eslint: fix bracket notation in build scripts

.eslint-allowed-bracket-notation-files

@@ -246,56 +246,6 @@ src/vs/sessions/contrib/providers/remoteAgentHost/browser/cloudSandboxApiService
 src/vs/sessions/electron-browser/sessions.ts
 src/vs/sessions/test/browser/chatGroupsView.test.ts
 
-# Build, CI, and scripts (48 files)
-build/azure-pipelines/common/apply-sdk-canary-override.ts
-build/azure-pipelines/common/createBuild.ts
-build/azure-pipelines/common/downloadNotice.ts
-build/azure-pipelines/common/getPublishAuthTokens.ts
-build/azure-pipelines/common/publish.ts
-build/azure-pipelines/common/releaseBuild.ts
-build/azure-pipelines/common/sign-win32.ts
-build/azure-pipelines/common/sign.ts
-build/azure-pipelines/distro/mixin-quality.ts
-build/azure-pipelines/oss/audit-notices.ts
-build/azure-pipelines/oss/merge-notices.ts
-build/azure-pipelines/oss/scan-licenses.ts
-build/azure-pipelines/upload-cdn.ts
-build/azure-pipelines/upload-nlsmetadata.ts
-build/azure-pipelines/upload-sourcemaps.ts
-build/azure-pipelines/win32/codesign.ts
-build/darwin/create-dmg.ts
-build/darwin/create-universal-app.ts
-build/darwin/sign-server.ts
-build/darwin/sign.ts
-build/darwin/verify-macho.ts
-build/gulpfile.reh.ts
-build/gulpfile.vscode.linux.ts
-build/gulpfile.vscode.ts
-build/gulpfile.vscode.win32.ts
-build/hygiene.ts
-build/lib/builtInExtensions.ts
-build/lib/compilation.ts
-build/lib/electron.ts
-build/lib/fetch.ts
-build/lib/getVersion.ts
-build/lib/i18n.ts
-build/lib/policies/exportPolicyData.ts
-build/lib/preLaunch.ts
-build/lib/test/render.test.ts
-build/linux/debian/install-sysroot.ts
-build/linux/libcxx-fetcher.ts
-build/npm/postinstall.ts
-build/npm/preinstall.ts
-build/npm/update-localization-extension.ts
-build/rspack/rspack.serve-out.config.mts
-build/win32/explorer-dll-fetcher.ts
-scripts/code-agent-host.js
-scripts/code-server.js
-scripts/code-sessions-web.js
-scripts/code-web.js
-scripts/sync-agent-host-protocol.ts
-scripts/test-agent-host-e2e.ts
-
 # Application bootstrap, server, and environment (41 files)
 src/bootstrap-cli.ts
 src/bootstrap-esm.ts

build/azure-pipelines/common/apply-sdk-canary-override.ts

@@ -176,8 +176,8 @@ function resolveLatestCanary(): string {
 }
 
 function collectOverrides(): Override[] {
-	let sdkVersion = (process.env['VSCODE_SDK_CANARY_VERSION'] ?? '').trim();
-	const explicitCli = (process.env['VSCODE_CLI_CANARY_VERSION'] ?? '').trim();
+	let sdkVersion = (process.env.VSCODE_SDK_CANARY_VERSION ?? '').trim();
+	const explicitCli = (process.env.VSCODE_CLI_CANARY_VERSION ?? '').trim();
 	// `latest-canary` sentinel: resolve the newest published @github/copilot-sdk
 	// canary here, inside the build, where private-feed npm auth already exists —
 	// so the GitHub-side orchestrator that queues this build never needs

build/azure-pipelines/common/createBuild.ts

@@ -29,8 +29,8 @@ async function main(): Promise<void> {
 	const queuedBy = getEnv('BUILD_QUEUEDBY');
 	const sourceBranch = getEnv('BUILD_SOURCEBRANCH');
 	const version = _version + (quality === 'stable' ? '' : `-${quality}`);
-	const buildId = process.env['BUILD_BUILDID'];
-	const definitionId = process.env['SYSTEM_DEFINITIONID'];
+	const buildId = process.env.BUILD_BUILDID;
+	const definitionId = process.env.SYSTEM_DEFINITIONID;
 
