Sync upstream/main + Copilot v0.57.0 release

.devcontainer/devcontainer-lock.json

@@ -9,6 +9,11 @@
       "version": "1.5.0",
       "resolved": "ghcr.io/devcontainers/features/rust@sha256:0c55e65f2e3df736e478f26ee4d5ed41bae6b54dac1318c443e31444c8ed283c",
       "integrity": "sha256:0c55e65f2e3df736e478f26ee4d5ed41bae6b54dac1318c443e31444c8ed283c"
+    },
+    "ghcr.io/devcontainers/features/sshd:1": {
+      "version": "1.1.0",
+      "resolved": "ghcr.io/devcontainers/features/sshd@sha256:f5251b8e4325f68f7280973c6cd65daff414449c66f240621502d4e8e74eb7ee",
+      "integrity": "sha256:f5251b8e4325f68f7280973c6cd65daff414449c66f240621502d4e8e74eb7ee"
     }
   }
 }

.devcontainer/devcontainer.json

@@ -5,7 +5,8 @@
 	},
 	"features": {
 		"ghcr.io/devcontainers/features/desktop-lite:": {},
-		"ghcr.io/devcontainers/features/rust:": {}
+		"ghcr.io/devcontainers/features/rust:": {},
+		"ghcr.io/devcontainers/features/sshd:1": {}
 	},
 	"containerEnv": {
 		"DISPLAY": "" // Allow the Dev Containers extension to set DISPLAY, post-create.sh will add it back in ~/.bashrc and ~/.zshrc if not set.

.github/instructions/best-practices.instructions.md

@@ -24,6 +24,11 @@ applyTo: src/vs/**
 - Don't hardcode URI scheme strings like `'file'`, `'untitled'`, or `'vscode-remote'`. Use the `Schemas` constants from `vs/base/common/network.ts` (e.g. `Schemas.file`, `Schemas.untitled`, `Schemas.vscodeRemote`).
 - Don't compare URIs with `===` or `uri.toString()`. Use the comparison utilities from `vs/base/common/resources.ts`: `isEqual` for equality, `isEqualOrParent` for containment, and `getComparisonKey` when a URI is used as a map/set key. These handle path-case sensitivity and fragment/authority correctly. When you need explicit control over case sensitivity, use an `ExtUri` instance (`extUri`, `extUriIgnorePathCase`, or `extUriBiasedIgnorePathCase`) instead of the bound helpers.
 
+## Resource Labels
+
+- Don't set `{ supportIcons: true }` when creating a `ResourceLabel` (`vs/workbench/browser/labels.ts`). This option makes the label parse `$(codicon)` syntax in the name/description and is only needed when you want to render a codicon inline with the resource text. By default (without it), the label computes the proper file-icon CSS classes for the resource, which is what we almost always want. Note that those classes only render as icons when an ancestor DOM element enables file icons (see below); otherwise the label shows text only.
+- To actually display file icons for resource labels in a tree/list, an ancestor container must have the `show-file-icons` class and be wired to the active file icon theme. Don't add the class by hand — call `createFileIconThemableTreeContainerScope` (`vs/workbench/contrib/files/browser/views/explorerView.ts`) on the container. It adds the required `show-file-icons` / `file-icon-themable-tree` classes and keeps `align-icons-and-twisties` / `hide-arrows` in sync with the file icon theme. Register the returned `IDisposable`. A common bug is placing a resource-label list/tree outside such a scoped container, which makes file icons silently disappear.
+
 ## Styling
 
 - Avoid `getComputedStyle`. If a style value is needed in both CSS and TypeScript, prefer hardcoding the value in TypeScript and setting it directly on the DOM element (e.g. `element.style.width = '100px'`), or set a CSS custom property via `element.style.setProperty('--my-var', value)` when the value is needed across multiple CSS rules.

