[pkg firewall] port the VS Code lifecycle and watcher to PowerShell - #30
Open
dekkagaijin wants to merge 1 commit into
Open
[pkg firewall] port the VS Code lifecycle and watcher to PowerShell#30dekkagaijin wants to merge 1 commit into
dekkagaijin wants to merge 1 commit into
Conversation
Completes the lib-level port. Mirrors bash/lib/common.sh's vscode_* functions and
its watcher, so review is a diff against something already merged.
Get-VSCodeInstallPath / Get-VSCodeEditionLabel / Get-VSCodeInstallRoot
Get-VSCodeNodeBin / Test-VSCodeCanWrite
Get-VSCodeStateDir / Set-VSCodeState / Get-VSCodeState / Write-VSCodeStateReport
Get-VSCodeMarkerField / Get-VSCodeManagedState / Get-VSCodeMarkerBase
Invoke-VSCodePatch / Invoke-VSCodeUnpatch
Invoke-VSCodePatchViaNode / Invoke-VSCodeUnpatchViaNode
Install-VSCodeWatcher / Uninstall-VSCodeWatcher
Three Windows-specific differences from the bash version, each load-bearing:
- Per-user install discovery uses $UserHome from console-user detection, NOT
$env:LOCALAPPDATA. Intune runs scripts as SYSTEM, whose LOCALAPPDATA is under
C:\Windows, so relying on the env var would silently miss every per-user
install on the fleet.
- Set-FileRestrictedAcl resolves SYSTEM from the well-known SID S-1-5-18 rather
than the name 'SYSTEM', which is localised.
- Task Scheduler has no file-watch trigger, so the watcher is -AtStartup +
-AtLogOn + hourly repetition. -AtLogOn is the proxy for "updated, then
relaunched" that launchd's WatchPaths gives for free on macOS.
Absent the Scheduled Task cmdlets, Install-VSCodeWatcher warns and returns false
rather than throwing: the patch is still worth applying on a box where the watcher
cannot be installed, it just needs re-pushing on each check-in.
Tests: 54 assertions mirroring the bash lifecycle and watcher suites, plus 2
explicit skips. The skips are the point — Scheduled Task registration and
%ProgramFiles% / AppData discovery cannot run off-Windows, and a suite that
reported green on a Mac while never touching the Windows code path would be worse
than no suite. They still need a Windows box before this goes to a Windows fleet.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
dekkagaijin
force-pushed
the
vscode-fw-7-powershell-lifecycle
branch
from
August 6, 2026 16:10
ab1ddff to
ac1a99f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge after #29
Completes the lib-level port. Mirrors bash/lib/common.sh's vscode_* functions and its watcher, so review is a diff against something already merged.
Get-VSCodeInstallPath / Get-VSCodeEditionLabel / Get-VSCodeInstallRoot
Get-VSCodeNodeBin / Test-VSCodeCanWrite
Get-VSCodeStateDir / Set-VSCodeState / Get-VSCodeState / Write-VSCodeStateReport
Get-VSCodeMarkerField / Get-VSCodeManagedState / Get-VSCodeMarkerBase
Invoke-VSCodePatch / Invoke-VSCodeUnpatch
Invoke-VSCodePatchViaNode / Invoke-VSCodeUnpatchViaNode
Install-VSCodeWatcher / Uninstall-VSCodeWatcher
Three Windows-specific differences from the bash version, each load-bearing:
Absent the Scheduled Task cmdlets, Install-VSCodeWatcher warns and returns false rather than throwing: the patch is still worth applying on a box where the watcher cannot be installed, it just needs re-pushing on each check-in.
Tests: 54 assertions mirroring the bash lifecycle and watcher suites, plus 2 explicit skips. The skips are the point — Scheduled Task registration and %ProgramFiles% / AppData discovery cannot run off-Windows, and a suite that reported green on a Mac while never touching the Windows code path would be worse than no suite. They still need a Windows box before this goes to a Windows fleet.
https://endorlabs.atlassian.net/browse/LM-452