Files
vscode/package.json
T
Josh SpicerandCopilot b24c5e3842 policy: enterprise managed_settings for Copilot clients (#318623)
* chat plugins: add policy-backed enabledPlugins / marketplaces / strictMarketplaces settings

Adds three new chat.plugins.* settings, each policy-backed:

- chat.plugins.enabledPlugins (policy:  objectChatEnabledPlugins)
  mapping plugin IDs (`<plugin>@<marketplace>`) to enable/disable.
- chat.plugins.marketplaces (policy:  array ofChatPluginMarketplaces)
  marketplace references (GitHub shorthand or Git URI). User entries
  survive alongside policy entries.
- chat.plugins.strictMarketplaces (policy: ChatStrictMarketplaces)
  boolean restricting trust to listed marketplaces only.

All three are gated on `tags: ['experimental']`. Consumers (plugin
discovery, install, URL handler, marketplace service, quick-pick action)
now read via `inspect()` so default + user + policy layers all flow
through. A shared `readConfiguredMarketplaces` helper in
marketplaceReference.ts dedups the inspect pattern across 5 sites.

Adds three matching fields to IPolicyData so the policy framework has
slots to fill in once the wiring lands; until then they're undefined and
behave like an empty policy (no-op). Plugin discovery now distinguishes
filesystem-path entries (removable from UI) from enterprise plugin IDs
(non-removable) via a single shared loop; `IAgentPlugin.remove` is
optional accordingly.

build/lib/policies/policyData.jsonc regenerated for the new policy keys.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: implement ADR-002 enterprise managed_settings fetch & policy wiring

Wires the previously-added chat.plugins.* policy slots to the new
`/copilot_internal/managed_settings` endpoint on the authenticated
Copilot host.

Core behavior in DefaultAccountProvider:
- Fetches managed_settings alongside entitlements; shares the 1-hour
  cache used by other account-policy fetches.
- Silent fallback to local-only policy on any non-2xx, network error,
  parse error, or missing managedSettingsUrl.
- Rate-limit-aware: backs off all /copilot_internal/* calls when the
  endpoint signals 429, 403 + X-RateLimit-Remaining: 0, or any non-2xx
  with Retry-After.
- adaptManagedSettings flattens the API's structured
  extraKnownMarketplaces map into the existing string-array shape that
  chat.plugins.marketplaces consumes; tolerates malformed entries and
  unknown response keys (forward-compatible).
- Telemetry: emits `defaultaccount:managedSettings:fetch` (owner:
  joshspicer) with an `outcome` bucket (ok / no-response / parse-error /
  status:NNN) and a `rateLimitBackoffActive` flag.

Surface area:
- IDefaultAccountProvider/Service expose managedSettingsFetchStatus and
  managedSettingsFetchedAt; ManagedSettingsFetchStatus is a named union.
- Developer: Policy Diagnostics shows a Managed Settings section with
  the URL status, last-fetched timestamp, and a JSON dump of the
  applied managed-settings policy slice.
- product.json adds a managedSettingsUrl key (populated via distro).

Refactor: `readHeader` and `retryAfterFromHeaders` are moved to
`platform/request/common/request.ts` so githubRepoFetcher.ts and this
new code share one implementation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* bump distro to 36d906669669f12466c6912bd65d9eeb47c6522d

Pulls in managedSettingsUrl from microsoft/vscode-distro#1422.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* update policyData

* policy: address PR review feedback

- Restore historical default for chat.plugins.marketplaces
  (['github/copilot-plugins', 'github/awesome-copilot#marketplace']) so
  existing users don't lose the two built-in marketplaces on update.
  Regenerate policyData.jsonc accordingly.

- Seed _managedSettingsFetchStatus = 'ok' on cache-hit so Policy
  Diagnostics reports the applied state after a process restart that
  warm-starts from cached policyData (instead of stuck at 'not yet
  fetched').

