VS Code 1.133: Agent Host Protocol Turns AI Sessions Into Infrastructure

VS Code 1.133, released August 12, is not a routine patch. The headline change is the Agent Host Protocol (AHP) — an open specification that moves AI agent sessions into a dedicated standalone process, keeps them alive when you close a window, and lets multiple clients connect to the same session over SSH or dev tunnels. Microsoft published the spec on GitHub under an MIT license, explicitly positioning it alongside LSP and DAP. The same release adds terminal sandboxing on macOS and Linux, and removes the GitHub sign-in requirement for Claude.

AI Sessions as Infrastructure

AHP is the architectural shift that sets this release apart. Before 1.133, AI agent sessions lived inside VS Code’s extension host — start the editor, get a session; close the editor, lose it. AHP breaks that coupling. Agent sessions now run in a standalone process that persists independently of any editor window.

The protocol uses JSON-RPC with immutable state and pure reducers. Clients subscribe to URI-addressed channels for sessions, terminals, and changesets. Every state change carries a monotonic sequence number, so if your connection drops, the client reconnects and replays missed actions — no lost context. Multiple VS Code windows can connect to the same session simultaneously, and remote access works via SSH or dev tunnels out of the box.

Microsoft published the AHP spec on GitHub under the MIT license with client libraries available in Go, Rust, TypeScript, Kotlin, and Swift. The company explicitly positions AHP alongside LSP and DAP — and that framing matters. LSP did not just improve VS Code; it improved every editor that adopted it. AHP bets that agent sessions become standardized infrastructure rather than a proprietary IDE feature. That is a reasonable bet and Microsoft is the right organization to make it. If you missed how the Agent Host first appeared, VS Code 1.130 introduced the early Agent Host architecture.

Sandboxed Terminal Commands

The second significant change is terminal sandboxing. When an AI agent runs a shell command in VS Code, it can now do so inside a restricted environment. On macOS, VS Code uses sandbox-exec; on Linux, it uses bubblewrap with seccomp filters. Both restrict filesystem access to the working directory and block all outbound network access by default.

However, you have to opt in. Set chat.agent.sandbox.enabled to "on" in your settings. If you need the agent to reach specific domains — npm registry, GitHub API — add them to chat.agent.sandbox.allowedDomains:

{
  "chat.agent.sandbox.enabled": "on",
  "chat.agent.sandbox.allowedDomains": ["registry.npmjs.org", "api.github.com"]
}

The limitations are worth noting upfront: Windows support is not available yet, and on Linux you need bubblewrap and socat installed or sandboxing silently fails. Nevertheless, the approach is sound. It uses OS-native primitives, requires no container daemon, and the underlying vscode-sandbox-runtime is a standalone open-source repository — other tools can adopt it without depending on VS Code.

VS Code 1.133 Claude Without GitHub Sign-In

The third change removes a specific friction point. The Agents window previously required you to route Claude through GitHub Copilot’s sign-in flow or configure a separate profile. Now the model picker shows both Anthropic and Copilot model groups, and you can switch providers between turns using your own Anthropic API key.

Developers who subscribe to Anthropic’s API but not GitHub Copilot can use Claude directly in VS Code without workarounds. Signed-out users are limited to Claude text (no image or tool-calling capabilities). Billing is straightforward: Anthropic models charge your API key; Copilot models charge your subscription.

Chat Sticky Scroll and HTML Auto-Reload

Two smaller additions round out the release. Chat sticky scroll pins the active prompt to the top of the viewport when scrolling through long agentic sessions, with previous and next navigation to jump between prompts — useful when a session spans dozens of turns. HTML auto-reload refreshes files in the integrated browser as they change on disk; toggle it per-tab or set workbench.browser.autoReloadOnFileChange globally. Both are incremental improvements, but they reduce the friction of long sessions.

What to Do Now

Update to VS Code 1.133 and enable terminal sandboxing if you are on macOS or Linux. The official release notes cover the full changelog. If you are building agent tooling outside of VS Code, the AHP specification and its MIT-licensed client libraries are worth reading now. The window to influence an emerging standard is early, and AHP is early.