Bump Copilot CLI SDK packages to 1.0.64-1 / 1.0.3

[anthonykim1]

Wanting to see if excluding SEA and using index.js would work. Coming from: #322430

PLEASE REVIEW EXPANDED CHANGE SUMMARY.

This bump is more than a lockfile update because @github/copilot@1.0.64-1 changed package layout. The top-level package is now mostly a loader, while real CLI/SDK assets live in platform packages like @github/copilot-linux-x64.

• Bump Copilot CLI package usage to @github/copilot@^1.0.64-1 and public Agent Host SDK usage to @github/copilot-sdk@^1.0.3.
• Update Agent Host to launch the selected @github/copilot-<platform>/index.js entrypoint, with old top-level @github/copilot/index.js fallback.
• Keep the standalone SEA executable (@github/copilot-<platform>/copilot / copilot.exe) out of VS Code packaging while preserving the platform JS/runtime files we need.
• Keep Copilot Chat extension @github/copilot/sdk imports working across local install, VSIX packaging, and built-in product packaging.
• Package target-platform Copilot runtime files for desktop/server builds, including linuxmusl-*, macOS universal handling, and cross-arch optional-package materialization.

Expanded change summary

Package versions

• Change: root and remote move @github/copilot-sdk ^1.0.2 -> ^1.0.3; root, remote, and extensions/copilot move @github/copilot ^1.0.64-0 -> ^1.0.64-1.
• Why: @github/copilot-sdk@1.0.3 expects the newer Copilot CLI package shape, and the extension internal SDK path needs the matching CLI package version.
• Effect: both the public Agent Host SDK path and the Copilot Chat extension internal SDK path consume the matching CLI package generation.

Package layout shift

• Change: @github/copilot@1.0.64-1 moves the old top-level CLI/SDK/runtime layout into @github/copilot-<platform> packages.
• Why: the top-level package no longer carries the old index.js / sdk / prebuilds layout.
• Effect: VS Code packaging has to restore the selected platform package, but can still avoid shipping the standalone SEA executable.

Agent Host CLI launch path

• Change: copilotAgent.ts resolves @github/copilot-<platform>/index.js directly, with fallback to the old top-level @github/copilot/index.js layout.
• Why: the platform package still contains the JS entrypoint that corresponds to the old launch shape, while the top-level package delegates through npm-loader.js and the standalone SEA executable.
• Effect: Agent Host launches through the JS entrypoint and does not need to ship or spawn @github/copilot-<platform>/copilot / copilot.exe.

Agent Host packaging and platform packages

• Change: build/lib/copilot.ts re-adds the selected @github/copilot-<platform>/** package after .moduleignore strips platform packages globally.
• Change: the same packaging filter explicitly excludes @github/copilot-<platform>/copilot and @github/copilot-<platform>/copilot.exe.
• Why: Agent Host needs the selected platform package's JS/runtime files, but not the large standalone SEA executable.
• Effect: packaged builds keep index.js, app.js, runtime prebuilds, tgrep/ripgrep payloads, and related support files without taking the SEA size hit.

Runtime prebuilds kept

• Change: packaging keeps platform runtime files that are actually shipped by the selected Copilot package, including runtime.node, Unix pty.node, macOS spawn-helper, and Windows conpty.node, conpty_console_list.node, conpty/OpenConsole.exe, and conpty/conpty.dll.
• Why: smoke tests showed packaged builds can fail with missing native runtime files when these prebuilds are omitted.
• Effect: the platform runtime package remains usable inside signed packaged builds.

Copilot Chat extension SDK layout

• Change: postinstall.ts materializes @github/copilot/sdk from @github/copilot-<platform>.
• Why: extension source code still imports @github/copilot/sdk, while the new package layout moved real SDK files into platform packages.
• Effect: local extension development and extension packaging preserve existing imports without rewriting the extension integration.

Built-in Copilot extension target natives

• Change: prepareBuiltInCopilotRipgrepShim restores target-platform SDK prebuilds/<platform> and tgrep/bin/<platform> from the selected product @github/copilot-<platform> package before pruning non-target SDK folders.
• Why: the Copilot VSIX is built once on Linux x64, so Windows/macOS products can otherwise ship the built-in extension with only Linux SDK natives.
• Effect: packaged products get the target runtime.node / related SDK prebuilds in extensions/copilot/node_modules/@github/copilot/sdk/prebuilds/<platform> and target tgrep in both top-level and SDK layouts.

macOS universal architecture-specific Copilot files

• Change: macOS universal app creation treats @github/copilot-darwin-* as architecture-specific as a whole package.
• Why: the platform packages contain multiple arch-specific native/tool paths, including prebuilds/darwin-*, ripgrep/bin/darwin-*, and tgrep/bin/darwin-*.
• Effect: universal merge handles the Copilot darwin platform package consistently instead of fixing individual subdirectories one at a time.

