This repository was archived by the owner on Sep 8, 2026. It is now read-only.
Bump the cargo group across 1 directory with 2 updates - #3
Open
dependabot[bot] wants to merge 1 commit into
Open
Bump the cargo group across 1 directory with 2 updates#3dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the cargo group with 2 updates in the /cli directory: [tokio](https://github.com/tokio-rs/tokio) and [openssl](https://github.com/sfackler/rust-openssl). Updates `tokio` from 1.38.2 to 1.42.1 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.38.2...tokio-1.42.1) Updates `openssl` from 0.10.72 to 0.10.73 - [Release notes](https://github.com/sfackler/rust-openssl/releases) - [Commits](rust-openssl/rust-openssl@openssl-v0.10.72...openssl-v0.10.73) --- updated-dependencies: - dependency-name: tokio dependency-version: 1.42.1 dependency-type: direct:production dependency-group: cargo - dependency-name: openssl dependency-version: 0.10.73 dependency-type: indirect dependency-group: cargo ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
pull Bot
pushed a commit
that referenced
this pull request
Jun 12, 2026
…ows (microsoft#319595) * nes: send periodic enhanced telemetry with overlapping recording windows Adds ContinuousEnhancedTelemetrySender which periodically ships a fixed-length slice (5 min) of DebugRecorder activity as an enhanced GH telemetry event, reusing the existing 'copilot-nes/provideInlineEdit' channel and tagging events with 'continuous: true' so the backend can route them. Adjacent slices are guaranteed to overlap by >= 30 s. With tick cadence INTERVAL = WINDOW - OVERLAP - HARD_CAP and a (idle, hard_cap) wait that mirrors the suggestion-anchored TelemetrySender, the slice always ends at a 'stable' moment so we don't capture mid-keystroke state. Slices with no actual edits are skipped. - DebugRecorder gains getLogInRange(from, to), with framing fast-forwarded so the emitted setContent reflects the document state at the slice start. - New experiment-gated setting chat.advanced.nes.continuousEnhancedTelemetry.enabled (default off). - Wired into InlineEditProviderFeature alongside TelemetrySender. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * nes: address PR review feedback - Fix config key mismatch: TS used 'chat.advanced.nes...' but package.json exposed 'chat.nes...', so user/experiment config was never read. Align the TS key with the package.json key. - Use DebugRecorder.getTimestamp() instead of Date.now() for the window end so edits whose recorded instant was bumped past Date.now() for total ordering aren't dropped at the boundary. - Drop unused 'at' parameter from the insertEdit test helper and clean up the call sites that were still passing a redundant timestamp. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * nes: drop config gate for continuous enhanced telemetry Per PR feedback: the existing GH enhanced-telemetry user controls are sufficient gating; no need for a dedicated setting. Removes: - chat.nes.continuousEnhancedTelemetry.enabled setting (package.json, package.nls.json, ConfigKey). - IConfigurationService + IExperimentationService dependencies from the sender; the loop now runs unconditionally for the sender's lifetime. - Two tests that exercised the config toggle. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * nes: clarify continuous telemetry semantics + drop misnamed field Subagent review findings: - Drop `activeDocumentRepository` for continuous events: a 5-min slice spans many docs over time, so there's no meaningful 'active' document. The full workspace repo set is reported via `repositories` already. - Rename `MAX_ENTRIES_BYTES` -> `MAX_ENTRIES_CHARS` (truth in advertising: it's `string.length` / UTF-16 code units, matching the existing suggestion- anchored recording cap). - Class-level doc: clarify that the overlap guarantee assumes timely scheduler execution; extension-host stalls / machine sleep / skipped empty slices can produce gaps. Treat `windowStart`/`windowEnd` as authoritative; don't infer contiguity from `sequenceNumber + 1`. - Doc that `sessionId` is per-sender-lifetime, and that the sender can be recreated within one extension session when `InlineEditProviderFeature`'s autorun reruns. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * nes: don't bump docVersion on selectionChanged in DebugRecorder Per PR review: `selectionChanged` entries have no `v` field in the schema (workspaceLog.ts:64), and production `WorkspaceRecorder` only bumps version on real document content changes via VS Code's model version. The replayer consumes `changed.v` directly when applying edits. Previously, `DebugRecorder` synthesized `v` and bumped it on every recorded event including selections, which produced phantom gaps in the `changed` version sequence (e.g. 2, 4, 5 instead of 2, 3, 4) that don't match what a real recording would contain. Fixed in both `getDocumentLog` and `getDocumentLogInRange`. Snapshot test updated; added a focused regression test asserting consecutive `changed` entries get consecutive `v` values regardless of interleaved selection changes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * nes: drop caller reference from DebugRecorder.getLogInRange jsdoc Per PR review: low-level method docs shouldn't reference specific callers — they easily go stale. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * nes: clamp slice framing times + dedup upstream-remote helper Two PR review threads: 1. Slice framing times made misleading. `getDocumentLogInRange` was emitting `documentEncountered.time = creationTime` and `setContent.time = baseValueTime`, both of which can pre-date the requested `[fromTimeMs, toTimeMs]` window (a doc may have been open for hours). Now framing times are clamped up to `fromTimeMs` so the slice's per-event `time` contract holds. Documented the invariant and added a coverage test asserting every emitted time falls in range; updated the fast-forward test's expectation accordingly. 