.github/instructions/committing.instructions.md

@@ -0,0 +1,11 @@
+---
+description: Guidelines for creating git commits — respecting signing configuration, verification hooks, and referencing GitHub issues.
+applyTo: '**'
+---
+
+# Committing
+
+Follow these rules when creating git commits:
+
+- Always respect the user's commit signing configuration. Do not disable, override, or work around signing (for example, do not pass `--no-gpg-sign` when the user has signing enabled).
+- Never commit with `--no-verify`. Always let the pre-commit and commit-msg hooks run.

.github/instructions/design-tokens.instructions.md

@@ -76,16 +76,32 @@ of a shorthand is checked independently (`0 5px → 0 6px`). `auto`, `%`,
 
 ## Font size — `font-size`
 
-Generic UI chrome (fixed px):
+Generic UI ramp — pair a **size** token with a **weight** token; "Strong"
+reuses the matching size token + `fontWeight.semiBold`, **never** a separate
+"strong" size:
 
-| px | Variable |
-|----|----------|
-| 13 | `--vscode-bodyFontSize` (base) |
-| 12 | `--vscode-bodyFontSize-small` |
-| 11 | `--vscode-bodyFontSize-xSmall` |
-
-Agents window ramp (`src/vs/sessions/**`) — pair size with a weight token,
-**never** add a separate "strong" size:
+| px | Size var | Weight |
+|----|----------|--------|
+| 26 | `--vscode-fontSize-heading1` | semiBold |
+| 18 | `--vscode-fontSize-heading2` | semiBold |
+| 13 | `--vscode-fontSize-heading3` | semiBold |
+| 13 | `--vscode-fontSize-body1` | regular |
+| 11 | `--vscode-fontSize-body2` | regular |
+| 12 | `--vscode-fontSize-label1` | regular |
+| 11 | `--vscode-fontSize-label2` | regular |
+| 10 | `--vscode-fontSize-label3` | regular |
+
+**Deprecated** — the legacy `--vscode-bodyFontSize*` tokens are deprecated. Use
+the generic ramp above instead:
+
+| Deprecated | px | Use instead |
+|------------|----|-------------|
+| `--vscode-bodyFontSize` | 13 | `--vscode-fontSize-body1` |
+| `--vscode-bodyFontSize-small` | 12 | `--vscode-fontSize-label1` |
+| `--vscode-bodyFontSize-xSmall` | 11 | `--vscode-fontSize-body2` |
+
+Agents window ramp (`src/vs/sessions/**`) — identical values, `agents-`-prefixed
+(pair size with a weight token, **never** add a separate "strong" size):
 
 | px | Size var | Weight |
 |----|----------|--------|
@@ -105,26 +121,26 @@ is no medium (500). "Strong" = same size token + `semiBold`. See
 
 ## Font weight — `font-weight`
 
-The agents window uses a **two-weight ramp** — there are no other weights.
-Pair every text style with one of these:
+Both the generic and agents ramps use a **two-weight ramp** — there are no other
+weights. Pair every text style with one of these:
 
-| weight | Variable | Use |
-|--------|----------|-----|
-| 400 | `--vscode-agents-fontWeight-regular` | body, labels, metadata |
-| 600 | `--vscode-agents-fontWeight-semiBold` | headings, "strong" emphasis |
+| weight | Generic var | Agents var | Use |
+|--------|-------------|------------|-----|
+| 400 | `--vscode-fontWeight-regular` | `--vscode-agents-fontWeight-regular` | body, labels, metadata |
+| 600 | `--vscode-fontWeight-semiBold` | `--vscode-agents-fontWeight-semiBold` | headings, "strong" emphasis |
 
