Add vscode-chat-response-resource:// URIs to allowlist to fix chat response resource reads

[Bestra]

In microsoft/vscode#308877 we're running into a problem where the resources from the GitHub MCP server (specifically for copilot spaces) come in under URIs like: vscode-chat-response-resource://...

These aren't part of the allowlist for readonly files so the model can't access them.

Summary

• centralize the read-only allowlist for URIs that are readable without workspace membership
• allow vscode-chat-response-resource URIs through both read-file access checks
• add regressions for unopened chat response resource reads

Testing

• npx vitest run src/extension/tools/node/test/toolUtils.spec.ts
• npx vitest run src/extension/tools/node/test/readFile.spec.tsx -t "reads chat response resources without requiring an open tab"

I also tested this locally in my Insiders instance using the launch copilot extension run and debug.

and it works swimmingly.

[Bestra]

I'll try this out locally before undrafting

[Bestra]

I've tested this out on my machine and it works, i've added a screenshot to the description. I think this is ready for review.

[Copilot]

Pull request overview

Centralizes the read-only allowlist logic in assertFileOkForTool and isFileExternalAndNeedsConfirmation into a shared helper, and adds vscode-chat-response-resource:// URIs to the allowlist so chat response resources (e.g. from GitHub MCP server for Copilot Spaces) can be read without requiring an open editor tab.

Changes:

• Extract allowlist checks into a single isUriAllowedWithoutWorkspaceMembership helper used by both access-check functions.
• Allow vscode-chat-response-resource scheme through read-only access checks.
• Add unit tests for the new behavior in toolUtils.spec.ts and readFile.spec.tsx.

Show a summary per file

File	Description
src/extension/tools/node/toolUtils.ts	Adds shared allowlist helper and routes both access-check entry points through it; allows vscode-chat-response-resource for read-only.
src/extension/tools/node/test/toolUtils.spec.ts	Adds regression tests for chat response resource allowlisting in read-only vs non-read-only mode.
src/extension/tools/node/test/readFile.spec.tsx	Adds regression that ReadFileTool.prepareInvocation works for chat response resources without an open tab.

Copilot's findings

• Files reviewed: 3/3 changed files
• Comments generated: 0

[Bestra]

Closing this PR, this has been fixed 🙇 microsoft/vscode@19d4617