 	console.log('Creating build...');
 	console.log('Quality:', quality);
@@ -43,7 +43,7 @@ async function main(): Promise<void> {
 		timestamp,
 		version,
 		isReleased: false,
-		private: process.env['VSCODE_PRIVATE_BUILD']?.toLowerCase() === 'true',
+		private: process.env.VSCODE_PRIVATE_BUILD?.toLowerCase() === 'true',
 		sourceBranch,
 		queuedBy,
 		assets: [],
@@ -56,8 +56,8 @@ async function main(): Promise<void> {
 		definitionId
 	};
 
-	const aadCredentials = new ClientAssertionCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, () => Promise.resolve(process.env['AZURE_ID_TOKEN']!));
-	const client = new CosmosClient({ endpoint: process.env['AZURE_DOCUMENTDB_ENDPOINT']!, aadCredentials });
+	const aadCredentials = new ClientAssertionCredential(process.env.AZURE_TENANT_ID!, process.env.AZURE_CLIENT_ID!, () => Promise.resolve(process.env.AZURE_ID_TOKEN!));
+	const client = new CosmosClient({ endpoint: process.env.AZURE_DOCUMENTDB_ENDPOINT!, aadCredentials });
 	const scripts = client.database('builds').container(quality).scripts;
 	await retry(() => scripts.storedProcedure('createBuild').execute('', [{ ...build, _partitionKey: '' }]));
 }

build/azure-pipelines/common/downloadNotice.ts

@@ -353,7 +353,7 @@ async function main(): Promise<void> {
 	// set VSCODE_OVERWRITE_TPN=false to force the legacy mixin notice. Check is
 	// case-insensitive on purpose so YAML casing (true/false vs True/False) can't
 	// silently break the rollback lever.
-	if ((process.env['VSCODE_OVERWRITE_TPN'] ?? '').trim().toLowerCase() === 'false') {
+	if ((process.env.VSCODE_OVERWRITE_TPN ?? '').trim().toLowerCase() === 'false') {
 		log('RESULT=disabled feature flag off (VSCODE_OVERWRITE_TPN=false); keeping legacy notice.');
 		return;
 	}

build/azure-pipelines/common/getPublishAuthTokens.ts

@@ -40,7 +40,7 @@ export async function getAccessToken(endpoint: string, tenantId: string, clientI
 
 async function main() {
 	const cosmosDBAccessToken = await getAccessToken(e('AZURE_DOCUMENTDB_ENDPOINT')!, e('AZURE_TENANT_ID')!, e('AZURE_CLIENT_ID')!, e('AZURE_ID_TOKEN')!);
-	const blobServiceAccessToken = await getAccessToken(`https://${e('VSCODE_STAGING_BLOB_STORAGE_ACCOUNT_NAME')}.blob.core.windows.net/`, process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, process.env['AZURE_ID_TOKEN']!);
+	const blobServiceAccessToken = await getAccessToken(`https://${e('VSCODE_STAGING_BLOB_STORAGE_ACCOUNT_NAME')}.blob.core.windows.net/`, process.env.AZURE_TENANT_ID!, process.env.AZURE_CLIENT_ID!, process.env.AZURE_ID_TOKEN!);
 	console.log(JSON.stringify({ cosmosDBAccessToken, blobServiceAccessToken }));
 }
 

build/azure-pipelines/common/publish.ts

@@ -540,7 +540,7 @@ class ESRPReleaseService {
 		};
 
