Bump Copilot CLI SDK packages to 1.0.64-1 / 1.0.3

[anthonykim1]

PLEASE REVIEW EXPANDED CHANGE SUMMARY.

This bump is more than a lockfile update because @github/[email protected] changed package layout. The top-level package now delegates through npm-loader.js, while real CLI/SDK assets live in platform packages like @github/copilot-linux-x64.

• Bump Copilot CLI package usage to @github/copilot@^1.0.64-1 and public Agent Host SDK usage to @github/copilot-sdk@^1.0.3.
• Update Agent Host CLI launch to use @github/copilot's declared bin.copilot entrypoint and packaged @github/copilot-<platform> runtime files.
• Keep Copilot Chat extension @github/copilot/sdk imports working across local install, VSIX packaging, and built-in product packaging.
• Package the selected Copilot platform runtime for desktop/server targets, including linuxmusl-*, macOS universal handling, and cross-arch optional-package materialization.
• Extend native dependency checks and deb/rpm baselines for the Copilot platform executable/runtime files, while filtering optional native payloads VS Code does not need.

Expanded change summary

Package versions

• Change: root and remote move @github/copilot-sdk ^1.0.2 -> ^1.0.3; root, remote, and extensions/copilot move @github/copilot ^1.0.64-0 -> ^1.0.64-1.
• Why: @github/[email protected] expects the newer Copilot CLI package shape, and the extension internal SDK path needs the matching CLI package version.
• Effect: both the public Agent Host SDK path and the Copilot Chat extension internal SDK path consume the matching CLI package generation.

Agent Host CLI launch path

• Change: copilotAgent.ts resolves @github/copilot/package.json bin.copilot instead of hardcoding node_modules/@github/copilot/index.js.
• Why: @github/[email protected] no longer has top-level index.js; the package-declared executable is npm-loader.js.
• Effect: Agent Host follows the package's advertised CLI entrypoint and does not keep the old-layout index.js fallback.

Agent Host packaged runtime path

• Change: copilotAgent.ts sets COPILOT_CLI_DIST_DIR when the selected @github/copilot-<platform> package is available in packaged node_modules.
• Why: the CLI runtime package contains signed platform files such as runtime.node, PTY/ConPTY files, loaders, and the platform executable.
• Effect: packaged builds prefer the VS Code-packaged runtime package instead of extracting runtime files to the user cache.

Copilot Chat extension SDK layout

• Change: postinstall.ts materializes @github/copilot/sdk from @github/copilot-<platform>.
• Why: extension source code still imports @github/copilot/sdk, while the new package layout moved real SDK files into platform packages.
• Effect: local extension development and extension packaging preserve existing imports without rewriting the extension integration.

Built-in Copilot extension target natives

• Change: prepareBuiltInCopilotRipgrepShim now restores target-platform SDK prebuilds/<platform> and tgrep/bin/<platform> from the selected product @github/copilot-<platform> package before pruning non-target SDK folders.
• Why: the Copilot VSIX is built once on Linux x64, so Windows/macOS products can otherwise ship the built-in extension with only Linux SDK natives. Azure smoke logs showed Native addon "runtime" not found for win32-x64 and darwin-arm64.
• Effect: packaged products get the target runtime.node / related SDK prebuilds in extensions/copilot/node_modules/@github/copilot/sdk/prebuilds/<platform> and target tgrep in both top-level and SDK layouts.

Agent Host packaging and platform packages

• Change: build/lib/copilot.ts re-adds the selected @github/copilot-<platform>/** package after .moduleignore strips platform packages globally.
• Why: npm-loader.js needs the selected platform executable, and the CLI package still ships runtime prebuilds used at runtime.
• Effect: Agent Host ships the selected platform package files needed by the CLI runtime.

Runtime prebuilds kept

• Change: packaging keeps platform runtime files that are actually shipped by the selected Copilot package, including runtime.node, Unix pty.node, macOS spawn-helper, and Windows conpty.node, conpty_console_list.node, conpty/OpenConsole.exe, and conpty/conpty.dll.
• Why: smoke tests showed packaged builds can fail with missing native runtime files when these prebuilds are omitted.
• Effect: the platform runtime package remains usable inside signed packaged builds.

macOS universal architecture-specific Copilot files

• Change: macOS universal app creation treats @github/copilot-darwin-* as architecture-specific as a whole package.
• Why: the platform packages contain multiple arch-specific native/tool paths, including prebuilds/darwin-*, ripgrep/bin/darwin-*, tgrep/bin/darwin-*, and the platform executable. Azure build 450413 failed on @github/copilot-darwin-arm64/ripgrep/bin/darwin-arm64/rg, and the same package also contains tgrep.
• Effect: universal merge handles the Copilot darwin platform package consistently instead of fixing individual subdirectories one at a time.

