[LutzLange]

Stacked on this fork so the diff is this PR only (base: copilot/pr3a-vscode-own-models). Sixth change in the series; James gets one integration PR from copilot/integration (the tip of the stack) when the series is ready.

What it does. programs.vscode gains copilotChat: githubModels: VS Code keeps GitHub's own models and its own Copilot sign-in, and the daemon routes Copilot Chat's traffic to GitHub through the gateway. The daemon merges two keys into the VS Code user settings.json: github.copilot.advanced.debug.overrideCapiUrl pointing at the loopback proxy's new /vscode-copilot-capi/<pairing> route, and that key plus github.copilot.internal.capiUrl in settingsSync.ignoredSettings (by value; user entries kept). The managed chatLanguageModels.json entry is removed under this value. User mode only; requires llmGateway.proxyUrl (a gateway route that forwards to GitHub with the client's own token; example in the README).

• Proxy route /vscode-copilot-capi/<pairing>/…: the pairing is the first path segment because VS Code cannot add a header to these requests; compared in constant time, stripped, never forwarded or logged; missing or wrong segment 403 pairing_invalid with the header ignored. The client's bearer token (tid= session token, gho_ on /agents/*) moves to x-llm-token as on the pass-through route; a credential-less GET /_ping (Copilot Chat's health check) is forwarded without x-llm-token, POST /_ping without a credential stays 401. The route's behaviour is three flags on ProxyRoute (pairing_in_path, tunnels_upgrades, credential_less_ping).
• WebSocket tunnel (Auto and agent mode use GET /responses as a WebSocket): serve_with_cache serves with_upgrades(); forward takes the inbound OnUpgrade before buffering the body, keeps Connection: Upgrade/Upgrade: websocket on the request and returns the upstream 101 with Connection/Upgrade/Sec-WebSocket-* after hop stripping; the tunnel is awaited by the connection task under the server's JoinSet (dropping the server closes it) and ends when either side closes or the gateway credential it was opened with expires (its own expiry on both clocks, read together with the credential; not the cache's 60 s reuse window). Behaviour change: a WebSocket upgrade on any other route is refused with 400 upgrade_not_supported (before, it was stripped and forwarded as plain HTTP); other Upgrade tokens are still stripped and forwarded.
• Settings file: written 0600 (an existing looser mode is tightened, since the URL carries the pairing), removal keeps the mode it finds, reports redacted, sidecar .settings.json.agentdesktop, plain-JSON rewrite (sorted keys), comments/trailing commas are a conflict. Removal on program absent, ownModels, useLlmGateway: false, no gateway, no proxyUrl, no proxy (with a warning); sidecar-less removal by this daemon's own URL; a user's own overrideCapiUrl is overwritten while active and restored on removal. daemon.vscode.settings overrides the path (error in system mode). --once and the system-mode message name settings.json.
• Config: VsCodeCopilotChat::GithubModels; githubModels with models rejected; githubModels without llmGateway.proxyUrl rejected when the gateway is used; VsCodeStartupConfig { config, settings }; schema regenerated.
• Frontend: proxyUrl field under the gateway section of the daemon-config builder; the VS Code program placeholder shows copilotChat: githubModels.
• Docs: README section (what VS Code sends, pairing-in-URL and why, _ping, the WebSocket authorisation window, settings rules, the stale-override token exposure while the daemon is down and the single-user recommendation and stop order, undocumented-setting caveat with the HTTP-proxy fallback, model policy, restart VS Code, no --dry-run preview, upgrade note), routes-table row, pairing paragraph, upgrade_not_supported, the Requests paragraph on tunnels, gateway route example (Business host, lab-verified), provider README.
• Settings ownership (json_merge): MergeOptions::owned_keys. A hand edit of the managed override after the merge is replaced on the next apply and never becomes the value removal restores; a value the user had before the first apply still comes back. Found by the lab: before this, a hand-edited URL came back as a stale override on removal and Copilot Chat got 403. Other callers pass no owned keys and are unchanged.
• Test harness (separate commits): Container::write removes an existing file first (fs.protected_regular=2 stopped root rewriting a tester-owned /tmp file), and Container::stop_process also signals the children of the recorded PID (runuser ignores SIGINT while its child runs). The Copilot CLI Docker test pushed models as a list, a shape PR 2's revision replaced with a map; fixed. The whole Docker suite now passes locally, 9 of 9.

