[Nathan (nturinski)]

Summary

Fix #1894

• Select prepare-plan.json from the active-session pointer, with a session-identity-verified root fallback. Use deterministic mtime recovery only for absent, invalid, or stale pointers; do not substitute another plan while an active session is pending.
• Validate session path segments and handle multi-root workspaces. Filter inactive watcher events, guard delayed async opens and pointer switches, and close obsolete plans when the selected session is still preparing.
• Preserve approval state keyed by artifact path and exact content. Include focused resolver/view regression tests, user/security documentation, and an issue-linked changelog entry under Unreleased / Fixed.

This PR is based directly on main and is independent of documentation-only PR #1995. No agent instruction changes are included. Intended release: 0.13.3.

Validation

• npm run build — passed.
• npx --no-install eslint --max-warnings 0 src\tree\project\findAppOnboardArtifact.ts src\webviews\copilotOnRails\extension\openDeploymentPlanView.ts src\webviews\copilotOnRails\extension\utils\singletonViewHost.ts test\copilotOnRails\findAppOnboardArtifact.test.ts test\copilotOnRails\deploymentPlanSessionSelection.test.ts — passed.
• npm test -- --run test\copilotOnRails\findAppOnboardArtifact.test.ts test\copilotOnRails\deploymentPlanSessionSelection.test.ts test\copilotOnRails\parsePreparePlanJson.test.ts test\copilotOnRails\deployPrerequisites.test.ts --reporter dot — 71 passing in VS Code 1.144.0 on Windows.
• git diff --check and staged whitespace/line-ending checks — passed; changed files use LF.
• Prior actual Extension Development Host UI verification on Windows reproduced the original wrong-session selection and confirmed the transferred fix selects the active plan, preserves editor focus and the active plan during inactive updates/creates, and updates the open view on pointer switches. Environment: Azure Resources 0.13.2, VS Code 1.144.0, Electron 43.8.3, Node 24.22.1, Playwright 1.64.1, signed-out isolated profiles and synthetic data.

No deployment approval or Azure resource operations were performed. macOS/Linux and signed-in deployments are not claimed verified. Screenshots remain local and are not published in this PR. No screen layout or controls changed; the existing deployment-plan screenshot layout remains applicable.

[Copilot]

🟡 Changes recommended

Unresolved watcher gaps and refresh races can leave stale plans available for approval or incorrectly close a newly opened valid plan view.

4 open issues

• Watch plan pointers and creations in every workspace root · New
• Discard stale refresh results before closing or showing the view · New
• Reload plan content when the pointer changes to the same URI · New
• Reconcile artifact changes that occur during region discovery · New

What changed in this PR

Addresses #1894 by making deployment-plan selection follow the active App Onboard session rather than modification time, with recovery when the session pointer is unavailable or stale.

Changes:

• Adds a shared resolver with session-path validation, verified root fallback, and deterministic recovery.
• Filters plan events and guards delayed opens, closing obsolete plans while the selected session is preparing.
• Adds resolver/view regression tests, user and security documentation, and a changelog entry.

Screenshot follow-up: Refresh 10-deployment-plan-view.png to illustrate active-session behavior; layout and controls are unchanged. No screenshot placeholders were added or removed.

File	Description
test/​copilotOnRails/​findAppOnboardArtifact.test.ts	Tests session selection, recovery, validation, and multiple roots.
test/​copilotOnRails/​deploymentPlanSessionSelection.test.ts	Tests watcher behavior, delayed opens, and approval preservation.
src/​webviews/​copilotOnRails/​extension/​utils/​singletonViewHost.ts	Adds explicit panel closure.
src/​webviews/​copilotOnRails/​extension/​openDeploymentPlanView.ts	Integrates session-aware selection and view refresh handling.
src/​tree/​project/​findAppOnboardArtifact.ts	Adds the shared active-session artifact resolver.
docs/​copilot-create-project.md	Documents selection, recovery, and pending-session behavior.
docs/​copilot-create-project-security.md	Documents session-path and fallback-identity validation.
CHANGELOG.md	Adds an issue-linked Unreleased fix entry.

_{Review effort: Balanced}