[Christof Marti (chrmarti)]

Adds HTTPS Git credential forwarding from the workspace host to the Agent Host and its harnesses inside a Dev Container.

• Adds chat.agentHost.devContainer.gitCredentialForwarding with off, prompt (default), and on.
• Defers consent until the first HTTPS credential lookup. The informational approval appears above the owning container's chat input, using the existing notice widget, keyboard actions, announcements, and focus restoration. It takes precedence over ordinary warnings without warning styling.
• Pending consent presents non-archived chats on that container connection as waiting for input and prevents inactivity shutdown, including terminal-originated lookups. There is no popup or automatic navigation, and no arbitrary approval deadline.
• Concurrent requests share one approval. Approvals and denials apply to the shared container and are remembered only for the current VS Code run. Canceling a credential client removes its waiter without affecting another live lookup; canceling the last waiter removes the notice.
• Gates every host credential read on an owning-connection permission response. Denial, cancellation, and disconnect fail closed. Changing the setting to off revokes live relays. Helper startup and actual host credential reads remain bounded.
• Uses the host's existing Git credential helpers over exec stdio without copying credential stores or persisting/logging credential values. SSH-agent forwarding and credential-store mutations are excluded.
• Adds a separate vscode.devContainers.gitCredentials capability for SSH, Tunnel, and WSL source hosts. Older hosts remain usable with forwarding off.

The approval notice explicitly explains that credentials are available to all sessions and processes in the shared container, not isolated per chat session. Container recreation, restarting VS Code, or changing the setting requires a new decision on the next lookup.

Review and CI fixes

• Optional helper installation failures (missing Git or read-only global config) are reported without preventing a container session from connecting. Cancellation and unsupported source-host capabilities still fail explicitly.
• Canceled helper startup releases the workspace operation queue even if its child process remains alive.
• Canceled permission requests settle their response promises and propagate cancellation through the relay, remote protocol, and owning renderer.
• Shared approvals track independent waiters, so canceling one lookup does not deny another live lookup.
• The remote permission round-trip regression is registered independently at suite level.
• The handshake expectation includes the new capability, and connection-only remote container smoke scenarios disable forwarding because their published source hosts can predate this optional capability.
• Startup removes recognized stale helper entries while preserving unrelated helpers and live relays. Guarded helpers avoid Node loader errors if a temporary script has disappeared.
• The latest completed CI run passed compilation/hygiene, fixture tests/screenshots, all three Electron unit platforms, and the Dev Container smoke scenarios. Its Linux smoke job exceeded the 20-minute job deadline with 66 tests passing and no assertion failures; no unrelated test or timeout configuration was changed.

How to test

1. Use a local, SSH, Tunnel, or WSL workspace with a Dev Container and a private HTTPS Git remote whose credentials are available through the workspace host's Git helpers.
2. With the setting at prompt, start a container session. No credential approval should appear until an operation requests credentials.
3. Run an authenticated Git operation in the container, including from a terminal. Confirm the container's chats show waiting for input without opening a popup or navigating to Chat.
4. Visit a matching chat and confirm the informational approval appears above the input even when another warning is active. Unrelated chats must not show it. Allow lets the operation proceed, and subsequent lookups reuse the decision. Use Shift+Tab and Enter/Space to operate the buttons.
5. Leave the approval pending beyond five minutes: it must remain pending and the container must not stop for inactivity. Cancel the Git process and confirm its waiter is removed; a concurrent live request must remain pending.
6. Restart VS Code and decline the first lookup. Confirm subsequent requests fail without repeated prompts.
7. Switch to on to enable forwarding without an approval notice; switch to off to revoke it.
8. Repeat with reconnection, a newly recreated container, archived chats, and another live helper.

Validation

• npm run typecheck-client - passed.

• npm run valid-layers-check - passed.

• git diff --check - passed.

• Incremental client transpilation using the existing build/next/transpile.ts helper - passed.

• Scoped hygiene (including formatting and lint) - passed, 20 changed TypeScript files:

  $files = @(git ls-files --modified --others --exclude-standard) | Where-Object { $_ -like '*.ts' } | ForEach-Object { $_.Replace('/', '\') }
  node build\hygiene.ts $files

• Targeted regression suites - 430 passed, 1 platform-specific test skipped:

  $env:VSCODE_SKIP_PRELAUNCH = '1'
  & .\scripts\test.bat --run src\vs\platform\agentHost\test\node\devContainerAgentHostService.test.ts --run src\vs\platform\agentHost\test\node\devContainerGitCredentialRelay.test.ts --run src\vs\platform\agentHost\test\node\devContainerAgentHostProtocol.test.ts --run src\vs\sessions\contrib\providers\remoteAgentHost\test\browser\devContainerAgentHostService.test.ts --run src\vs\sessions\contrib\providers\remoteAgentHost\test\browser\remoteAgentHostSessionsProvider.test.ts --run src\vs\sessions\contrib\providers\remoteAgentHost\test\browser\devContainerGitCredentialForwarding.test.ts --run src\vs\sessions\contrib\providers\remoteAgentHost\test\electron-browser\devContainerAgentHostConnector.test.ts --run src\vs\workbench\contrib\chat\test\browser\widget\input\chatInputNotificationWidget.test.ts --run src\vs\workbench\contrib\chat\test\browser\agentSessions\agentHostSandboxNotification.test.ts

  Tests use Electron 43.7.7 and include real Git/helper subprocess round trips, approval-before-host-read checks, waits exceeding six minutes under virtual time, inactivity protection and a fresh grace period after consent, preserved host status, main/peer/archived chat presentation, informational approval priority over warnings, relay client cancellation, independent waiters, denial/revocation, optional setup failures, and remote protocol ownership/capabilities.

