[ImgBot] Optimize images

.cnb.yml

@@ -0,0 +1,64 @@
+# .cnb.yml
+.npc: &npc
+  - services:
+      - docker
+    stages:
+      - name: run with npc
+        image: cnbcool/default-npc-agent:latest
+
+好大个:
+  issue.comment@npc: *npc
+  pull_request.comment@npc: *npc
+
+$:
+  vscode:
+    - runner:
+        cpus: 32
+      docker:
+        build: .ide/Dockerfile
+      env:
+        # 声明首次打开终端时自动执行的命令，支持多行文本
+        CNB_WELCOME_CMD: |
+          echo "Hello World!"
+          echo done
+      services:
+        - vscode
+        - docker
+      # 开发环境启动后会执行的任务
+      stages:
+        - name: ls
+          script: ls -al
+  tag_push:
+    - stages:
+        - name: 生成 Code Wiki
+          timeout: 4h
+          image: cnbcool/codewiki:latest
+          settings:
+            git_doc_dir: /${CNB_BUILD_WORKSPACE}/${CNB_REPO_SLUG}/codewiki
+
+# .cnb.yml
+"**":  # 触发的分支名，默认所有分支，可按需修改
+  push:  # push 触发，可按需修改为 pull_request 等
+    - stages:
+      # 代码分析
+      - name: TCA
+        timeout: 2h
+        image: cnbcool/tca:latest
+        settings:
+          from_file:  # 可选，可以传递一个文件（比如 changed.txt），内容为需要分析的文件列表，一行一个文件（采用基于工作空间的相对路径）
+          ignore_paths: # 可选，指定一个或多个相对工作空间的文件屏蔽路径(黑名单)，多个路径可写成数组格式，路径采用Unix通配符格式。
+          white_paths: # 可选，指定一个或多个相对工作区的扫描路径(白名单)，多个路径可写成数组格式，路径采用Unix通配符格式。
+          block:  # 可选，默认为true, 如果有代码问题或分析异常，会阻塞流水线。如果不希望阻塞流水线，可以设置为false。
+
+    - stages:
+        - name: build knowledge base
+          image: cnbcool/knowledge-base
+          settings:
+            include: '**/*.md,**/*.mdx,**/*.pdf,**/*.docx,**/*.txt'
+            issue_sync_enabled: true
+            issue_labels:
+              - bug
+              - feature
+            issue_state: "open"
+            issue_priority: "P0,P1"
+

.cnb/settings.yml

@@ -0,0 +1,32 @@
+npc:
+  roles:
+    - name: 好大个
+      prompt: |
+        你用"好大个"自称，叫用户"大人"，
+        你的口头禅是『此事必有蹊跷！』，
+        结束对话前礼貌地回复一行："此事背后一定有一个天大的秘密。"
+        无论是日常对话还是讲解知识，你都会保持以上风格，
+        使用中文的『～』代替所有英文的『~』，
+        用卑微并专业的语气回答接下来的问题
+
+
+# 云原生开发配置
+# 注意：读取云原生启动按钮所在页面当前分支的 .cnb/settings.yml 配置
+workspace:
+  launch:
+    # 定制云原生开发启动按钮
+    button:
+      # 按钮名称
+      name: 启动云原生开发
+      # 按钮描述
+      # 如果值为 null，则不显示默认描述
+      description: 点击此按钮启动云原生开发环境
+      # 鼠标悬浮图片：仓库图片填相对路径（如 .cnb/launch-hover.gif），外部图片填 raw 地址，最大 10MB
+      # hoverImage: .cnb/launch-hover.gif
+    # CPU 核心数，默认 8，仅对默认模板有效
+    cpus: 16
+    # 是否禁用默认按钮，默认 false
+    disabled: false
+    # 环境创建后是否自动打开 WebIDE，默认 false
+    # 未安装 openssh 时会自动打开，不受此参数影响
+    autoOpenWebIDE: true