 		// The Release service expects x5c as a '.' separated string, not the standard array format
-		(header as Record<string, unknown>)['x5c'] = this.requestSigningCertificates.map(c => getCertificateBuffer(c).toString('base64url')).join('.');
+		(header as Record<string, unknown>).x5c = this.requestSigningCertificates.map(c => getCertificateBuffer(c).toString('base64url')).join('.');
 
 		return jws.sign({
 			header,

build/azure-pipelines/common/releaseBuild.ts

@@ -45,7 +45,7 @@ async function main(force: boolean): Promise<void> {
 	const quality = getEnv('VSCODE_QUALITY');
 
 	const { cosmosDBAccessToken } = JSON.parse(getEnv('PUBLISH_AUTH_TOKENS'));
-	const client = new CosmosClient({ endpoint: process.env['AZURE_DOCUMENTDB_ENDPOINT']!, tokenProvider: () => Promise.resolve(`type=aad&ver=1.0&sig=${cosmosDBAccessToken.token}`) });
+	const client = new CosmosClient({ endpoint: process.env.AZURE_DOCUMENTDB_ENDPOINT!, tokenProvider: () => Promise.resolve(`type=aad&ver=1.0&sig=${cosmosDBAccessToken.token}`) });
 
 	if (!force) {
 		const config = await getConfig(client, quality);

build/azure-pipelines/common/sign-win32.ts

@@ -7,7 +7,7 @@ import { main } from './sign.ts';
 import path from 'path';
 
 main([
-	process.env['EsrpCliDllPath']!,
+	process.env.EsrpCliDllPath!,
 	'sign-windows',
 	path.dirname(process.argv[2]),
 	path.basename(process.argv[2])

build/azure-pipelines/common/sign.ts

@@ -141,7 +141,7 @@ export function main([esrpCliPath, type, folderPath, pattern]: string[]) {
 	const key = crypto.randomBytes(32);
 	const iv = crypto.randomBytes(16);
 	const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);
-	const encryptedToken = cipher.update(process.env['SYSTEM_ACCESSTOKEN']!.trim(), 'utf8', 'hex') + cipher.final('hex');
+	const encryptedToken = cipher.update(process.env.SYSTEM_ACCESSTOKEN!.trim(), 'utf8', 'hex') + cipher.final('hex');
 
 	const encryptionDetailsPath = tmp.tmpNameSync();
 	fs.writeFileSync(encryptionDetailsPath, JSON.stringify({ key: key.toString('hex'), iv: iv.toString('hex') }));
@@ -159,14 +159,14 @@ export function main([esrpCliPath, type, folderPath, pattern]: string[]) {
 	const adoTaskVersion = path.basename(path.dirname(path.dirname(esrpCliPath)));
 
 	const federatedTokenData = {
-		jobId: process.env['SYSTEM_JOBID'],
-		planId: process.env['SYSTEM_PLANID'],
-		projectId: process.env['SYSTEM_TEAMPROJECTID'],
-		hub: process.env['SYSTEM_HOSTTYPE'],
-		uri: process.env['SYSTEM_COLLECTIONURI'],
-		managedIdentityId: process.env['VSCODE_ESRP_CLIENT_ID'],
-		managedIdentityTenantId: process.env['VSCODE_ESRP_TENANT_ID'],
-		serviceConnectionId: process.env['VSCODE_ESRP_SERVICE_CONNECTION_ID'],
+		jobId: process.env.SYSTEM_JOBID,
+		planId: process.env.SYSTEM_PLANID,
+		projectId: process.env.SYSTEM_TEAMPROJECTID,
+		hub: process.env.SYSTEM_HOSTTYPE,
+		uri: process.env.SYSTEM_COLLECTIONURI,
+		managedIdentityId: process.env.VSCODE_ESRP_CLIENT_ID,
+		managedIdentityTenantId: process.env.VSCODE_ESRP_TENANT_ID,
+		serviceConnectionId: process.env.VSCODE_ESRP_SERVICE_CONNECTION_ID,
 		tempDirectory: os.tmpdir(),
 		systemAccessToken: encryptedTokenPath,
 		encryptionKey: encryptionDetailsPath
@@ -175,8 +175,8 @@ export function main([esrpCliPath, type, folderPath, pattern]: string[]) {
 	const args = [
 		esrpCliPath,
 		'vsts.sign',
-		'-a', process.env['ESRP_CLIENT_ID']!,
-		'-d', process.env['ESRP_TENANT_ID']!,
+		'-a', process.env.ESRP_CLIENT_ID!,
+		'-d', process.env.ESRP_TENANT_ID!,
 		'-k', JSON.stringify({ akv: 'vscode-esrp' }),
 		'-z', JSON.stringify({ akv: 'vscode-esrp', cert: 'esrp-sign' }),
 		'-f', folderPath,
@@ -202,7 +202,7 @@ export function main([esrpCliPath, type, folderPath, pattern]: string[]) {
 		'-pendingAnalysisWaitTimeoutMinutes', '5',
 		'-adoTaskVersion', adoTaskVersion,
 		'-resourceUri', 'https://msazurecloud.onmicrosoft.com/api.esrp.microsoft.com',
-		'-esrpClientId', process.env['ESRP_CLIENT_ID']!,
+		'-esrpClientId', process.env.ESRP_CLIENT_ID!,
 		'-useMSIAuthentication', 'true',
 		'-federatedTokenData', JSON.stringify(federatedTokenData)
 	];

