chore: bump @github/copilot to 1.0.84-4

[vs-code-engineering]

Automated signed Copilot dependency bump.

• @github/copilot: 1.0.84-3 → 1.0.84-4
• Base: main @ 45744b3a87b664a8b16a45a5078493f9b681a1dc
• Opened by workflow run

Draft until validation passes. The sdk-vscode-bump-fix agent first iterates on Linux PR checks (up to 10 cycles), then on the authoritative full product build (up to 5 cycles).

Each product build triggered for this PR is posted as a comment below with a link.

Published package layout changes

Copilot published package layout diff

Best-effort path comparison from npm pack --dry-run; CLI platform paths use representative x64 packages for macOS, Linux, and Windows. Content-only and architecture-specific changes are left to the product build. This is not an availability gate.

@github/copilot 1.0.84-3 → 1.0.84-4

No published path changes.

@github/copilot-darwin-x64 1.0.84-3 → 1.0.84-4

No published path changes.

@github/copilot-linux-x64 1.0.84-3 → 1.0.84-4

_Could not inspect this package: Command failed: npm pack @github/copilot-linux-x64@1.0.84-4 --dry-run --json --ignore-scripts
npm warn Unknown project config "disturl". This will stop working in the next major version of npm. See npm help npmrc for supported config options.
npm warn Unknown project config "target". This will stop working in the next major version of npm. See npm help npmrc for supported config options.
npm warn Unknown project config "ms_build_id". This will stop working in the next major version of npm. See npm help npmrc for supported config options.
npm warn Unknown project config "runtime". This will stop working in the next major version of npm. See npm help npmrc for supported config options.
npm warn Unknown project config "build_from_source". This will stop working in the next major version of npm. See npm help npmrc for supported config options.
npm warn Unknown project config "timeout". This will stop working in the next major version of npm. See npm help npmrc for supported config options.
npm error code ETARGET
npm error notarget No matching version found for @github/copilot-linux-x64@1.0.84-4.
npm error notarget In most cases you or one of your dependencies are requesting a package version that doesn't exist.
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2026-09-10T17_26_12_108Z-debug-0.log
_

@github/copilot-win32-x64 1.0.84-3 → 1.0.84-4

_Could not inspect this package: Command failed: npm pack @github/copilot-win32-x64@1.0.84-4 --dry-run --json --ignore-scripts
npm warn Unknown project config "disturl". This will stop working in the next major version of npm. See npm help npmrc for supported config options.
npm warn Unknown project config "target". This will stop working in the next major version of npm. See npm help npmrc for supported config options.
npm warn Unknown project config "ms_build_id". This will stop working in the next major version of npm. See npm help npmrc for supported config options.
npm warn Unknown project config "runtime". This will stop working in the next major version of npm. See npm help npmrc for supported config options.
npm warn Unknown project config "build_from_source". This will stop working in the next major version of npm. See npm help npmrc for supported config options.
npm warn Unknown project config "timeout". This will stop working in the next major version of npm. See npm help npmrc for supported config options.
npm error code ETARGET
npm error notarget No matching version found for @github/copilot-win32-x64@1.0.84-4.
npm error notarget In most cases you or one of your dependencies are requesting a package version that doesn't exist.
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2026-09-10T17_26_15_243Z-debug-0.log
_

---

sdk-vscode-bump-fix status

Stage: pr-checks cycle 1 · SDK 1.0.13 · CLI 1.0.84-4 · State: ⚠️ two decorrelated flaky PR-check jobs; no integration change warranted

Prior blocker resolved

The previous cycle's blocker — the publish-race lockfile omission (4 of 8 @github/copilot platform sub-packages missing from package-lock.json / remote/package-lock.json) — has been fixed on the branch by commit bf801e5 ("chore: restore Copilot platform packages to lockfiles"). Both lockfiles now list all 8 platform entries (darwin/linux/linuxmusl/win32 × arm64/x64), matching the published @github/copilot@1.0.84-4 optionalDependencies. As a result every npm ci-dependent job now passes: Copilot - Test (Linux/Windows), Copilot - Check Test Cache, Compile & Hygiene, and the native-binary inventory test are all ✅.