Optional native payload guardrails

• Change: packaging filters and tests exclude optional payload directories and files: clipboard, pvrecorder, mxc-bin, foundry-local-sdk, computer.node, keytar.node, and non-Windows cli-native.node.
• Why: those payloads are not needed for this Agent Host integration path and previously introduced unnecessary native/GLIBC surface area.
• Effect: we keep the required runtime package while avoiding unrelated optional native payloads.

Cross-arch desktop package materialization

• Change: ensureCopilotPlatformPackage materializes a missing selected @github/copilot-<platform> package from the package lock before desktop packaging, verifying npm integrity when present.
• Why: npm optional dependency install only brings down packages compatible with the host machine, but VS Code desktop packaging can build a target package for a different architecture.
• Effect: desktop packaging can include the correct selected Copilot platform package even when it was not host-installed by npm.

linuxmusl packaging

• Change: Copilot platform selection maps Alpine/musl builds to linuxmusl-x64 / linuxmusl-arm64.
• Why: the new Copilot package publishes musl-specific platform packages separately from glibc Linux packages.
• Effect: Alpine/musl builds select the matching Copilot platform package instead of accidentally using the glibc one.

Linux dependency generation

• Change: dependencies-generator.ts scans node_modules/@github/copilot-*/copilot in addition to *.node.
• Why: the Copilot platform CLI is a native executable, not a .node addon, so the old scanner missed it.
• Effect: deb/rpm dependency checks correctly see Copilot's shared-library requirements.

Linux package dependency references

• Change: build/linux/debian/dep-lists.ts and build/linux/rpm/dep-lists.ts are updated to match generated CI output after the Copilot platform executable/runtime files are included.
• Latest CI-backed fixes from Azure build 450406:
  • remove armhf deb baseline libstdc++6 (>= 7)
  • add arm64 deb baseline libstdc++6 (>= 7)
  • add x64 rpm baseline libstdc++.so.6(GLIBCXX_3.4.22)(64bit)
• Later CI-backed fixes from Azure build 450413:
  • add Linux arm64 rpm dependency symbols generated after packaging target Copilot runtime files
• Effect: the checked-in deb/rpm dependency references match what CI generates for the package contents we now ship.

SDK typing fallout

• Change: small guards/casts around blob attachment data, copilotUsage, permission helper formatting, and MCP sampling request IDs.
• Why: updated SDK declarations are stricter or shaped differently.
• Effect: no intended behavior change; existing integration code compiles against the new SDK types.

Dependency summary

NPM package dependencies

@github/[email protected] declares these dependencies:

{
  "@github/copilot": "^1.0.64-1",
  "vscode-jsonrpc": "^8.2.1",
  "zod": "^4.3.6"
}

Verified with:

npm view @github/[email protected] dependencies --json

@github/[email protected] declares platform packages as optional dependencies:

{
  "@github/copilot-linux-x64": "1.0.64-1",
  "@github/copilot-win32-x64": "1.0.64-1",
  "@github/copilot-darwin-x64": "1.0.64-1",
  "@github/copilot-linux-arm64": "1.0.64-1",
  "@github/copilot-win32-arm64": "1.0.64-1",
  "@github/copilot-darwin-arm64": "1.0.64-1",
  "@github/copilot-linuxmusl-x64": "1.0.64-1",
  "@github/copilot-linuxmusl-arm64": "1.0.64-1"
}

Verified with:

npm view @github/[email protected] optionalDependencies --json

Package layout shift

@github/[email protected] no longer provides the old top-level index.js / sdk layout used by previous VS Code wiring. The top-level package exposes bin.copilot as npm-loader.js, while platform packages carry the real runtime and SDK assets.