build/azure-pipelines/distro/mixin-quality.ts

@@ -28,7 +28,7 @@ function log(...args: unknown[]): void {
 }
 
 function main() {
-	const quality = process.env['VSCODE_QUALITY'];
+	const quality = process.env.VSCODE_QUALITY;
 
 	if (!quality) {
 		throw new Error('Missing VSCODE_QUALITY, skipping mixin');
@@ -51,8 +51,8 @@ function main() {
 				throw new Error('Unexpected builtInExtensions array, expected object with include/exclude or array of extensions');
 
 			} else if (distro.builtInExtensions) {
-				const include = distro.builtInExtensions['include'] ?? [];
-				const exclude = distro.builtInExtensions['exclude'] ?? [];
+				const include = distro.builtInExtensions.include ?? [];
+				const exclude = distro.builtInExtensions.exclude ?? [];
 
 				log('OSS built-in extensions:', builtInExtensions.map(e => e.name));
 				log('Including built-in extensions:', include.map(e => e.name));

build/azure-pipelines/oss/audit-notices.ts

@@ -456,16 +456,16 @@ function printReport(noticePath: string, stats: NoticeStats, xref: CrossRefResul
 function main(): void {
 	const args = parseArgs(process.argv.slice(2));
 
-	if (!args['notice']) {
+	if (!args.notice) {
 		console.error('Usage: npx tsx build/azure-pipelines/oss/audit-notices.ts --notice <path> [--repo <path>]');
 		console.error('');
 		console.error('  --notice   Path to ThirdPartyNotices.txt');
 		console.error('  --repo     Path to the repo root (defaults to cwd)');
 		process.exit(1);
 	}
 
-	const noticePath = path.resolve(args['notice']);
-	const repoRoot = path.resolve(args['repo'] ?? process.cwd());
+	const noticePath = path.resolve(args.notice);
+	const repoRoot = path.resolve(args.repo ?? process.cwd());
 
 	if (!fs.existsSync(noticePath)) {
 		console.error(`Error: NOTICE file not found: ${noticePath}`);

build/azure-pipelines/oss/merge-notices.ts

@@ -174,12 +174,12 @@ export function computeUnaccounted(
 
 async function mainAsync(): Promise<void> {
 	const args = parseArgs(process.argv.slice(2));
-	const cgPath = args['cg'] || '';
-	const extPath = args['extensions'] || '';
-	const outputPath = args['output'];
-	const cglicensesPath = args['cglicenses'] || '';
+	const cgPath = args.cg || '';
+	const extPath = args.extensions || '';
+	const outputPath = args.output;
+	const cglicensesPath = args.cglicenses || '';
 	const strict = process.argv.includes('--strict');
-	const provenance = args['provenance'] !== undefined;
+	const provenance = args.provenance !== undefined;
 
