update

.config/guardian/.gdnsuppress

@@ -1,46 +1,68 @@
 {
-  "hydrated": false,
+  "hydrated": true,
   "properties": {
     "helpUri": "https://eng.ms/docs/microsoft-security/security/azure-security/cloudai-security-fundamentals-engineering/security-integration/guardian-wiki/microsoft-guardian/general/suppressions"
   },
   "version": "1.0.0",
   "suppressionSets": {
     "default": {
       "name": "default",
-      "createdDate": "2025-03-17 11:52:32Z",
-      "lastUpdatedDate": "2025-03-17 11:52:32Z"
+      "createdDate": "2025-01-28 06:29:05Z",
+      "lastUpdatedDate": "2025-08-25 17:55:20Z"
     }
   },
   "results": {
-    "216e2ac9cb596796224b47799f656570a01fa0d9b5f935608b47d15ab613c8e8": {
-      "signature": "216e2ac9cb596796224b47799f656570a01fa0d9b5f935608b47d15ab613c8e8",
+    "6216d3477ad4f56cb4ec316a9aaff02e9530a10d56469a4ef4063b8d02fe344b": {
+      "signature": "6216d3477ad4f56cb4ec316a9aaff02e9530a10d56469a4ef4063b8d02fe344b",
       "alternativeSignatures": [
-        "07746898f43afab7cc50931b33154c2d9e1a35f82a649dbe8aecf785b3d5a813"
+        "46ad210995b2ff199f3bee5f271938a4251ed7a60058041ace1beaa53e36b51c"
       ],
+      "target": "file:///D:/a/_work/1/vscode-server-win32-x64/node.exe",
       "memberOf": [
         "default"
       ],
-      "createdDate": "2025-03-17 11:52:32Z"
+      "tool": "binskim",
+      "ruleId": "BA2008",
+      "createdDate": "2025-08-25 17:54:06Z"
     },
-    "77797a3e44634bb2994bd13ccc95ff4575bba474585dbd2cf3068a1c16bc0624": {
-      "signature": "77797a3e44634bb2994bd13ccc95ff4575bba474585dbd2cf3068a1c16bc0624",
+    "b8a4702fb4b855719e5e5033c3b629fbe6267d516ce8a18bd8f3be3b9962434b": {
+      "signature": "b8a4702fb4b855719e5e5033c3b629fbe6267d516ce8a18bd8f3be3b9962434b",
       "alternativeSignatures": [
-        "4a6cb67bd4b401e9669c13a2162660aaefc0a94a4122e5b50c198414db545672"
+        "52d986be88f1c5696fc87d7794279d02f5084c645440e2dd2c3b5a2176b6bf52"
       ],
+      "target": "file:///D:/a/_work/1/vscode-server-win32-x64-web/node.exe",
       "memberOf": [
         "default"
       ],
-      "createdDate": "2025-03-17 11:52:32Z"
+      "tool": "binskim",
+      "ruleId": "BA2008",
+      "createdDate": "2025-08-25 17:54:06Z"
     },
-    "30418bcc5269eaeb2832a2404465784431d4e72a2af332320c2b1db4768902ad": {
-      "signature": "30418bcc5269eaeb2832a2404465784431d4e72a2af332320c2b1db4768902ad",
+		"4dbc45d0405de2e83d53f10227e36b2a9d15eceb2c5e6934da5c4a1bffbfad89": {
+      "signature": "4dbc45d0405de2e83d53f10227e36b2a9d15eceb2c5e6934da5c4a1bffbfad89",
       "alternativeSignatures": [
-        "b7b9eb974d7d3a4ae14df8695ca5a62592c8c9d20b7eda70a6535d50cbda3e7f"
+        "b6bab85ba5e97bc4e6ff2e8a7913cb9f4f3346f7bda435d176e0b1e3cfb883cf"
       ],
+      "target": "file:///D:/a/_work/1/vscode-server-win32-arm64/node.exe",
       "memberOf": [
         "default"
       ],
-      "createdDate": "2025-03-17 11:52:32Z"
+      "tool": "binskim",
+      "ruleId": "BA2008",
+      "createdDate": "2025-08-25 17:45:35Z"
+    },
+    "024ff37af329b63d2d9c83784cc071badf63b7729e3dd0969ab921d2f04d8e09": {
+      "signature": "024ff37af329b63d2d9c83784cc071badf63b7729e3dd0969ab921d2f04d8e09",
+      "alternativeSignatures": [
+        "b46b7d6ed331f3e62eff23c57d3a074f76ef618f108929851065904200f5a572"
+      ],
+      "target": "file:///D:/a/_work/1/vscode-server-win32-arm64-web/node.exe",
+      "memberOf": [
+        "default"
+      ],
+      "tool": "binskim",
+      "ruleId": "BA2008",
+      "createdDate": "2025-08-25 17:45:35Z"
     }
   }
 }