.devcontainer/devcontainer-lock.json

@@ -9,6 +9,11 @@
       "version": "1.5.0",
       "resolved": "ghcr.io/devcontainers/features/rust@sha256:0c55e65f2e3df736e478f26ee4d5ed41bae6b54dac1318c443e31444c8ed283c",
       "integrity": "sha256:0c55e65f2e3df736e478f26ee4d5ed41bae6b54dac1318c443e31444c8ed283c"
+    },
+    "ghcr.io/devcontainers/features/sshd:1": {
+      "version": "1.1.0",
+      "resolved": "ghcr.io/devcontainers/features/sshd@sha256:f5251b8e4325f68f7280973c6cd65daff414449c66f240621502d4e8e74eb7ee",
+      "integrity": "sha256:f5251b8e4325f68f7280973c6cd65daff414449c66f240621502d4e8e74eb7ee"
     }
   }
 }

.devcontainer/devcontainer.json

@@ -5,7 +5,8 @@
 	},
 	"features": {
 		"ghcr.io/devcontainers/features/desktop-lite:": {},
-		"ghcr.io/devcontainers/features/rust:": {}
+		"ghcr.io/devcontainers/features/rust:": {},
+		"ghcr.io/devcontainers/features/sshd:1": {}
 	},
 	"containerEnv": {
 		"DISPLAY": "" // Allow the Dev Containers extension to set DISPLAY, post-create.sh will add it back in ~/.bashrc and ~/.zshrc if not set.

.github/CODENOTIFY

@@ -4,12 +4,12 @@ src/vs/base/browser/domSanitize.ts @mjbvz
 src/vs/base/parts/quickinput/** @TylerLeonhardt
 
 # Base Widgets
-src/vs/base/browser/ui/grid/** @joaomoreno @benibenj
-src/vs/base/browser/ui/list/** @joaomoreno @benibenj
-src/vs/base/browser/ui/sash/** @joaomoreno @benibenj
-src/vs/base/browser/ui/splitview/** @joaomoreno @benibenj
-src/vs/base/browser/ui/table/** @joaomoreno @benibenj
-src/vs/base/browser/ui/tree/** @joaomoreno @benibenj
+src/vs/base/browser/ui/grid/** @benibenj
+src/vs/base/browser/ui/list/** @benibenj
+src/vs/base/browser/ui/sash/** @benibenj
+src/vs/base/browser/ui/splitview/** @benibenj
+src/vs/base/browser/ui/table/** @benibenj
+src/vs/base/browser/ui/tree/** @benibenj
 
 # Platform
 src/vs/platform/browserView/** @kycutler @jruales
@@ -43,7 +43,7 @@ src/vs/workbench/contrib/quickaccess/browser/commandsQuickAccess.ts @TylerLeonha
 src/vs/workbench/contrib/scm/** @lszomoru
 src/vs/workbench/contrib/terminal/** @anthonykim1
 src/vs/workbench/contrib/terminalContrib/** @anthonykim1
-src/vs/workbench/contrib/update/browser/releaseNotesEditor.ts @alexr00 @joaomoreno
+src/vs/workbench/contrib/update/browser/releaseNotesEditor.ts @alexr00
 src/vs/workbench/contrib/preferences/** @rzhao271
 
