accounts: preserve sign-in during session replacement - #333206
Merged
Vritant Bhardwaj (vritant24) merged 6 commits intoAug 31, 2026
Merged
accounts: preserve sign-in during session replacement#333206Vritant Bhardwaj (vritant24) merged 6 commits into
Vritant Bhardwaj (vritant24) merged 6 commits into
Conversation
Copilot started reviewing on behalf of
Vritant Bhardwaj (vritant24)
August 28, 2026 17:19
View session
Contributor
There was a problem hiding this comment.
Copilot review overview
Review tier: Balanced
Findings: 1
New issues introduced by this change (1)
| Severity | Finding |
|---|---|
 |
src/vs/workbench/services/accounts/browser/defaultAccount.ts — A removal-only event can be undone by an already-running replacement refresh. That refresh captures… |
What changed in this PR
Preserves default-account continuity while GitHub Authentication replaces sessions.
Changes:
- Reconciles combined removal/replacement events without an intermediate sign-out.
- Retains immediate clearing for removal-only events.
- Adds regression coverage for replacement, removal, and later addition.
| File | Description |
|---|---|
src/vs/workbench/services/accounts/browser/defaultAccount.ts |
Distinguishes replacement events from removal-only events. |
src/vs/workbench/services/accounts/test/browser/defaultAccount.test.ts |
Tests session transition behavior and adds authentication fixture overrides. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
📬 CODENOTIFYThe following users are being notified based on files changed in this PR: TylerLeonhardtMatched files:
|
Vritant Bhardwaj (vritant24)
marked this pull request as draft
August 28, 2026 18:14
Keep the default account available while authentication providers replace a removed session with a new candidate in the same event. Add privacy-safe logs to distinguish interactive and secret-storage replacements. Fixes #333197 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Vritant Bhardwaj (vritant24)
force-pushed
the
agents/investigate-issue-333197-root-cause
branch
from
August 31, 2026 17:52
17817ec to
14060e6
Compare
Copilot started reviewing on behalf of
Vritant Bhardwaj (vritant24)
August 31, 2026 17:53
View session
Contributor
There was a problem hiding this comment.
Copilot review overview
Review tier: Balanced
Findings: 1
New issues introduced by this change (2)
| Severity | Finding |
|---|---|
|
src/vs/workbench/services/accounts/browser/defaultAccount.ts — A removal-only event can be overwritten by the reconciliation started for a preceding replacement… |
 |
src/vs/workbench/services/accounts/test/browser/defaultAccount.test.ts — The PR description says the regression coverage exercises changed-session candidates and recovery… |
Issues resolved since last review (1)
| Severity | Finding |
|---|---|
|
src/vs/workbench/services/accounts/browser/defaultAccount.ts — A removal-only event can be undone by an already-running replacement refresh. That refresh captures… View resolved comment |
Do not publish an asynchronous refresh result after the current session changes. This keeps a removal-only sign-out final when replacement reconciliation was already in flight. Refs #333197 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
|
Base:
|
Vritant Bhardwaj (vritant24)
marked this pull request as ready for review
August 31, 2026 20:38
Dmitriy Vasyura (dmitrivMS)
previously approved these changes
Aug 31, 2026
Model the Agents web workbench in the account test fixture so browser runs do not skip provider initialization and session-change listener registration. Refs #333197 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Model a local editor in Electron and a remote editor in browser tests so the shared default-account replacement behavior is covered outside the Agents window as well. Refs #333197 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Dmitriy Vasyura (dmitrivMS)
approved these changes
Aug 31, 2026
Vritant Bhardwaj (vritant24)
enabled auto-merge
August 31, 2026 23:04
Vritant Bhardwaj (vritant24)
deleted the
agents/investigate-issue-333197-root-cause
branch
August 31, 2026 23:14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #333197
Technical context for AI-assisted review
Intent and previous behavior
GitHub Authentication can publish one session-change event containing both the removed current session and its replacement. The default-account listener treated the removal as a complete sign-out, cleared the account, and skipped reconciliation. That temporary null account propagated through chat entitlement state and caused the Agent Host sign-in banner to appear even though the replacement credential was valid.
Runtime logs from the reported occurrence show the GitHub removal and addition in the same event cycle, followed within milliseconds by the Sessions signed-out path. Subsequent authentication using the replacement credential succeeded.
Implementation
The default-account listener now distinguishes removal-only events from events containing added or changed replacement candidates. Removal-only events still clear the account immediately. Replacement events retain the current account while the existing throttled refresh retrieves, validates, and selects the actual default session.
Each asynchronous refresh captures the current session before it starts. If that session changes while the refresh is pending, the stale result is discarded so an earlier replacement reconciliation cannot overwrite a later removal-only sign-out.
GitHub Authentication records replacement events at info level with only the source category, event kind, and added/removed/changed counts. Routine session changes remain at trace level. The logs intentionally exclude account labels and identifiers, session identifiers, scopes, and credentials.
Regression coverage drives a combined replacement and a genuine removal-only event through the authentication service fixture. A blocked-refresh case verifies that removal remains final when replacement reconciliation was already in flight.
Behavior and constraints