platform/agentHost/common/sessionConfigKeys.js

@@ -1,4 +1,5 @@
 
+import '../../../base/common/errors.js';
 
 var SessionConfigKey;
 (function(SessionConfigKey) {
@@ -10,11 +11,15 @@ var SessionConfigKey;
     SessionConfigKey["Mode"] = "mode";
     SessionConfigKey["WorktreeBranchPrefix"] = "worktreeBranchPrefix";
     SessionConfigKey["WorktreeIncludeFiles"] = "worktreeIncludeFiles";
-    SessionConfigKey["WorktreeBranchTrack"] = "worktreeBranchTrack";
-    SessionConfigKey["WorktreeCreateNewBranch"] = "worktreeCreateNewBranch";
+    SessionConfigKey["WorktreeSymlinkFolders"] = "worktreeSymlinkFolders";
+    SessionConfigKey["PullRequestUrl"] = "pullRequestUrl";
     SessionConfigKey["AgentMerge"] = "agentMerge";
     SessionConfigKey["AgentMergeController"] = "agentMerge.controller";
+    SessionConfigKey["AgentMergeFolders"] = "agentMerge.folders";
+    SessionConfigKey["AgentMergeControllerFolders"] = "agentMerge.controller.folders";
+    SessionConfigKey["AgentMergeInjectedConfiguration"] = "agentMerge.injectedConfiguration";
     SessionConfigKey["ShellInitScripts"] = "shellInitScripts";
+    SessionConfigKey["SensitiveEditLocations"] = "sensitiveEditLocations";
 })(SessionConfigKey || (SessionConfigKey = {}));
 const KNOWN_AUTO_APPROVE_VALUES = ( new Set(["default", "assisted", "autoApprove", "autopilot"]));
 const KNOWN_MODE_VALUES = ( new Set(["interactive", "plan", "autopilot"]));
@@ -23,19 +28,22 @@ function omitTransientSessionConfigValues(values) {
         ...values
     };
     delete result[SessionConfigKey.ShellInitScripts];
+    delete result[SessionConfigKey.SensitiveEditLocations];
     return result;
 }
 const automationDefinitionOwnedConfigKeys = [
     SessionConfigKey.Permissions,
-    SessionConfigKey.SandboxEnabled,
     SessionConfigKey.Isolation,
     SessionConfigKey.Branch,
     SessionConfigKey.WorktreeBranchPrefix,
     SessionConfigKey.WorktreeIncludeFiles,
-    SessionConfigKey.WorktreeBranchTrack,
-    SessionConfigKey.WorktreeCreateNewBranch,
+    SessionConfigKey.WorktreeSymlinkFolders,
+    SessionConfigKey.PullRequestUrl,
     SessionConfigKey.AgentMerge,
-    SessionConfigKey.AgentMergeController
+    SessionConfigKey.AgentMergeController,
+    SessionConfigKey.AgentMergeFolders,
+    SessionConfigKey.AgentMergeControllerFolders,
+    SessionConfigKey.AgentMergeInjectedConfiguration
 ];
 function omitAutomationSessionTemplateConfigValues(values) {
     const result = omitTransientSessionConfigValues(values);