- Scope the <plugin>@<marketplace> ID-resolution rule to the enterprise
  ChatEnabledPlugins setting only. User-typed entries in
  chat.pluginLocations that happen to contain '@' are now treated as
  filesystem paths, as a user would expect, not silently rewritten to
  ~/.copilot/installed-plugins/<x>/<y>/. Split _resolvePluginPath into
  a path-only resolver and a dedicated _resolveEnterprisePluginId.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: revert unnecessary _pluginLocationsConfig refactor

chat.pluginLocations has no policy slot, so observableConfigValue
(which uses getValue() under the hood) is functionally equivalent to
the hand-rolled inspect() version. Reverting reduces diff  thechurn
inspect-based observable is now used only for _enterpriseEnabledPluginsConfig
where the default+user+policy merge actually matters.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: split managed marketplaces into dedicated policy-only setting

Adds chat.plugins.extraMarketplaces (ChatExtraMarketplaces policy,
included: false so it's hidden from the Settings UI). This receives the
'extraKnownMarketplaces' payload from the managed_settings API.

Restores chat.plugins.marketplaces to its pre-PR shape: no policy slot,
no inspect()-juggling required in consumers, no risk of accidentally
clobbering user data. Users write to chat.plugins.marketplaces; the
enterprise writes to chat.plugins.extraMarketplaces; the effective set
is the union.

Consumer simplifications:
- readConfiguredMarketplaces returns { userValues, extraValues,
   two getValue() reads, no inspect() needed.effectiveValues }
- Write-back is now just [...userValues, refValue] in all three sites.
- 'Manage Plugin Marketplaces' still surfaces the 'managed by enterprise
  policy' badge by checking ref membership in extraValues.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: tidy managed_settings code paths

- fetchMarketplacePlugins: drop the over-engineered pre-dedup-by-string;
  parseMarketplaceReferences already dedups by canonical id.
- agentPluginServiceImpl: pass source.remove directly to _toPlugin instead
  of wrapping in a null-asserted closure.
- adaptManagedSettings: use a Set for flatten-and-dedup (insertion order
  is preserved).
- getDefaultAccountFromAuthenticatedSessions: spread merge instead of
  three explicit field assignments.
- developerActions: collapse the 'ok' branch into the catch-all backtick
  wrap; same behavior, less code.
- marketplaceReference.ts: tighter JSDoc on IConfiguredMarketplaces.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: enforce ChatEnabledPlugins and strict-marketplace gates at discovery

Previously the enterprise-managed policy values were delivered into the
policy framework but not  a plugin already installed locallyenforced
(e.g. via the marketplace discovery path) would remain active even when
the policy excluded it or strict-marketplace mode rejected its source.

Adds policy enforcement on AgentPluginService.plugins, applied after
discovery dedup/sort and gated by two observables:

- ChatEnabledPlugins policy: when set, filters the surfaced plugin set
  to only those whose '<name>@<marketplace>' ID appears in the policy
  map with value true. Plugins without a marketplace provenance
  (filesystem entries from chat.pluginLocations) are unaffected.

- ChatStrictMarketplaces: when on, filters out plugins whose source
  marketplace is not trusted. Trust is sourced ONLY from
  chat.plugins.extraMarketplaces (the policy-only  user-setslot)
  entries in chat.plugins.marketplaces do NOT grant trust under strict
  mode. This matches the ADR-002 semantics: strict mode hands full
  marketplace control to the enterprise.

Also updates the chat.plugins.strictMarketplaces description text to
match the new behavior (was still pointing at the user setting).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: extract managed_settings adapter to dedicated helper

Moves IManagedSettingsResponse and adaptManagedSettings out of
defaultAccount.ts and into a new managedSettings.ts in the same folder.
Adapter is a pure transformation function with no service dependencies,
so it belongs in its own file alongside the HTTP/wiring code.

