build: override product Copilot runtime

build/azure-pipelines/common/apply-sdk-canary-override.ts

@@ -17,19 +17,9 @@ import { execFileSync } from 'child_process';
  * node_modules cache key, derived from these manifests + lockfiles, naturally
  * misses).
  *
- * Driven by environment variables so it is a no-op in normal builds:
- *   VSCODE_SDK_CANARY_VERSION - version to pin `@github/copilot-sdk` to (empty =
- *                               no override / normal build). The sentinel
- *                               `latest-canary` resolves to the newest
- *                               `@github/copilot-sdk` canary on the feed here,
- *                               inside the build.
- *   VSCODE_CLI_CANARY_VERSION - version to pin `@github/copilot` to. When empty
- *                               (and an SDK version is set) the CLI version is
- *                               inferred from the SDK's own `@github/copilot`
- *                               dependency so the two stay compatible. When set
- *                               explicitly, it is validated against that same
- *                               dependency range and the build fails fast on a
- *                               confirmed incompatible SDK/CLI pair.
+ * Driven by environment variables so SDK and runtime overrides can be applied
+ * independently. Product builds use an exact checked-in runtime parameter
+ * default while retaining the SDK version from the OSS manifest.
  *
  * npm registry + auth must already be configured in the ambient environment
  * (the orchestrator authenticates to the private feed before invoking this).
@@ -150,9 +140,7 @@ function assertCliSatisfiesSdk(sdkVersion: string, cliVersion: string): void {
  * orchestrator that queues the build never needs feed-read access.
  *
  * Canary versions look like `X.Y.Z-canary.<N>.g<sha>`; "newest" is the highest
- * `[X, Y, Z, N]` tuple (numeric, so `canary.9` < `canary.10`). The resolved
- * concrete version is also emitted as an ADO build tag (`sdk-canary=<version>`)
- * so the orchestrator can read it back for accurate Slack reporting.
+ * `[X, Y, Z, N]` tuple (numeric, so `canary.9` < `canary.10`).
  */
 function resolveLatestCanary(): string {
 	const versionsRaw = execFileSync(NPM, ['view', '@github/copilot-sdk', 'versions', '--json'], { encoding: 'utf8', shell: IS_WINDOWS });
@@ -178,39 +166,34 @@ function resolveLatestCanary(): string {
 	}
 	const latest = canaries[canaries.length - 1].v;
 	console.log(`[canary-override] Resolved 'latest-canary' -> @github/copilot-sdk@${latest} (from ${canaries.length} canary versions on the feed).`);
-	// Surface the concrete version on the build so the GitHub orchestrator can
-	// read it back (build tags API) for accurate reporting, without itself
-	// needing feed-read access. Idempotent across the per-platform jobs. Use `=`
-	// (not `:`) as the separator: build tags land in the Add Build Tag REST URL
-	// path, and ASP.NET rejects `:` there as a "dangerous" path character.
-	console.log(`##vso[build.addbuildtag]sdk-canary=${latest}`);
 	return latest;
 }
 
 function collectOverrides(): Override[] {
 	let sdkVersion = (process.env['VSCODE_SDK_CANARY_VERSION'] ?? '').trim();
-	if (!sdkVersion) {
-		return [];
-	}
+	const explicitCli = (process.env['VSCODE_CLI_CANARY_VERSION'] ?? '').trim();
 	// `latest-canary` sentinel: resolve the newest published @github/copilot-sdk
 	// canary here, inside the build, where private-feed npm auth already exists —
 	// so the GitHub-side orchestrator that queues this build never needs
 	// feed-read access.
 	if (sdkVersion === 'latest-canary') {
 		sdkVersion = resolveLatestCanary();
 	}
-	assertSafeSpec('SDK canary version', sdkVersion);
-	const overrides: Override[] = [{ name: '@github/copilot-sdk', version: sdkVersion }];
+	const overrides: Override[] = [];
+	if (sdkVersion) {
+		assertSafeSpec('SDK canary version', sdkVersion);
+		console.log(`##vso[build.addbuildtag]sdk-canary=${sdkVersion}`);
+		overrides.push({ name: '@github/copilot-sdk', version: sdkVersion });
+	}
 