2. Upstream-remote extraction was copy-pasted in three places (twice in `nextEditProviderTelemetry.ts`, once in the new sender). Extracted to `getUpstreamRemote(repository)` in `platform/git/common/utils.ts` and reused everywhere. Behaviour preserved. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * nes: extract NES_GH_TELEMETRY_EVENT_NAME constant Per PR review: the literal 'copilot-nes/provideInlineEdit' was hardcoded in three call sites in nextEditProviderTelemetry.ts plus the new continuous sender. Extract into a named export from nextEditProviderTelemetry.ts (the file that already owns the event) and import it from the continuous sender so the relationship is explicit. Behaviour unchanged. Tests intentionally still use the literal string since they assert on the wire-level event name. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * nes: revert clamp of framing times in getDocumentLogInRange The clamp I added in b1d795c was wrong on three counts: 1. **Sort ambiguity**: clamping multiple docs' framing to `fromTimeMs` creates ties in the sortTime used by the cross-doc merge sort in `getLogInRange`. Ordering then depends on insertion order (i.e. map iteration order) instead of real time. Stable sort still preserves the per-doc framing-before-edits invariant, but the result becomes load-bearing on insertion order in a way the old code wasn't. 2. **Inconsistency with production**: `WorkspaceRecorder` (workspaceRecorder.ts:254) emits `documentEncountered`/`setContent`/ `opened` with their actual timestamps, never clamped to a window. The DebugRecorder slice should match that semantic. 3. **Worse for stitching**: with clamping, the same logical `documentEncountered` event gets a different time in each overlapping slice (fromTimeMs of that slice) — harder to dedup than the stable true creationTime. Revert the clamp; document that framing carries true creation/base-value times even when they pre-date `fromTimeMs`, and that consumers should treat any entry with `time < fromTimeMs` as framing. Drop the out-of-range test, restore the original setContent.time expectation in the fast-forward test. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * nes: harden continuous telemetry loop against subagent-found issues Subagent review (rounds: code-review HIGH + rubber-duck #2,#3,#8) found: 1. **Unhandled throw in _sendNow kills the loop forever.** RunOnceScheduler's runner has no try/catch, so an exception from JSON.stringify or the telemetry service would propagate out and never let reschedule() run. Fix: try/finally around _sendNow() so reschedule() always fires. Added regression test. 2. **cleanUpHistory() in getDocumentLogInRange races with fromTimeMs.** Cleanup uses getNow() - 5min as its cutoff. Between the caller computing windowEnd and the per-doc cleanup running, getNow() can advance enough that earliestTime > fromTimeMs, causing an edit at the leading edge of the requested range to be rotated into baseValue and dropped from the emitted slice. Fix: don't call cleanUpHistory() in this getter at all — the fast-forward loop already handles any base state, and the per-edit cleanup in handleEdit keeps memory bounded. 3. **Disposed idleStores accumulate in loopStore.** Calling idleStore.dispose() doesn't remove it from the parent's tracking Set, so dead inner stores leak one per ~4 min for the sender's lifetime. Fix: loopStore.delete(idleStore) instead. 4. **_sendNow() duration not in overlap math.** Added a doc caveat — the JSON.stringify cost is added to inter-send spacing but is well under 1 % of the 30 s overlap budget in practice. No code change. 5. **No test for doc opened after toTimeMs.** Added one. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
pull Bot
pushed a commit
that referenced
this pull request
Aug 21, 2026
* Let the setup banner reload an agent's configuration A user who finishes setup outside the app — `claude login` in a terminal, an exported key — leaves no signal the app can see, so the banner kept asking them to sign in to something they had already signed in to. Give them a way to say "look again", and rename the docs link to "learn more" now that it is one of two links rather than the only one. The re-look is the tail of a download promoted to its own gesture: restart chat discovery, then refresh models. `AgentSdkSetupChannel` grows a second request key rather than per-agent code, so agent #3 still needs no edit here — one consumed nonce per key, cleared as it is claimed, so a repeat press still lands. The reload clause folds into each of the four `noAccount` sentences rather than trailing them: it is unconditional, so the table stays at four branches and no localized string is assembled from fragments. * Rank the no-account copy as the buttons rank it, and harden its links Read the sentence in the order the routes are weighted: GitHub sign-in leads, as the primary button; the provider sign-in follows; reload and docs trail, being the copy's only links rather than buttons. Reload and docs become their own sentences — kept as trailing clauses they would have fallen under the "if you already set up Claude elsewhere" conditional, which does not scope docs. Addresses review feedback: build both `command:` hrefs through `createCommandUri` instead of by hand (`encodeURIComponent` leaves `)` alone, so an agent id containing one closed the markdown link destination early), and escape the host-supplied display name and sign-in provider before interpolating them into markdown this banner trusts for two commands. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Rewrite the no-account copy, and point Claude at its integrations docs The four sentences now put every sign-in route and the reload into one "or" list, ranked as the buttons rank them, and give the docs their own trailing sentence. Claude's docs URL moves to the third-party integrations page, which is what "other ways to set up Claude" actually means: Console, Bedrock, Vertex, Foundry, Teams and Enterprise. "Set up" is the verb, two words, as the rest of the string already had it. Both agents' URL constants still described the workbench as labelling a button. It has been a link since docs stopped being an action. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