Renames the test file to managedSettings.test.ts to match what it
actually tests and tightens the suite name.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: tidy enforcement filter and sync strict-marketplace policy description

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: show policy-blocked plugins as disabled instead of hiding them

Blocked plugins (ChatEnabledPlugins / strict marketplaces) now stay
visible but are forced disabled via their enablement observable, and the
enable affordance notifies the user instead of re-enabling.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: enforce enabledPlugins/strictMarketplaces for Copilot-CLI plugins

CLI-installed plugins under `~/.copilot/installed-plugins/<marketplace>/<plugin>/`
have no `fromMarketplace` metadata, so they previously bypassed enterprise
policy. Derive their identity from the install-path bucket (matching the
convention used by `_resolveEnterprisePluginId`) so enabledPlugins gating
applies, and add a bucket-name heuristic for strict marketplaces.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* log raw managed_settings response at trace level

Helps debug schema drift / unknown server fields that get dropped by
adaptManagedSettings(). Trace-only so it's off by default.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* improve managed_settings warning for missing repo/url

When a github source is missing 'repo' or a git source is missing 'url',
emit a specific warning naming the missing field instead of the misleading
'unknown source type' message.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* preserve marketplace name through managed_settings policy delivery

The managed_settings adapter previously flattened extraKnownMarketplaces
entries to bare "<owner>/<repo>" or "<url>" strings, losing the marketplace
name. That broke enabledPlugins matching because plugin IDs are keyed as
"<plugin>@<marketplace-name>" but our parsed reference's displayLabel was
derived from the URL/repo instead.

Changes:
- adapter now emits { name, source } objects preserving the full shape
- IPolicyData.extraKnownMarketplaces accepts string | object entries
- parseMarketplaceReferences gains object-handling, using name as displayLabel
- workspacePluginSettingsService shares the object parser
- policy schema relaxed to allow object items

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: clarify chat.plugins.enabledPlugins description

The previous 'Merged with entries from chat.pluginLocations' was misleading:
the two settings use different key namespaces (plugin IDs vs filesystem paths)
and the enabledPlugins policy also acts as an allowlist that gates
marketplace-discovered  not a symmetric merge.plugins

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: add description for chat.plugins.extraMarketplaces

The setting was missing a markdownDescription, so the Settings UI card
rendered empty when shown under 'Managed by organization'. Also updated
the policy localization to mention the new { name, source } object form.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: shorten chat.plugins.extraMarketplaces description

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: drop policy name from extraMarketplaces description

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: re-fetch plugin marketplaces when ExtraMarketplaces policy changes

pluginMarketplaceService.onDidChangeMarketplaces only listened for
PluginsEnabled and PluginMarketplaces config changes, so the
ExtraMarketplaces values delivered by the ChatExtraMarketplaces policy
never triggered a  the union was stale until the next user editrefetch
to chat.plugins.marketplaces or a workspace-trust change.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: extract IExtraKnownMarketplaceEntry to base/common/managedSettings

Move the enterprise-managed marketplace entry type out of defaultAccount.ts
into a dedicated managedSettings.ts so the type lives alongside other
managed-settings-specific code.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: cleanup pass

- Sync policyData.jsonc ChatExtraMarketplaces description with the
  source declaration in chat.shared.contribution.ts (object-form
  entries were missing from the policy artifact).
- Reorder Event import in agentPluginServiceImpl.ts to keep base/common
  imports alphabetical.
- Fix stale doc reference (COPILOT_CLI_INSTALLED_PLUGINS_DIR -> the
  function it actually mirrors).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: accept host-only git URLs in extraKnownMarketplaces

ADR-002 describes the `git` source `url` as a free-form `(string)`
the example happens to be a full clone URL, but the schema doesn't
require a repo path. Our marketplace-URI parser was rejecting host-only
HTTPS endpoints (e.g. `https://plugins.internal.example.com`), so
enterprise policy entries with marketplace-registry-style URLs were
silently dropped before they ever reached the UI.