.devcontainer/devcontainer-lock.json

@@ -1,14 +1,14 @@
 {
   "features": {
-    "ghcr.io/devcontainers/features/desktop-lite:1": {
-      "version": "1.0.8",
-      "resolved": "ghcr.io/devcontainers/features/desktop-lite@sha256:e7dc4d37ab9e3d6e7ebb221bac741f5bfe07dae47025399d038b17af2ed8ddb7",
-      "integrity": "sha256:e7dc4d37ab9e3d6e7ebb221bac741f5bfe07dae47025399d038b17af2ed8ddb7"
+    "ghcr.io/devcontainers/features/desktop-lite:": {
+      "version": "1.2.8",
+      "resolved": "ghcr.io/devcontainers/features/desktop-lite@sha256:14ac23fd59afab939e6562ba6a1f42a659a805e4c574a1be23b06f28eb3b0b71",
+      "integrity": "sha256:14ac23fd59afab939e6562ba6a1f42a659a805e4c574a1be23b06f28eb3b0b71"
     },
-    "ghcr.io/devcontainers/features/rust:1": {
-      "version": "1.3.3",
-      "resolved": "ghcr.io/devcontainers/features/rust@sha256:2521a8eeb4911bfcb22557c8394870ea22eb790d8e52219ddc5182f62d388995",
-      "integrity": "sha256:2521a8eeb4911bfcb22557c8394870ea22eb790d8e52219ddc5182f62d388995"
+    "ghcr.io/devcontainers/features/rust:": {
+      "version": "1.5.0",
+      "resolved": "ghcr.io/devcontainers/features/rust@sha256:0c55e65f2e3df736e478f26ee4d5ed41bae6b54dac1318c443e31444c8ed283c",
+      "integrity": "sha256:0c55e65f2e3df736e478f26ee4d5ed41bae6b54dac1318c443e31444c8ed283c"
     }
   }
 }

.devcontainer/devcontainer.json

@@ -4,8 +4,8 @@
 		"dockerfile": "Dockerfile"
 	},
 	"features": {
-		"ghcr.io/devcontainers/features/desktop-lite:1": {},
-		"ghcr.io/devcontainers/features/rust:1": {}
+		"ghcr.io/devcontainers/features/desktop-lite:": {},
+		"ghcr.io/devcontainers/features/rust:": {}
 	},
 	"containerEnv": {
 		"DISPLAY": "" // Allow the Dev Containers extension to set DISPLAY, post-create.sh will add it back in ~/.bashrc and ~/.zshrc if not set.

.eslint-ignore

@@ -10,30 +10,27 @@
 **/extensions/markdown-language-features/media/**
 **/extensions/markdown-language-features/notebook-out/**
 **/extensions/markdown-math/notebook-out/**
+**/extensions/mermaid-chat-features/chat-webview-out/**
 **/extensions/notebook-renderers/renderer-out/index.js
 **/extensions/simple-browser/media/index.js
 **/extensions/terminal-suggest/src/completions/upstream/**
 **/extensions/terminal-suggest/src/shell/zshBuiltinsCache.ts
 **/extensions/terminal-suggest/src/shell/fishBuiltinsCache.ts
 **/extensions/terminal-suggest/third_party/**
 **/extensions/typescript-language-features/test-workspace/**
-**/extensions/typescript-language-features/extension.webpack.config.js
-**/extensions/typescript-language-features/extension-browser.webpack.config.js
 **/extensions/typescript-language-features/package-manager/node-maintainer/**
 **/extensions/vscode-api-tests/testWorkspace/**
 **/extensions/vscode-api-tests/testWorkspace2/**
 **/fixtures/**
 **/node_modules/**
-**/out-*/**/*.js
-**/out-editor-*/**
-**/out/**/*.js
+**/out/**
+**/out-*/**
 **/src/**/dompurify.js
 **/src/**/marked.js
 **/src/**/semver.js
 **/src/typings/**/*.d.ts
 **/src/vs/*/**/*.d.ts
 **/src/vs/base/test/common/filters.perf.data.js
-**/src/vs/loader.js
 **/test/unit/assert.js
 **/test/automation/out/**
 **/typings/**

