Log AHP frames for the Web PubSub relay transport

[Osvaldo Ortega (osortega)]

The Web PubSub relay was the only agent host transport with no AHP JSONL logging. Cloud sandbox hosts also do not implement vscode/collectAgentHostDebugLogs, so the debug-log export cannot gather frames for them either. Between the two, a sandbox session had no way to show what it actually put on the wire.

What this does

Records every AHP frame to a JSONL transcript, gated on chat.agentHost.ahpJsonlLoggingEnabled, which defaults to product.quality !== 'stable' — on in Insiders and dev builds, off in stable. AhpJsonlLogger truncates oversized values rather than retaining everything.

Outbound frames are logged before chunking, so the transcript holds whole AHP messages rather than the relay frames they were split into. Inbound frames are logged after reassembly, for the same reason.

The logger is optional and owned by the transport, so it is disposed with it. Each soft-reconnect builds a fresh transport and gets its own logger keyed on the connection id.

Risk

No behaviour change when the setting is off, which is the default. The only non-logging change is that the transport registers the logger for disposal.

Validation

• npm run typecheck-client
• Verified against a live session: the transcript captured the full handshake and per-request frames.

[Copilot]

Pull request overview

Adds JSONL frame logging to the Web PubSub transport for cloud sandbox diagnostics.

Changes:

• Logs outbound messages before chunking and inbound messages after reassembly.
• Creates a transport-owned logger for each connection.

Show a summary per file

File	Description
cloudSandboxAgentHostService.ts	Configures per-transport AHP logging.
webPubSubRelayTransport.ts	Records inbound and outbound AHP messages.

Review details

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Suppressed comments (1)

src/vs/platform/agentHost/browser/webPubSubRelayTransport.ts:290

• The raw message can be an authenticate request containing the cloud sandbox's encrypted_github_token (this service sends it during establishment), so this writes a credential envelope into the JSONL log. This is especially risky because the setting defaults to enabled in non-stable builds. AgentHostIpcChannelTransport already redacts params.token before logging; apply that redaction centrally (ideally in AhpJsonlLogger) so this and other relay transports cannot persist authentication credentials.

		this._options.ahpLogger?.log(message, 'c2s', getAhpLogByteLength(JSON.stringify(message)));

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Balanced