Relax `parseUriMarketplaceReference` to accept host-only URLs and
treat them as a marketplace endpoint identified by host alone. The
canonical id becomes `git:<host>/` so distinct hosts still dedupe
correctly. Existing path-aware behavior is preserved unchanged.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: fix string entry guard in extraKnownMarketplaces policy.value; fix test cloneUrl expectation

- Handle string-typed entries in extraKnownMarketplaces (IPolicyData allows string | IExtraKnownMarketplaceEntry)
- Fix test expectation: URI.parse normalizes host-only URLs to include trailing slash

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: read extraMarketplaces dict and convert to nested entry shape

The setting schema is now `{ [name]: url-or-shorthand }` (object), so
readConfiguredMarketplaces must convert each entry to the nested
IExtraMarketplaceObjectEntry shape that parseMarketplaceReferences expects.
Uses a regex to detect GitHub shorthand (owner/repo[#ref]) vs URI.

 TypeError in CI:
'extraValues is not iterable' on [...userValues, ...extraValues].

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: extract extraKnownMarketplacesToConfigDict helper + add regression tests for Settings Editor display

Extract the policy.value conversion for ChatExtraMarketplaces out of
chat.shared.contribution.ts into a reusable, unit-testable helper. The
helper converts the IExtraKnownMarketplaceEntry[] policy payload into the
{ [name]: url-or-shorthand } dict that:
  - the Settings Editor's ComplexObject renderer can display inline as
    key/value rows (instead of just 'Edit in settings.json'), and
  - readConfiguredMarketplaces reverses back into IExtraMarketplaceObjectEntry[]
    so parseMarketplaceReferences preserves displayLabel = name.

Tests added:
 undefined
 owner/repo
 owner/repo#ref
 raw URL (+ optional #ref)

    parseMarketplaceReferences flow (the regression test that catches the
    'extraValues is not iterable' bug we just hit in CI)
  - schema-shape: chat.plugins.extraMarketplaces is registered with
    type=object + additionalProperties.type=['string'], the exact shape
    the Settings Editor requires to render as ComplexObject

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: stop spurious 'invalid marketplace entry' warnings for object-form entries

url dict, policy
entries always reach the marketplace fetcher as IExtraMarketplaceObjectEntry
objects (not strings). The validation loop was only accepting strings,
producing a 'Ignoring invalid marketplace entry: [object Object]' debug log
for every valid policy entry.

Validate using parseMarketplaceObjectEntry for object values so the warning
fires only for genuinely-unparseable entries.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: drop schema-shape test that double-registered chat contribution commands

The schema-shape test for chat.plugins.extraMarketplaces imported the full
chat.shared.contribution module to populate the configuration registry.
This re-registered commands (already registered by the workbench under
test), producing 'Cannot register two commands with the same id:
workbench.action.chat.markHelpful' and cascading disposable leaks in
unrelated suites (EditorService, WorkingCopyBackupTracker).

The other 5 tests (extraKnownMarketplacesToConfigDict + end-to-end round
trip) cover the actual behavior that broke; the schema shape is exercised
implicitly by the round-trip test.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* policy: normalize github.com URI/SSH refs to the GitHub shorthand canonical id

Plugin marketplace trust under strict mode compares canonicalId. A plugin
discovered from 'https://github.com/microsoft/vscode-team-kit.git' was
being blocked even though 'microsoft/vscode-team-kit' was in the trusted
list, because the URI parser produced 'git:github.com/microsoft/vscode-team-kit.git'
while the shorthand parser produced 'github:microsoft/vscode-team-kit'.

When parseUriMarketplaceReference / parseScpMarketplaceReference detect a
github.com authority, emit the same canonical id form the shorthand parser
uses so all three forms (shorthand, https URI, SCP) collapse to a single
trusted reference.

