agent-host: report git-driven session file diffs (#312632)

* agent-host: report git-driven session file diffs (Written by Copilot)

Adds an alternative diff source for agent sessions that derives changes
from the working-tree git state instead of from edit-tool emissions, so
edits made via terminal/shell commands also show up in the Changes view.

Approach
--------
* IAgentHostGitService gains computeSessionFileDiffs() and showBlob().
* gitDiffContent.ts encodes 'git-blob:' content URIs that pin a blob to
  a session + sha + repo-relative path.
* AgentService routes 'git-blob:' resourceRead requests to
  gitService.showBlob(); AgentHostFileSystemProvider.stat() short-
  circuits 'git-blob:' alongside 'session-db:' so the diff editor's
  stat-then-read flow works end-to-end.
* AgentSideEffects._tryComputeGitDiffs runs after each turn (debounced
  with the existing diff scheduler) and overrides edit-tool diffs when
  git is available.

Tests
-----
Unit + integration coverage in src/vs/platform/agentHost/test/node/.

* agent-host: regression tests for git-blob: stat fast-path

Adds five tests against AgentHostFileSystemProvider covering the
synthetic content scheme fast-path in stat(): git-blob: and
session-db: URIs must return a File stat directly without trying
to list a parent directory that doesn't exist.

Verified by reverting the git-blob: branch of the  theallowlist
new 'git-blob: stat' and 'full stat-then-read round-trip' tests
fail with EntryNotFound, which is exactly the error the diff
editor surfaced when opening a diff of a new file.

(Written by Copilot)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* agent-host: address Copilot review feedback

- agentHostGitService: bump default execFile maxBuffer to 32MB so
  diff output in large repos doesn't fail with ENOBUFS and silently
  drop terminal-driven diffs.
- agentHostGitService.showBlob: validate sha is a hex object name
  before passing it to git, so a malformed git-blob: URI can't
  inject options or resolve to surprising refs.
- mockAgent terminal-edit branch: void+catch the async IIFE so a
  filesystem failure surfaces as a chat delta instead of an
  unhandled rejection (test flake source).
- agentSideEffects.test: replace setTimeout(100) with awaiting the
  SessionDiffsChanged envelope event for both new diff-computation
   deterministic and immune to slow CI.tests
- sessionDiffsRealSdk integrationTest: shell-quote the target file
  path so temp dirs containing spaces don't break the prompt.

(Written by Copilot)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* agent-host: use IFileService and INativeEnvironmentService in AgentHostGitService

Replace direct fs/promises and os.tmpdir usage with platform services so
the temp-index dance in computeSessionFileDiffs goes through the same
file system abstraction as the rest of the workbench. (Written by Copilot)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* agent-host: set COMMAND_HOOK_LOCK=1 in temp-index env for GVFS repos

Mirrors the extension's buildTempIndexEnv which sets this flag to avoid
holding the GVFS command hook lock during temp-index git operations.
(Written by Copilot)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* agent-host: inject IAgentHostGitService via DI into AgentSideEffects

Instead of threading gitService through IAgentSideEffectsOptions, register
it in the local ServiceCollection and inject it via @IAgentHostGitService
decorator, which is the normal pattern everywhere else. (Written by Copilot)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix deleted file diffs: use IChatSessionFileChange2 with undefined modifiedUri for deletions

For deleted files, the 'modified' side of the diff editor must be absent.
The renderer detects deletions via `change.modifiedUri === undefined`, so
producing `IChatSessionFileChange2` (which carries a `uri` key alongside
optional `modifiedUri`) is the right shape.

Previously diffsToChanges returned IChatSessionFileChange (required
modifiedUri) and fell back to the deleted file's pre-deletion path as
modifiedUri, causing the diff editor to try to read a nonexistent file.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: roblourens

src/vs/platform/agentHost/common/agentHostFileSystemProvider.ts

@@ -91,7 +91,7 @@ export abstract class AHPFileSystemProvider extends Disposable implements IFileS
 			return { type: FileType.Directory, mtime: 0, ctime: 0, size: 0, permissions: FilePermission.Readonly };
 		}
 		const decoded = this._decodeUri(resource);
-		if (decoded.scheme === 'session-db') {
+		if (decoded.scheme === 'session-db' || decoded.scheme === 'git-blob') {
 			return { type: FileType.File, mtime: 0, ctime: 0, size: 0, permissions: FilePermission.Readonly };
 		}
 

