Fix enterprise BYOK issues: hidden models, disabled button, account carryover

[pierceboggan]

Fixes three bugs reported against #309023 in the BYOK (Bring Your Own Key) model feature:

#309499 — BYOK model hidden by default

byokKnownModelToAPIInfo() was missing isUserSelectable: true, so the view model defaulted newly added BYOK models to hidden (metadata.isUserSelectable ?? false).

Fix: Add isUserSelectable: true to the returned LanguageModelChatInformation.

#309492 — Add Models button disabled when BYOK is enabled

ContextKeysContribution constructor called _inspectContext() and _updatePermissiveSessionContext() on init, but never _updateClientByokEnabledContext(). The BYOK context key was only set on auth changes, so if auth was already established at extension activation, the context key remained unset and clientByokEnabled returned false.

Fix: Call _updateClientByokEnabledContext() during initialization.

#309501 — BYOK model carries over from individual account

BYOK provider registrations were added to the main DisposableStore and never cleaned up on account switch. When switching from an individual account (BYOK enabled) to an enterprise account (BYOK disabled), providers remained registered and models persisted in the picker.

Fix: Use a separate DisposableStore for BYOK provider registrations, clear it when auth changes and BYOK is disabled, and reset the _byokProvidersRegistered flag.

---

Note: #309495 (rough edges for invalid BYOK flows — no validation warning on add, no UI auto-update on remove) is not addressed in this PR and needs further investigation.

[github-actions]

Screenshot Changes

Base: d87671df Current: 981a87b3

Changed (2)

chat/aiCustomizations/aiCustomizationManagementEditor/McpBrowseMode/Dark

Before	After

chat/aiCustomizations/aiCustomizationManagementEditor/PromptsTabScrolled/Dark

Before	After

[Copilot]

Pull request overview

Fixes enterprise BYOK (Bring Your Own Key) model integration issues in the Copilot extension so BYOK models appear correctly, the “Add Models” UI enables reliably, and BYOK providers don’t persist across account switches when entitlement changes.

Changes:

• Initialize the github.copilot.clientByokEnabled context key during activation (not only on auth changes).
• Track BYOK language model provider registrations in a dedicated DisposableStore and clear them when BYOK becomes disabled on auth change.
• Mark BYOK known models as user-selectable by default (isUserSelectable: true).

Show a summary per file

File	Description
extensions/copilot/src/extension/contextKeys/vscode-node/contextKeys.contribution.ts	Sets the BYOK entitlement context key during initialization to avoid a disabled “Add Models” button when auth already exists.
extensions/copilot/src/extension/byok/vscode-node/byokContribution.ts	Separates BYOK provider registrations for cleanup on account/entitlement changes.
extensions/copilot/src/extension/byok/common/byokProvider.ts	Ensures newly added BYOK models are visible by default in the picker by setting isUserSelectable.

Copilot's findings

Comments suppressed due to low confidence (2)

extensions/copilot/src/extension/byok/vscode-node/byokContribution.ts:67

• There’s a race if authentication changes while fetchKnownModelList is in-flight: _byokProvidersRegistered is set to true before the await, so a later auth change can clear registrations and set the flag back to false, but the original call can still resume and re-register providers even when BYOK is now disabled. Add a cancellation/version guard (or re-check BYOK enablement + current token after the await) before registering providers, and consider setting _byokProvidersRegistered only once registration is actually committed.

		if (byokEnabled && !this._byokProvidersRegistered) {
			this._byokProvidersRegistered = true;
			// Update known models list from CDN so all providers have the same list
			const knownModels = await this.fetchKnownModelList(this._fetcherService);
			if (this._store.isDisposed) {
				return;
			}
			this._providers.set(OllamaLMProvider.providerName.toLowerCase(), instantiationService.createInstance(OllamaLMProvider, this._byokStorageService));

extensions/copilot/src/extension/byok/vscode-node/byokContribution.ts:64

• _authChange is invoked without await/.catch() from the constructor and auth-change listener. If fetchKnownModelList (or later provider setup) throws, this will surface as an unhandled promise rejection. Please catch and log errors within _authChange (or ensure call sites use void this._authChange(...).catch(...)) so transient network failures don’t destabilize the extension host.

			// Update known models list from CDN so all providers have the same list
			const knownModels = await this.fetchKnownModelList(this._fetcherService);
			if (this._store.isDisposed) {

• Files reviewed: 3/3 changed files
• Comments generated: 1

[Copilot]

byokEnabled is derived via authService.copilotToken && ..., which yields boolean | undefined (and relies on truthiness checks). Consider coercing to a strict boolean (e.g. !!authService.copilotToken && ...) so the intent is explicit and the variable’s type stays boolean.

Suggested change

	const byokEnabled = authService.copilotToken && isBYOKEnabled(authService.copilotToken, this._capiClientService);
	const byokEnabled = !!authService.copilotToken && isBYOKEnabled(authService.copilotToken, this._capiClientService);