package/vscode/src/vs/platform/agentHost/common/sessionConfigProperties.d.ts

@@ -0,0 +1,30 @@
+import type { SessionConfigPropertySchema, SessionConfigSchema } from "./state/protocol/commands.js";
+export type SessionApprovalLevel = "default" | "assisted" | "autoApprove";
+export type SessionWorkspaceTarget = "folder" | "worktree";
+export interface ISessionConfigProperty {
+    readonly key: string;
+    readonly schema: SessionConfigPropertySchema;
+}
+/** A published VS Code key wins even if its shape requires the generic picker. */
+export declare function getSessionApprovalProperty(schema: SessionConfigSchema | undefined): ISessionConfigProperty | undefined;
+export declare function getSessionModeProperty(schema: SessionConfigSchema | undefined): ISessionConfigProperty | undefined;
+export declare function getSessionIsolationProperty(schema: SessionConfigSchema): ISessionConfigProperty | undefined;
+export declare function getSessionBaseBranchProperty(schema: SessionConfigSchema): ISessionConfigProperty | undefined;
+export declare function getSessionWorkspaceProperties(schema: SessionConfigSchema): {
+    isolationKey: string;
+    baseBranchKey: string;
+    isolation: ISessionConfigProperty | undefined;
+    baseBranch: ISessionConfigProperty | undefined;
+};
+/** Reuses existing controls without renaming the host's properties or confusing its two branch fields. */
+export declare function getSessionConfigPresentationKey(key: string, schema: SessionConfigSchema): string;
+export declare function readSessionApprovalLevel(property: ISessionConfigProperty | undefined, value: unknown): SessionApprovalLevel | undefined;
+export declare function writeSessionApprovalLevel(property: ISessionConfigProperty | undefined, level: string): string | undefined;
+export declare function readSessionIsolation(property: ISessionConfigProperty | undefined, value: unknown): SessionWorkspaceTarget | undefined;
+export declare function writeSessionIsolation(property: ISessionConfigProperty | undefined, isolation: string): string | undefined;
+export declare function getAvailableSessionApprovalValues(property: ISessionConfigProperty, schema: SessionConfigSchema, values: Readonly<Record<string, unknown>>): readonly string[];
+export declare function getEffectiveSessionApprovalValue(property: ISessionConfigProperty, schema: SessionConfigSchema, values: Readonly<Record<string, unknown>>): unknown;
+export declare function isSessionConfigWritable(schema: SessionConfigPropertySchema | undefined, isNewSession: boolean): boolean;
+export declare function validateSessionConfigWrite(schema: SessionConfigSchema, values: Readonly<Record<string, unknown>>, key: string, value: unknown, isNewSession: boolean): void;
+/** Retains advertised inputs without inventing defaults, renaming aliases, or forwarding approval reports. */
+export declare function filterSessionConfigValues(schema: SessionConfigSchema, values: Readonly<Record<string, unknown>> | undefined, isNewSession?: boolean): Record<string, unknown>;