 # Sessions Contributions

.github/CODEOWNERS

@@ -1,14 +1,14 @@
 # GitHub actions required reviewers
-.github/workflows/monaco-editor.yml @hediet @alexdima @lszomoru @joaomoreno
-.github/workflows/no-package-lock-changes.yml @lszomoru @alexdima @joaomoreno @TylerLeonhardt @rzhao271 @Yoyokrazy
-.github/workflows/no-yarn-lock-changes.yml @lszomoru @alexdima @joaomoreno @TylerLeonhardt @rzhao271 @Yoyokrazy
-.github/workflows/pr-darwin-test.yml @lszomoru @alexdima @joaomoreno @TylerLeonhardt @rzhao271 @Yoyokrazy
-.github/workflows/pr-linux-cli-test.yml @lszomoru @alexdima @joaomoreno @TylerLeonhardt @rzhao271 @Yoyokrazy
-.github/workflows/pr-linux-test.yml @lszomoru @alexdima @joaomoreno @TylerLeonhardt @rzhao271 @Yoyokrazy
-.github/workflows/pr-node-modules.yml @lszomoru @alexdima @joaomoreno @TylerLeonhardt @rzhao271 @Yoyokrazy
-.github/workflows/pr-win32-test.yml @lszomoru @alexdima @joaomoreno @TylerLeonhardt @rzhao271 @Yoyokrazy
-.github/workflows/pr.yml @lszomoru @alexdima @joaomoreno @TylerLeonhardt @rzhao271 @Yoyokrazy
-.github/workflows/telemetry.yml @lramos15 @lszomoru @alexdima @joaomoreno
+.github/workflows/monaco-editor.yml @hediet @alexdima @lszomoru
+.github/workflows/no-package-lock-changes.yml @lszomoru @alexdima @sandy081 @TylerLeonhardt @rzhao271 @Yoyokrazy
+.github/workflows/no-yarn-lock-changes.yml @lszomoru @alexdima @sandy081 @TylerLeonhardt @rzhao271 @Yoyokrazy
+.github/workflows/pr-darwin-test.yml @lszomoru @alexdima @sandy081 @TylerLeonhardt @rzhao271 @Yoyokrazy
+.github/workflows/pr-linux-cli-test.yml @lszomoru @alexdima @sandy081 @TylerLeonhardt @rzhao271 @Yoyokrazy
+.github/workflows/pr-linux-test.yml @lszomoru @alexdima @sandy081 @TylerLeonhardt @rzhao271 @Yoyokrazy
+.github/workflows/pr-node-modules.yml @lszomoru @alexdima @sandy081 @TylerLeonhardt @rzhao271 @Yoyokrazy
+.github/workflows/pr-win32-test.yml @lszomoru @alexdima @sandy081 @TylerLeonhardt @rzhao271 @Yoyokrazy
+.github/workflows/pr.yml @lszomoru @alexdima @sandy081 @TylerLeonhardt @rzhao271 @Yoyokrazy
+.github/workflows/telemetry.yml @lramos15 @lszomoru @alexdima
 
 # VS Code API
 # Ensure the API team is aware of changes to the vscode-dts file

.github/commands.json

@@ -82,7 +82,7 @@
 		"name": "*caused-by-extension",
 		"action": "close",
 		"reason": "not_planned",
-		"comment": "This issue is caused by an extension, please file it with the repository (or contact) the extension has linked in its overview in VS Code or the [marketplace](https://aka.ms/vscodemarketplace) for VS Code. See also our [issue reporting guidelines](https://aka.ms/vscodeissuereporting). If you don't know which extension is causing the problem, you can run `Help: Start extension bisect` from the command palette (F1) to help identify the problem extension.\n\nHappy Coding!"
+		"comment": "This issue is caused by an extension, please file it with the repository (or contact) the extension has linked in its overview in VS Code or the [marketplace](https://aka.ms/vscodemarketplace) for VS Code. See also our [issue reporting guidelines](https://aka.ms/vscodeissuereporting). If you don't know which extension is causing the problem, you can run `Help: Start Extension Bisect` from the command palette (F1) to help identify the problem extension.\n\nHappy Coding!"
 	},
 	{
 		"type": "label",

.github/instructions/best-practices.instructions.md

@@ -24,6 +24,15 @@ applyTo: src/vs/**
 - Don't hardcode URI scheme strings like `'file'`, `'untitled'`, or `'vscode-remote'`. Use the `Schemas` constants from `vs/base/common/network.ts` (e.g. `Schemas.file`, `Schemas.untitled`, `Schemas.vscodeRemote`).
 - Don't compare URIs with `===` or `uri.toString()`. Use the comparison utilities from `vs/base/common/resources.ts`: `isEqual` for equality, `isEqualOrParent` for containment, and `getComparisonKey` when a URI is used as a map/set key. These handle path-case sensitivity and fragment/authority correctly. When you need explicit control over case sensitivity, use an `ExtUri` instance (`extUri`, `extUriIgnorePathCase`, or `extUriBiasedIgnorePathCase`) instead of the bound helpers.
 
