Fix GitHub Enterprise authentication in Agent Host

[Copilot]

Summary

• authenticate the Copilot SDK client directly for GitHub Enterprise hosts so COPILOT_GH_HOST is honored
• use that host-aware client identity for model discovery, session creation, and session resume
• restart the enterprise client safely after an actual credential update while preserving GitHub.com per-request and session-level authentication behavior
• keep client restart idle-safe so an active turn is not terminated
• add regression coverage for enterprise model discovery, token changes, session materialization, resume-session credential projection, and credential modes

Expiring GHE credentials are intentionally not handled in this PR. They currently exist only in the unreleased Microsoft-brokered sign-in flow; support can be added with that flow without changing normal Agent Host restart or turn-admission behavior now.

Fixes #337485
Fixes #337562
Fixes #337661

Validation

• npm run transpile-client
• focused Agent Host authentication regressions through npm run test-node -- --grep ... (the runner completed the full node suite: 18,992 passing, 214 pending)
• npm run typecheck-client
• npm run eslint -- src/vs/platform/agentHost/node/copilot/copilotAgent.ts src/vs/platform/agentHost/node/copilot/copilotGitHubCredentials.ts src/vs/platform/agentHost/test/node/copilotAgent.test.ts src/vs/platform/agentHost/test/node/copilotGitHubCredentials.test.ts
• git diff --check
• pre-commit hygiene on the changed files

(Written by Copilot)

[Copilot]

Copilot review overview

🟡 Changes recommended

Initial one-hour credentials and deferred client restarts can still produce empty catalogs or stale-token requests.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• One-hour credentials prevent initial enterprise model discovery · New
• Model refresh uses stale client after enterprise token rotation · New

What changed in this PR

Fixes GitHub Enterprise authentication in Agent Host by moving credentials to the host-aware SDK client and renewing expiring credentials.

Changes:

• Adds client-level enterprise authentication and safe client restarts.
• Adds proactive credential-expiry detection.
• Adds regression tests for discovery, renewal, materialization, and resume flows.

File	Description
copilotAgent.ts	Integrates enterprise client authentication and renewal.
copilotGitHubCredentials.ts	Adds refresh detection and client-auth session mode.
copilotAgent.test.ts	Covers enterprise authentication workflows.
copilotGitHubCredentials.test.ts	Covers expiry and credential modes.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Screenshot Changes

Base: a6e06b50 Current: f001d4bf

Changed (3)

chat/scrollAnchoring/chatScrollAnchoring/CompletedVisibleHeader/Dark

Before	After

chat/scrollAnchoring/chatScrollAnchoring/CompletedVisibleHeader/Light

Before	After

chat/scrollAnchoring/chatScrollAnchoring/CompletedOffscreenHeader/Dark

Before	After

2 insignificant change(s) omitted (≤20 px, Δ≤2). See CI logs for details.

[roblourens]

Validated the GitHub Enterprise host routing with the real bundled Copilot runtime, reviewed the restart scope, and confirmed all required checks pass. (Written by Copilot)