Process. Spec reviewed (Opus) before the test author, then frozen (specs/PR-3b.md rev 2); tests first by a separate agent in their own baseline commit (f1f8967: 13 proxy tests with a hand-rolled RFC 6455 echo, 18 settings tests, 3 config tests); test guard with a two-entry ledger (two hand-written struct literals gained new fields; no assertion changed); gate (218 agent + 18 core tests, clippy, schema, frontend build + lint); three review lenses on two models; delta review; independent lab run. Round 1 findings folded in: the tunnel deadline was the cache's 60 s reuse window instead of the credential expiry and a second lookup could leave a tunnel without a deadline (adversarial blocker + major, confirmed by probe); the README lacked the stale-override exposure text; route behaviour keyed on a prefix string; the 101 skipped hop stripping; a stale ProgramsConfig.vscode doc comment in the schema; provider README; misleading upgrade note; unverified Enterprise host claim. Follow-ups noted: extracting the duplicated reconcile helpers, the Reconciler::new argument list, override removal on shutdown.

Delta reviews (Opus): delta 1 on the fixes was "pass with minors" (the blocker fix re-probed: a credential with exp = now + 3600 now gives a tunnel deadline of 3599.9999 s, was 59.9997 s); the minors (a regression test for the deadline through CredentialCache::insert, one match_route call in forward, one system-mode check) went into the next commit, and delta 2 was a clean pass. After the lab run, delta 3 on the owned-key change was "pass with minors" (every MergeOptions caller checked; a probe confirmed a user value from before the first apply survives); its minors (a test for that case, README note on the headers VS Code sends) are in the last code commit, which adds a test and README text only, so no further delta pass was run. Two cosmetic nits stay: the _ping exemption is tied to the path-pairing branch (correct for the only route that sets both flags), and the settings/reconcile module pair could be renamed chat_models/settings later.

Lab (Linux VM, user mode, VS Code 1.139, Business seat, Solo Enterprise for AgentGateway standalone v2026.9.1 with the /copilot-proxy route, controller-pushed config, Playwright over CDP for the GUI steps):

• First run on a85f77d by an independent agent: settings written and tightened 644 to 600 with both ignore entries next to the user's, chatLanguageModels.json entry removed, chat turns and _ping 200 through the gateway with llm.client="vscode-copilot" and the enrolled user, pairing absent from VS Code's logs, agent turns over 120 s complete, hand edit restored, re-pairing makes the old URL 403 even with a valid header, comment conflict blocks every managed file and the daemon restart exits, controller rejects githubModels with models and without proxyUrl, --once, --dry-run and system-mode messages. Three findings went into code or docs: GitHub refused the forwarded WebSocket upgrade until the gateway backend was pinned to HTTP/1.1 (alpn, now in the README example); the stale override after a hand edit (fixed with owned keys); VS Code saving settings.json as 664 (documented). VS Code's upgrade carries no Origin.
• Repeat on 11e1de4 with lab/checks/pr3b-vscode.sh: 21 of 21 checks pass, including the hand-edit-then-ownModels sequence that failed before. GUI: an agent turn of 2m 15s over the WebSocket, gateway GET /copilot-proxy/responses http.status=101 duration=259532ms llm.client="vscode-copilot"; the close at credential expiry is one error line in VS Code's log and the next agent turn answers in 5 s without falling back.

Not covered by a test: Enterprise Cloud (api.enterprise.githubcopilot.com) and other plans' hosts; macOS and Windows settings paths beyond unit tests; Settings Sync across two devices; a VS Code release without overrideCapiUrl.

Follow-ups: extract the reconcile helpers now copied three times; a ProviderPaths struct for Reconciler::new; removing the override on graceful daemon shutdown (bounds the stale-override exposure); the reconcile tick (PR 5), which would also bound the window after VS Code rewrites the file as 664.

🤖 Generated with Claude Code

[LutzLange]

Superseded: landed upstream in agentdesktop-dev#135 (VS Code githubModels).