The practical split in this PR is:

@github/copilot                  -> npm-loader.js entrypoint
@github/copilot-<platform>       -> copilot executable, SDK files, runtime prebuilds, tgrep/ripgrep payloads
@github/copilot-sdk              -> public Agent Host SDK package, depends on @github/copilot@^1.0.64-1

Platform runtime files

The platform packages still ship runtime prebuilds that packaged builds need. For example:

npm pack @github/[email protected] --silent
tar -tzf github-copilot-darwin-arm64-1.0.64-1.tgz | rg 'package/(copilot|index.js|app.js|sea-loader.js|prebuilds/darwin-arm64/(runtime.node|pty.node|spawn-helper))$'

Relevant files include:

package/copilot
package/index.js
package/app.js
package/sea-loader.js
package/prebuilds/darwin-arm64/runtime.node
package/prebuilds/darwin-arm64/pty.node
package/prebuilds/darwin-arm64/spawn-helper

Linux packages similarly ship copilot, runtime.node, and pty.node; Windows packages ship runtime.node and ConPTY files such as conpty.node, conpty_console_list.node, conpty/OpenConsole.exe, and conpty/conpty.dll.

Built-in extension native files

The built-in Copilot extension must contain the target SDK native files after product packaging, not only the Linux files from the Linux-built VSIX. The target files are copied from the product platform package:

resources/app/node_modules/@github/copilot-<platform>/prebuilds/<platform>

into the built-in extension SDK layout:

resources/app/extensions/copilot/node_modules/@github/copilot/sdk/prebuilds/<platform>

This addresses the Windows/macOS smoke failure shape where the extension looked for sdk/prebuilds/<platform>/runtime.node and found only the Linux-built VSIX contents.

macOS universal platform package files

The macOS universal step now treats these copied platform package trees as architecture-specific:

node_modules/@github/copilot-darwin-x64/**
node_modules/@github/copilot-darwin-arm64/**

That is broader than a single prebuilds glob on purpose. The package contains several arch-specific locations (copilot, prebuilds, ripgrep, tgrep), and CI already failed on one of those tool paths.

Optional native payloads filtered from product packaging

The selected platform package is included, but product packaging filters out optional payloads we do not need for this integration path:

clipboard/**
pvrecorder/**
mxc-bin/**
foundry-local-sdk/**
computer.node
keytar.node
non-Windows cli-native.node

This keeps the runtime package usable while avoiding extra native binaries and GLIBC surface area.

Linux package dependency references

The dependency generator now scans node_modules/@github/copilot-*/copilot, so deb/rpm dependency generation sees the native platform executable we ship.

Azure build 450406 generated these remaining reference corrections:

# build/linux/debian/dep-lists.ts armhf
- libstdc++6 (>= 7)

# build/linux/debian/dep-lists.ts arm64
+ libstdc++6 (>= 7)

# build/linux/rpm/dep-lists.ts x86_64
+ libstdc++.so.6(GLIBCXX_3.4.22)(64bit)

Those lines came from the Prepare deb package / Prepare rpm package dependency-list guard after packaging the current Copilot platform runtime files.

Validation

• cd build && npm run test -- lib/test/copilot.test.ts
• node --experimental-strip-types build/hygiene.ts build/lib/copilot.ts build/lib/test/copilot.test.ts build/darwin/create-universal-app.ts
• node --experimental-strip-types build/hygiene.ts build/gulpfile.vscode.ts build/gulpfile.reh.ts
• node --experimental-strip-types build/hygiene.ts src/vs/platform/agentHost/node/copilot/copilotAgent.ts
• node --experimental-strip-types build/hygiene.ts build/linux/debian/dep-lists.ts
• node --experimental-strip-types build/hygiene.ts build/linux/rpm/dep-lists.ts
• cd build && npm run typecheck
• cd extensions/copilot && npm run typecheck
• cd extensions/copilot && npx vitest --run src/extension/chatSessions/copilotcli/vscode-node/test/copilotCLISDKUpgrade.spec.ts --pool=forks
• npx tsgo --noEmit --project src/tsconfig.json

---

Inspirations from:

• The app packaging re-add path follows the existing Copilot packaging hook in build/gulpfile.vscode.ts.
• The remote packaging re-add path follows the existing server packaging hook in build/gulpfile.reh.ts.
• The narrow package include behavior is constrained by the existing module pruning policy in build/.moduleignore.
• The dependency scanner change extends the existing Linux native dependency scan in build/linux/dependencies-generator.ts.
• The deb dependency reference follows the generated dependency-list guard in build/linux/debian/dep-lists.ts.
• The rpm dependency reference follows the generated dependency-list guard in build/linux/rpm/dep-lists.ts.