 - **No medium (500).** `font-weight: 500` is **off the ramp** — snap it to
   `semiBold` (600). The same goes for `700`/`bold` and any other numeric weight:
   round to the nearer of 400/600.
 - **"Strong" is not a separate size.** A "Body 1 Strong" / "Label 2 Strong"
-  style reuses the matching `--vscode-agents-fontSize-*` token paired with
-  `semiBold`. Never introduce a separate strong *size* token.
+  style reuses the matching `--vscode-fontSize-*` (or `--vscode-agents-fontSize-*`)
+  token paired with `semiBold`. Never introduce a separate strong *size* token.
 - `normal` ≡ 400 → `regular`. **Leave untouched:** `inherit`, `lighter`,
   `bolder`, and any `var()`/`calc()` expression. Preserve `!important`.
 
 ```css
 /* avoid */            font-weight: 500;   /* not on the 400/600 ramp */
-/* prefer */           font-weight: var(--vscode-agents-fontWeight-semiBold);
+/* prefer */           font-weight: var(--vscode-fontWeight-semiBold);
 ```
 
 ## Codicon size — icon `font-size`

.github/skills/add-policy/SKILL.md

@@ -25,7 +25,7 @@ Policies allow enterprise administrators to lock configuration settings via OS-l
 |--------|---------------|----------------------|
 | **OS-level** (Windows registry, macOS plist) | `NativePolicyService` via `@vscode/policy-watcher` | Watches `Software\Policies\Microsoft\{productName}` (Windows) or bundle identifier prefs (macOS) |
 | **Linux file** | `FilePolicyService` | Reads `/etc/vscode/policy.json` |
-| **Account/GitHub** | `AccountPolicyService` | Reads `IPolicyData` from `IDefaultAccountService.policyData`, applies `value()` function. Server-delivered managed settings arrive on `policyData.managedSettings`; native MDM (`INativeManagedSettingsService`) and a file on disk (`IFileManagedSettingsService`) are **separate** inputs that `AccountPolicyService` selects among in `getPolicyData()` via `selectManagedSettings(server, nativeMdm, file)` (single authoritative source by precedence server > native MDM > file; no merging between layers) |
+| **Account/GitHub** | `AccountPolicyService` | Reads `IPolicyData` from `IDefaultAccountService.policyData`, applies `value()` function. Server-delivered managed settings arrive on `policyData.managedSettings`; native MDM (`INativeManagedSettingsService`) and a file on disk (`IFileManagedSettingsService`) are **separate** inputs that `AccountPolicyService` merges in `getPolicyData()` via `pickManagedSettings(nativeMdm, server, file)` (per-key precedence native MDM > server > file; a key locked by a higher channel cannot be overwritten, keys it leaves unset fall through to lower channels) |
 | **Copilot managed settings (native MDM)** | `NativeManagedSettingsService` via `@vscode/policy-watcher` | Watches `SOFTWARE\Policies\GitHubCopilot` (Windows) / `com.github.copilot` prefs (macOS); feeds the canonical `managedSettings` bag — see [github-managed-settings.md](./github-managed-settings.md) |
 | **Copilot managed settings (file)** | `FileManagedSettingsService` | Reads + watches `managed-settings.json` from a well-known per-OS path in the main process, exposed to renderers over IPC; lowest-precedence managed-settings channel — see [github-managed-settings.md](./github-managed-settings.md) |
 | **Multiplex** | `MultiplexPolicyService` | In the main process, combines multiple OS/file policy readers; in desktop and Agents-window renderers, combines the main-process `PolicyChannelClient` with `AccountPolicyService` |
@@ -36,12 +36,12 @@ Policies allow enterprise administrators to lock configuration settings via OS-l
 |------|---------|
 | `src/vs/base/common/policy.ts` | `PolicyCategory` enum, `IPolicy` interface, `IPolicyReference`, `ManagedSettingsData`, `IManagedSettingsPolicyDefinitions` |
 | `src/vs/platform/policy/common/policy.ts` | `IPolicyService`, `AbstractPolicyService`, `PolicyDefinition`, `toSerializablePolicyDefinition` (drops the non-cloneable `value()` for IPC), `getRestrictedPolicyValue` |
-| `src/vs/platform/policy/common/copilotManagedSettings.ts` | Managed-settings key constants + well-known file paths, `collectManagedSettingsDefinitions`, `projectManagedSettings`, the shared `normalizeManagedSettings` (single normalizer for all channels), `selectManagedSettings` (channel precedence), `INativeManagedSettingsService` / `IFileManagedSettingsService` |
+| `src/vs/platform/policy/common/copilotManagedSettings.ts` | Managed-settings key constants + well-known file paths, `collectManagedSettingsDefinitions`, `projectManagedSettings`, the shared `normalizeManagedSettings` (single normalizer for all channels), `pickManagedSettings` (per-key channel precedence), `INativeManagedSettingsService` / `IFileManagedSettingsService` |
 | `src/vs/platform/policy/node/nativeManagedSettingsService.ts` | Native MDM watcher (`@vscode/policy-watcher`) for Copilot managed settings |
 | `src/vs/platform/policy/common/fileManagedSettingsService.ts` | File-based channel: reads + watches `managed-settings.json` on a well-known per-OS path, normalizes via `normalizeManagedSettings` |
 | `src/vs/platform/configuration/common/configurations.ts` | `PolicyConfiguration` — bridges policies to configuration values; parses JSON-string managed settings back to typed values; applies values to `policyReference` settings |
 | `src/vs/platform/configuration/common/configurationRegistry.ts` | `policy` / `policyReference` registration; `getPolicyReferenceConfigurations()` (name → subordinate settings) |
-| `src/vs/workbench/services/policies/common/accountPolicyService.ts` | Account/GitHub-based policy evaluation; selects + projects managed settings (server over MDM; single authoritative layer) |
+| `src/vs/workbench/services/policies/common/accountPolicyService.ts` | Account/GitHub-based policy evaluation; selects + projects managed settings (native MDM over server; single authoritative layer) |
 | `src/vs/workbench/services/accounts/browser/managedSettings.ts` | `adaptManagedSettings` — normalizes the server `managed_settings` response into the canonical bag |
 | `src/vs/workbench/services/policies/common/multiplexPolicyService.ts` | Combines multiple policy services |
 | `src/vs/workbench/contrib/policyExport/electron-browser/policyExport.contribution.ts` | `--export-policy-data` CLI handler |
@@ -329,4 +329,4 @@ Search the codebase for `policy:` to find all the examples of different policy c
 