.eslint-plugin-local/README.md

@@ -0,0 +1,125 @@
+# Custom ESLint rules
+
+We use a set of custom [ESLint](http://eslint.org) to enforce repo specific coding rules and styles. These custom rules are run in addition to many standard ESLint rules we enable in the project. Some example custom rules includes:
+
+- Enforcing proper code layering
+- Preventing checking in of `test.only(...)`
+- Enforcing conventions in `vscode.d.ts`
+
+Custom rules are mostly used for enforcing or banning certain coding patterns. We tend to leave stylistic choices up to area owners unless there's a good reason to enforce something project wide.
+
+This doc provides a brief overview of how these rules are setup and how you can add a new one.
+
+# Resources
+- [ESLint rules](https://eslint.org/docs/latest/extend/custom-rules) — General documentation about writing eslint rules
+- [TypeScript ASTs and eslint](https://typescript-eslint.io/blog/asts-and-typescript-eslint/) — Look at how ESLint works with TS programs
+- [ESTree selectors](https://eslint.org/docs/latest/extend/selectors)  — Info about the selector syntax rules use to target specific nodes in an AST. Works similarly to css selectors.
+- [TypeScript ESLint playground](https://typescript-eslint.io/play/#showAST=es) — Useful tool for figuring out the structure of TS programs and debugging custom rule selectors
+
+
+# Custom Rule Configuration
+
+Custom rules are defined in the `.eslint-plugin-local` folder. Each rule is defined in its own TypeScript file. These follow the naming convention:
+
+- `code-RULE-NAME.ts` — General rules that apply to the entire repo.
+- `vscode-dts-RULE-NAME.ts` — Rules that apply just to `vscode.d.ts`.
+
+These rules are then enabled in the `eslint.config.js` file. This is the main eslint configuration for our repo. It defines a set of file scopes which rules should apply to files in those scopes.
+
+For example, here's a configuration that enables the no `test.only` rule in all `*.test.ts` files in the VS Code repo:
+
+```ts
+{
+    // Define which files these rules apply to
+    files: [
+        '**/*.test.ts'
+    ],
+    languageOptions: { parser: tseslint.parser, },
+    plugins: {
+        'local': pluginLocal,
+    },
+    rules: {
+         // Enable the rule from .eslint-plugin-local/code-no-test-only.ts
+        'local/code-no-test-only': 'error',
+    }
+}
+```
+
+# Creating a new custom rule
+This walks through the steps to create a new eslint rule:
+
+1. Create a new rule file under `.eslint-plugin-local`. Generally you should call it `code-YOUR-RULE-NAME.ts`, for example, `.eslint-plugin-local/code-no-not-null-assertions-on-undefined-values.ts`
+
+2. In this file, add the rule. Here's a template:
+
+    ```ts
+    /*---------------------------------------------------------------------------------------------
+    *  Copyright (c) Microsoft Corporation. All rights reserved.
+    *  Licensed under the MIT License. See License.txt in the project root for license information.
+    *--------------------------------------------------------------------------------------------*/
+
+    import * as eslint from 'eslint';
+
+    export = new class YourRuleName implements eslint.Rule.RuleModule {
+
+        readonly meta: eslint.Rule.RuleMetaData = {
+            messages: {
+                customMessageName: 'message text shown in errors/warnings',
+            },
+            schema: false,
+        };
+
+        create(context: eslint.Rule.RuleContext): eslint.Rule.RuleListener {
+            return {
+                [SELECTOR]: (node: any) => {
+                    // Report errors if needed
+                    return context.report({
+                        node,
+                        messageId: 'customMessageName'
+                    });
+                }
+            };
+        }
+    };
+    ```
+
+    - Update the name of the class to match the name of your rule
+    - Add message entries for any errors you want to report
+    - Update `SELECTOR` with the [ESTree selector](https://eslint.org/docs/latest/extend/selectors) needed to target the nodes you are interested in. Use the [TypeScript ESLint playground](https://typescript-eslint.io/play/#showAST=es) to figure out which nodes you need and debug selectors
+
+3. Register the rule in `eslint.config.js`
+
+    Generally this is just turning on the rule in the rule list like so:
+
+    ```js
+    rules: {
+         // Name should match file name
+	'local/code-no-not-null-assertions-on-undefined-values': 'warn',
+        ...
+    }
+    ```
+
+Rules can also take custom arguments. For example, here's how we can pass arguments to a custom rule in the `eslint.config.js`:
+
+```
+rules: {
+    'local/code-no-not-null-assertions-on-undefined-values': ['warn', { testsOk: true }],
+    ...
+}
+```
+
+In these cases make sure to update the `meta.schema` property on your rule with the JSON schema for the arguments. You can access these arguments using `context.options` in the rule `create` function
+
+
+## Adding fixes to custom rules
+Fixes are a useful way to mechanically fix basic linting issues, such as auto inserting semicolons. These fixes typically work at the AST level, so they are a more reliable way to perform bulk fixes compared to find/replaces.
+
+To add a fix for a custom rule:
+
+1. On the `meta` for your rule, add `fixable: 'code'`
+
+2. When reporting an error in the rule, also include a `fix`. This is a function that takes a `fixer` argument and returns one or more fixes.
+
+See the [Double quoted to single quoted string covert fix](https://github.com/microsoft/vscode/blob/b074375e1884ae01033967bf0bbceeaa4795354a/.eslint-plugin-local/code-no-unexternalized-strings.ts#L128) for an example. The ESLint docs also have [details on adding fixes and the fixer api](https://eslint.org/docs/latest/extend/custom-rules#applying-fixes)
+
+The fixes can be run using `npx eslint --fix` in the VS Code repo

