[roblourens]

Upgrades the root and remote-server @github/copilot-sdk dependency from 1.0.17-preview.4 to 1.0.17-preview.5, with the SDK-bundled runtime pin updated to 1.0.92-5. Both lockfiles were regenerated by running npm install from the repository root, and their changes are confined to the SDK and its platform packages.

This is a follow-up to merged #339423, based on current main rather than extending the old PR.

SDK compatibility

Preview.5 adds AccountAuthInfo, a credential-free provider-owned account that exposes login directly and does not have copilotUser. Update connector account matching to read that login through the SDK's discriminant instead of assuming a Copilot-user payload. Parameterize the existing launcher test for token-callback and provider-owned accounts, including a different-login account that must not be selected. The initial SDK compilation error is resolved without casts or narrowed production types.

No E2E assertions, gates, fixtures, prompt baselines, or AHP baselines were changed.

Validation

• npm install — passed in the repository root. Root/remote SDK and runtime pins were checked against their installed packages.
• npm run compile-client — passed with zero errors after handling the new authentication variant.
• env -u COPILOT_HOME VSCODE_SKIP_PRELAUNCH=1 ./scripts/test.sh --run src/vs/platform/agentHost/test/node/copilotSessionLauncher.test.ts — passed: 99 tests, including both connector account variants.
• npm run eslint -- src/vs/platform/agentHost/node/copilot/copilotSessionLauncher.ts src/vs/platform/agentHost/test/node/copilotSessionLauncher.test.ts — passed.
• VSCODE_SKIP_PRELAUNCH=1 ./scripts/test-integration.sh --runGlob '**/agentHost/test/node/{providerIntegration/*,e2e/providers/copilotPromptsE2E,e2e/providers/codexAgentHostLive}.integrationTest.js' — clean repeat passed: 70 tests and 6 existing skips. The initial run hit the unchanged Codex plugin-MCP advertisement failure; that exact test passed an isolated retry, and the entire batch then passed without changes.
• VSCODE_SKIP_PRELAUNCH=1 npm run test-agent-host-e2e — initial attempt passed conformance, Claude, Codex, Copilot, and all five OTel scenarios, but the managed-settings entrypoint timed out during startup. Its complete isolated entrypoint passed an unchanged retry.
• VSCODE_SKIP_PRELAUNCH=1 npm run test-agent-host-e2e -- --jobs 2 — clean full strict replay repeat passed: all six entrypoints (conformance, Claude, Codex, Copilot, Copilot OTel, Copilot managed-settings diagnostics), 842 passing and 107 existing skips.
• git diff --check and commit hygiene — passed.

GitHub Code OSS run 37341675492 passed on commit d4bb3c96cbc, including Windows/Linux/macOS Electron smoke and integration jobs.

Azure packaged validation 480756 passed packaged Electron smoke and integration tests on Windows, Linux, and macOS. Downloaded integration-task logs confirm all six Agent Host E2E entrypoints actually ran and passed on each platform. Publishing and release are disabled.

The overall Azure build initially failed because the Windows Unit Tests job exceeded its 50-minute job limit during post-test Component Governance. Retried only that canceled Windows job, which reused its successful test checkpoints and completed finalization. Build 480756 is now succeeded on d4bb3c96cbc, with no code, assertion, or job-timeout changes. Checkpoint reuse is not counted as another independent test execution.

All build/test CI checks are green; the draft/review-policy VS Code PR Check remains pending. This does not resolve the separately documented live approve-only concern below.

Remaining live approve-only concern

Keep this PR in draft. Preview.5 still attempts implementation after selecting exit_only (“Approve Plan Only”) in the existing planning scenario: 3/3 local live recording checks failed the unchanged no-pending-confirmation assertion. These were local real-model checks, not CI replay failures:

AGENT_HOST_REPLAY_RECORD=1 VSCODE_SKIP_PRELAUNCH=1 ./scripts/test-integration.sh \
  --run src/vs/platform/agentHost/test/node/e2e/providers/copilotAgentHostE2E.integrationTest.ts \
  --grep 'planning-mode session-state writes are auto-approved in default mode'

Original fixture bytes were restored after every check; no failed recording was accepted. The previously investigated plan-exit notice/approval semantics are not fixed by this bump. Green deterministic replay uses recorded assistant responses and must not be treated as evidence that the live model respects approve-only.

Runtime provenance: cli-1.0.92-5.

(Written by Copilot)

[Copilot]

Copilot review overview

🔵 Needs a closer look

The acknowledged live approve-only regression remains unresolved despite the reviewed code and dependency pins being internally consistent.

Review effort: Balanced
Findings: None

What changed in this PR

Updates the Copilot SDK and bundled runtime while supporting the SDK’s new provider-owned account authentication variant.

Changes:

• Bumps SDK to 1.0.17-preview.5 and runtime to 1.0.92-5.
• Matches provider-owned accounts using their direct login.
• Tests both token-provider and provider-owned account selection.

File	Description
package.json	Updates root SDK and runtime pins.
package-lock.json	Refreshes root SDK platform packages.
remote/​package.json	Updates remote-server pins.
remote/​package-lock.json	Refreshes remote SDK platform packages.
copilotSessionLauncher.ts	Supports account-owned login matching.
copilotSessionLauncher.test.ts	Covers both authentication variants.

Files not reviewed (1)

• remote/package-lock.json: Generated file

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.