 * Never hand-edit `build/lib/policies/policyData.jsonc` (its header explicitly forbids it). If `npm run export-policy-data` is failing, fix the script — don't patch the JSON. Common cause: running it in the wrong working directory (e.g. main repo instead of a worktree), which silently exports the wrong source tree.
 * **Regenerate `policyData.jsonc` in a clean environment, or the `PolicyExport` integration test will fail in CI.** `referencedSettings` is only captured for references **loaded at export time**. A plain `npm run export-policy-data` loads your **dev-profile extensions** (e.g. the Copilot extension), which injects `referencedSettings` onto core policies that the test's **fixture-based** export (clean profile, no user extensions) won't produce — so the checked-in file ends up with extra `referencedSettings` and CI fails. This is **not reproducible locally** because the test reuses your default extensions dir. Regenerate the way the test exports: `DISTRO_PRODUCT_JSON=<extensionPolicyFixture.json> ./scripts/code.sh --export-policy-data="$PWD/build/lib/policies/policyData.jsonc" --user-data-dir="$(mktemp -d)" --extensions-dir="$(mktemp -d)"` (with `VSCODE_SKIP_PRELAUNCH=1`).
-* Document **behavior and business-logic expectations**, not copy-pasted implementation. Reproducing internal code (e.g. the `getPolicyData()` merge body) in the skill rots the moment the source changes and adds no information beyond the source itself. State the contract in prose (e.g. "server-delivered managed settings win over native MDM; the two layers are never merged") and point to the source for the implementation. Reserve code blocks for the **author-facing API contract** a contributor must follow — how to *declare* a `policy` / `managedSettings` / `value` callback — not for restating runtime plumbing.
+* Document **behavior and business-logic expectations**, not copy-pasted implementation. Reproducing internal code (e.g. the `getPolicyData()` merge body) in the skill rots the moment the source changes and adds no information beyond the source itself. State the contract in prose (e.g. "native MDM managed settings win over the server-delivered channel; the two layers are never merged") and point to the source for the implementation. Reserve code blocks for the **author-facing API contract** a contributor must follow — how to *declare* a `policy` / `managedSettings` / `value` callback — not for restating runtime plumbing.

