chore: bump @github/copilot to 1.0.83-1

[vs-code-engineering]

Automated signed Copilot dependency bump.

• @github/copilot: 1.0.83-0 → 1.0.83-1
• Base: main @ 32e32a79173f692b9561aca62c3ea577de6c296c
• Opened by workflow run

Draft until validation passes. The sdk-vscode-bump-fix agent first iterates on Linux PR checks (up to 10 cycles), then on the authoritative full product build (up to 5 cycles).

Each product build triggered for this PR is posted as a comment below with a link.

🤖 sdk-bump-fix status — product cycle 1

State: BLOCKED on upstream package feed (not a VS Code integration issue) — sdk-bump-fix-stuck

Integration changes this cycle: none. No VS Code integration edit can resolve the failure, and no version pin / lockfile change is permitted (or would help).

**Authoritative failure (product build [470018]((dev.azure.com/redacted) the single real failure is the Install vscode dependencies (Copilot) task:

npm error code E404
npm error 404 Not Found - GET .../_packaging/vscode/npm/registry/`@github/copilot`/-/copilot-1.0.83-1.tgz
  - Cannot find the file copilot-1.0.83-1.tgz in package '`@github/copilot` 1.0.83-1' in feed 'vscode'

Every other failing task (Checkout ..., Codesign, Compile ..., 1ES PT Pre-Job, Install dependencies (Quality), etc.) is a canceled cascade from this one npm ci failure — not an independent break.

Root cause (failure class: package installation / feed availability): the pinned primary CLI package @github/copilot@1.0.83-1 has version metadata in the internal monacotools/vscode npm feed, but its tarball blob copilot-1.0.83-1.tgz is not present (not yet mirrored/published into the feed). This is upstream package-availability, not a VS Code packaging/integration defect.

SDK+CLI correlation & compatibility:

• Branch pair: SDK 1.0.13-preview.4 (declares CLI floor ^1.0.83-0) + CLI 1.0.83-1. SDK floor reaches this CLI — compatible.
• Exact-match SDK canary for CLI 1.0.83-1 (run 33488560558) — success across Linux/macOS/Windows.
• SDK dependency-update PR github/copilot-sdk#2467 — merged; public Node.js publish jobs green.
• Same-base canary integration threads are red, but those use a different (unsigned canary) CLI and a -canary SDK, so they are hypotheses only and do not implicate VS Code here. The exact signed-pair failure is the feed 404, which is orthogonal to any integration change.

Why no push: the missing artifact is the primary pinned package tarball. It cannot be fixed by editing VS Code integration surfaces, and it is out of scope to alter version pins/lockfiles. The scoped-override escape hatch does not apply (it covers a transitive dep selecting a too-new/quarantined version, not an entirely-absent primary tarball).

Smallest unresolved human task: ensure @github/copilot@1.0.83-1 (copilot-1.0.83-1.tgz) is published/mirrored into the internal monacotools/vscode npm feed, then re-dispatch the product build (no code change needed). If the CLI version was mis-pinned, re-run the bump with an available version.

Validation stage: product, cycle 1 — blocked on feed availability. PR left as draft.> Generated by sdk-vscode-bump-fix · opus48 · 133.4 AIC · ⌖ 11.2 AIC · ⊞ 18.3K · ◷

[Copilot]

🟢 Approval recommended

All manifests and platform-specific lockfile records are complete and consistent.

Pull request overview

Updates the bundled GitHub Copilot dependency from 1.0.83-0 to 1.0.83-1 across local and remote environments.

Changes:

• Updates both dependency manifests.
• Regenerates lockfile versions, URLs, integrity hashes, and platform packages consistently.

File summaries

File	Description
package.json	Updates the root Copilot pin.
package-lock.json	Locks root and platform packages to 1.0.83-1.
remote/package.json	Updates the remote environment pin.
remote/package-lock.json	Locks remote packages to 1.0.83-1.

Review details

Files not reviewed (1)

• remote/package-lock.json: Generated file

• Files reviewed: 2/4 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[vs-code-engineering]

🏗️ Full product build queued for cycle 1: https://dev.azure.com/monacotools/Monaco/_build/results?buildId=470018 — validating the PR branch…

[vs-code-engineering]

❌ Full product build against the PR branch — cycle 1: failed

• Validating: @github/copilot-sdk@1.0.13-preview.4 · @github/copilot@1.0.83-1
• ADO build: https://dev.azure.com/monacotools/Monaco/_build/results?buildId=470018
• Dispatched by: https://github.com/microsoft/vscode-engineering/actions/runs/33572253364

[vs-code-engineering]

🤖 sdk-bump-fix — escalation: upstream package feed availability (no VS Code fix possible)

Completed automated work: Investigated the failing product build ([470018]((dev.azure.com/redacted) end-to-end, checked out the bump branch, and reproduced/root-caused the failure. Confirmed the branch pins (SDK 1.0.13-preview.4, CLI 1.0.83-1) are correct and mutually compatible, and that all upstream SDK evidence is green (exact-match SDK canary passed on all 3 platforms; dependency PR github/copilot-sdk#2467 merged; public npm publish jobs green). Verified that every other failing build task is a canceled cascade from a single npm ci failure, not an independent break.

Root cause (package installation / feed availability):

npm error code E404
npm error 404 Not Found - GET .../_packaging/vscode/npm/registry/`@github/copilot`/-/copilot-1.0.83-1.tgz
  - Cannot find the file copilot-1.0.83-1.tgz in package '`@github/copilot` 1.0.83-1' in feed 'vscode'

The pinned primary package @github/copilot@1.0.83-1 has version metadata in the internal monacotools/vscode npm feed, but its tarball blob copilot-1.0.83-1.tgz is not present (not yet mirrored/published into the feed). This is an upstream package-availability problem, not a VS Code integration/packaging defect.

Why no code change was pushed: No VS Code integration surface can supply a missing primary-package tarball, and it is out of scope to modify version pins or lockfiles. The scoped transitive-dependency override escape hatch does not apply (the absent artifact is the primary pinned package, not a too-new/quarantined transitive dep).

Remaining minimal human task: Publish/mirror @github/copilot@1.0.83-1 (copilot-1.0.83-1.tgz) into the internal monacotools/vscode npm feed, then re-dispatch the product build for this PR — no code change is needed. If 1.0.83-1 was pinned prematurely, re-run the bump against a version whose tarball is already available in the feed.

PR left as a draft.

cc @pwang347 @anthonykim1

Generated by sdk-vscode-bump-fix · opus48 · 133.4 AIC · ⌖ 11.2 AIC · ⊞ 18.3K · ◷