-	// Explicit CLI version wins (but must be compatible with the SDK); empty
-	// means "infer a compatible CLI from the SDK".
-	const explicitCli = (process.env['VSCODE_CLI_CANARY_VERSION'] ?? '').trim();
 	let cliVersion: string | undefined;
 	if (explicitCli) {
 		assertSafeSpec('CLI canary version', explicitCli);
-		assertCliSatisfiesSdk(sdkVersion, explicitCli);
+		if (sdkVersion) {
+			assertCliSatisfiesSdk(sdkVersion, explicitCli);
+		}
 		cliVersion = explicitCli;
-	} else {
+	} else if (sdkVersion) {
 		cliVersion = inferCliVersion(sdkVersion);
 	}
 	if (cliVersion) {

build/azure-pipelines/common/apply-sdk-canary.yml

@@ -1,4 +1,4 @@
-# SDK canary integration (no-op unless VSCODE_SDK_CANARY_VERSION is set).
+# Copilot product dependency integration (no-op unless an override is set).
 # Overrides @github/copilot-sdk / @github/copilot to a version published to the
 # private feed and refreshes the lockfile so the node_modules cache key below
 # misses and `npm ci` installs the canary. Authenticates to the feed first so
@@ -16,32 +16,32 @@ steps:
       - powershell: |
           npm config set registry $env:NPM_REGISTRY
           Write-Host "##vso[task.setvariable variable=SDK_CANARY_NPMRC_PATH]$(npm config get userconfig)"
-        condition: and(succeeded(), ne(variables['VSCODE_SDK_CANARY_VERSION'], ''))
+        condition: and(succeeded(), or(ne(variables['VSCODE_SDK_CANARY_VERSION'], ''), ne(variables['VSCODE_CLI_CANARY_VERSION'], '')))
         displayName: SDK canary — set registry for auth
   - ${{ else }}:
       - script: |
           set -e
           npm config set registry "$NPM_REGISTRY"
           echo "##vso[task.setvariable variable=SDK_CANARY_NPMRC_PATH]$(npm config get userconfig)"
-        condition: and(succeeded(), ne(variables['VSCODE_SDK_CANARY_VERSION'], ''))
+        condition: and(succeeded(), or(ne(variables['VSCODE_SDK_CANARY_VERSION'], ''), ne(variables['VSCODE_CLI_CANARY_VERSION'], '')))
         displayName: SDK canary — set registry for auth
 
   - task: npmAuthenticate@0
     inputs:
       workingFile: $(SDK_CANARY_NPMRC_PATH)
-    condition: and(succeeded(), ne(variables['VSCODE_SDK_CANARY_VERSION'], ''))
+    condition: and(succeeded(), or(ne(variables['VSCODE_SDK_CANARY_VERSION'], ''), ne(variables['VSCODE_CLI_CANARY_VERSION'], '')))
     displayName: SDK canary — authenticate feed
 
   - ${{ if eq(parameters.windows, true) }}:
       - powershell: node build/azure-pipelines/common/apply-sdk-canary-override.ts
-        condition: and(succeeded(), ne(variables['VSCODE_SDK_CANARY_VERSION'], ''))
+        condition: and(succeeded(), or(ne(variables['VSCODE_SDK_CANARY_VERSION'], ''), ne(variables['VSCODE_CLI_CANARY_VERSION'], '')))
         env:
           VSCODE_SDK_CANARY_VERSION: $(VSCODE_SDK_CANARY_VERSION)
           VSCODE_CLI_CANARY_VERSION: $(VSCODE_CLI_CANARY_VERSION)
         displayName: Apply SDK canary override
   - ${{ else }}:
       - script: node build/azure-pipelines/common/apply-sdk-canary-override.ts
-        condition: and(succeeded(), ne(variables['VSCODE_SDK_CANARY_VERSION'], ''))
+        condition: and(succeeded(), or(ne(variables['VSCODE_SDK_CANARY_VERSION'], ''), ne(variables['VSCODE_CLI_CANARY_VERSION'], '')))
         env:
           VSCODE_SDK_CANARY_VERSION: $(VSCODE_SDK_CANARY_VERSION)
           VSCODE_CLI_CANARY_VERSION: $(VSCODE_CLI_CANARY_VERSION)

build/azure-pipelines/product-build-ado-ci.yml

@@ -73,17 +73,17 @@ parameters:
     displayName: "Use legacy OSS Notice"
     type: boolean
     default: false
-  # SDK -> VS Code integration: override the Copilot dependencies to a version
-  # already published to the private feed. 'none'/'auto' = normal build.
+  # SDK -> VS Code integration: override Copilot dependencies with versions
+  # already published to the private feed. 'none' = use the OSS SDK version.
   # See microsoft/vscode-engineering specs/sdk-vscode-integration.spec.md.
   - name: VSCODE_SDK_CANARY_VERSION
     displayName: "SDK canary: @github/copilot-sdk version ('none' = normal build)"
     type: string
     default: none
   - name: VSCODE_CLI_CANARY_VERSION
-    displayName: "SDK canary: @github/copilot version ('auto' = infer from the SDK)"
+    displayName: "Product @github/copilot runtime version ('auto' = infer from an SDK override)"
     type: string
-    default: auto
+    default: 1.0.84-canary.66.g9267bf0.unsigned
 
