feat: support scalar union policy types

[Harald Kirschner (digitarald)]

Summary

• allow a policy key to declare a non-empty union of scalar native types
• read exact boolean/string/number representations through one per-key native policy
• preserve machine-over-user precedence and reject unforced macOS preferences
• keep existing single-type declarations on their established readers
• pin GitHub Windows CI to the Windows 2022 image supported by Node 22's node-gyp
• prepare the 1.5.0 package release

This unblocks the canonical strictPluginOnlyCustomization managed-setting key from carrying both its existing boolean form and its selective JSON-array string form without breaking deployed native booleans.

Dependent VS Code PR: microsoft/vscode#332071

Validation

• authoritative Azure pipeline passes on Linux, macOS, Windows, package creation, and SDL analysis
• GitHub Actions passes on Linux, macOS, and Windows 2022, plus CodeQL
• local Windows native build (Node 24.18.0)
• manual registry reads for REG_DWORD true and REG_SZ "[]"
• two focused code-review passes over Windows and macOS native readers

CI compatibility

GitHub's windows-latest image now exposes Visual Studio 2026, which Node 22's bundled node-gyp cannot identify. PR #76 pins the GitHub Windows job to windows-2022, retaining the supported Visual Studio 2022 toolchain while leaving the Azure Windows build unchanged.

Release sequence

After approval and merge, run the existing Azure pipeline with publishPackage: true to publish @vscode/policy-watcher@1.5.0. The dependent VS Code draft will then replace its temporary 1.4 compatibility state with the published version and regenerated lockfile.

[Harald Kirschner (digitarald)]

All GitHub Actions and platform build jobs are now green after pinning the GitHub Windows job to the VS 2022 image supported by Node 22's node-gyp. This PR is the dependency for microsoft/vscode-internalbacklog#8826; a 1.5.0 package release will be needed before the dependent VS Code PR can consume it.

[Harald Kirschner (digitarald)]

Dependent draft is now open: microsoft/vscode#332071. The watcher PR's GitHub Actions and all Azure Linux/macOS/Windows/package jobs are green. VS Code CI currently fails only because 1.5.0 is not yet published, so merge + publish of this PR is the remaining dependency.

[Harald Kirschner (digitarald)]

Correction: I briefly changed the GitHub Windows runner to work around the hosted VS 2026/node-gyp discovery failure. That was unrelated scope, so I reverted it in 5164f91 and updated the PR description. The Azure Windows build is green; the GitHub windows-latest failure is documented as infrastructure rather than hidden by this feature PR.

[joshspicer]

AI review

I think the union readers currently turn wrong-typed native values into an enforced empty string whenever the union accepts strings.

• On Windows, read() returns { true, std::nullopt } for an unsupported or malformed value, and refresh() converts that state to "". Since the value is also marked present, a wrong-typed HKLM value prevents fallback to a valid HKCU value. See src/windows/UnionPolicy.cc:23-28 and src/windows/UnionPolicy.cc:72-88.
• On macOS, the final else if (acceptsString) converts any forced preference with an unsupported Core Foundation type to "". See src/macos/UnionPolicy.cc:70-71.

This seems different from the existing single-type readers, which treat native type mismatches as unset. Downstream consumers could therefore treat an invalid policy as actively enforced; on Windows, we can also lose the established user-policy fallback. Maybe wrong-typed values should remain unset while preserving the existing HKLM/HKCU behavior. Thanks.

[Copilot]

Pull request overview

Adds scalar-union policy types to support boolean-or-string managed settings, unblocking VS Code PR #332071.

Changes:

• Adds union validation and TypeScript value inference.
• Implements native Windows/macOS union readers.
• Prepares version 1.5.0 and adjusts CI/build configuration.

Show a summary per file

File	Description
src/windows/UnionPolicy.hh	Defines Windows union policies.
src/windows/UnionPolicy.cc	Reads union values from the registry.
src/windows/PolicyWatcher.cc	Registers Windows union policies.
src/PolicyWatcher.hh	Adds the shared union registration API.
src/main.cc	Validates and dispatches union declarations.
src/macos/UnionPolicy.hh	Defines macOS union policies.
src/macos/UnionPolicy.cc	Reads forced scalar preferences.
src/macos/PreferencesPolicy.hh	Rejects unforced preferences.
src/macos/PolicyWatcher.cc	Registers macOS union policies.
src/linux/PolicyWatcher.cc	Adds the Linux API stub.
package.json	Bumps the package to 1.5.0.
package-lock.json	Synchronizes package metadata.
index.d.ts	Exposes union policy typings.
binding.gyp	Builds the new native readers.
.github/workflows/ci.yml	Pins Windows CI to Windows 2022.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Suppressed comments (1)

src/windows/UnionPolicy.cc:79

• This constructs line without a length bound, but registry string data is not guaranteed to be NUL-terminated. A malformed REG_MULTI_SZ can therefore make this read past buffer and crash the watcher. Scan only up to end and append that bounded range.

    while (current < end && *current != '\0') {
      std::string line(current);

• Files reviewed: 13/15 changed files
• Comments generated: 2
• Review effort level: Balanced

[Copilot]

Review details

• Files reviewed: 13/15 changed files
• Comments generated: 0 new
• Review effort level: Balanced