Optional native payload guardrails

• Change: packaging filters and tests exclude optional payload directories and files: clipboard, pvrecorder, mxc-bin, foundry-local-sdk, computer.node, keytar.node, and non-Windows cli-native.node.
• Why: those payloads are not needed for this Agent Host integration path and previously introduced unnecessary native/GLIBC surface area.
• Effect: we keep the required runtime package while avoiding unrelated optional native payloads.

Cross-arch package materialization

• Change: ensureCopilotPlatformPackage materializes a missing selected @github/copilot-<platform> package from the package lock before desktop/server packaging, verifying npm integrity when present.
• Why: npm optional dependency install only brings down packages compatible with the host machine, but VS Code packaging can build a target package for a different architecture.
• Effect: packaging can include the correct selected Copilot platform package even when it was not host-installed by npm.

linuxmusl packaging

• Change: Copilot platform selection maps Alpine/musl builds to linuxmusl-x64 / linuxmusl-arm64.
• Why: the new Copilot package publishes musl-specific platform packages separately from glibc Linux packages.
• Effect: Alpine/musl builds select the matching Copilot platform package instead of accidentally using the glibc one.

Linux dependency generation

• Change: the previous experimental scan of node_modules/@github/copilot-*/copilot is removed from this branch.
• Why: this branch no longer ships the standalone SEA executable, so Linux dependency generation should stay scoped to shipped native addon files.
• Effect: deb/rpm dependency references do not need the extra SEA-executable dependency baselines.

SDK typing fallout

• Change: small guards/casts around blob attachment data, copilotUsage, permission helper formatting, and MCP sampling request IDs.
• Why: updated SDK declarations are stricter or shaped differently.
• Effect: no intended behavior change; existing integration code compiles against the new SDK types.

Dependency summary

NPM package dependencies

@github/copilot-sdk@1.0.3 declares these dependencies:

{
  "@github/copilot": "^1.0.64-1",
  "vscode-jsonrpc": "^8.2.1",
  "zod": "^4.3.6"
}

Verified with:

npm view @github/copilot-sdk@1.0.3 dependencies --json

@github/copilot@1.0.64-1 declares platform packages as optional dependencies:

{
  "@github/copilot-linux-x64": "1.0.64-1",
  "@github/copilot-win32-x64": "1.0.64-1",
  "@github/copilot-darwin-x64": "1.0.64-1",
  "@github/copilot-linux-arm64": "1.0.64-1",
  "@github/copilot-win32-arm64": "1.0.64-1",
  "@github/copilot-darwin-arm64": "1.0.64-1",
  "@github/copilot-linuxmusl-x64": "1.0.64-1",
  "@github/copilot-linuxmusl-arm64": "1.0.64-1"
}

Verified with:

npm view @github/copilot@1.0.64-1 optionalDependencies --json

Package layout used by VS Code

@github/copilot                  -> top-level package metadata / loader package
@github/copilot-<platform>       -> index.js, app.js, SDK files, runtime prebuilds, tgrep/ripgrep payloads
@github/copilot-<platform>/copilot(.exe)
                                  -> standalone SEA executable; explicitly excluded from VS Code packaging here
@github/copilot-sdk              -> public Agent Host SDK package, depends on @github/copilot@^1.0.64-1

Platform runtime files

The platform packages still ship runtime prebuilds that packaged builds need. For example:

npm pack @github/copilot-darwin-arm64@1.0.64-1 --silent
tar -tzf github-copilot-darwin-arm64-1.0.64-1.tgz | rg 'package/(index.js|app.js|sea-loader.js|prebuilds/darwin-arm64/(runtime.node|pty.node|spawn-helper))$'

Relevant files include:

package/index.js
package/app.js
package/sea-loader.js
package/prebuilds/darwin-arm64/runtime.node
package/prebuilds/darwin-arm64/pty.node
package/prebuilds/darwin-arm64/spawn-helper

Linux packages similarly ship runtime.node and pty.node; Windows packages ship runtime.node and ConPTY files such as conpty.node, conpty_console_list.node, conpty/OpenConsole.exe, and conpty/conpty.dll.

Built-in extension native files

The built-in Copilot extension must contain the target SDK native files after product packaging, not only the Linux files from the Linux-built VSIX. The target files are copied from the product platform package:

resources/app/node_modules/@github/copilot-<platform>/prebuilds/<platform>

into the built-in extension SDK layout:

resources/app/extensions/copilot/node_modules/@github/copilot/sdk/prebuilds/<platform>

Optional native payloads filtered from product packaging

The selected platform package is included, but product packaging filters out optional payloads we do not need for this integration path:

copilot / copilot.exe
clipboard/**
pvrecorder/**
mxc-bin/**
foundry-local-sdk/**
computer.node
keytar.node
non-Windows cli-native.node

This keeps the runtime package usable while avoiding the standalone SEA executable and unrelated optional native binaries.

