Address review on sandbox write permission rendering

Translate the write permission's invocationMessage, not just the
confirmation message. AgentSessionApprovalModel reads
invocationMessage for non-terminal approvals, so the sessions list
showed the host's generic "Edit file" while the confirmation card
showed the file. Both now derive from the same value.

Normalize a Windows host path before formatting the link. URI.file
only rewrites separators when the client runs Windows, so a Windows
host paired with a non-Windows client collapsed C:\repo\file.ts into
a single-segment basename and an unresolvable URI.

Revert the chatToolConfirmationSubPart change. It surfaced the raw
input for plain-string confirmations, but that editor is writable
while agent-host approval dispatch never sends editedToolInput, so
edits were silently discarded. Translating the message removes the
need for it, and this no longer touches shared rendering code.

Also stop emitting the raw input for writes: it repeated the file the
message already names.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: osortega

src/vs/workbench/contrib/chat/browser/agentSessions/agentHost/stateToProgressAdapter.ts

@@ -2334,12 +2334,11 @@ export function toolCallStateToInvocation(tc: ToolCallState, subAgentInvocationI
 			};
 		} else if (getToolKind(tc) === 'terminal' && getInlineToolInput(tc.toolInput)) {
 			toolSpecificData = buildTerminalToolSpecificData(tc, sessionResource);
-		} else {
-			const writePermission = remoteWritePermission(tc);
+		} else if (!remoteWriteInvocationMessage(tc)) {
+			// A write's only argument is the file the message already names,
+			// so there is nothing left for the raw input view to add.
 			const toolInput = getInlineToolInput(tc.toolInput);
-			if (writePermission) {
-				toolSpecificData = { kind: 'input', rawInput: writePermission.rawInput };
-			} else if (toolInput) {
+			if (toolInput) {
 				let rawInput: unknown;
 				try { rawInput = JSON.parse(toolInput); } catch { rawInput = { input: toolInput }; }
 				toolSpecificData = { kind: 'input', rawInput };
@@ -2348,7 +2347,7 @@ export function toolCallStateToInvocation(tc: ToolCallState, subAgentInvocationI
 
 		return new ChatToolInvocation(
 			{
-				invocationMessage: stringOrMarkdownToString(tc.invocationMessage, connectionAuthority),
+				invocationMessage: stringOrMarkdownToString(remoteWriteInvocationMessage(tc) ?? tc.invocationMessage, connectionAuthority),
 				confirmationMessages,
 				presentation: ToolInvocationPresentation.HiddenAfterComplete,
 				toolSpecificData,
@@ -2415,19 +2414,25 @@ export function toolCallStateToInvocation(tc: ToolCallState, subAgentInvocationI
 }
 
 /**
- * A remote host names a write's target file in `_meta` and sends a plain-text
- * message, where a local host sends the file link and a `{ path }` input.
- * Restates the remote request in that same shape so both render identically.
+ * The invocation message for a remote host's write permission.
+ *
+ * A remote host names the target file in `_meta` and sends a plain-text
+ * message, where a local host sends the shared `Edit <file link>` message.
+ * Restating it in that form is what gives both hosts the same file pill, in
+ * the confirmation card and anywhere else the message is summarized.
  *
- * The link is left as a plain `file:` URI, exactly as a local host emits it;
- * {@link stringOrMarkdownToString} rewrites it to address the remote host.
+ * The path is normalized the same way {@link parseAbsoluteFileLinkTarget}
+ * normalizes a remote link: `URI.file` only rewrites separators when the
+ * *client* runs Windows, so a Windows host paired with a non-Windows client
+ * would otherwise keep `C:\repo\file.ts` verbatim and yield a single-segment
+ * basename. The link itself stays a plain `file:` URI, exactly as a local host
+ * emits it; {@link stringOrMarkdownToString} rewrites it to address the host.
  */
-function remoteWritePermission(tc: ToolCallPendingConfirmationState): { readonly message: StringOrMarkdown; readonly rawInput: { readonly path: string } } | undefined {
+function remoteWriteInvocationMessage(tc: ToolCallPendingConfirmationState): StringOrMarkdown | undefined {
 	const { kind, fileName } = readAgentPermissionRequestMeta(tc);
-	if (kind !== AgentPermissionRequestKind.Write || !fileName) {
-		return undefined;
-	}
-	return { message: getEditFileMessage(fileName), rawInput: { path: fileName } };
+	return kind === AgentPermissionRequestKind.Write && fileName
+		? getEditFileMessage(fileName, path => win32.isAbsolute(path) ? path.replaceAll('\\', '/') : path)
+		: undefined;
 }
 
 export function toolCallConfirmationMessages(tc: ToolCallPendingConfirmationState, connectionAuthority: string): IToolConfirmationMessages {
@@ -2448,7 +2453,7 @@ export function toolCallConfirmationMessages(tc: ToolCallPendingConfirmationStat
 			: stringOrMarkdownToString(tc.confirmationTitle, connectionAuthority) ?? tc.displayName,
 		message: isViewUnreviewedCommentsTool(tc.toolName)
 			? localize('agentFeedback.reviewMessage', "Choose which comments to reveal to the agent. Unchecked comments stay hidden.")
-			: stringOrMarkdownToString(remoteWritePermission(tc)?.message ?? tc.invocationMessage, connectionAuthority),
+			: stringOrMarkdownToString(remoteWriteInvocationMessage(tc) ?? tc.invocationMessage, connectionAuthority),
 		approvalReason,
 		...(tc.options ? { customOptions: tc.options } : {}),
 	};

src/vs/workbench/contrib/chat/browser/widget/chatContentParts/toolInvocationParts/chatToolConfirmationSubPart.ts