 	if (!outputPath) {
 		console.error('Usage: merge-notices.js --cg <path> --extensions <path> --output <path> [--cglicenses <path>] [--strict]');
@@ -221,7 +221,7 @@ async function mainAsync(): Promise<void> {
 	// SPDX expression instead of real license text); for them the scanner entry
 	// must WIN the collision, overriding CG's stub with the real fetched text.
 	const stubOverrideKeys = new Set<string>();
-	const stubOverridePath = args['stuboverride'] || (extPath ? extPath + '.stuboverride.json' : '');
+	const stubOverridePath = args.stuboverride || (extPath ? extPath + '.stuboverride.json' : '');
 	if (stubOverridePath && fs.existsSync(stubOverridePath)) {
 		try {
 			const raw: unknown = JSON.parse(fs.readFileSync(stubOverridePath, 'utf8'));
@@ -328,7 +328,7 @@ async function mainAsync(): Promise<void> {
 				// Load the scanner's presence index (packages on disk with no license
 				// file). This lets applyOverrides tell "present but unlicensed" (inject)
 				// apart from "not shipped" (stale -> warn + skip).
-				const presencePath = args['presence'] || (extPath ? extPath + '.presence.json' : '');
+				const presencePath = args.presence || (extPath ? extPath + '.presence.json' : '');
 				const presentNames = new Set<string>();
 				if (presencePath && fs.existsSync(presencePath)) {
 					try {
@@ -480,7 +480,7 @@ required to debug changes to any libraries licensed under the GNU Lesser General
 	// produced no row for). Cross-checked against the final merged notice below so
 	// packages rescued downstream (e.g. a cglicenses.json override) are excluded.
 	// Never throws — a missing/garbled sibling just yields an empty list.
-	const unresolvedPath = args['unresolved'] || (extPath ? extPath + '.unresolved.json' : '');
+	const unresolvedPath = args.unresolved || (extPath ? extPath + '.unresolved.json' : '');
 	let unresolvedList: Array<{ name: string; version: string; reason: string }> = [];
 	if (unresolvedPath && fs.existsSync(unresolvedPath)) {
 		try {

build/azure-pipelines/oss/scan-licenses.ts

@@ -998,8 +998,8 @@ function findCargoLockFiles(repoRoot: string): string[] {
 
 async function main(): Promise<void> {
 	const args = parseArgs(process.argv.slice(2));
-	const repoRoot = args['repo'];
-	const outputPath = args['output'];
+	const repoRoot = args.repo;
+	const outputPath = args.output;
 
 	if (!repoRoot || !outputPath) {
 		console.error('Usage: scan-licenses.js --repo <path> --output <path> [--cg <ThirdPartyNotices.generated.txt>]');
@@ -1015,7 +1015,7 @@ async function main(): Promise<void> {
 	// "stub" bodies (CG emitted the SPDX expression instead of real text) and to
 	// gate fetches (don't re-fetch crates CG already covered with real text).
 	const cgBodies = new Map<string, string>();
-	const cgNoticePath = args['cg'];
+	const cgNoticePath = args.cg;
 	if (cgNoticePath && fs.existsSync(cgNoticePath)) {
 		try {
 			for (const e of parseNoticeFile(cgNoticePath)) {
@@ -2129,7 +2129,7 @@ async function main(): Promise<void> {
 	// Write the presence index as a sibling file. A package counts as
 	// "present but unlicensed" only if it was never resolved with a license
 	// anywhere (filter out anything that later landed in `entries`).
-	const presencePath = args['presence'] || (outputPath + '.presence.json');
+	const presencePath = args.presence || (outputPath + '.presence.json');
 	const presence = [...noLicenseSeen.entries()]
 		.filter(([k]) => !entries.has(k))
 		.map(([, v]) => ({ name: v.name, version: v.version }))
@@ -2139,15 +2139,15 @@ async function main(): Promise<void> {
 	// Write the stub-override index as a sibling file. merge-notices.ts reads it
 	// to let these cargo entries beat CG on `<name>@<version>` collision (CG
 	// otherwise always wins). Mirrors the presence.json sibling pattern.
-	const stubOverridePath = args['stuboverride'] || (outputPath + '.stuboverride.json');
+	const stubOverridePath = args.stuboverride || (outputPath + '.stuboverride.json');
 	const stubOverrideList = [...stubOverrideKeys].sort();
 	fs.writeFileSync(stubOverridePath, JSON.stringify(stubOverrideList, null, '\t'), 'utf8');
 