Validation

Latest local validation after the SEA-executable pivot:

• cd build && npm run test -- lib/test/copilot.test.ts
• node --experimental-strip-types build/hygiene.ts build/lib/copilot.ts build/lib/test/copilot.test.ts src/vs/platform/agentHost/node/copilot/copilotAgent.ts build/linux/dependencies-generator.ts
• cd build && npm run typecheck

Additional targeted validation used while iterating this PR:

• node --experimental-strip-types build/hygiene.ts build/darwin/create-universal-app.ts
• node --experimental-strip-types build/hygiene.ts build/gulpfile.vscode.ts build/gulpfile.reh.ts
• cd extensions/copilot && npm run typecheck
• cd extensions/copilot && npx vitest --run src/extension/chatSessions/copilotcli/vscode-node/test/copilotCLISDKUpgrade.spec.ts --pool=forks

---

Inspirations from:

• The app packaging re-add path follows the existing Copilot packaging hook in build/gulpfile.vscode.ts.
• The remote packaging re-add path follows the existing server packaging hook in build/gulpfile.reh.ts.
• The narrow package include behavior is constrained by the existing module pruning policy in build/.moduleignore.
• The extension package filtering follows the built-in extension packaging constraints in extensions/copilot/.vscodeignore.

[Copilot]

Pull request overview

Updates VS Code’s Agent Host + built-in Copilot extension integration to work with the newer Copilot CLI/SDK package layout, and bumps the repo dependency versions accordingly. This primarily impacts how the Copilot CLI runtime is resolved/packaged across desktop, remote (reh), and the built-in extension.

Changes:

• Bump @github/copilot to ^1.0.64-1 and @github/copilot-sdk to ^1.0.3 in root + remote + Copilot extension, updating lockfiles.
• Update Agent Host and extension-side code to tolerate new SDK/runtime shapes (attachment data typing changes, longer-running SDK import + native-binary checks).
• Extend build/packaging logic to include and (when cross-building) materialize the correct @github/copilot-<platform> optional package, plus macOS universal app handling and new build-level tests for the packaging rules.

Show a summary per file

File	Description
src/vs/platform/agentHost/node/copilot/mapSessionEvents.ts	Adds stricter type guard for blob attachment data before decoding/forwarding.
src/vs/platform/agentHost/node/copilot/copilotAgentSession.ts	Adjusts MCP sampling forwarding to satisfy updated SDK typing for mcpRequestId.
src/vs/platform/agentHost/node/copilot/copilotAgent.ts	Adds platform-package CLI resolution helpers and switches CLI launch to the resolved path.
remote/package.json	Bumps Copilot CLI + SDK dependency versions for remote agent host.
remote/package-lock.json	Lockfile updates for the remote dependency bumps and transitive changes.
package.json	Bumps root Copilot CLI + SDK dependency versions.
package-lock.json	Lockfile updates for the root dependency bumps and transitive changes.
extensions/copilot/src/extension/chatSessions/copilotcli/vscode-node/test/copilotCLISDKUpgrade.spec.ts	Increases timeouts and relaxes native-binary assertions for non-current platform payloads.
extensions/copilot/src/extension/chatSessions/copilotcli/node/permissionHelpers.ts	Loosens helper input type to unknown for JSON formatting.
extensions/copilot/src/extension/chatSessions/copilotcli/node/copilotcliSession.ts	Adjusts casting around copilotUsage access for updated SDK event typing.
extensions/copilot/src/extension/chatSessions/copilotcli/common/copilotCLITools.ts	Guards blob attachment decoding on data being a string.
extensions/copilot/script/postinstall.ts	Materializes the SDK layout from platform packages and patches exports for @github/copilot/sdk imports.
extensions/copilot/package.json	Bumps extension’s @github/copilot dependency version.
extensions/copilot/package-lock.json	Lockfile updates for the extension dependency bump and transitive changes.
extensions/copilot/.vscodeignore	Excludes additional optional native payload directories from VSIX packaging.
build/lib/test/copilot.test.ts	Adds unit tests validating Copilot packaging filters and platform package materialization behavior.
build/lib/copilot.ts	Implements platform-package inclusion/exclusion globs, lockfile-based package materialization, and built-in extension prebuild restoration.
build/gulpfile.vscode.ts	Ensures target platform package exists before packaging desktop builds.
build/gulpfile.reh.ts	Ensures target platform package exists before packaging remote server builds.
build/darwin/create-universal-app.ts	Treats Copilot darwin platform packages as arch-specific inputs for universal app merging.

Copilot's findings

Files not reviewed (2)

• extensions/copilot/package-lock.json: Generated file
• remote/package-lock.json: Generated file

• Files reviewed: 17/20 changed files
• Comments generated: 1