@@ -157,14 +157,8 @@ export class ToolConfirmationSubPart extends AbstractToolConfirmationSubPart {
 		}
 		const { message, disclaimer } = state.confirmationMessages!;
 		const toolInvocation = this.toolInvocation as IChatToolInvocation;
-		const hasRenderableInput = toolInvocation.toolSpecificData?.kind === 'input'
-			&& !!toolInvocation.toolSpecificData.rawInput
-			&& !isEmptyObject(toolInvocation.toolSpecificData.rawInput);
-
-		// A plain-string message alone needs no surrounding structure, but the
-		// input editor below does — skipping it would hide what is being
-		// approved.
-		if (typeof message === 'string' && !disclaimer && !hasRenderableInput) {
+
+		if (typeof message === 'string' && !disclaimer) {
 			return message;
 		} else {
 			const codeBlockRenderOptions: ICodeBlockRenderOptions = {

src/vs/workbench/contrib/chat/test/browser/agentSessions/stateToProgressAdapter.test.ts

@@ -1615,8 +1615,9 @@ suite('stateToProgressAdapter', () => {
 
 		test('restates a remote host write permission in the local shape', () => {
 			// A remote host names the file in `_meta` and sends a plain-text
-			// message; a local host sends the shared `Edit <link>` message and a
-			// `{ path }` input. Both must render through the same path.
+			// message; a local host sends the shared `Edit <link>` message.
+			// Both the confirmation card and the sessions list read
+			// `invocationMessage`, so it must carry the file too.
 			const tc: ToolCallPendingConfirmationState = {
 				toolCallId: 'tc-write',
 				toolName: 'str_replace_editor',
@@ -1638,16 +1639,42 @@ suite('stateToProgressAdapter', () => {
 				: undefined;
 
 			assert.deepStrictEqual({
+				invocationMessage: typeof invocation.invocationMessage === 'string' ? invocation.invocationMessage : invocation.invocationMessage?.value,
 				markdown: typeof message === 'string' ? message : message?.value,
 				toolSpecificData: invocation.toolSpecificData,
 			}, {
 				// Link rewriting drops the label so the renderer shows a file
 				// widget; a local host's message collapses to the same form.
+				invocationMessage: 'Edit [](file:///workspaces/simple-server/index.js)',
 				markdown: 'Edit [](file:///workspaces/simple-server/index.js)',
-				toolSpecificData: { kind: 'input', rawInput: { path: '/workspaces/simple-server/index.js' } },
+				// The message names the file, so raw input would only repeat it.
+				toolSpecificData: undefined,
 			});
 		});
 
+		test('normalizes a Windows host path regardless of the client platform', () => {
+			// `URI.file` only rewrites separators when the *client* runs
+			// Windows, so a Windows host paired with a POSIX client would
+			// otherwise yield a single-segment basename.
+			const tc: ToolCallPendingConfirmationState = {
+				toolCallId: 'tc-write-win',
+				toolName: 'str_replace_editor',
+				displayName: 'Edit',
+				invocationMessage: 'Edit file',
+				status: ToolCallStatus.PendingConfirmation,
+				toolInput: 'C:\\repo\\src\\index.ts',
+				_meta: { requestId: 'req-w2', promptRequest: { kind: 'write', fileName: 'C:\\repo\\src\\index.ts' } },
+			};
+
+			const invocation = toolCallStateToInvocation(tc);
+			const message = invocation.invocationMessage;
+
+			assert.strictEqual(
+				typeof message === 'string' ? message : message?.value,
+				'Edit [](file:///c%3A/repo/src/index.ts)',
+			);
+		});
+
 		test('keeps the host message for a write permission that names no file', () => {
 			const tc: ToolCallPendingConfirmationState = {
 				toolCallId: 'tc-write-nofile',
@@ -1656,7 +1683,7 @@ suite('stateToProgressAdapter', () => {
 				invocationMessage: 'Edit file',
 				status: ToolCallStatus.PendingConfirmation,
 				toolInput: '{"path":"/tmp/a.txt"}',
-				_meta: { requestId: 'req-w2', promptRequest: { kind: 'write' } },
+				_meta: { requestId: 'req-w3', promptRequest: { kind: 'write' } },
 			};
 
 			const invocation = toolCallStateToInvocation(tc);
@@ -1678,7 +1705,6 @@ suite('stateToProgressAdapter', () => {
 			const tc = createToolCallState({
 				_meta: { toolKind: 'subagent', subagentDescription: 'Review code', subagentAgentName: 'code-reviewer' },
 			});
-
 			const invocation = toolCallStateToInvocation(tc);
 			assert.ok(invocation.toolSpecificData);
 			assert.strictEqual(invocation.toolSpecificData.kind, 'subagent');