package/vscode/src/vs/platform/agentHost/common/sessionConfigProperties.js

@@ -0,0 +1,100 @@
+
+import { isString } from '../../../base/common/types.js';
+import { SessionConfigKey, KNOWN_AUTO_APPROVE_VALUES, KNOWN_MODE_VALUES } from './sessionConfigKeys.js';
+
+const copilotApprovalValues = ( new Set(["manual", "assisted", "allow-all"]));
+const vscodeIsolationValues = ( new Set(["folder", "worktree"]));
+const copilotIsolationValues = ( new Set(["workspace", "worktree"]));
+function getEnumProperty(schema, key, values, required) {
+    const property = schema?.properties[key];
+    return property?.type === "string" && !property.enumDynamic && Array.isArray(property.enum) && property.enum.includes(required) && property.enum.every(value => isString(value) && ( values.has(value))) ? {
+        key,
+        schema: property
+    } : undefined;
+}
+function getSessionApprovalProperty(schema) {
+    return schema && Object.hasOwn(schema.properties, SessionConfigKey.AutoApprove) ? getEnumProperty(schema, SessionConfigKey.AutoApprove, KNOWN_AUTO_APPROVE_VALUES, "default") : getEnumProperty(schema, "approvalMode", copilotApprovalValues, "manual");
+}
+function getSessionModeProperty(schema) {
+    return getEnumProperty(schema, SessionConfigKey.Mode, KNOWN_MODE_VALUES, "interactive");
+}
+function usesVSCodeWorkspaceProperties(schema) {
+    return Object.hasOwn(schema.properties, SessionConfigKey.Isolation) || (!Object.hasOwn(schema.properties, "target") && !Object.hasOwn(schema.properties, "baseBranch"));
+}
+function getSessionIsolationProperty(schema) {
+    return usesVSCodeWorkspaceProperties(schema) ? getEnumProperty(schema, SessionConfigKey.Isolation, vscodeIsolationValues, "folder") : getEnumProperty(schema, "target", copilotIsolationValues, "workspace");
+}
+function getSessionBaseBranchProperty(schema) {
+    const key = usesVSCodeWorkspaceProperties(schema) ? SessionConfigKey.Branch : "baseBranch";
+    const property = schema.properties[key];
+    return property?.type === "string" && (property.enumDynamic || property.enum?.every(isString)) ? {
+        key,
+        schema: property
+    } : undefined;
+}
+function getSessionWorkspaceProperties(schema) {
+    const vscode = usesVSCodeWorkspaceProperties(schema);
+    return {
+        isolationKey: vscode ? SessionConfigKey.Isolation : "target",
+        baseBranchKey: vscode ? SessionConfigKey.Branch : "baseBranch",
+        isolation: getSessionIsolationProperty(schema),
+        baseBranch: getSessionBaseBranchProperty(schema)
+    };
+}
+function getSessionConfigPresentationKey(key, schema) {
+    const workspace = getSessionWorkspaceProperties(schema);
+    return key === workspace.isolation?.key ? SessionConfigKey.Isolation : key === workspace.baseBranch?.key ? SessionConfigKey.Branch : key === SessionConfigKey.Branch && !usesVSCodeWorkspaceProperties(schema) ? "newBranch" : key;
+}
+function readSessionApprovalLevel(property, value) {
+    const level = property?.key === "approvalMode" ? value === "manual" ? "default" : value === "allow-all" ? "autoApprove" : value : value;
+    return isString(value) && property?.schema.enum?.includes(value) && (level === "default" || level === "assisted" || level === "autoApprove") ? level : undefined;
+}
+function writeSessionApprovalLevel(property, level) {
+    const value = property?.key === "approvalMode" ? level === "default" ? "manual" : level === "autoApprove" ? "allow-all" : level : level;
+    return readSessionApprovalLevel(property, value) === level ? value : undefined;
+}
+function readSessionIsolation(property, value) {
+    const isolation = property?.key === "target" && value === "workspace" ? "folder" : value;
+    return isString(value) && property?.schema.enum?.includes(value) && (isolation === "folder" || isolation === "worktree") ? isolation : undefined;
+}
+function writeSessionIsolation(property, isolation) {
+    const value = property?.key === "target" && isolation === "folder" ? "workspace" : isolation;
+    return readSessionIsolation(property, value) === isolation ? value : undefined;
+}
+function getAvailableSessionApprovalValues(property, schema, values) {
+    const offered = (property.schema.enum ?? []).filter(
+        value => isString(value) && readSessionApprovalLevel(property, value) !== undefined
+    );
+    const available = values.availableApprovalModes;
+    return schema.properties.availableApprovalModes?.type === "array" && schema.properties.availableApprovalModes.readOnly === true && Array.isArray(available) ? offered.filter(value => available.includes(value)) : offered;
+}
+function getEffectiveSessionApprovalValue(property, schema, values) {
+    return schema.properties.effectiveApprovalMode?.type === "string" && schema.properties.effectiveApprovalMode.readOnly === true && isString(values.effectiveApprovalMode) ? values.effectiveApprovalMode : values[property.key] ?? property.schema.default;
+}
+function isSessionConfigWritable(schema, isNewSession) {
+    return !!schema && !schema.readOnly && (isNewSession || schema.sessionMutable === true);
+}
+function getSessionConfigWriteError(schema, values, key, value, isNewSession) {
+    const property = schema.properties[key];
+    if (!property || (!isNewSession && property.sessionMutable !== true) || (key === "approvalMode" && Object.hasOwn(schema.properties, SessionConfigKey.AutoApprove)) || ((key === "target" || key === "baseBranch") && usesVSCodeWorkspaceProperties(schema))) {
+        return `Session configuration '${key}' is not writable.`;
+    }
+    const approval = getSessionApprovalProperty(schema);
+    if ((approval?.key === key && (!isString(value) || !getAvailableSessionApprovalValues(approval, schema, values).includes(value))) || (value !== undefined && property.enum?.length && !property.enumDynamic && !( property.enum.some(candidate => candidate === value)))) {
+        return `Session configuration '${key}' does not offer '${String(value)}'.`;
+    }
+    return undefined;
+}
+function validateSessionConfigWrite(schema, values, key, value, isNewSession) {
+    const error = getSessionConfigWriteError(schema, values, key, value, isNewSession);
+    if (error) {
+        throw ( new Error(error));
+    }
+}
+function filterSessionConfigValues(schema, values, isNewSession = true) {
+    return Object.fromEntries(Object.entries(values ?? {}).filter(
+        ([key, value]) => value !== undefined && !((key === "availableApprovalModes" || key === "effectiveApprovalMode") && schema.properties[key]?.readOnly) && !getSessionConfigWriteError(schema, values ?? {}, key, value, isNewSession)
+    ));
+}
+
+export { filterSessionConfigValues, getAvailableSessionApprovalValues, getEffectiveSessionApprovalValue, getSessionApprovalProperty, getSessionBaseBranchProperty, getSessionConfigPresentationKey, getSessionIsolationProperty, getSessionModeProperty, getSessionWorkspaceProperties, isSessionConfigWritable, readSessionApprovalLevel, readSessionIsolation, validateSessionConfigWrite, writeSessionApprovalLevel, writeSessionIsolation };