Existing dedup test now expects 1 entry instead of 2; ref-distinction test
collapses the https+#ref entry with its shorthand sibling. Added a focused
regression test asserting all four forms produce identical canonical ids.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* update policy

* fix dupe policy export

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-05-29 14:03:37 -07:00

281 lines
13 KiB
JSON

{
"name": "code-oss-dev",
"version": "1.122.0",
"distro": "36d906669669f12466c6912bd65d9eeb47c6522d",
"author": {
"name": "Microsoft Corporation"
},
"license": "MIT",
"main": "./out/main.js",
"type": "module",
"private": true,
"scripts": {
"test": "echo Please run any of the test scripts from the scripts folder.",
"test-browser": "npx playwright install && node test/unit/browser/index.js",
"test-browser-no-install": "node test/unit/browser/index.js",
"test-node": "mocha test/unit/node/index.js --delay --ui=tdd --timeout=5000 --exit",
"test-extension": "vscode-test",
"test-build-scripts": "cd build && npm run test",
"check-cyclic-dependencies": "node build/lib/checkCyclicDependencies.ts out",
"preinstall": "node build/npm/preinstall.ts",
"postinstall": "node build/npm/postinstall.ts",
"compile": "npm-run-all2 -lp compile-client compile-copilot",
"compile-client": "npm run gulp compile",
"compile-copilot": "npm --prefix extensions/copilot run compile",
"compile-check-ts-native": "tsgo --project ./src/tsconfig.json --noEmit --skipLibCheck",
"watch": "npm-run-all2 -lp watch-client-transpile watch-client watch-extensions watch-copilot",
"watchd": "deemon npm run watch",
"watch-webd": "deemon npm run watch-web",
"kill-watchd": "deemon --kill npm run watch",
"kill-watch-webd": "deemon --kill npm run watch-web",
"restart-watchd": "deemon --restart npm run watch",
"restart-watch-webd": "deemon --restart npm run watch-web",
"watch-client": "npm run gulp watch-client",
"watch-clientd": "deemon npm run watch-client",
"kill-watch-clientd": "deemon --kill npm run watch-client",
"transpile-client": "node build/next/index.ts transpile",
"watch-client-transpile": "node build/next/index.ts transpile --watch",
"watch-client-transpiled": "deemon npm run watch-client-transpile",
"kill-watch-client-transpiled": "deemon --kill npm run watch-client-transpile",
"watch-extensions": "npm run gulp watch-extensions watch-extension-media",
"watch-extensionsd": "deemon npm run watch-extensions",
"kill-watch-extensionsd": "deemon --kill npm run watch-extensions",
"watch-copilot": "npm --prefix extensions/copilot run watch",
"watch-copilotd": "deemon npm run watch-copilot",
"kill-watch-copilotd": "deemon --kill npm run watch-copilot",
"precommit": "node --experimental-strip-types build/hygiene.ts",
"gulp": "node --experimental-strip-types --max-old-space-size=8192 ./node_modules/gulp/bin/gulp.js",
"electron": "node build/lib/electron.ts",
"7z": "7z",
"update-grammars": "node build/npm/update-all-grammars.ts",
"update-localization-extension": "node build/npm/update-localization-extension.ts",
"mixin-telemetry-docs": "node build/npm/mixin-telemetry-docs.ts",