pull Bot
pushed a commit
that referenced
this pull request
Sep 1, 2026
…rosoft#325331) * Add extensions.gallery.authProvider policy, marketplace scope, and context key Introduce the `extensions.gallery.authProvider` policy that selects which identity provider (github or microsoft) gates Private Marketplace access, and register it in the exported policy data. Add the marketplace auth-provider context key and the Entra ID resource scope constant used to acquire a Private Marketplace-audienced token. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Add Entra ID eligibility check to the gallery manifest service Resolve the marketplace access strategy in the workbench gallery manifest service: cache-first startup, provider-routed access handling, Microsoft eligibility probing against the eligibility resource from the gallery manifest, the GitHub DefaultAccount path, the marketplace auth-provider context key, and access telemetry. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Add provider-aware marketplace sign-in and access-denied UX Surface a provider-aware sign-in prompt and access-denied state in the extensions viewlet, driven by the marketplace auth-provider context key so the correct identity provider is presented to the user. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Add microsoft to trustedExtensionAuthAccess Allow the built-in extensions gallery to silently use Microsoft (Entra ID) authentication sessions for Private Marketplace access. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Add unit tests for marketplace provider routing and eligibility Cover provider selection, cache-first startup, Microsoft eligibility handling, and the GitHub access path in the gallery manifest service. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Harden Entra marketplace access: cache scoping, race guards, error handling Address rubber-duck review findings on the Entra ID marketplace path: - Scope the cached access verdict to the marketplace it was computed against (authProvider + accountId + serviceUrl), rejecting stale caches on any mismatch. - Guard cache application and background validation with a monotonic epoch so a session/account/config change mid-validation supersedes an in-flight result. - Register session/account listeners before applying the cache, and the config listener before initial validation, closing startup TOCTOU windows. - Route transient auth-service and marketplace-fetch failures to Unreachable instead of leaving a configured marketplace on a blank Unavailable view. - Split 401 (missing/expired token -> RequiresSignIn, not cached) from 403 (durable denial -> AccessDenied, cached ineligible). - Never follow redirects on token-bearing requests; only send the Entra token to an HTTPS same-origin target; reject non-2xx and non-manifest 200 responses before parsing. - Restore the galleryservice:custom:marketplace telemetry on the GitHub path and drop the unused server-provided eligibility reason from persisted cache. Expand unit coverage to 45 tests across provider routing, eligibility, caching, error classification, and the epoch race paths. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address Copilot PR review: policy export, cross-account leak, layering, resource validation, UX copy - Policy: make the `extensions.gallery.authProvider` schema enum and enumDescriptions unconditional (`github`, `microsoft`). Gating the enum on the Entra product flag left the policy metadata exporting two enum descriptions against a single-value enum, which fails the policy-artifact generator's equal-length requirement on a clean export. The Entra gate is already enforced at runtime in getEffectiveAuthProvider(), and the setting is hidden (included: false), so this advertises nothing new in the UI. - Cross-account authorization leak: on Microsoft session change and GitHub default-account change, revoke the active manifest (drop `Available`) before revalidating. Previously the active status stayed `Available`, so a transient index/eligibility failure on the new account preserved the prior account's access. - Layering: move CONTEXT_MARKETPLACE_AUTH_PROVIDER down to the platform extensionGalleryManifest module so the workbench service no longer imports from a workbench/contrib module. The Extensions contribution re-exports it for existing consumers. - Resource validation: reject a 200 service index whose `resources` entries are malformed (missing string `id`/`type`), not just a non-array `resources`. Endpoint discovery calls `resource.type.split()` outside the fetch try/catch, so an undefined `type` would crash initialization instead of surfacing `Unreachable`. - UX: make the Microsoft AccessDenied welcome message generic. A bare 403 gives no typed reason, so asserting that an Entra ID account or Visual Studio Subscription is required could tell an already-signed-in user to obtain access they already have. Adds a unit test covering the malformed-resources -> Unreachable path. All 47 gallery tests pass; typecheck-client and valid-layers-check are clean. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Avoid `any` casts in extensionGalleryManifestService test Replace the two `as any` casts flagged by the local/code-no-any-casts ESLint rule that failed hygiene: complete the stubbed IProductService.extensionsGallery so it satisfies Partial<IProductService> without a cast, and cast the entitlements literal to IEntitlementsData. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Refactor Private Marketplace access validation into a provider strategy Extract all eligibility/access-validation logic out of WorkbenchExtensionGalleryManifestService into a dedicated, provider-agnostic ExtensionGalleryAccessValidator, and split the GitHub-vs-Microsoft branching into IExtensionGalleryAccessProvider strategy classes. This debloats the host service (it now only builds a status sink and delegates) and isolates each identity system's account resolution + eligibility check. Replace the hand-rolled monotonic validationEpoch TOCTOU counter with a CancellationTokenSource held in a MutableDisposable: assigning a new source cancels/disposes the prior one, and each validation re-checks token.isCancellationRequested immediately before mutating status/cache/manifest, so a superseded in-flight validation cannot commit a stale verdict for an account that is no longer current. Addresses reviewer feedback that the epoch machinery bloated the service. New files: - extensionGalleryAccess.ts: shared leaf contracts (IExtensionGalleryAccessCore, IExtensionGalleryAccessProvider, IExtensionGalleryAccessSink, ICachedAccess, AccountResolution, ExtensionGalleryAccessProviderId, isSafeTokenTarget). - extensionGalleryAccessProviders.ts: GitHub and Microsoft access providers. - extensionGalleryAccessValidator.ts: provider-agnostic orchestrator. Security invariants preserved: no microsoft->github fallback, cache scoped to provider+serviceUrl, bearer only over HTTPS same-origin with followRedirects:0, and the 401/403/transient status mappings are unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c * Surface AccessDenied instead of re-prompting sign-in on 401 for signed-in Microsoft accounts When a signed-in Microsoft account made an authenticated Marketplace request that returned 401, the previous logic mapped it to RequiresSignIn, which re-prompted the same account whose token had just been rejected - producing an infinite sign-in loop. Map both Microsoft 401 branches (service-index and eligibility) to AccessDenied so the condition is surfaced to the user, and do not cache the 401 verdict (unlike a durable 403 denial) so a later config/account/session change re-evaluates cleanly. Lower the MarketplaceAuthRequiredError log level to trace. First-time no-session flows are unchanged (still RequiresSignIn). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c * Remove policy data from contributor PR Keep the extensions.gallery.authProvider setting while moving its policy declaration and generated catalog entry to a separate maintainer-authored change.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>\nCopilot-Session: 449a6246-235a-4c42-8d6d-ef65fd83a190 * Dissolve access validator into account + service-index services Replace ExtensionGalleryAccessValidator and the provider/sink strategy classes with two plain services and restore the manifest service toward its upstream-main shape (minimal diff): - ExtensionGalleryAccountService: mirrors IDefaultAccountService (getAccount/getCachedAccess/clearCache/onDidChangeAccount); owns GitHub + Microsoft account resolution, the eligibility check, and the ICachedAccess read/write/validate. - ExtensionGalleryServiceIndexService: memoized service-index fetch. - extensionGalleryManifestService: delegates all account/eligibility/ index/cache work to the two services; keeps the added validation orchestration with a MutableDisposable<CancellationTokenSource> for the TOCTOU supersession guard. - extensionGalleryAccess: trimmed leaf (removed orphaned sink/core interfaces), keeps shared helpers and error types. The onDidChangeAccount subscription is registered before the initial awaited validation so a sign-out mid-flight is observed. All 46 existing manifest-service tests pass unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c * marketplace: thread CancellationToken guards, materialize index in cache path, restore logs, trim comments Continue the Private Marketplace access refactor on the extracted services: - Thread CancellationToken through the account service's cache mutations (denyFromAuthError and the eligible fast-path), guarding every write with token.isCancellationRequested so a superseded validation can never restore or persist a verdict for an account that is no longer current (TOCTOU guard). - Materialize the service index inside the account service's cached-access path and add invalidateServiceIndexCache(), so the host maps a verdict to status without any further fetching and each validation generation re-fetches cleanly. - Restore the [Marketplace] debug log messages (sign-in / access / SKU / enterprise) for parity with main's observability. - Trim branch-added comments to why-only, leaving main's pre-existing comments untouched. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c * marketplace: make getEffectiveAuthProvider dependency-free, cache resolved provider Replace the DI-service parameters on getEffectiveAuthProvider with plain primitives (configured provider string + Entra product flag) so the helper never reaches into a service, and cache the resolved provider in a field on the manifest service to avoid resolving it twice. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c * marketplace: collapse duplicate access-denied welcome content into one entry The microsoft and github/default access-denied welcome blocks carried near-identical messages and together covered every provider state, so replace them with a single entry gated on the AccessDenied status alone. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c * marketplace: fix telemetry provider scoping galleryservice:custom:marketplace was gated on the github provider, so successful Microsoft/Entra marketplace access went uncounted. It now fires for any successfully accessed serviceUrl-configured marketplace, restoring its original meaning (custom-marketplace access, independent of provider). The github-vs-microsoft distinction is instead tracked by marketplace:auth:checked, which is now emitted from cacheAccess so every definitive eligibility verdict reports its authProvider + eligible for both providers (previously only the Microsoft 200 path emitted it). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c * test: add gallery access unit and telemetry coverage Add a dedicated extensionGalleryAccess.test.ts exercising the pure getEffectiveAuthProvider and isSafeTokenTarget helpers directly, and telemetry-assertion cases in the manifest service suite verifying galleryservice:custom:marketplace fires for both GitHub and Microsoft on eligible access, and marketplace:auth:checked reports the correct authProvider+eligible at each definitive verdict. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c * Remove CONTEXT_MARKETPLACE_AUTH_PROVIDER re-export Import the context key directly from the platform extensionGalleryManifest module in extensionsViewlet.ts (its only consumer) instead of re-exporting it from contrib/extensions/common/extensions.ts, so there is a single import source. Addresses PR review feedback. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c * Use Event.signal for onDidChangeAccount instead of an emitter relay Assign onDidChangeAccount directly via Event.signal over the provider-specific source instead of relaying through a private Emitter with Event.map. Removes the now-unused Emitter import. Addresses PR review feedback. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c * Default extensions gallery auth provider to a valid enum member Set the default for the marketplace auth-provider setting to 'github' instead of the empty string, so the default is a member of the declared enum. Both readers treat any non-'microsoft' value as the GitHub path, so behavior is unchanged. Addresses PR review feedback. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c * Revert 'Add microsoft to trustedExtensionAuthAccess' Drop the empty 'microsoft': [] placeholder from trustedExtensionAuthAccess in product.json. It granted no silent access (no-op) and was local scaffolding for the Entra path. Addresses PR review feedback. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c * Register account resolver as a Delayed singleton (Tyler #3, #4) Replace the lazy `galleryAccountService: | undefined` field and its `createInstance` in the manifest service with a proper `InstantiationType.Delayed` singleton behind a new `IExtensionGalleryAccountService` decorator, injected into the ctor. The Delayed proxy makes ctor-time injection and the `onDidChangeAccount` subscription non-instantiating, so the account service (and its transitively-cyclic `IAuthenticationService` dependency) only materializes on first non-event access. A `galleryAccountServiceActive` flag guards the config-change handler so an unrelated config change never force-instantiates the resolver when no private marketplace was configured. The ctor microtask is kept: it defers the eager bootstrap's first access past ctor return so the re-entry resolves the cached instance instead of throwing "RECURSIVELY instantiating". Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c * Ground Private Marketplace account selection in a persisted slot The Microsoft auth provider returns one session per signed-in account, so picking sessions[0] was arbitrary when several accounts are signed in. Persist a provider-scoped account slot (marketplace.account = { authProvider, id }) and add a single getMicrosoftSession() selector that both the live check and cache validation use: prefer the remembered account, adopt-and-persist a lone account, and refuse to guess (require sign-in) when several accounts are signed in with no remembered choice or the remembered one is gone. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c * Show account quick pick on Microsoft marketplace sign-in Address PR review: the Microsoft sign-in action no longer blindly creates a session. When multiple Microsoft accounts are signed in, a quick pick lets the user choose one (with a "different account" escape hatch); a single account is bound directly, and no accounts falls through to interactive sign-in. The chosen account is persisted so selection stays grounded across restarts. The browser-layer sign-in action delegates to a command registered in the electron-browser account service (mirroring the GitHub branch's DEFAULT_ACCOUNT_SIGN_IN_COMMAND delegation), respecting the layer boundary. Binding uses createSession({ account }) so an already signed-in account is bound without a fresh login while still firing the session-change event that drives marketplace re-validation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c * Clarify getAccount vs resolveCurrentAccount intent Address PR review: the two methods read as similar. Add JSDoc on each contrasting it with the other so the distinct responsibilities are clear at the call site: getAccount is the heavier public eligibility verdict (may hit the network), while resolveCurrentAccount is an identity-only silent resolution used solely for cache validation. The overlapping "current account" selection logic was already unified into the single getMicrosoftSession() selector. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c * Move Microsoft (Entra) marketplace eligibility check client-side Decide Private Marketplace eligibility locally from the account's ID-token tenant (`tid`) claim instead of round-tripping to a server-side EligibilityService endpoint, mirroring how the GitHub path already gates locally. A work/school (Entra) tenant is eligible; a personal Microsoft Account (MSA) is not. The check runs before any index fetch, so an ineligible account never touches the (possibly auth-gated) index, and fails closed on an undecodable/opaque token or a token with no `tid`. Removes the EligibilityService resource type, its URL discovery, the same-origin token-target guard for it, and the IRequestService dependency and POST round-trip in ExtensionGalleryAccountService. Adds an optional `tid` claim to IAuthorizationJWTClaims and rewrites the surrounding docs. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c * marketplace: break account->auth DI cycle via orchestrator wiring ExtensionGalleryAccountService injected IAuthenticationService, forming a service DI cycle (account -> auth -> extensionService -> extensionGalleryService -> manifest -> account) that the instantiation graph walker detects and aborts startup on. `Delayed` does not help: the cycle graph is a static walk over the @iService constructor decorators. Remove the @IAuthenticationService constructor dependency and supply it post-startup through a new connectAuthentication() init API, wired by a small ExtensionGalleryAccountAuthenticationContribution at WorkbenchPhase.AfterRestored (orchestrator wiring, per reviewer guidance - not a service-locator lookup). Until connected the Microsoft path reports "no account"; connecting re-signals onDidChangeAccount once so any verdict resolved in that window is re-validated. Update the manifest service test to play the orchestrator role by calling connectAuthentication after constructing the account service. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c * marketplace: rename ExtensionGalleryServiceIndexService to ...Fetcher The class carried a "Service" suffix but is a plain createInstance helper owned by ExtensionGalleryAccountService (an owner-scoped memo cache), not a DI-registered service. Rename the class to ExtensionGalleryServiceIndexFetcher and the field indexService -> serviceIndexFetcher so the name no longer implies a service registration it does not have, per reviewer feedback (either register it properly or rename it). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c * marketplace: drop obsolete microtask deferral in gallery manifest service The deferral guarded against "RECURSIVELY instantiating service 'IAuthenticationService'" as introduced in bd44656, when this service resolved authentication itself through instantiationService.invokeFunction while still constructing. af73002 moved access resolution into ExtensionGalleryAccountService and removed authentication from that service graph: IAuthenticationService is now handed over after startup by ExtensionGalleryAccountAuthenticationContribution (WorkbenchPhase.AfterRestored), and the account service reports "no account" until then. Nothing reachable from this constructor can resolve authentication anymore, so the deferral was dead code. Verified by launching a configured private marketplace with and without the deferral on a clean build: both start normally, with no recursion error and identical [Marketplace] trace output. Also corrects the galleryAccountService comment, which described an IAuthenticationService dependency that no longer exists and pointed at the deferral removed here. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155 * marketplace: move access resolution into the gallery account service The manifest service was orchestrating access validation rather than consuming it: it drove the two-phase cached-then-live resolution, owned the validation generations and cancellation tokens, and reached into the account service to clear caches and invalidate the memoized service index. Roughly 125 of its 272 lines were access machinery, and four account-service internals had to be public for it. Move all of that behind the account service. It now resolves access itself (cache first, then re-validating in the background) and publishes the outcome as a verdict, so the manifest service only maps verdict to ExtensionGalleryManifestStatus. Interface changes: - add onDidChangeAccess: Event<IExtensionGalleryAccessVerdict> and resolveAccess(serviceUrl), which needs no CancellationToken from the caller - add reset() for the configuration-change path - getAccount and getCachedAccess become private; clearCache becomes private; invalidateServiceIndexCache is deleted (unused once the caller moved) No behaviour change: verdict classification, the "never downgrade an already Available marketplace" rule, cancellation semantics and cache lifetimes are preserved. extensionGalleryManifestService.ts drops from 272 to 203 lines and its access-validation section from ~125 lines to a 40-line mapping. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155 * marketplace: include the service index error body in the failure A non-2xx service index response was reported as only a status code, so a marketplace that rejects the client and explains why in the body was indistinguishable from an unreachable network. The workbench surfaces such a failure as "The Extensions Marketplace is currently unavailable. Check your network connection", which sends the user looking in the wrong place. Append a best-effort, truncated response body to the error so the reason reaches the log. For example a marketplace enforcing a minimum client version now reports: Service index returned status 400: Access denied: Only VS Code clients version 1.104.2 or later are allowed. Diagnostics only: the status mapping is unchanged, and reading the body never throws so it cannot mask the status we already have. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155 * marketplace: pin that a signed-out user is never told to check the network With no session the service index is never probed, so a failing marketplace cannot turn RequiresSignIn into Unreachable and leave the user with a "check your network connection" message and a reload link instead of a sign-in affordance. That invariant was untested for the post-startup re-validation path, which runs when authentication connects and re-signals an account change. Adds a test covering that sequence: no session, an index that would reject the client, and a session-change event after the initial resolution. Asserts the status stays RequiresSignIn and that no index request is made. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155 * marketplace: report a rejected client as denied, not unreachable A marketplace can refuse the client outright — for example one enforcing a minimum supported VS Code version replies 400 "Only VS Code clients version 1.104.2 or later are allowed". That is durable: retrying cannot help. Such a response was classified as a transient failure and surfaced as "The Extensions Marketplace is currently unavailable. Check your network connection", which points the user at something that is not the problem. On main any failed fetch of a configured marketplace reports AccessDenied ("please contact your administrator"), so this was also a regression in what the user is told. Classify a non-401/403 4xx as a new MarketplaceClientRejectedError and map it to a denial, restoring the message main gives. 5xx and network failures stay transient and continue to report Unreachable. The denial is deliberately not cached: it belongs to the client, not the account, and can change on upgrade. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155 * marketplace: give the account service one job, and the manifest service the rest Review feedback on the previous split: the account service should answer whether there is a usable account, and nothing else. It was still fetching the service index, so its verdict carried a manifest and it needed the marketplace URL — neither of which is its concern. Account service now resolves identity and entitlement only: readonly accountStatus: ExtensionGalleryAccountStatus; readonly onDidChangeAccountStatus: Event<ExtensionGalleryAccountStatus>; getAccount(): Promise<IExtensionGalleryAccount | undefined>; readonly onDidChangeAccount: Event<void>; setPreferredAccount(accountId: string): void; connectAuthentication(authenticationService: IAuthenticationService): void; It no longer takes a serviceUrl or a CancellationToken, returns no manifest, and owns no index cache. getAccount returns the signed-in account even when it is not entitled, so callers can scope a durable denial to it; accountStatus says whether it may be used. The marketplace auth-provider context key moves here too, which also removes a second call to getEffectiveAuthProvider. The manifest service now owns the marketplace side: the serviceUrl, the non-HTTPS token-target check, the index fetch, resolution generations, and the mapping from outcome to ExtensionGalleryManifestStatus. The durable access verdict moves to a new ExtensionGalleryAccessCache rather than into either service, so neither carries storage plumbing and the scoping rules — a verdict is only honoured for the account, marketplace and auth provider it was written for — live in one testable place. It resolves the effective auth provider itself via getEffectiveAuthProvider, a pure function, rather than requiring a new member on the account service. Two ordering bugs surfaced while testing this and are fixed here: the configuration-change listener was registered after the initial resolution, so a change during a slow index fetch was missed entirely; and a transient failure to resolve the account discarded the cached verdict that a later retry needs. Behaviour is otherwise unchanged, verified against a deployed private marketplace and by the existing suite. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155 * marketplace: cut comment volume across the PR Review feedback: keep code comments minimal. The marketplace files carried long explanatory blocks that restated what the code already says. Trimmed every file this PR touches, keeping rationale only where the code cannot show it — the service DI cycle, why an ineligible account is still returned, why only a 403 is persisted, why a bearer is confined to a same-origin HTTPS target. Net 107 lines removed with no functional change. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155 * Fold the service index fetch back in and drop the access cache The index fetcher only existed to hold a memo that could never be hit: resolve() invalidated it immediately before its single read. With no state left it returns to a private method on the manifest service. The durable access cache is removed. Its `true` verdict was never read, and the `false` written for a client-side ineligible account outlived the condition it recorded - an account later granted entitlement stayed AccessDenied until sign-out. Covered by a new regression test. isSafeTokenTarget was called with the same URL for both arguments, so only its HTTPS check ever ran; it becomes an inline guard. Redirects are already handled by followRedirects: 0. MarketplaceMisconfiguredError was never thrown and is gone. The configuration listener returns to its shape on main, with the auth provider key added. renderAvailable becomes setAvailable. Comment volume across these files drops from 24% to 8%, against 4% in the surrounding extensionManagement code. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155 * Publish the catalog on every successful resolve A private marketplace is account-scoped, but the success path skipped publishing whenever the status was already Available. Switching to a different eligible account therefore fetched that account's catalog and then discarded it, leaving the previous account's in place until restart. The manifest is now published on every success; the custom-marketplace telemetry still fires only on the transition into Available. Removing the access cache orphaned IExtensionGalleryAccount.id - it existed only to scope a cached verdict to an account - so it goes, along with the comment describing the verdict it scoped. That removal also took with it the only test asserting that an already-available marketplace survives a transient failure. Restored for both the fetch and the account-resolution paths. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155 * refactor gallery manifest service to have minimal changes * Adopt the reviewer's gallery manifest service Takes c41e451 as-is, with two changes that restore main's outcome: A failed manifest fetch is reported as denied, as on main, rather than asking an already-signed-in user to sign in. This also keeps the minimum-client-version rejection reading the way it does today. A transient failure to resolve the account no longer retracts a marketplace the user already has. On main that throw rejects the promise and no status is published, so an available marketplace survives; here the account service catches it, reports Unknown, and returned undefined would otherwise be read as a sign-out. Authentication moves to the follow-up PR: the bearer on the service index, the HTTPS guard, redirect suppression, and 401/403 typing all go, along with the Unreachable and Misconfigured statuses that only existed to describe them, and their welcome content and badges. Two defects that also reproduce on main are now separate PRs - microsoft#331800 (a sign-out during an in-flight fetch) and microsoft#331804 (a 200 carrying any JSON accepted as a service index) - so the tests covering them move there. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155 * Remove the Entra auth product flag extensions.gallery.authProvider is now the only switch for the Microsoft path. Also removes extensionGalleryAccess.ts, whose remaining exports were already orphaned by the manifest service adoption in e61ce45. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155 * Read marketplace auth scopes from product.json Adds extensionsGallery.accessScopes and drops the hardcoded PRIVATE_MARKETPLACE_SCOPES, following defaultChatAgent.providerScopes. Session lookup and interactive sign-in resolve the scopes through one accessor so they cannot drift. A deployment that enables the Microsoft path without configuring scopes now reports no account instead of requesting a session with scopes it did not ask for. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155 * Route marketplace sign-in through the account service Follows DefaultAccountProvider: the auth-dependent half becomes an IExtensionGalleryAccountProvider that a workbench contribution builds and hands to the service, so the service no longer takes IAuthenticationService at all and connectAuthentication is gone. Sign-in is now a single signIn() on the service, which removes the provider-specific command id and the cross-layer invoke-by-string. The extensions view welcome content collapses back to one status-gated entry labelled Sign In, leaving CONTEXT_MARKETPLACE_AUTH_PROVIDER with no consumers. The service interface moves to common/ so the browser layer can call it directly. Both desktop entry points import the electron-browser module explicitly: it is now only reachable for its registerSingleton side effect, and without that the renderer fails to start. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155 * Prompt for restart when the marketplace auth provider changes The provider is selected once at startup, so changing extensions.gallery.authProvider mid-session had no effect and gave no indication that it had not been applied. The sibling serviceUrl setting already prompts; this reuses that listener and dialog rather than rebuilding the provider live. Each setting keeps its own message: serviceUrl still reports a different Marketplace, and the auth change reports a configuration change. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Josh Spicer <23246594+joshspicer@users.noreply.github.com> Co-authored-by: Sandeep Somavarapu <sasomava@microsoft.com> Copilot-Session: fe244b45-6362-4563-880d-fa3d9a27a07c Copilot-Session: 4e27c63d-f29e-4ee0-a324-8adb523f5155
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the cargo group with 2 updates in the /cli directory: tokio and openssl.
Updates
tokiofrom 1.38.2 to 1.42.1Release notes
Sourced from tokio's releases.
... (truncated)
Commits
f7fb0bdchore: prepare Tokio v1.42.19faea74Merge 'tokio-1.38.x' into 'tokio.1.42.x'bb9d570chore: prepare Tokio v1.42.0 (#7005)af9c683tests: fix typo in build test instructions (#7004)4bc5a1aci: allow Unicode-3.0 license for unicode-ident (#7006)f8948earuntime: do not deferyield_nowinsideblock_in_place(#6999)bce9780time: usearray::from_fninstead of manually creating array (#7000)38151f3readme: unlist 1.32.x as LTS release (#6997)5dda72dci: pin valgrind to rustc 1.82 (#6998)c07257fio: simplify io readiness logic (#6966)Updates
opensslfrom 0.10.72 to 0.10.73Release notes
Sourced from openssl's releases.
Commits
e6209d4Merge pull request #2415 from alex/bump-version9ca6cfeRelease openssl v0.10.73 and openssl-sys v0.9.109c42d49cMerge pull request #2414 from alex/boringssl-fix5e24219Attempt to fix with vcpkg93f30fffixed building on the latest boringssleb88fb0Merge pull request #2403 from botovq/ctest79a304aReplace ctest2 with ctest132418bMerge pull request #2399 from alex/release-sysf7a692bRelease openssl-sys v0.9.1082f9b496Merge pull request #2398 from botovq/libressl-4.1Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by Bito
This pull request updates the Cargo.lock file in the /cli directory, upgrading the 'tokio' package from 1.38.2 to 1.42.1 and the 'openssl' package from 0.10.72 to 0.10.73. These updates address a soundness issue and incorporate various improvements and fixes, enhancing the project's functionality and security.