package/vscode/src/vs/platform/agentHost/common/sshRemoteAgentHost.d.ts

@@ -177,15 +177,18 @@ export declare function isSSHStrictHostKeyChecking(value: string): value is SSHS
  */
 export interface ISSHResolvedConfig {
     readonly hostname: string;
+    /** Host identity used for host-key lookup and storage instead of {@link hostname}. */
+    readonly hostKeyAlias?: string;
     readonly user: string | undefined;
     readonly port: number;
     readonly identityFile: string[];
     readonly identityAgent: string | undefined;
+    /** Command providing the raw SSH connection over standard input/output. */
+    readonly proxyCommand?: string;
     readonly forwardAgent: boolean;
     /**
-     * `UserKnownHostsFile` paths, in priority order. `ssh -G` emits these as a
-     * single space-separated list, so this is already split. Typically
-     * `~/.ssh/known_hosts` and `~/.ssh/known_hosts2`.
+     * `UserKnownHostsFile` paths, in priority order. The node service recovers
+     * unquoted paths containing spaces only when filesystem matches are unambiguous.
      */
     readonly userKnownHostsFiles: string[];
     /** `GlobalKnownHostsFile` paths, e.g. `/etc/ssh/ssh_known_hosts`. */
@@ -275,7 +278,7 @@ export type ISSHEndpointSelection = {
  * `KnownHostsMatch` in `../node/sshKnownHosts.js`, redeclared here because
  * this common-layer module cannot import from `node`.
  */
-export type SSHKnownHostsMatch = "match" | "mismatch" | "revoked" | "ca-only" | "unknown";
+export type SSHKnownHostsMatch = "match" | "mismatch" | "other-key-type" | "revoked" | "ca-only" | "unknown";
 /**
  * Error name for a connect attempt refused because the server's host key was
  * not trusted. Matching on the name (rather than `instanceof`) is deliberate:
@@ -318,8 +321,10 @@ export interface ISSHHostKeyVerificationRequest {
     readonly connectionKey: string;
     /** Display-friendly host (e.g. SSH config alias or `user@host`). */
     readonly displayHost: string;
-    /** Resolved hostname the key was presented for. */
+    /** Effective host-key identity: `HostKeyAlias` when configured, otherwise the resolved hostname. */
     readonly host: string;
+    /** Resolved connection hostname, used to consult trust stored before `HostKeyAlias` was supported. */
+    readonly resolvedHost: string;
     readonly port: number;
     /** Host key algorithm, e.g. `ssh-ed25519`. */
     readonly keyType: string;