"smoketest": "node build/lib/preLaunch.ts && cd test/smoke && npm run compile && node test/index.js",
"smoketest-no-compile": "cd test/smoke && node test/index.js",
"download-builtin-extensions": "node build/lib/builtInExtensions.ts",
"download-builtin-extensions-cg": "node build/lib/builtInExtensionsCG.ts",
"monaco-compile-check": "tsgo --project src/tsconfig.monaco.json --noEmit",
"tsec-compile-check": "node node_modules/tsec/bin/tsec -p src/tsconfig.tsec.json",
"vscode-dts-compile-check": "tsgo --project src/tsconfig.vscode-dts.json && tsgo --project src/tsconfig.vscode-proposed-dts.json",
"valid-layers-check": "node build/checker/layersChecker.ts && tsgo --project build/checker/tsconfig.browser.json && tsgo --project build/checker/tsconfig.worker.json && tsgo --project build/checker/tsconfig.node.json && tsgo --project build/checker/tsconfig.electron-browser.json && tsgo --project build/checker/tsconfig.electron-main.json && tsgo --project build/checker/tsconfig.electron-utility.json",
"define-class-fields-check": "node build/lib/propertyInitOrderChecker.ts && tsgo --project src/tsconfig.defineClassFields.json",
"update-distro": "node build/npm/update-distro.ts",
"export-policy-data": "node build/lib/policies/exportPolicyData.ts",
"web": "echo 'npm run web' is replaced by './scripts/code-server' or './scripts/code-web'",
"compile-cli": "npm run gulp compile-cli",
"compile-web": "npm run gulp compile-web",
"serve-out-rspack": "cd build/rspack && npx rspack serve --config rspack.serve-out.config.mts",
"watch-web": "npm run gulp watch-web",
"watch-cli": "npm run gulp watch-cli",
"eslint": "node build/eslint.ts",
"stylelint": "node build/stylelint.ts",
"playwright-install": "npm exec playwright install",
"compile-build": "npm run gulp compile-build-with-mangling",
"compile-extensions-build": "npm run gulp compile-extensions-build",
"minify-vscode": "npm run gulp minify-vscode",
"minify-vscode-reh": "npm run gulp minify-vscode-reh",
"minify-vscode-reh-web": "npm run gulp minify-vscode-reh-web",
"hygiene": "npm run gulp hygiene",
"core-ci": "npm run gulp core-ci",
"extensions-ci": "npm run gulp extensions-ci",
"perf": "node scripts/code-perf.js",
"perf:chat": "node scripts/chat-simulation/test-chat-perf-regression.js",
"perf:chat-leak": "node scripts/chat-simulation/test-chat-mem-leaks.js",
"copilot:setup": "npm --prefix extensions/copilot run setup",
"copilot:get_token": "npm --prefix extensions/copilot run get_token",
"update-build-ts-version": "npm install -D typescript@next && npm install -D @typescript/native-preview && (cd build && npm run typecheck)",
"install-local-component-explorer": "npm install ../vscode-packages/js-component-explorer/dist/vscode-component-explorer-0.1.0.tgz ../vscode-packages/js-component-explorer/dist/vscode-component-explorer-cli-0.1.0.tgz --no-save && cd build/rspack && npm install ../../../vscode-packages/js-component-explorer/dist/vscode-component-explorer-webpack-plugin-0.1.0.tgz --no-save && cd ../vite && npm install ../../../vscode-packages/js-component-explorer/dist/vscode-component-explorer-vite-plugin-0.1.0.tgz --no-save",