Remaining failures are cross-platform flake, not a contract change

Only 2 of ~26 checks fail, and each is contradicted by the same test type passing on other platforms:

• Linux / Electron ❌ — while Linux / Electron-Smoke, Linux / Electron-Unit, Linux / Remote, Linux / Browser, Linux / CLI, Copilot - Test (Linux), and macOS / Electron are all ✅. The linux-x64 CLI binary loads and runs cleanly in every other Linux job.
• macOS / Electron-Smoke ❌ — while Linux / Electron-Smoke, Windows / Electron-Smoke, and macOS / Electron are all ✅.

A genuine SDK/CLI native-payload or runtime regression would fail deterministically for that binary's tests across platforms (the shared Agent Host spawns the same bumped @github/copilot binary everywhere). Single-job, single-platform failures whose sibling-platform equivalents pass are the signature of ordinary VS Code CI flake, not a bump-owned failure.

SDK+CLI correlation / compatibility

• This is a CLI-only patch bump 1.0.84-3 → 1.0.84-4; SDK stays 1.0.13. The branch code diff vs main is lockfiles only — all integration surfaces (agent.ts managed-settings snapshot, mock-llm-server.ts non-streaming Responses, build/.moduleignore SDK platform-package strips) already landed in main and require no change here.
• Slack canary threads are SDK 1.0.14-canary.* / CLI 1.0.84-canary.*.unsigned — a different CLI from this bump's signed 1.0.84-4; treated as non-applicable hypotheses.
• sdk-compatibility.md: SDK 1.0.13 is the pinned/published SDK; no SDK bump is needed for this CLI-only PR. The upstream SDK dependency PR Update Copilot CLI to 1.0.84-4 github/copilot-sdk#2609 is merged.

Work completed / not done

• ✅ Confirmed the prior lockfile blocker is resolved on-branch (bf801e5) and all npm ci jobs are green.
• ✅ Verified the branch requires no integration edits: diff vs main is lockfiles only; extensions/copilot (maintenance-mode, frozen) left untouched.
• ⛔ No push: there is no correct code change to make — forcing green flake or masking a non-existent regression would be wrong.
• Note: the exact failed-job logs could not be fetched (the pre-fetched capture ran while the job was still in progress; github.com/ADO are firewall-blocked from this sandbox), so the flake classification rests on the cross-platform check matrix above.

Smallest human/next task

Re-run the two failed jobs (Linux / Electron, macOS / Electron-Smoke). Given every sibling-platform equivalent is green, a plain re-run is expected to clear them and turn the PR-check stage green, advancing to the product build.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• api.github.com
• github.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"
    - "github.com"

See Network Configuration for more information.

Generated by sdk-vscode-bump-fix · copilot · opus48 · 287.8 AIC · ⌖ 40.1 AIC · ⊞ 17.6K · ◷

[Copilot]

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Install dependencies

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.

[Copilot]

🟡 Changes recommended

Required Linux x64 and Windows x64 platform packages are unpublished, leaving supported installations without a Copilot executable.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Bumps @github/copilot from 1.0.84-3 to 1.0.84-4 across local and remote dependencies.

Changes:

• Updates dependency manifests.
• Regenerates lockfiles and platform package metadata.

File summaries

File	Description
package.json	Updates the root dependency.
package-lock.json	Locks the updated root packages.
remote/package.json	Updates the remote dependency.
remote/package-lock.json	Locks the updated remote packages.