src/vs/platform/agentHost/node/agentHostGitService.ts

@@ -89,21 +89,23 @@ function startAgentHost(): void {
 	// Create the real service implementation that lives in this process
 	let agentService: AgentService;
 	try {
-		const gitService = new AgentHostGitService();
-		agentService = new AgentService(logService, fileService, sessionDataService, productService, gitService);
-		const pluginManager = new AgentPluginManager(URI.file(environmentService.userDataPath), fileService, logService);
+		// Build the DI container early so the git service can be created via
+		// `createInstance` (it needs IFileService + INativeEnvironmentService).
 		const diServices = new ServiceCollection();
 		diServices.set(INativeEnvironmentService, environmentService);
 		diServices.set(ILogService, logService);
 		diServices.set(IFileService, fileService);
 		diServices.set(ISessionDataService, sessionDataService);
+		const instantiationService = new InstantiationService(diServices);
+		const gitService = instantiationService.createInstance(AgentHostGitService);
+		diServices.set(IAgentHostGitService, gitService);
+		agentService = new AgentService(logService, fileService, sessionDataService, productService, gitService);
+		const pluginManager = new AgentPluginManager(URI.file(environmentService.userDataPath), fileService, logService);
 		diServices.set(IAgentPluginManager, pluginManager);
 		const diffComputeService = disposables.add(new NodeWorkerDiffComputeService(logService));
 		diServices.set(IDiffComputeService, diffComputeService);
 
 		diServices.set(IAgentHostTerminalManager, agentService.terminalManager);
-		const instantiationService = new InstantiationService(diServices);
-		diServices.set(IAgentHostGitService, gitService);
 		agentService.registerProvider(instantiationService.createInstance(CopilotAgent));
 	} catch (err) {
 		logService.error('Failed to create AgentService', err);

src/vs/platform/agentHost/node/agentHostMain.ts

@@ -162,26 +162,31 @@ async function main(): Promise<void> {
 	// Session data service
 	const sessionDataService = new SessionDataService(URI.file(environmentService.userDataPath), fileService, logService);
 
+	// Build the DI container early so the git service can be created via
+	// `createInstance` (it needs IFileService + INativeEnvironmentService).
+	// The git service is shared by AgentService (for diff computation +
+	// showBlob) and the production agent registration path.
+	const diServices = new ServiceCollection();
+	diServices.set(IProductService, productService);
+	diServices.set(INativeEnvironmentService, environmentService);
+	diServices.set(ILogService, logService);
+	diServices.set(IFileService, fileService);
+	diServices.set(ISessionDataService, sessionDataService);
+	const instantiationService = new InstantiationService(diServices);
+	const gitService = instantiationService.createInstance(AgentHostGitService);
+
 	// Create the agent service (owns AgentHostStateManager + AgentSideEffects internally)
-	const gitService = new AgentHostGitService();
 	const agentService = new AgentService(logService, fileService, sessionDataService, productService, gitService);
 	disposables.add(agentService);
 
 	// Register agents
 	if (!options.quiet) {
 		// Production agents (require DI)
-		const diServices = new ServiceCollection();
 		const pluginManager = new AgentPluginManager(URI.file(environmentService.userDataPath), fileService, logService);
-		diServices.set(IProductService, productService);
-		diServices.set(INativeEnvironmentService, environmentService);
-		diServices.set(ILogService, logService);
-		diServices.set(IFileService, fileService);
-		diServices.set(ISessionDataService, sessionDataService);
 		diServices.set(IAgentPluginManager, pluginManager);
 		diServices.set(IDiffComputeService, disposables.add(new NodeWorkerDiffComputeService(logService)));
 		diServices.set(IAgentHostTerminalManager, agentService.terminalManager);
 		diServices.set(IAgentHostGitService, gitService);
-		const instantiationService = new InstantiationService(diServices);
 		const copilotAgent = disposables.add(instantiationService.createInstance(CopilotAgent));
 		agentService.registerProvider(copilotAgent);
 		log('CopilotAgent registered');

src/vs/platform/agentHost/node/agentHostServerMain.ts

@@ -26,6 +26,7 @@ import { AgentConfigurationService, IAgentConfigurationService } from './agentCo
 import { AgentSideEffects } from './agentSideEffects.js';
 import { AgentHostTerminalManager, type IAgentHostTerminalManager } from './agentHostTerminalManager.js';
 import { ISessionDbUriFields, parseSessionDbUri } from './copilot/fileEditTracker.js';
+import { IGitBlobUriFields, parseGitBlobUri } from './gitDiffContent.js';
 import { AgentHostStateManager } from './agentHostStateManager.js';
 import { IAgentHostGitService } from './agentHostGitService.js';
 