package/vscode/src/vs/platform/agentHost/common/sshRemoteAgentHost.js

@@ -6,9 +6,14 @@ var SSHAuthMethod;
     SSHAuthMethod["KeyFile"] = "keyFile";
     SSHAuthMethod["Password"] = "password";
 })(SSHAuthMethod || (SSHAuthMethod = {}));
+function computeSSHConnectionKey(config) {
+    return config.sshConfigHost
+        ? `ssh:${config.sshConfigHost}`
+        : `${config.username}@${config.host}:${config.port ?? 22}`;
+}
 const SSH_HOST_KEY_DENIED_ERROR_NAME = 'SSHHostKeyDenied';
 function isSSHHostKeyDeniedError(error) {
     return error instanceof Error && error.name === SSH_HOST_KEY_DENIED_ERROR_NAME;
 }
 
-export { SSHAuthMethod, SSH_HOST_KEY_DENIED_ERROR_NAME, isSSHHostKeyDeniedError };
+export { SSHAuthMethod, SSH_HOST_KEY_DENIED_ERROR_NAME, computeSSHConnectionKey, isSSHHostKeyDeniedError };

package/vscode/src/vs/platform/agentHost/common/sshRemoteAgentHost.service.d.ts

@@ -79,6 +79,8 @@ export interface ISSHRemoteAgentHostMainService {
     readonly onDidReportConnectProgress: Event<ISSHConnectProgress>;
     /** Fires when a message is received from a remote agent host via the SSH relay. */
     readonly onDidRelayMessage: Event<IRelayMessage>;
+    /** Fires with a connection ID while that SSH relay receives part of a message. */
+    readonly onDidRelayActivity: Event<string>;
     /** Fires when a relay connection to a remote agent host closes. */
     readonly onDidRelayClose: Event<string>;
     /**
@@ -148,12 +150,18 @@ export interface ISSHRemoteAgentHostMainService {
     /**
     * Bootstrap a remote agent host over SSH. Returns serializable
     * connection info for the renderer to register.
+    *
+    * @param expectedConnectionId The caller's current relay lease. When it is
+    * supplied, concurrent renewal of that lease coalesces and a stale lease
+    * resolves to its current replacement.
     */
-    connect(config: ISSHAgentHostConfig): Promise<ISSHConnectResult>;
+    connect(config: ISSHAgentHostConfig, expectedConnectionId?: string): Promise<ISSHConnectResult>;
     /**
     * Send a message to a remote agent host through the SSH relay.
     */
     relaySend(connectionId: string, message: string): Promise<void>;
+    /** Release one renderer-owned relay lease; the shared SSH session closes after its final lease is released. */
+    releaseRelay(connectionId: string): Promise<void>;
     /**
     * Disconnect an SSH-bootstrapped connection by host address.
     */
@@ -180,5 +188,5 @@ export interface ISSHRemoteAgentHostMainService {
     * The renderer computes this from its stored preference for this host's
     * {@link computeSSHConnectionKey stable key} before calling reconnect.
     */
-    reconnect(sshConfigHost: string, name: string, remoteAgentHostCommand?: string, agentForward?: boolean, userInitiated?: boolean, preferredAgentLocation?: RemoteAgentHostLocationPreference): Promise<ISSHConnectResult>;
+    reconnect(sshConfigHost: string, name: string, remoteAgentHostCommand?: string, agentForward?: boolean, userInitiated?: boolean, preferredAgentLocation?: RemoteAgentHostLocationPreference, expectedConnectionId?: string): Promise<ISSHConnectResult>;
 }

