Don't flash sign-in modal at signed-in users during Agents window startup

[Tyler James Leonhardt (TylerLeonhardt)]

The bug

With chat.agentHost.allowSignedOutWhenUsable: true and already signed in to GitHub, launching the Agents window produced a broken sequence:

1. Window launches (auth state not loaded yet)
2. A Claude discovered-config notification flashes
3. The sign-in modal dialog appears
4. In the background, auth finally resolves
5. …but the modal stays up — nothing retires it.

Root cause

The conditional-auth UI added in #328990 conflates "auth not resolved yet" with "signed out."

IDefaultAccountService.currentDefaultAccount is a synchronous getter that returns null for everyone until the first async resolution completes — and that initial null → account assignment fires no onDidChangeDefaultAccount event. So during the startup gap a signed-in user reads as signed-out. Meanwhile Claude churns native → proxy as the host forwards the token (advertising required:false, then required:true), repeatedly re-driving the reaction. The modal gets raised on the transient null, and because resolution is event-silent, nothing ever tears it back down.

The fix

Gate both reactive consumers on a resolved-auth signal, learned via a one-shot getDefaultAccount() await — the only reliable indicator that resolution happened, since the initial assignment is event-silent:

• sessionsSetUpService.ts (the modal): _onUsableWithoutGitHubChanged now no-ops unless the state is genuinely SignedOut, so gap-time Claude churn is inert and the normal sign-in watch owns the signed-in path.
• agentHostDiscoveredConfigNotification.ts (the nudge): _update() returns early while Unresolved instead of flashing the signed-out nudge.
• Shared logic both consumers were duplicating is consolidated into a unit-tested conditionalAuthState() helper (Unresolved | SignedIn | SignedOut) in sessionsAuthGate.ts — single source of truth for the unresolved-vs-signed-out distinction.

The intended signed-out conditional-auth behaviour from #328990 is fully preserved; the change only suppresses action during the unresolved window.

Validation

• Unit: new conditionalAuthState test covers all four (resolved, signedIn) combinations; existing nudge test still passes (2/2).
• Live (signed-in, allowSignedOutWhenUsable: true):
  • Showing sign-in dialog log lines: 0 — modal never raised.
  • Claude churn confirmed active during the gap (26 required:false + 10 required:true protected-resource transitions, plus token-forward/proxy markers) — so the reaction was exercised repeatedly and stayed inert.
  • Steady-state DOM: dialogCount:0, no "Sign in to use Agents" text, no loading overlay, signed-in button present.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Prevents transient sign-in UI while the Agents window’s GitHub account state is unresolved.

Changes:

• Adds a shared conditional-auth state helper.
• Gates the setup modal and configuration notification until authentication resolves.
• Adds a truth-table unit test.

Show a summary per file

File	Description
src/vs/sessions/browser/sessionsAuthGate.ts	Defines resolved authentication states.
src/vs/sessions/browser/sessionsSetUpService.ts	Gates modal reactions during startup.
src/vs/sessions/contrib/providers/agentHost/browser/agentHostDiscoveredConfigNotification.ts	Suppresses unresolved-state notifications.
src/vs/sessions/test/browser/sessionsAuthGate.test.ts	Tests authentication-state classification.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced