[Tal Zaccai (TalZaccai)]

Issue

The Visual Studio extension trusted an unauthenticated localhost discovery response and action WebSocket. A local impostor could substitute the bridge endpoint and dispatch arbitrary IDE actions, including named commands with attacker-controlled arguments.

Mitigating steps

• Authenticate Visual Studio discovery responses before trusting returned ports.
• Provision fail-closed, ACL-protected per-user bootstrap credentials.
• Add mutual action-channel authentication with directional session keys, replay protection, and expiry enforcement.
• Dispatch executor actions only after authentication and bind responses to the exact client/session.
• Preserve authenticated explicit-port overrides, reconnects, multiple-client routing/fallback, and browser-Origin rejection.
• Avoid logging bootstrap secrets, proofs, session keys, or authenticated envelopes.
• Add ephemeral-loopback C# and TypeScript regressions using stub/recording executors.
• Validate affected TypeScript/C# builds, the VSIX build, focused tests, frozen lockfile, formatting, and repository ratchet gates.

[Copilot]

🟡 Changes recommended

Connection lifecycle failures and a clock-dependent regression fixture remain unresolved.

4 open issues

• Fixed session expiry breaks valid-action test · New
• Authentication receive can block reconnects indefinitely · New
• Late responses disconnect authenticated clients · New
• Shutdown leaves unauthenticated sockets open · New

1 file not reviewed

• ts/pnpm-lock.yaml: Generated file

What changed in this PR

Authenticates the bridge between TypeAgent and Visual Studio before trusting discovery results or dispatching IDE actions.

Changes:

• Adds protected per-user credentials and authenticated discovery.
• Adds session-based action authentication, replay protection, and response ownership checks.
• Adds regression tests, build wiring, and authentication documentation.

File	Description
ts/​pnpm-lock.yaml	Records new test dependencies.
ts/​packages/​utils/​webSocketUtils/​src/​visualStudioBridgeAuth.ts	Implements credentials and authentication primitives.
ts/​packages/​utils/​webSocketUtils/​package.json	Exports authentication utilities.
ts/​packages/​shell/​src/​main/​discoveryServer.ts	Protects shell discovery responses.
ts/​packages/​agentServer/​server/​src/​connectionHandler.ts	Protects server discovery responses.
ts/​packages/​agentServer/​protocol/​src/​protocol.ts	Adds discovery authentication contracts and hooks.
ts/​packages/​agentServer/​protocol/​src/​index.ts	Exports discovery authentication types.
ts/​packages/​agents/​visualStudio/​tsconfig.json	Includes the test project.
ts/​packages/​agents/​visualStudio/​test/​visualStudioBridgeAuth.spec.ts	Tests authentication and client routing.
ts/​packages/​agents/​visualStudio/​test/​tsconfig.json	Configures test compilation.
ts/​packages/​agents/​visualStudio/​src/​visualStudioActionHandler.ts	Authenticates clients and binds responses to sessions.
ts/​packages/​agents/​visualStudio/​src/​originAllowlist.ts	Rejects explicit null origins.
ts/​packages/​agents/​visualStudio/​README.md	Documents authentication and overrides.
ts/​packages/​agents/​visualStudio/​package.json	Adds test scripts and dependencies.
dotnet/​visualStudioTypeAgent/​VisualStudioTypeAgent.csproj	Includes authentication sources and security reference.
dotnet/​visualStudioTypeAgent/​Bridge/​DTEActionExecutor.cs	Implements the executor interface.
dotnet/​visualStudioTypeAgent/​Bridge/​BridgeDiscovery.cs	Verifies discovery proofs before accepting ports.
dotnet/​visualStudioTypeAgent/​Bridge/​BridgeAuthentication.cs	Implements credential validation and cryptographic framing.
dotnet/​visualStudioTypeAgent/​Bridge/​AuthenticatedBridgeConnection.cs	Gates execution behind authenticated sessions.
dotnet/​visualStudioTypeAgent/​Bridge/​AgentBridgeClient.cs	Uses authenticated discovery and connections.
dotnet/​visualStudioTypeAgent.Tests/​VisualStudioTypeAgent.Tests.csproj	Adds the C# regression harness.
dotnet/​visualStudioTypeAgent.Tests/​VisualStudioTypeAgent.BridgeCompile.csproj	Adds framework compatibility compilation.
dotnet/​visualStudioTypeAgent.Tests/​Program.cs	Tests proofs, replay rejection, and executor gating.
dotnet/​visualStudioTypeAgent.Tests/​BridgeCompileStubs.cs	Supplies isolated Visual Studio stubs.

_{Review effort: Balanced}