Review details

Files not reviewed (1)

• remote/package-lock.json: Generated file

• Files reviewed: 2/4 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[vs-code-engineering]

🤖 sdk-vscode-bump-fix — blocked (publish-race lockfile defect)

Stage: pr-checks cycle 1 · SDK 1.0.13 · CLI 1.0.84-4

Completed automated work

• Root-caused the failing PR check (Copilot - Check Test Cache → Install root dependencies, npm ci):

  npm error `npm ci` can only install packages when your package.json and package-lock.json ... are in sync.
  npm error Missing: @github/copilot-linux-arm64@ from lock file
  npm error Missing: @github/copilot-linux-x64@ from lock file
  npm error Missing: @github/copilot-linuxmusl-arm64@ from lock file
  npm error Missing: @github/copilot-win32-x64@ from lock file
  

• The bump commit (8d2a61d) regenerated both package-lock.json and remote/package-lock.json with only 4 of 8 @github/copilot platform sub-package entries. The published @github/copilot@1.0.84-4 manifest still declares all 8 in optionalDependencies, so the lockfiles are out of sync.
• Why: at bump time (17:26 UTC) the 4 platform sub-packages were not yet published — this PR's own "Published package layout changes" section records npm pack @github/copilot-linux-x64@1.0.84-4 → ETARGET: No matching version found. Lockfile regeneration therefore silently omitted them. Shortly after (17:40 UTC pre-install) their manifests resolved with HTTP 200 / placeDep OK, confirming a publish race in the bump generation — not a VS Code integration, API, payload, or native-arch change.
• Confirmed extensions/copilot is maintenance-mode (frozen at 1.0.73) and unaffected; made no integration edits (none are warranted).

Remaining minimal human task

Regenerate the two lockfiles now that the packages exist, then push to this branch:

npm install --package-lock-only --ignore-scripts --no-audit --no-fund
npm install --package-lock-only --ignore-scripts --no-audit --no-fund --prefix remote

This re-adds the 4 missing entries (copilot-linux-arm64, copilot-linux-x64, copilot-linuxmusl-arm64, copilot-win32-x64) with correct resolved+integrity. A plain re-dispatch of the bump's lockfile-regeneration step should also self-heal since the packages are now published.

Why this could not be automated here: the fix needs npm-registry access to obtain the 1.0.84-4 resolved+integrity for the 4 entries. This agent's sandbox blocks the registry (registry.npmjs.org → HTTP 403 via proxy), has an empty npm cache, and no pre-installed node_modules (the pre-install failed on this same defect). Integrity hashes cannot be fetched or safely fabricated offline, so no valid lockfile can be produced from here. No version pins or package.json files were changed.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• github.com
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

Generated by sdk-vscode-bump-fix · copilot · opus48 · 348 AIC · ⌖ 40.6 AIC · ⊞ 17.6K · ◷

[roblourens]

Lockfiles now include every published Copilot platform package and pass npm lockfile validation. (Written by Copilot)

The merge-base changed after approval.

[vs-code-engineering]

📬 CODENOTIFY

The following users are being notified based on files changed in this PR:

Ulugbek Abdullaev (@ulugbekna)

Matched files:

• src/vs/platform/agentHost/node/agentService.ts
• src/vs/sessions/contrib/providers/agentHost/browser/baseAgentHostSessionsProvider.ts
• src/vs/sessions/contrib/providers/agentHost/test/browser/localAgentHostSessionsProvider.test.ts

Sandeep Somavarapu (@sandy081)

Matched files:

• src/vs/sessions/services/sessions/common/session.ts
• src/vs/sessions/services/sessions/test/common/session.test.ts

Ladislau Szomoru (@lszomoru)

Matched files:

• src/vs/sessions/services/sessions/common/session.ts
• src/vs/sessions/services/sessions/test/common/session.test.ts

Kyle Cutler (@kycutler)

Matched files:

• src/vs/workbench/contrib/browserView/electron-browser/features/webContentsViewRendererFeature.ts
• src/vs/workbench/contrib/browserView/test/electron-browser/features/webContentsViewRendererFeature.test.ts

Joaquín Ruales (@jruales)

Matched files:

• src/vs/workbench/contrib/browserView/electron-browser/features/webContentsViewRendererFeature.ts
• src/vs/workbench/contrib/browserView/test/electron-browser/features/webContentsViewRendererFeature.test.ts

[roblourens]

Verified the corrected PR contains only the Copilot dependency bump and regenerated platform lockfile entries. (Written by Copilot)