"symlink-local-component-explorer": "npm install ../vscode-packages/js-component-explorer/packages/explorer ../vscode-packages/js-component-explorer/packages/cli --no-save && cd build/rspack && npm install ../../../vscode-packages/js-component-explorer/packages/webpack-plugin ../../../vscode-packages/js-component-explorer/packages/explorer --no-save && cd ../vite && npm install ../../../vscode-packages/js-component-explorer/packages/vite-plugin ../../../vscode-packages/js-component-explorer/packages/explorer --no-save",
"install-latest-component-explorer": "npm install @vscode/component-explorer@next @vscode/component-explorer-cli@next && cd build/rspack && npm install @vscode/component-explorer-webpack-plugin@next @vscode/component-explorer@next && cd ../vite && npm install @vscode/component-explorer-vite-plugin@next @vscode/component-explorer@next"
},
"dependencies": {
"@anthropic-ai/sdk": "^0.82.0",
"@github/copilot": "1.0.55-3",
"@github/copilot-sdk": "1.0.0-beta.8",
"@microsoft/1ds-core-js": "^3.2.13",
"@microsoft/1ds-post-js": "^3.2.13",
"@microsoft/dev-tunnels-connections": "^1.3.41",
"@microsoft/dev-tunnels-contracts": "^1.3.41",
"@microsoft/dev-tunnels-management": "^1.3.41",
"@microsoft/dev-tunnels-ssh": "^3.12.22",
"@microsoft/dev-tunnels-ssh-tcp": "^3.12.22",
"@microsoft/mxc-sdk": "0.2.1",
"@parcel/watcher": "^2.5.6",
"@types/semver": "^7.5.8",
"@vscode/codicons": "^0.0.46-14",
"@vscode/copilot-api": "^0.4.2",
"@vscode/deviceid": "^0.1.1",
"@vscode/diff": "0.0.2-7",
"@vscode/iconv-lite-umd": "0.7.1",
"@vscode/native-watchdog": "^1.4.6",
"@vscode/policy-watcher": "^1.3.2",
"@vscode/proxy-agent": "^0.42.0",
"@vscode/ripgrep-universal": "^1.18.0",
"@vscode/sandbox-runtime": "0.0.1",
"@vscode/spdlog": "^0.15.8",
"@vscode/sqlite3": "5.1.12-vscode",
"@vscode/sudo-prompt": "9.3.2",
"@vscode/tree-sitter-wasm": "^0.3.1",
"@vscode/vscode-languagedetection": "1.0.23",
"@vscode/windows-mutex": "^0.5.0",
"@vscode/windows-process-tree": "^0.7.0",
"@vscode/windows-registry": "^1.2.0",
"@xterm/addon-clipboard": "^0.3.0-beta.220",
"@xterm/addon-image": "^0.10.0-beta.220",
"@xterm/addon-ligatures": "^0.11.0-beta.220",
"@xterm/addon-progress": "^0.3.0-beta.220",
"@xterm/addon-search": "^0.17.0-beta.220",
"@xterm/addon-serialize": "^0.15.0-beta.220",
"@xterm/addon-unicode11": "^0.10.0-beta.220",
"@xterm/addon-webgl": "^0.20.0-beta.219",
"@xterm/headless": "^6.1.0-beta.220",
"@xterm/xterm": "^6.1.0-beta.220",
"chrome-remote-interface": "^0.33.0",
"http-proxy-agent": "^7.0.0",
"https-proxy-agent": "^7.0.2",
"jschardet": "3.1.4",
"katex": "^0.16.22",
"kerberos": "2.1.1",
"minimist": "^1.2.8",
"native-is-elevated": "0.9.0",
"native-keymap": "^3.3.5",
"node-pty": "^1.2.0-beta.13",
"open": "^10.1.2",
"playwright-core": "1.59.1",
"ssh2": "^1.16.0",
"tas-client": "0.3.1",
"undici": "^7.24.0",
"vscode-oniguruma": "1.7.0",
"vscode-regexpp": "^3.1.0",
"vscode-textmate": "^9.3.2",
"ws": "^8.19.0",
"yauzl": "^3.3.1",
"yazl": "^2.4.3",
"zod": "^3.25.76"
},
"devDependencies": {
"@anthropic-ai/claude-agent-sdk": "0.2.128",
"@playwright/cli": "^0.1.9",
"@playwright/test": "^1.56.1",
"@stylistic/eslint-plugin-ts": "^2.8.0",
"@types/chrome-remote-interface": "^0.33.0",