@@ -105,6 +106,7 @@ export class AgentService extends Disposable implements IAgentService {
 		const services = new ServiceCollection(
 			[ILogService, this._logService],
 			[IAgentConfigurationService, configurationService],
+			[IAgentHostGitService, this._gitService],
 		);
 		const instantiationService = this._register(new InstantiationService(services, /*strict*/ true));
 
@@ -648,6 +650,15 @@ export class AgentService extends Disposable implements IAgentService {
 			return this._fetchSessionDbContent(dbFields);
 		}
 
+		// Handle git-blob: URIs that reference file content at a specific
+		// git commit (the merge-base used as diff baseline). The URI
+		// encodes the session it belongs to so we can find the right
+		// working directory to run `git show` from.
+		const blobFields = parseGitBlobUri(uri.toString());
+		if (blobFields) {
+			return this._fetchGitBlobContent(blobFields);
+		}
+
 		try {
 			const content = await this._fileService.readFile(uri);
 			return {
@@ -1031,6 +1042,25 @@ export class AgentService extends Disposable implements IAgentService {
 		}
 	}
 
+	private async _fetchGitBlobContent(fields: IGitBlobUriFields): Promise<ResourceReadResult> {
+		if (!this._gitService) {
+			throw new ProtocolError(AhpErrorCodes.NotFound, `git service unavailable for: ${fields.repoRelativePath}`);
+		}
+		const workingDirectory = this._stateManager.getSessionState(fields.sessionUri)?.summary.workingDirectory;
+		if (!workingDirectory) {
+			throw new ProtocolError(AhpErrorCodes.NotFound, `Session has no working directory for git-blob URI: ${fields.sessionUri}`);
+		}
+		const blob = await this._gitService.showBlob(URI.parse(workingDirectory), fields.sha, fields.repoRelativePath);
+		if (!blob) {
+			throw new ProtocolError(AhpErrorCodes.NotFound, `git blob not found: ${fields.sha}:${fields.repoRelativePath}`);
+		}
+		return {
+			data: blob.toString(),
+			encoding: ContentEncoding.Utf8,
+			contentType: 'text/plain',
+		};
+	}
+
 	/**
 	 * Restores a subagent session from its parent session's event history.
 	 * Loads the parent's raw messages, filters for events belonging to

src/vs/platform/agentHost/node/agentService.ts

@@ -14,7 +14,7 @@ import { ILogService } from '../../log/common/log.js';
 import { IInstantiationService } from '../../instantiation/common/instantiation.js';
 import { IAgent, IAgentAttachment, IAgentProgressEvent, type IAgentToolCompleteEvent, type IAgentToolReadyEvent } from '../common/agentService.js';
 import { IDiffComputeService } from '../common/diffComputeService.js';
-import { ISessionDataService } from '../common/sessionDataService.js';
+import { ISessionDatabase, ISessionDataService } from '../common/sessionDataService.js';
 import type { AgentInfo } from '../common/state/protocol/state.js';
 import { ActionType, SessionAction } from '../common/state/sessionActions.js';
 import {
@@ -29,10 +29,12 @@ import {
 	type SessionCustomization,
 	type SessionState,
 	type ToolResultContent,
+	type ISessionFileDiff,
 	type URI as ProtocolURI,
 } from '../common/state/sessionState.js';
 import { AgentEventMapper } from './agentEventMapper.js';
 import { AgentHostStateManager } from './agentHostStateManager.js';
+import { IAgentHostGitService, META_DIFF_BASE_BRANCH } from './agentHostGitService.js';
 import { NodeWorkerDiffComputeService } from './diffComputeService.js';
 import { computeSessionDiffs, type IIncrementalDiffOptions } from './sessionDiffAggregator.js';
 import { SessionPermissionManager } from './sessionPermissions.js';
@@ -113,6 +115,7 @@ export class AgentSideEffects extends Disposable {
 		private readonly _options: IAgentSideEffectsOptions,
 		@IInstantiationService instantiationService: IInstantiationService,
 		@ILogService private readonly _logService: ILogService,
+		@IAgentHostGitService private readonly _gitService: IAgentHostGitService,
 	) {
 		super();
 		this._diffComputeService = this._register(new NodeWorkerDiffComputeService(this._logService));
@@ -931,20 +934,29 @@ export class AgentSideEffects extends Disposable {
 			return;
 		}
 		try {
-			// Build incremental options when a specific turn triggered the recomputation
-			let incremental: IIncrementalDiffOptions | undefined;
-			if (changedTurnId) {
-				const previousDiffs = this._stateManager.getSessionState(session)?.summary.diffs;
-				if (previousDiffs) {
-					incremental = { changedTurnId, previousDiffs };
+			// Prefer a git-driven diff so terminal-driven file changes show up
+			// alongside SDK-tracked tool edits. The git path is the source of
+			// truth whenever the working directory is a real work tree; we
+			// only fall back to the edit-tracker aggregator when it isn't
+			// (e.g. agents running in non-git scratch directories or under
+			// test harnesses without git).
+			let diffs = await this._tryComputeGitDiffs(session, ref.object);
+			if (!diffs) {
+				// Build incremental options when a specific turn triggered the recomputation
+				let incremental: IIncrementalDiffOptions | undefined;
+				if (changedTurnId) {
+					const previousDiffs = this._stateManager.getSessionState(session)?.summary.diffs;
+					if (previousDiffs) {
+						incremental = { changedTurnId, previousDiffs };
+					}
 				}
+				diffs = await computeSessionDiffs(session, ref.object, this._diffComputeService, incremental);
 			}
 
