Support signed-out Agents sessions with BYOK models

[Vritant Bhardwaj (vritant24)]

Summary

• allow local and Copilot harnesses to remain available while signed out
• recognize visible BYOK models in signed-out session availability and bypass Copilot auth preflight for exact advertised BYOK selections
• show harness-scoped guidance to sign in or add a model when no usable model is available
• Gated behind chat.agentHost.allowSignedOutWhenUsable

Related to #329667.

[Copilot]

Pull request overview

Enables signed-out Agents sessions to use BYOK models and adds setup guidance when no usable model exists.

Changes:

• Detects visible BYOK models and bypasses Copilot authentication for advertised BYOK selections.
• Keeps local harnesses accessible while signed out and adds model/sign-in guidance.
• Adds focused availability, authentication, picker, and notification tests.

Show a summary per file

File	Description
modelPickerItems.test.ts	Tests model management during setup.
chatInputNotificationWidget.test.ts	Tests dual Copilot target scoping.
sessionTypeAvailability.test.ts	Tests signed-out and BYOK availability.
agentHostAuth.test.ts	Tests model-specific authentication.
modelPickerItemSections.ts	Adds Manage Models to setup state.
sessionTypeAvailability.ts	Adds BYOK-aware availability.
agentHostSessionHandler.ts	Passes model selection to authentication.
agentHostAuth.ts	Identifies BYOK authentication exemptions.
copilotChatSessionsProvider.test.ts	Tests session authentication metadata.
copilotChatSessionsProvider.ts	Changes legacy harness auth requirements.
sessionTypeAuthRequirement.test.ts	Tests notification readiness predicates.
localAgentHostSessionsProvider.test.ts	Tests signed-out local availability.
localAgentHostSessionsProvider.ts	Marks local harnesses authentication-free.
localAgentHost.contribution.ts	Registers signed-out model guidance.
baseAgentHostSessionsProvider.ts	Supports provider-specific auth resolution.
agentHostSignedOutModelsNotification.ts	Implements reactive setup guidance.

Review details

Suppressed comments (1)

src/vs/sessions/contrib/providers/copilotChatSessions/browser/copilotChatSessionsProvider.ts:71

• Cloud is explicitly a remote Copilot delegation type and still requires GitHub authentication (the availability test at sessionTypeAvailability.test.ts:153-159 asserts this). Advertising it as None lets the signed-out auth gate count it as usable and lets _preferUsableSessionTypeWhenSignedOut retain/select Cloud, after which session creation reaches an auth-dependent backend. Keep Cloud GitHub-gated.

	authRequirement: SessionTypeAuthRequirement.None,

• Files reviewed: 16/16 changed files
• Comments generated: 3
• Review effort level: Balanced

[Copilot]

Review details

Suppressed comments (2)

src/vs/workbench/contrib/chat/browser/agentSessions/agentHost/agentHostSessionHandler.ts:1531

• This preflight only runs while resolving/creating the session. Later turns compute a fresh selectedModel in _sendRequest and dispatch it without calling _ensureRequiredAuthentication, so an established BYOK session that switches to (or retains after sign-out) a Copilot-backed model fails the turn instead of triggering the normal sign-in flow. Re-run the model-aware preflight before dispatching each turn/model change.

				await this._ensureRequiredAuthentication(this._createModelSelection(request.userSelectedModelId, request.modelConfiguration));

src/vs/platform/agentHost/node/copilot/copilotAgent.ts:1001

• Using _byokModels.length reports the provider as usable even when none of those models is usable in the UI. The renderer bridge includes hidden BYOK models (and the bridge contract allows models without modelIdentifier), while renderer availability explicitly rejects hidden or metadata-less copies. Consequently the Agents window gate can open signed out with no selectable BYOK model, violating the no-usable-model case. Base optionality on the same usable-model predicate or propagate visibility/validity through the bridge.

			allowSignedOutWhenUsable && this._byokModels.length > 0 ? { ...copilotResource, required: false } : copilotResource,

• Files reviewed: 30/31 changed files
• Comments generated: 1
• Review effort level: Balanced