"@types/cookie": "^0.3.3",
"@types/debug": "^4.1.5",
"@types/eslint": "^9.6.1",
"@types/gulp-svgmin": "^1.2.1",
"@types/http-proxy-agent": "^2.0.1",
"@types/kerberos": "^1.1.2",
"@types/minimist": "^1.2.1",
"@types/mocha": "^10.0.10",
"@types/node": "24.x",
"@types/sinon": "^10.0.2",
"@types/sinon-test": "^2.4.2",
"@types/source-map-support": "^0.5.10",
"@types/ssh2": "^1.15.4",
"@types/trusted-types": "^2.0.7",
"@types/vscode-notebook-renderer": "^1.72.0",
"@types/wicg-file-system-access": "^2023.10.7",
"@types/windows-foreground-love": "^0.3.0",
"@types/winreg": "^1.2.30",
"@types/ws": "^8.18.1",
"@types/yauzl": "^2.10.0",
"@types/yazl": "^2.4.2",
"@typescript-eslint/utils": "^8.45.0",
"@typescript/native-preview": "^7.0.0-dev.20260429",
"@vscode/component-explorer": "^0.2.1-27",
"@vscode/component-explorer-cli": "^0.2.1-27",
"@vscode/gulp-electron": "1.41.3",
"@vscode/l10n-dev": "0.0.35",
"@vscode/telemetry-extractor": "^1.20.2",
"@vscode/test-cli": "^0.0.6",
"@vscode/test-electron": "^2.4.0",
"@vscode/test-web": "^0.0.76",
"@vscode/v8-heap-parser": "^0.1.0",
"@vscode/vscode-perf": "^0.0.19",
"@webgpu/types": "^0.1.66",
"ansi-colors": "^3.2.3",
"asar": "^3.0.3",
"chromium-pickle-js": "^0.2.0",
"cookie": "^0.7.2",
"debounce": "^1.0.0",
"deemon": "^1.13.6",
"electron": "42.2.0",
"eslint": "^9.36.0",
"eslint-formatter-compact": "^8.40.0",
"eslint-plugin-header": "3.1.1",
"eslint-plugin-import": "^2.32.0",
"eslint-plugin-jsdoc": "^50.3.1",
"event-stream": "3.3.4",
"fancy-log": "^1.3.3",
"glob": "^5.0.13",
"gulp": "^4.0.0",
"gulp-azure-storage": "^0.12.1",
"gulp-bom": "^3.0.0",
"gulp-buffer": "0.0.2",
"gulp-filter": "^5.1.0",
"gulp-flatmap": "^1.0.2",
"gulp-gunzip": "^1.0.0",
"gulp-gzip": "^1.4.2",
"gulp-json-editor": "^2.5.0",
"gulp-plumber": "^1.2.0",
"gulp-rename": "^1.2.0",
"gulp-replace": "^0.5.4",
"gulp-sourcemaps": "^3.0.0",
"gulp-svgmin": "^4.1.0",
"husky": "^0.13.1",
"innosetup": "^6.4.1",
"istanbul-lib-coverage": "^3.2.0",
"istanbul-lib-instrument": "^6.0.1",
"istanbul-lib-report": "^3.0.0",
"istanbul-lib-source-maps": "^4.0.1",
"istanbul-reports": "^3.1.5",
"lazy.js": "^0.4.2",
"merge-options": "^1.0.1",
"mime": "^1.4.1",
"minimatch": "^3.1.5",
"mocha": "^10.8.2",
"mocha-junit-reporter": "^2.2.1",
"mocha-multi-reporters": "^1.5.1",
"npm-run-all2": "^8.0.4",
"os-browserify": "^0.3.0",
"p-all": "^1.0.0",
"path-browserify": "^1.0.1",
"pump": "^1.0.1",
"rcedit": "^1.1.0",
"rimraf": "^2.2.8",
"sinon": "^12.0.1",
"sinon-test": "^3.1.3",
"source-map": "0.6.1",
"source-map-support": "^0.5.21",
"tar": "^7.5.9",
"tsec": "0.2.7",
"tslib": "^2.6.3",
"typescript": "^6.0.0-dev.20260416",
"typescript-eslint": "^8.45.0",
"util": "^0.12.4",
"xml2js": "^0.5.0",
"yaserver": "^0.4.0"
},
"overrides": {
"node-gyp-build": "4.8.1",
"kerberos@2.1.1": {
"node-addon-api": "7.1.0"
},
"serialize-javascript": "^7.0.3",
"ssh2": {
"cpu-features": "0.0.0"
},
"yauzl": "^3.3.1"
},
"repository": {
"type": "git",
"url": "https://github.com/microsoft/vscode.git"
},
"bugs": {
"url": "https://github.com/microsoft/vscode/issues"
},
"optionalDependencies": {
"windows-foreground-love": "0.6.1"
}
}