-			const diffs = await computeSessionDiffs(session, ref.object, this._diffComputeService, incremental);
 			this._stateManager.dispatchServerAction({
 				type: ActionType.SessionDiffsChanged,
 				session,
-				diffs,
+				diffs: [...diffs],
 			});
 			// Persist diffs to the session database so they survive restarts
 			ref.object.setMetadata('diffs', JSON.stringify(diffs)).catch(err => {
@@ -957,6 +969,35 @@ export class AgentSideEffects extends Disposable {
 		}
 	}
 
+	/**
+	 * Computes session diffs by shelling out to git. Returns the diff list
+	 * when the session has a working directory and that directory is a git
+	 * work tree; returns `undefined` otherwise so the caller can fall back
+	 * to the edit-tracker aggregator. The base branch (anchor for the
+	 * `merge-base` baseline) is read from the provider-agnostic
+	 * {@link META_DIFF_BASE_BRANCH} metadata key — agents that create
+	 * worktrees write it at session-creation time.
+	 */
+	private async _tryComputeGitDiffs(session: ProtocolURI, db: ISessionDatabase): Promise<readonly ISessionFileDiff[] | undefined> {
+		const workingDirectory = this._stateManager.getSessionState(session)?.summary.workingDirectory;
+		if (!workingDirectory) {
+			return undefined;
+		}
+		let workingDirectoryUri: URI;
+		try {
+			workingDirectoryUri = URI.parse(workingDirectory);
+		} catch {
+			return undefined;
+		}
+		const baseBranch = (await db.getMetadata(META_DIFF_BASE_BRANCH)) ?? undefined;
+		try {
+			return await this._gitService.computeSessionFileDiffs(workingDirectoryUri, { sessionUri: session, baseBranch });
+		} catch (err) {
+			this._logService.warn('[AgentSideEffects] git-driven diff computation failed; falling back to edit-tracker', err);
+			return undefined;
+		}
+	}
+
 	override dispose(): void {
 		this._toolCallAgents.clear();
 		super.dispose();