[Copilot]

Pull request overview

Updates VS Code’s pinned Copilot CLI SDK packages and adjusts the agent host + built-in Copilot extension integration points (CLI entry resolution, attachment handling, packaging, and upgrade tests) to stay compatible with the new SDK layout/platform packages.

Changes:

• Bump @github/copilot to ^1.0.64-1 and @github/copilot-sdk to ^1.0.3 across root + remote + built-in Copilot extension dependencies/locks.
• Harden attachment handling for blob payloads and adjust MCP sampling forwarding/types for the updated SDK surface.
• Update Copilot extension postinstall + build packaging helpers and upgrade tests to account for linuxmusl platform packages and revised SDK layout.

Show a summary per file

File	Description
src/vs/platform/agentHost/node/copilot/mapSessionEvents.ts	Guard blob attachment conversion when SDK blob data isn’t a string.
src/vs/platform/agentHost/node/copilot/copilotAgentSession.ts	Adjust MCP executeSampling call to match updated SDK param typing.
src/vs/platform/agentHost/node/copilot/copilotAgent.ts	Resolve Copilot CLI entrypoint via @github/copilot’s bin field instead of hardcoding index.js.
remote/package.json	Bump Copilot CLI packages for the remote server build.
remote/package-lock.json	Lockfile updates for bumped remote dependencies (incl. platform packages).
package.json	Bump Copilot CLI packages for core.
package-lock.json	Lockfile updates for bumped core dependencies (incl. platform packages).
extensions/copilot/src/extension/chatSessions/copilotcli/vscode-node/test/copilotCLISDKUpgrade.spec.ts	Extend/relax binary expectations and add platform-aware “missing binary” filtering; increase import timeout.
extensions/copilot/src/extension/chatSessions/copilotcli/node/permissionHelpers.ts	Loosen codeBlock helper parameter type to unknown.
extensions/copilot/src/extension/chatSessions/copilotcli/node/copilotcliSession.ts	Adjust typing around copilotUsage extraction in usage events.
extensions/copilot/src/extension/chatSessions/copilotcli/common/copilotCLITools.ts	Guard blob attachment data type before base64 decoding when building history references.
extensions/copilot/script/postinstall.ts	Materialize Copilot CLI SDK layout from platform packages and patch exports to expose ./sdk.
extensions/copilot/package.json	Bump built-in Copilot extension’s @github/copilot dependency.
extensions/copilot/package-lock.json	Lockfile updates for built-in Copilot extension dependency bump.
build/lib/copilot.ts	Include linuxmusl platform packages in packaging filters and runtime file preservation logic.

Copilot's findings

Files not reviewed (2)

• extensions/copilot/package-lock.json: Generated file
• remote/package-lock.json: Generated file

• Files reviewed: 12/15 changed files
• Comments generated: 5

[anthonykim1]

• VS Code Linux packaging computes deb/rpm dependencies by scanning native files that are shipped in the product.
• Previously the scanner only looked for native addon files under node_modules, mainly *.node.
• @github/[email protected] now ships platform executables such as node_modules/@github/copilot-linux-x64/copilot.
• That file is a native Linux executable, but it is not a *.node file.
• Because the scanner missed it, CI incorrectly thought libstdc++6 (>= 6) was no longer required.
• Scanning this executable also lets CI catch too-new GLIBC / GLIBCXX requirements for the actual files we ship.
• So the fix is to include node_modules/@github/copilot-*/copilot in the dependency scan, not to remove libstdc++6 from dep-lists.ts unless the corrected scan still says it is gone.

[anthonykim1]

@DonJayamanne @deepak1556 @rzhao271 This ended up being a scary amount of changes because @github/[email protected] changed from the old top-level package layout to a loader + platform-package layout.

The top-level @github/copilot package now delegates through npm-loader.js, while the real CLI/SDK assets live under packages like @github/copilot-linux-x64 and @github/copilot-darwin-arm64.

Could you guys please take a look at the “Expanded change summary” and "dependency summary" above?
I especially want a sanity check on the package-layout compatibility, the selected platform executable packaging, and the Linux deb/rpm dependency-list updates that come from scanning the new @github/copilot-*/copilot executables.