Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[wip] Add canvas launch authorization and session retention - #2630

Draft
ulugbekna wants to merge 1 commit into
mainfrom
ulugbekna/local-canvas-sdk-launch
Draft

[wip] Add canvas launch authorization and session retention#2630
ulugbekna wants to merge 1 commit into
mainfrom
ulugbekna/local-canvas-sdk-launch

Conversation

@ulugbekna

@ulugbekna ulugbekna commented Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Summary

Add the public Node SDK launch-provider and no-turn retention contracts required by a host that runs explicitly approved local canvas packages.

Included

  • CopilotClientOptions.extensionLaunchProvider, public request/result/profile/source types, and exact live { contractVersion: 1 } acknowledgement before creation/resume and on replacement connections.
  • Shared startup, cancellation and replacement-connection handling; older/null/error acknowledgements fail closed rather than retrying without the provider.
  • Generated session.retain / session.retained bindings and client.retainSession(sessionId) for connected-client retention while an initial create/resume is still waiting on a launch resolver.
  • Documentation and focused unit/E2E fixtures covering registration, denial/error, reconnect, retention, reentrant startup and actual package execution.
  • Clients without a launch provider preserve their existing behavior.

This API is not a code-integrity mechanism, trust store or backend sandbox. The consuming host still owns exact package/revision/workspace approval.

Validation

  • Fresh pre-PR run: npx vitest run test/extension-launch-provider.test.ts — 23 passing.
  • The implementation handoff additionally records 93 targeted tests, type/lint/format checks, real compatible-runtime tests and packed-package consumption checks.
  • The compatible stack was exercised through actual native canvas creation, actions, lifecycle and canvas-originated model requests.
  • The generated protocol files came from the runtime's canonical schema generation, not manual mirror edits.
  • Generation reflects the complete supplied schema snapshot, including unrelated upstream declaration changes; it does not imply additional SDK feature implementation or compatibility coverage.

WIP / dependencies

  • Requires a companion compatible runtime implementation; registration with an incompatible runtime must reject.
  • The previously reproduced model-selection/disconnect/same-ID-resume failure is fixed in the companion runtime. The unchanged public SDK reproducer and full three-test host integration file now pass with that corrected runtime; no additional SDK API change was needed.
  • This draft does not bump/release SDK packages or claim all-language SDK parity for the new Node client option.

Review and CI follow-up (2026-09-13)

  • Rebased head dd1a8979 passes Node typecheck, build, lint/format and 225 selected local tests with the correct runtime artifacts.
  • Real VS Code SDK integration and native OSS verification cover first-worktree materialization, immediate opening after an existing turn's package approval, multiple canvas documents, explicit tool permission, same-ID reconfiguration and provider restart.
  • Current CI has 39 passing and five skipped checks. The only failure is Verify generated files are up-to-date: it regenerates from released CLI 1.0.84-5, whose schemas do not contain the new launch acknowledgement or retention API/event.
  • This is a release-order dependency, not a check to suppress. First release the companion runtime through its authorized process, then update the real CLI pin and regenerate through the normal SDK workflow. No unpublished registry version, private source vendoring or generation waiver is introduced here.

Local .local/ and nodejs/.local/ caches, packed artifacts, runtime logs and consumer scratch directories are intentionally excluded.

Public companion drafts

The runtime implementation is tracked separately in its existing private repository.

@ulugbekna ulugbekna mentioned this pull request Sep 11, 2026
Draft
@ulugbekna
sdk: feat: add canvas launch authorization and session retention
dd1a897 
Require an exact live launch-provider contract acknowledgement before session
startup and on replacement connections. Preserve ordinary client behavior
when no provider is configured, and fail closed instead of falling back.

Expose explicit no-turn retention through generated session RPCs and a
connected-client retain-by-ID helper. Include source, reconnect, runtime and
packed-consumer regression coverage and document the public contract.

Co-authored-by: Copilot <[email protected]>
Copilot-Session: a069b1a2-65a9-4427-b3fe-6546a3bffc9e
@ulugbekna
ulugbekna force-pushed the ulugbekna/local-canvas-sdk-launch branch from c595899 to dd1a897 Compare September 13, 2026 15:09
@github-actions

github-actions Bot commented Sep 13, 2026

Copy link
Copy Markdown
Contributor

SDK Consistency Review

This PR (marked [wip] / draft) adds two new Node.js/TypeScript-only client capabilities:

  1. CopilotClientOptions.extensionLaunchProvider — a connection-global resolver for extension process launches, with client.rpc.registerExtensionLaunchProvider() wiring, {contractVersion: 1} acknowledgement handshake, and fail-closed behavior on older/incompatible runtimes.
  2. client.retainSession(sessionId) — new generated session.retain / session.retained RPC bindings for connected-client session retention while an initial create/resume is pending on a launch resolver.

Cross-SDK findings

  • extensionLaunchProvider: The Rust SDK already has a fuller, previously-merged implementation of the equivalent concept (rust/src/extension_launch_provider.rs, ClientOptions::with_extension_launch_provider, ExtensionLaunchProvider trait, register_extension_launch_provider()), so Rust is not behind here. However, Go, Python, .NET, and Java only have the generated RPC/protocol types (ExtensionLaunchProviderResolveRequest/Result, RegisterExtensionLaunchProvider) with no client-level ClientOptions field or handler wiring exposed — i.e., the feature is not actually usable from those four SDKs yet.
  • retainSession: Not found in any other SDK (Go, Python, .NET, Java, Rust) — this appears to be Node.js-exclusive so far.

Assessment

This looks like intentional, staged work rather than an oversight: the PR description explicitly states "This draft does not bump/release SDK packages or claim all-language SDK parity for the new Node client option" and is still in draft/WIP state pending a companion runtime implementation. No inline comments are being added since the author has already flagged the parity gap themselves.

Suggestion for follow-up (non-blocking for this draft): once the runtime contract stabilizes, consider tracking follow-up work to bring extensionLaunchProvider client wiring and retainSession to Go, Python, .NET, and Java to restore full cross-language parity, since Rust already demonstrates the pattern can be mirrored.

Generated by SDK Consistency Review Agent for #2630 · copilot · sonnet50 · 41.7 AIC · ⌖ 12.2 AIC · ⊞ 8.3K · ◷

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot will automatically review once the pull request is marked ready for review

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ulugbekna