src/vs/platform/agentHost/node/agentSideEffects.ts

@@ -31,7 +31,7 @@ import type { ResolveSessionConfigResult, SessionConfigCompletionsResult } from
 import { ProtectedResourceMetadata, type ConfigSchema, type ModelSelection, type ToolDefinition } from '../../common/state/protocol/state.js';
 import { AHP_AUTH_REQUIRED, ProtocolError } from '../../common/state/sessionProtocol.js';
 import { CustomizationStatus, CustomizationRef, SessionInputResponseKind, type PendingMessage, type SessionInputAnswer, type ToolCallResult, type PolicyState } from '../../common/state/sessionState.js';
-import { IAgentHostGitService } from '../agentHostGitService.js';
+import { IAgentHostGitService, META_DIFF_BASE_BRANCH } from '../agentHostGitService.js';
 import { IAgentHostTerminalManager } from '../agentHostTerminalManager.js';
 import { CopilotAgentSession, SessionWrapperFactory, type IActiveClientSnapshot } from './copilotAgentSession.js';
 import { ICopilotSessionContext, projectFromCopilotContext } from './copilotGitProject.js';
@@ -1024,7 +1024,7 @@ export class CopilotAgent extends Disposable implements IAgent {
 		this._pendingFirstTurnAnnouncements.set(sessionId, buildWorktreeAnnouncementText(branchName));
 		const sessionUri = AgentSession.uri(this.id, sessionId);
 		try {
-			await this._writeWorktreeBranchMetadata(sessionUri, branchName);
+			await this._writeWorktreeBranchMetadata(sessionUri, branchName, baseBranch);
 		} catch (error) {
 			this._logService.warn(`[Copilot:${sessionId}] Failed to persist worktree branch metadata: ${error instanceof Error ? error.message : String(error)}`);
 		}
@@ -1054,10 +1054,14 @@ export class CopilotAgent extends Disposable implements IAgent {
 	private static readonly _META_PROJECT_DISPLAY_NAME = 'copilot.project.displayName';
 	private static readonly _META_WORKTREE_BRANCH = 'copilot.worktree.branchName';
 
-	private async _writeWorktreeBranchMetadata(session: URI, branchName: string): Promise<void> {
+	private async _writeWorktreeBranchMetadata(session: URI, branchName: string, baseBranch: string | undefined): Promise<void> {
 		const dbRef = this._sessionDataService.openDatabase(session);
 		try {
-			await dbRef.object.setMetadata(CopilotAgent._META_WORKTREE_BRANCH, branchName);
+			const work: Promise<void>[] = [dbRef.object.setMetadata(CopilotAgent._META_WORKTREE_BRANCH, branchName)];
+			if (baseBranch) {
+				work.push(dbRef.object.setMetadata(META_DIFF_BASE_BRANCH, baseBranch));
+			}
+			await Promise.all(work);
 		} finally {
 			dbRef.dispose();
 		}

src/vs/platform/agentHost/node/copilot/copilotAgent.ts

@@ -0,0 +1,63 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+import { decodeHex, encodeHex, VSBuffer } from '../../../base/common/buffer.js';
+import { basename } from '../../../base/common/path.js';
+import { URI } from '../../../base/common/uri.js';
+
+const GIT_BLOB_SCHEME = 'git-blob';
+
+/**
+ * Builds a `git-blob:` URI that references a file blob at a specific git
+ * commit, scoped to a given session. Resolved by reading the session's
+ * working directory and shelling out to `git show <sha>:<path>`.
+ *
+ * The session URI is preserved so the resolver can find the session's
+ * working directory; the SHA and repository-relative path identify the
+ * blob to fetch.
+ */
+export function buildGitBlobUri(sessionUri: string, sha: string, repoRelativePath: string): string {
+	return URI.from({
+		scheme: GIT_BLOB_SCHEME,
+		authority: encodeHex(VSBuffer.fromString(sessionUri)).toString(),
+		path: `/${encodeURIComponent(sha)}/${encodeHex(VSBuffer.fromString(repoRelativePath))}/${basename(repoRelativePath)}`,
+	}).toString();
+}
+
+/** Parsed fields from a `git-blob:` content URI. */
+export interface IGitBlobUriFields {
+	readonly sessionUri: string;
+	readonly sha: string;
+	readonly repoRelativePath: string;
+}
+
+/**
+ * Parses a `git-blob:` URI produced by {@link buildGitBlobUri}.
+ * Returns `undefined` if the URI is not a valid `git-blob:` URI.
+ */
+export function parseGitBlobUri(raw: string): IGitBlobUriFields | undefined {
+	let parsed: URI;
+	try {
+		parsed = URI.parse(raw);
+	} catch {
+		return undefined;
+	}
+	if (parsed.scheme !== GIT_BLOB_SCHEME) {
+		return undefined;
+	}
+	const [, sha, encodedPath] = parsed.path.split('/');
+	if (!sha || !encodedPath) {
+		return undefined;
+	}
+	try {
+		return {
+			sessionUri: decodeHex(parsed.authority).toString(),
+			sha: decodeURIComponent(sha),
+			repoRelativePath: decodeHex(encodedPath).toString(),
+		};
+	} catch {
+		return undefined;
+	}
+}