.github/skills/add-policy/github-managed-settings.md

@@ -52,14 +52,15 @@ described delivery slots (native MDM, server-managed, and file-based).
 
 All three VS Code channels converge in `AccountPolicyService.getPolicyData()`.
 
-**Precedence: server-delivered managed settings win over native MDM, which in turn win
-over the file-based channel** (`selectManagedSettings` in `copilotManagedSettings.ts`).
-There is a single authoritative source at any point in time — the channels are **not**
-merged. The highest-precedence non-empty channel wins outright and the rest are ignored.
-Rationale: the server is harder to bypass than local MDM, and a local file is the most
-easily tampered with, so admins need one authoritative source to reason about. The
-winning channel is then projected onto the declared schema (see below). Client-side
-merging still happens *within* the winning channel (e.g. `enabledPlugins`,
+**Precedence: native MDM managed settings win over the server-delivered channel, which in
+turn wins over the file-based channel** (`pickManagedSettings` in `copilotManagedSettings.ts`).
+Precedence is resolved **per key**: for each key the highest-precedence channel that supplies
+it wins, but a key that the higher channels leave unset is still filled in by a lower channel.
+A value an admin locks via native MDM therefore cannot be overwritten by the server or a file,
+while keys the higher channels never set remain available to lower ones. Rationale for the
+order: the server is harder to bypass than local MDM, and a local file is the most easily
+tampered with. The merged bag is then projected onto the declared schema (see below).
+Client-side merging still happens *within* a channel's value (e.g. `enabledPlugins`,
 `extraKnownMarketplaces`).
 
 ## Schema source of truth
@@ -201,7 +202,7 @@ delivery slot for the managed value.
 | `collectManagedSettingsDefinitions(policyDefinitions)` | Aggregates every policy's `managedSettings` into one `key → { type }` map. **Single source of truth** for which keys (and types) are honored; drives both the MDM watcher and the server projection. |
 | `hasManagedSettingsDefinitions(policyDefinitions)` | Cheap short-circuiting existence check (does *any* policy declare a managed key?) — used to decide whether the native MDM watcher is needed at all, without building the full aggregate. |
 | `projectManagedSettings(values, definitions, onWarn?)` | Keeps only declared keys whose runtime value **matches the declared type**. Undeclared keys and type mismatches are **dropped (validated, never coerced)**, with an optional warning. |
-| `selectManagedSettings(server, nativeMdm, file)` | Picks the single authoritative channel by precedence (server → native MDM → file); never merges. **The extension point when adding a new channel** — extend the `ManagedSettingsSource` union and this function together. |
+| `pickManagedSettings(nativeMdm, server, file)` | Merges the channels **per key** by precedence (native MDM → server → file): the highest-precedence channel that sets a key wins, lower channels fill in keys the higher ones leave unset, and every contribution is recorded for provenance. **The extension point when adding a new channel** — extend the `ManagedSettingsChannel` union, the `MANAGED_SETTINGS_CHANNELS` order, and this function together. |
 | `managedSettingValue(key)` | Builds the standard pass-through `value` callback `policyData => policyData.managedSettings?.[key]`. Use for the common "lock to the managed value, else fall through" case (see [Declaring a managed setting](#declaring-a-managed-setting-on-a-policy)). |
 
 ### Normalization: the structured-key descriptor table