 	// Write the unresolved index as a sibling file. These are packages the scanner
 	// tried to resolve but produced NO row for. merge-notices.ts cross-checks this
 	// against the final merged NOTICE so packages rescued downstream (e.g. a
 	// cglicenses.json override) are excluded. Mirrors the presence.json sibling.
-	const unresolvedPath = args['unresolved'] || (outputPath + '.unresolved.json');
+	const unresolvedPath = args.unresolved || (outputPath + '.unresolved.json');
 	const unresolvedSorted = unresolved.slice().sort((a, b) => a.name.toLowerCase().localeCompare(b.name.toLowerCase()));
 	fs.writeFileSync(unresolvedPath, JSON.stringify(unresolvedSorted, null, '\t'), 'utf8');
 

build/azure-pipelines/upload-cdn.ts

@@ -11,8 +11,8 @@ import mime from 'mime';
 import { ClientAssertionCredential } from '@azure/identity';
 import { VinylStat } from '../lib/util.ts';
 
-const commit = process.env['BUILD_SOURCEVERSION'];
-const credential = new ClientAssertionCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, () => Promise.resolve(process.env['AZURE_ID_TOKEN']!));
+const commit = process.env.BUILD_SOURCEVERSION;
+const credential = new ClientAssertionCredential(process.env.AZURE_TENANT_ID!, process.env.AZURE_CLIENT_ID!, () => Promise.resolve(process.env.AZURE_ID_TOKEN!));
 
 mime.define({
 	'application/typescript': ['ts'],

build/azure-pipelines/upload-nlsmetadata.ts

@@ -11,8 +11,8 @@ import { ClientAssertionCredential } from '@azure/identity';
 import path from 'path';
 import { readFileSync } from 'fs';
 
-const commit = process.env['BUILD_SOURCEVERSION'];
-const credential = new ClientAssertionCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, () => Promise.resolve(process.env['AZURE_ID_TOKEN']!));
+const commit = process.env.BUILD_SOURCEVERSION;
+const credential = new ClientAssertionCredential(process.env.AZURE_TENANT_ID!, process.env.AZURE_CLIENT_ID!, () => Promise.resolve(process.env.AZURE_ID_TOKEN!));
 
 interface NlsMetadata {
 	keys: { [module: string]: string };

build/azure-pipelines/upload-sourcemaps.ts

@@ -14,8 +14,8 @@ import Stream from 'stream';
 import { azureStorage } from '../lib/gulp/facade.ts';
 
 const root = path.dirname(path.dirname(import.meta.dirname));
-const commit = process.env['BUILD_SOURCEVERSION'];
-const credential = new ClientAssertionCredential(process.env['AZURE_TENANT_ID']!, process.env['AZURE_CLIENT_ID']!, () => Promise.resolve(process.env['AZURE_ID_TOKEN']!));
+const commit = process.env.BUILD_SOURCEVERSION;
+const credential = new ClientAssertionCredential(process.env.AZURE_TENANT_ID!, process.env.AZURE_CLIENT_ID!, () => Promise.resolve(process.env.AZURE_ID_TOKEN!));
 
 // optionally allow to pass in explicit base/maps to upload
 const [, , base, maps] = process.argv;