+## Resource Labels
+
+- Don't set `{ supportIcons: true }` when creating a `ResourceLabel` (`vs/workbench/browser/labels.ts`). This option makes the label parse `$(codicon)` syntax in the name/description and is only needed when you want to render a codicon inline with the resource text. By default (without it), the label computes the proper file-icon CSS classes for the resource, which is what we almost always want. Note that those classes only render as icons when an ancestor DOM element enables file icons (see below); otherwise the label shows text only.
+- To actually display file icons for resource labels in a tree/list, an ancestor container must have the `show-file-icons` class and be wired to the active file icon theme. Don't add the class by hand — call `createFileIconThemableTreeContainerScope` (`vs/workbench/contrib/files/browser/views/explorerView.ts`) on the container. It adds the required `show-file-icons` / `file-icon-themable-tree` classes and keeps `align-icons-and-twisties` / `hide-arrows` in sync with the file icon theme. Register the returned `IDisposable`. A common bug is placing a resource-label list/tree outside such a scoped container, which makes file icons silently disappear.
+
+## Styling
+
+- Avoid `getComputedStyle`. If a style value is needed in both CSS and TypeScript, prefer hardcoding the value in TypeScript and setting it directly on the DOM element (e.g. `element.style.width = '100px'`), or set a CSS custom property via `element.style.setProperty('--my-var', value)` when the value is needed across multiple CSS rules.
+
 ## Editor Decorations
 
 - For editor highlights, use a regular editor decoration with an `inlineClassName` or `className` plus a CSS rule.

.github/instructions/coding-guidelines.instructions.md

@@ -28,6 +28,11 @@ Use tabs, not spaces.
 
 - Use JSDoc style comments for functions, interfaces, enums, and classes
 - Do not write large comments in the middle of a method or comments that explain a single line. If a line or block needs a paragraph of explanation to be understood, treat that as a signal that the code itself is unclear: extract a well-named function, introduce an explanatory variable, or simplify the logic instead. Keep any remaining inline comment to a brief note.
+- **Default to NO comment.** Add one only when the code cannot be made self-explanatory by naming. Code that is obvious from its identifiers must not be commented.
+- **Hard limits** (treat as rules, not suggestions):
+  - JSDoc on a function/interface/property: at most 1–2 short sentences. Do not enumerate every branch/feature, restate the signature, list what it does NOT do, or explain parameters that are obvious from their names/types.
+  - Inline comment inside a method body: at most 1 line, and only for a genuine workaround/hack, a non-obvious ordering constraint, or a surprising side effect. Never narrate the next statement (e.g. `// Expand the variable`, `// loop over args`).
+- Before writing any comment longer than one line, stop and either delete it or shorten it to a single line. A multi-line block comment inside a method body is almost always wrong.
 
 ## Strings
 

.github/instructions/oss-third-party-notices.instructions.md

@@ -1,10 +1,12 @@
 ---
-applyTo: 'build/azure-pipelines/oss/**'
+applyTo: 'build/azure-pipelines/{oss/**,common/downloadNotice.ts,{win32,linux,darwin}/steps/product-build-*-compile.yml}'
 ---
 
 # VS Code OSS Third-Party-Notices pipeline
 
-This directory contains the thin VS Code-specific layer around Component Governance (CG) for producing OSS third-party notices. The goal is to replace the legacy custom OSS tool with CG plus a gap-filling scanner, so release owners do not need to babysit `ThirdPartyNotices.txt` every release. The generated output should be at least as good as the legacy tool: CG provides the base NOTICE, the local scanner fills known CG gaps, and human-authored overrides cover the small set that automation cannot safely resolve.
+This directory contains the thin VS Code-specific layer around Component Governance (CG) for producing OSS third-party notices. It replaces the legacy custom OSS tool with CG plus a gap-filling scanner, so release owners do not need to babysit `ThirdPartyNotices.txt` every release. The generated output should be at least as good as the legacy tool: CG provides the base NOTICE, the local scanner fills known CG gaps, and human-authored overrides cover the small set that automation cannot safely resolve.
+
+The pipeline has two halves: **generation** (this `oss/` directory — CG + scanner + merge, producing the `notice_output` artifact) and **application** (the cutover that swaps the merged notice into the shipped product — see "Applying the NOTICE (cutover)" below).
 