.eslint-plugin-local/code-amd-node-module.ts

@@ -4,10 +4,12 @@
  *--------------------------------------------------------------------------------------------*/
 
 import * as eslint from 'eslint';
+import type * as ESTree from 'estree';
+import { readFileSync } from 'fs';
 import { join } from 'path';
 
 
-export = new class ApiProviderNaming implements eslint.Rule.RuleModule {
+export default new class ApiProviderNaming implements eslint.Rule.RuleModule {
 
 	readonly meta: eslint.Rule.RuleMetaData = {
 		messages: {
@@ -21,7 +23,8 @@ export = new class ApiProviderNaming implements eslint.Rule.RuleModule {
 		const modules = new Set<string>();
 
 		try {
-			const { dependencies, optionalDependencies } = require(join(__dirname, '../package.json'));
+			const packageJson = JSON.parse(readFileSync(join(import.meta.dirname, '../package.json'), 'utf-8'));
+			const { dependencies, optionalDependencies } = packageJson;
 			const all = Object.keys(dependencies).concat(Object.keys(optionalDependencies));
 			for (const key of all) {
 				modules.add(key);
@@ -33,13 +36,13 @@ export = new class ApiProviderNaming implements eslint.Rule.RuleModule {
 		}
 
 
-		const checkImport = (node: any) => {
+		const checkImport = (node: ESTree.Literal & { parent?: ESTree.Node & { importKind?: string } }) => {
 
-			if (node.type !== 'Literal' || typeof node.value !== 'string') {
+			if (typeof node.value !== 'string') {
 				return;
 			}
 
-			if (node.parent.importKind === 'type') {
+			if (node.parent?.type === 'ImportDeclaration' && node.parent.importKind === 'type') {
 				return;
 			}
 

.eslint-plugin-local/code-declare-service-brand.ts

@@ -4,8 +4,9 @@
  *--------------------------------------------------------------------------------------------*/
 
 import * as eslint from 'eslint';
+import type * as ESTree from 'estree';
 
-export = new class DeclareServiceBrand implements eslint.Rule.RuleModule {
+export default new class DeclareServiceBrand implements eslint.Rule.RuleModule {
 
 	readonly meta: eslint.Rule.RuleMetaData = {
 		fixable: 'code',
@@ -14,7 +15,7 @@ export = new class DeclareServiceBrand implements eslint.Rule.RuleModule {
 
 	create(context: eslint.Rule.RuleContext): eslint.Rule.RuleListener {
 		return {
-			['PropertyDefinition[key.name="_serviceBrand"][value]']: (node: any) => {
+			['PropertyDefinition[key.name="_serviceBrand"][value]']: (node: ESTree.PropertyDefinition) => {
 				return context.report({
 					node,
 					message: `The '_serviceBrand'-property should not have a value`,

.eslint-plugin-local/code-ensure-no-disposables-leak-in-test.ts

@@ -4,9 +4,9 @@
  *--------------------------------------------------------------------------------------------*/
 
 import * as eslint from 'eslint';
-import { Node } from 'estree';
+import type * as estree from 'estree';
 
-export = new class EnsureNoDisposablesAreLeakedInTestSuite implements eslint.Rule.RuleModule {
+export default new class EnsureNoDisposablesAreLeakedInTestSuite implements eslint.Rule.RuleModule {
 
 	readonly meta: eslint.Rule.RuleMetaData = {
 		type: 'problem',
@@ -18,15 +18,15 @@ export = new class EnsureNoDisposablesAreLeakedInTestSuite implements eslint.Rul
 	};
 
 	create(context: eslint.Rule.RuleContext): eslint.Rule.RuleListener {
-		const config = <{ exclude: string[] }>context.options[0];
+		const config = context.options[0] as { exclude: string[] };
 
 		const needle = context.getFilename().replace(/\\/g, '/');
 		if (config.exclude.some((e) => needle.endsWith(e))) {
 			return {};
 		}
 
 		return {
-			[`Program > ExpressionStatement > CallExpression[callee.name='suite']`]: (node: Node) => {
+			[`Program > ExpressionStatement > CallExpression[callee.name='suite']`]: (node: estree.Node) => {
 				const src = context.getSourceCode().getText(node);
 				if (!src.includes('ensureNoDisposablesAreLeakedInTestSuite(')) {
 					context.report({