• Real Windows Code OSS dev build and existing Docker container - passed: a synthetic HTTPS request for example.invalid showed a visible informational approval with Allow/Don't Allow actions above the matching chat input despite the active sandbox warning; the session displayed Attention Needed. Canceling the synthetic lookup restored Completed without reading host credentials. The same isolated authenticated profile was preserved.

• Earlier core compilation (npm run gulp compile-client), smoke-test compilation (npm --prefix test\smoke run compile), and four dark/light, normal/narrow approval fixtures - passed before these lifecycle fixes. The full smoke suite was not rerun locally.

No linked issue was supplied; this change was requested in the development session.

[Copilot]

🟡 Changes recommended

Helper initialization and cancellation handling can block container use or fail otherwise valid concurrent credential requests.

5 open findings

• Git helper setup failure aborts container connection · New
• Relay cancellation leaves readiness promise pending · New
• Canceled lookup leaves response promise and timeout unsettled · New
• First canceled credential waiter rejects shared consent · New
• Nested round-trip test is not independently registered · New

What changed in this PR

Adds host-backed HTTPS Git credential forwarding for Dev Container Agent Hosts across local, SSH, Tunnel, and WSL workspaces.

Changes:

• Adds deferred, container-wide consent with off, prompt, and on modes.
• Introduces credential relays, permission messages, and capability negotiation.
• Adds documentation and regression coverage.

File	Description
src/​vs/​sessions/​contrib/​providers/​remoteAgentHost/​test/​electron-browser/​devContainerAgentHostConnector.test.ts	Tests connector consent integration.
src/​vs/​sessions/​contrib/​providers/​remoteAgentHost/​test/​browser/​devContainerGitCredentialForwarding.test.ts	Tests consent and revocation.
src/​vs/​sessions/​contrib/​providers/​remoteAgentHost/​REMOTE_AGENT_HOST_SESSIONS_PROVIDER.md	Documents forwarding behavior.
src/​vs/​sessions/​contrib/​providers/​remoteAgentHost/​electron-browser/​devContainerAgentHostConnector.contribution.ts	Registers settings and connects forwarding.
src/​vs/​sessions/​contrib/​providers/​remoteAgentHost/​browser/​devContainerGitCredentialForwarding.ts	Manages consent decisions.
src/​vs/​sessions/​common/​devContainerAgentHostService.ts	Defines the setting identifier.
src/​vs/​platform/​agentHost/​test/​node/​devContainerGitCredentialRelay.test.ts	Tests helper subprocess behavior.
src/​vs/​platform/​agentHost/​test/​node/​devContainerAgentHostService.test.ts	Tests permission-gated credential reads.
src/​vs/​platform/​agentHost/​test/​node/​devContainerAgentHostProtocol.test.ts	Adds protocol ownership checks.
src/​vs/​platform/​agentHost/​test/​common/​mockDevContainerService.ts	Extends forwarding mocks.
src/​vs/​platform/​agentHost/​node/​devContainerGitCredentialRelay.ts	Implements the credential relay.
src/​vs/​platform/​agentHost/​node/​devContainerAgentHostService.ts	Manages relays and host lookups.
src/​vs/​platform/​agentHost/​node/​devContainerAgentHostProtocol.ts	Handles forwarding requests.
src/​vs/​platform/​agentHost/​common/​meta/​vscode/​agentHostDevContainersMeta.ts	Defines capability detection.
src/​vs/​platform/​agentHost/​common/​meta/​agentHostDevContainersMeta.ts	Exports capability helpers.
src/​vs/​platform/​agentHost/​common/​devContainerAgentHostProtocolClient.ts	Routes permission messages.
src/​vs/​platform/​agentHost/​common/​devContainerAgentHost.ts	Extends service contracts.
src/​vs/​platform/​agentHost/​common/​agentHostExtensionProtocol.ts	Defines protocol messages and validators.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[github-actions]

Screenshot Changes

Base: f21d8cb4 Current: 8c8de4d3

Added (2)

sessions/devContainerGitCredentials/devContainerGitCredentialForwarding/Approval/Light

sessions/devContainerGitCredentials/devContainerGitCredentialForwarding/NarrowApproval/Light

[Miquel Camps (miquelcv)]

Hi Christof Marti (@chrmarti),

I came across this PR while following up on microsoft/vscode-remote-release#11899, which was closed as a duplicate of #340566.

Unfortunately, the issue is still reproducible in VS Code 1.143.0, specifically when using the Copilot Agent Host in Agents Window with a Dev Container (macOS ARM64, sandbox disabled).

I've verified the same Git HTTPS command in both windows, using the same Dev Container:

• Editor Window: REMOTE_CONTAINERS_IPC points to an available socket, and Git HTTPS authentication succeeds.
• Agents Window: REMOTE_CONTAINERS_IPC is unavailable, and Git HTTPS authentication fails with fatal: unable to get password from user.

The affected repository is hosted on Azure DevOps over HTTPS.

I noticed this PR introduces a dedicated Git credential forwarding mechanism for Dev Container Agent Host sessions.

Is this PR intended to address the scenario described in #11899, including Agents Window and non-GitHub HTTPS repositories such as Azure DevOps?

Thanks for your work on this!