Repository navigation
agentHost: use static SDK tokens for Mission Control credentials - #342201
Merged
Merged
Conversation
Pass captured Mission Control credentials as explicit SDK tokens so valid one-hour grants do not enter the provider's minimum-lifetime path. Preserve scoped expiry/revocation admission checks and legacy credential-provider behavior. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Dmitriy Vasyura (dmitrivMS)
approved these changes
Oct 16, 2026
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Short-lived-token behavior has not been revalidated against the currently bundled SDK, leaving an authentication-sensitive integration gap.
No open issues 🎉
What changed in this PR
Uses explicit SDK tokens for Mission Control’s short-lived credentials, following the credential-isolation work in #341455.
Changes:
- Replaces scoped token providers with static SDK tokens while preserving expiry and revocation checks.
- Updates tests for short-lived credentials, isolation, and safe-boundary rollover.
- Documents renewal limitations and unchanged legacy authentication behavior.
| File | Description |
|---|---|
| src/vs/platform/agentHost/test/node/copilotGitHubCredentials.test.ts | Tests static delivery and expired/revoked credential rejection. |
| src/vs/platform/agentHost/test/node/copilotAgent.test.ts | Checks scoped token isolation and rollover without providers. |
| src/vs/platform/agentHost/node/missionControl/MISSION_CONTROL.md | Documents static authentication and renewal limitations. |
| src/vs/platform/agentHost/node/copilot/copilotGitHubCredentials.ts | Supplies validated captured credentials through gitHubToken. |
Review effort: Balanced
Contributor
Screenshot ChangesBase: Changed (1)
|
| Before | After |
|---|---|
 |
 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #341455. Mission Control's scoped tokens have a one-hour lifetime, but the SDK token-provider path requires more than one hour remaining. Pass captured Mission Control credentials through the SDK's explicit
gitHubTokenoption instead.No new setting, SDK/runtime change, or token-market exchange in VS Code.
Validation
npm run gulp compile-client— passed, including client type-checking.npm run eslint -- src/vs/platform/agentHost/node/copilot/copilotGitHubCredentials.ts src/vs/platform/agentHost/test/node/copilotGitHubCredentials.test.ts src/vs/platform/agentHost/test/node/copilotAgent.test.ts— passed.env -u COPILOT_HOME ./scripts/test.sh --run src/vs/platform/agentHost/test/node/copilotGitHubCredentials.test.ts --run src/vs/platform/agentHost/test/node/copilotAgent.test.ts --run src/vs/platform/agentHost/test/node/copilotAgentSession.test.ts --run src/vs/platform/agentHost/test/node/copilotSessionLauncher.test.ts --grep 'CopilotGitHubCredentials|CopilotAgent scoped credentials|scoped credentials|materialization.*(GitHub|authentication|refreshable)|resumeSession relies on client authentication|updates GitHub credentials|CopilotSessionLauncher customization policy session' --reporter dot— 51 passed. An initial run with an agent-injectedCOPILOT_HOMEfailed the unchanged mock-storage-path assertion; removing that environment override restored the expected test environment.git diff origin/main...HEAD --check— passed.Repeated the real-token SDK session-creation probe after rebasing, using the currently bundled
@github/copilot-sdkversion1.0.23-preview.2: a fresh token reporting 3,599 seconds remaining successfully created a session through the changed captured-credential options, with no token provider and ambient authentication disabled. The isolated probe session was disconnected and its temporary profile removed. No live model turn, disconnected-expiry/renewal scenario, or full smoke suite was run locally.(Written by Copilot)