package/vscode/src/vs/platform/agentHost/common/state/agentSubscription.d.ts

@@ -3,6 +3,7 @@ import { Disposable, IReference } from "../../../../base/common/lifecycle.js";
 import { IObservable } from "../../../../base/common/observable.js";
 import { URI } from "../../../../base/common/uri.js";
 import { ActionEnvelope, ChatAction, AnnotationsAction, ClientAnnotationsAction, type ClientAutomationAction, type ClientAutomationRunAction, ClientChangesetAction, IRootConfigChangedAction, SessionAction, StateAction } from "./sessionActions.js";
+import type { CanvasState } from "./protocol/channels-canvas/state.js";
 import type { TerminalAction } from "./protocol/action-origin.generated.js";
 import type { AnnotationsState, AutomationRunState, AutomationState, ChangesetState, ChatState, RootState, SessionState, TerminalState } from "./protocol/state.js";
 import type { IStateSnapshot } from "./sessionProtocol.js";
@@ -131,6 +132,7 @@ declare abstract class BaseAgentSubscription<T> extends Disposable implements IA
     protected _getOptimisticState(): T | undefined;
     /** Hook called after a snapshot is applied. Replays buffered actions. */
     protected _onSnapshotApplied(_fromSeq: number): void;
+    protected _acknowledgeSnapshotAction(_clientSeq: number): void;
     /**
      * Default reconciliation: apply to confirmed, fire change event.
      * Session subscriptions override this for write-ahead.
@@ -192,6 +194,7 @@ export declare class SessionStateSubscription extends BaseAgentSubscription<Sess
      * by the server.
      */
     getPendingActions(): IPendingDispatchAction[];
+    protected _acknowledgeSnapshotAction(clientSeq: number): void;
     /**
      * Drop the pending entry whose `clientSeq` matches the supplied value.
      * Used during reconnect to evict actions the server already echoed back
@@ -228,6 +231,7 @@ export declare class ChatStateSubscription extends BaseAgentSubscription<ChatSta
     private _recomputeOptimistic;
     clearPending(): void;
     getPendingActions(): IPendingDispatchAction[];
+    protected _acknowledgeSnapshotAction(clientSeq: number): void;
     dropPendingByClientSeq(clientSeq: number): boolean;
 }
 /**
@@ -255,6 +259,13 @@ export declare class AutomationRunSubscription extends BaseAgentSubscription<Aut
     protected _isRelevantEnvelope(envelope: ActionEnvelope): boolean;
     protected _reconcile(envelope: ActionEnvelope, isOwnAction: boolean): void;
 }
+/** Server-authoritative subscription to an advertised canvas resource. */
+export declare class CanvasStateSubscription extends BaseAgentSubscription<CanvasState> {
+    private readonly _resource;
+    constructor(_resource: string, clientId: string, log: (msg: string) => void);
+    protected _applyReducer(state: CanvasState, action: StateAction): CanvasState;
+    protected _isRelevantEnvelope(envelope: ActionEnvelope): boolean;
+}
 /**
  * Subscription to a changeset at an expanded changeset URI (e.g.
  * `<sessionUri>/changeset/session`).
@@ -312,6 +323,7 @@ export declare class AnnotationsStateSubscription extends BaseAgentSubscription<
     private _recomputeOptimistic;
     clearPending(): void;
     getPendingActions(): IPendingDispatchAction[];
+    protected _acknowledgeSnapshotAction(clientSeq: number): void;
     dropPendingByClientSeq(clientSeq: number): boolean;
 }
 /**
@@ -347,6 +359,8 @@ export declare class AgentSubscriptionManager extends Disposable {
      * Returns `undefined` if no subscription is active for the given resource.
      */
     getSubscriptionUnmanaged<T>(resource: URI): IAgentSubscription<T> | undefined;
+    /** Re-read a held channel without unsubscribing or discarding pending local actions. */
+    refreshSubscription(resource: URI): Promise<void>;
     /**
      * Returns the in-flight `createSession` Promise for this URI, or `undefined` if no create is pending. Used by
      * callers that need to gate their own work on a still-running eager `createSession` (e.g. the chat handler awaits