 variables:
   - name: VSCODE_PRIVATE_BUILD
@@ -94,9 +94,8 @@ variables:
     value: false
   - name: NPM_REGISTRY
     value: ${{ parameters.NPM_REGISTRY }}
-  # Normalize the canary sentinels ('none'/'auto') back to empty so the gated
-  # node-modules steps (condition: ne(..., '')) stay a no-op for normal builds
-  # and the override script infers the CLI when it is empty.
+  # Normalize sentinels back to empty so the override script can distinguish
+  # the normal SDK and inferred runtime paths.
   - name: VSCODE_SDK_CANARY_VERSION
     ${{ if eq(parameters.VSCODE_SDK_CANARY_VERSION, 'none') }}:
       value: ""

build/azure-pipelines/product-build.yml

@@ -126,26 +126,25 @@ parameters:
     displayName: "Run sanity tests against this build's artifacts (for unpublished builds)"
     type: boolean
     default: false
-  # SDK -> VS Code integration: override the Copilot dependencies to a version
-  # already published to the private feed. 'none'/'auto' = normal build.
+  # SDK -> VS Code integration: override Copilot dependencies with versions
+  # already published to the private feed. 'none' = use the OSS SDK version.
   # See microsoft/vscode-engineering specs/sdk-vscode-integration.spec.md.
   - name: VSCODE_SDK_CANARY_VERSION
     displayName: "SDK canary: @github/copilot-sdk version ('none' = normal build)"
     type: string
     default: none
   - name: VSCODE_CLI_CANARY_VERSION
-    displayName: "SDK canary: @github/copilot version ('auto' = infer from the SDK)"
+    displayName: "Product @github/copilot runtime version ('auto' = infer from an SDK override)"
     type: string
-    default: auto
+    default: 1.0.84-canary.66.g9267bf0.unsigned
 
 variables:
   - name: VSCODE_PRIVATE_BUILD
     value: ${{ ne(variables['Build.Repository.Uri'], 'https://github.com/microsoft/vscode.git') }}
   - name: NPM_REGISTRY
     value: ${{ parameters.NPM_REGISTRY }}
-  # Normalize the canary sentinels ('none'/'auto') back to empty so the gated
-  # node-modules steps (condition: ne(..., '')) stay a no-op for normal builds
-  # and the override script infers the CLI when it is empty.
+  # Normalize sentinels back to empty so the override script can distinguish
+  # the normal SDK and inferred runtime paths.
   - name: VSCODE_SDK_CANARY_VERSION
     ${{ if eq(parameters.VSCODE_SDK_CANARY_VERSION, 'none') }}:
       value: ""

src/vs/platform/agentHost/common/agent.ts

@@ -95,7 +95,7 @@ export interface IAgentHostNetworkEndpoint {
 
 export interface IAgentHostManagedSettingsSnapshot {
 	readonly account?: string;
-	readonly source: 'server' | 'device' | 'client' | 'mixed' | 'none';
+	readonly source: 'server' | 'device' | 'client' | 'policyHelper' | 'mixed' | 'none';
 	readonly serverManaged: boolean;
 	readonly deviceManaged: boolean;
 	readonly clientManaged?: boolean;

src/vs/platform/agentHost/test/node/e2e/suites/managementExtensionsSuite.ts

@@ -433,7 +433,7 @@ export function defineManagementExtensionTests(context: IAgentHostE2ETestContext
 				hasProvider: provider !== undefined,
 				hasSnapshot: provider?.snapshot !== undefined,
 				hasError: provider?.error !== undefined,
-				sourceIsValid: provider?.snapshot !== undefined && ['server', 'device', 'client', 'mixed', 'none'].includes(provider.snapshot.source),
+				sourceIsValid: provider?.snapshot !== undefined && ['server', 'device', 'client', 'policyHelper', 'mixed', 'none'].includes(provider.snapshot.source),
 				managedKeysAreArray: Array.isArray(provider?.snapshot?.managedKeys),
 			}, {
 				hasProvider: true,