 ## Architecture
 
@@ -34,6 +36,45 @@ In `product-quality-checks.yml`:
 6. `merge-notices.js` runs with `--cg`, `--extensions`, `--cglicenses`, and `--output`.
 7. The generated CG file, scanner file, final merged file, and optional cache metadata are uploaded under `notice_output`.
 
+## Applying the NOTICE (cutover)
+
+Generation (above) produces the merged `ThirdPartyNotices.new.txt` in the `notice_output` artifact. **Application** is the cutover that makes that file the one VS Code actually ships, replacing the legacy mixin notice.
+
+Consumer script: `build/azure-pipelines/common/downloadNotice.ts` (read its header comment for the full design rationale).
+
+How it works, per desktop platform compile template (`build/azure-pipelines/{win32,linux,darwin}/steps/product-build-*-compile.yml`):
+
+1. **Pull CG NOTICE (background)** — at compile start, `deemon --detach` launches `downloadNotice.ts` as a detached poller. It polls the parallel Quality stage's `notice_output` artifact while compilation runs, so the wait overlaps work already happening.
+2. **Apply CG NOTICE** — right before gulp packages the app, `deemon --attach` blocks on that poller. It downloads, extracts, validates the merged notice, and **overwrites the repo-root `ThirdPartyNotices.txt`**. `build/gulpfile.vscode.ts` then packages whatever file is at that path → the CG notice ships.
+
+Only the 7 desktop targets that bundle a notice run these steps (win32 x64/arm64, darwin universal, linux x64/arm64/armhf). REH/server/web/alpine are unaffected.
+
+### Fallback chain (never fail the build)
+
+`downloadNotice.ts` is **non-fatal — it always exits 0.** A notice problem must never break packaging. The outcomes, in order:
+
+1. **CG fresh** — the `notice_output` artifact is present and valid → overwrite with it.
+2. **Cached CG** — if CG generation failed upstream, the Quality stage substitutes the last good `ThirdPartyNotices.generated.txt` (same branch, then `main`) before the artifact is published — so the consumer still gets a CG notice.
+3. **Legacy** — if no usable artifact is available, the legacy mixin notice that `mixin-quality.ts` already laid down is left in place. `mixin-quality.ts` is deliberately left untouched (it's a shared chokepoint used by 8+ pipelines), which is what guarantees we never ship with *no* notice.
+
+The accept-gate validates the *extracted content* (file present AND non-trivial) inside the poll loop — it does not trust the artifact listing alone. A mid-upload miss re-polls rather than falling back, which prevents a "mixed notice" race where one platform ships legacy while its siblings ship CG.
+
+### Rollback lever
+
+A queue-time checkbox **"Use legacy OSS Notice"** (parameter `VSCODE_USE_LEGACY_OSS_NOTICE`, default `false`) is the instant rollback. When checked, it derives `VSCODE_OVERWRITE_TPN=false`, and `downloadNotice.ts` skips the overwrite so the legacy notice ships — no code change or redeploy needed.
+
+> ⚠️ `downloadNotice.ts` normalizes the flag with `.trim().toLowerCase()` before comparing, so YAML casing (`true`/`false` vs `True`/`False`) can't break the rollback lever. The pipeline still derives `VSCODE_OVERWRITE_TPN` as a lowercase string literal (`'true'`/`'false'`) for clarity. See the comment in `product-build-variables.yml`.
+
+### Diagnosing a build
+
+`downloadNotice.ts` logs three greppable markers so a build log answers "did the cutover work?":
+
+- `[notice-cutover] RESULT=fresh` — overwrote from `notice_output` (the happy path).
+- `[notice-cutover] RESULT=fallback` — artifact missing → kept the legacy notice.
+- `[notice-cutover] RESULT=disabled` — feature flag off → kept the legacy notice.
+
+To confirm a shipped artifact carries the CG notice, the root `resources/app/ThirdPartyNotices.txt` should be the large CG-merged file (multi-MB) rather than the ~3 MB legacy notice. Validate *intra-build* parity — all platforms in one build should produce a byte-identical notice (same SHA-256) — rather than checking against a fixed byte count, since CG's exact output size varies run-to-run.
+
 ## Script reference
 
 ### `scan-licenses.ts`