Megaport Copilot Adapter (VS Code extension)

Stage, upgrade, and verify the Megaport Copilot adapter (.github/copilot-instructions.md + skills + hooks) into any repo from inside Visual Studio Code.

This extension is a thin wrapper around the install-core-cli Go binary: each .vsix bundles a per-platform statically-linked binary in bin/install-core-cli, and every command shells out to it. Drift, checksum, and Sigstore verification semantics are the source-of-truth in install-core-cli; this extension surfaces them as clean VS Code notifications.

Commands

All commands appear under the Megaport: category in the command palette (⇧⌘P / Ctrl+Shift+P).

Command	Behaviour
`Megaport: Install Copilot Adapter`	Stage the latest signed `copilot-v*` release into the active workspace folder's `.github/`. Refuses on drift; offers a modal "Force re-install" prompt.
`Megaport: Upgrade Copilot Adapter`	Re-stage on top of an existing install. Surfaces "no install stamp" cleanly so users know to run install first.
`Megaport: Uninstall Copilot Adapter`	Remove staged assets while preserving customer-edited files. Mandatory confirmation modal.
`Megaport: Show Copilot Adapter Status`	One-line summary of the installed tag, source identifier, and drift state. "Show output" reveals the full JSON dump.
`Megaport: Copilot Adapter Doctor`	Redacted diagnostic dump for bug reports — env-var values are reported as `set (N chars)` / `UNSET` only, never the raw value.

Configuration

Setting	Default	Description
`megaport.copilot.ref`	`""`	Pin to a specific `copilot-vX.Y.Z` tag. Empty string resolves the latest signed release.
`megaport.copilot.verifySigstore`	`false`	Additionally verify `SHA256SUMS.txt` against its Sigstore bundle on install/upgrade.
`megaport.copilot.installCoreCliPath`	`""`	Local-development override pointing at a self-built `install-core-cli` binary. Empty string resolves the binary shipped inside the extension.

Source identifier

Every install/upgrade/uninstall invocation passes --source vscode-extension to install-core-cli, which records the identifier in .github/.megaport-tools-version. That stamp lets analytics distinguish VS Code installs from gh megaport, the bare CLI, and other surfaces. The bats round-trip suite at tests/vscode-extension-round-trip.bats asserts the stamp's source field equals vscode-extension after an install via this extension.

Verifying a published `.vsix`

The release pipeline (.github/workflows/release-vscode.yml) emits six per-platform .vsix files, signs them with Cosign keyless, and attaches SLSA 3 provenance. To verify a downloaded artefact:

# 1. Verify SLSA 3 provenance (requires github.com/slsa-framework/slsa-verifier).
slsa-verifier verify-artifact \
  --provenance-path megaport-copilot-tools-darwin-arm64.intoto.jsonl \
  --source-uri github.com/megaport/megaport-copilot-tools \
  --source-tag vscode-vX.Y.Z \
  megaport-copilot-tools-darwin-arm64.vsix

# 2. Verify Cosign keyless signature.
cosign verify-blob \
  --bundle megaport-copilot-tools-darwin-arm64.vsix.cosign.bundle \
  --certificate-identity-regexp \
    "https://github.com/megaport/megaport-copilot-tools/.github/workflows/release-vscode.yml@refs/tags/vscode-v.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  megaport-copilot-tools-darwin-arm64.vsix

Marketplace installs are gated by VS Code's own publisher-verification step; the SLSA + Cosign envelope is for sideload / air-gapped review.

Local development

cd packages/vscode-extension
npm install
# Build the host-arch install-core-cli into bin/.
npm run build:install-core-cli
# Compile TypeScript.
npm run compile
# Run the unit tests (no VS Code API surface — uses node --test + tsx).
npm test
# Smoke-test the .vsix package step (does not publish).
npm run package

To launch VS Code with the extension loaded against a sample workspace:

code --extensionDevelopmentPath=$(pwd) /tmp/sample-repo

The TypeScript unit tests live under src/__tests__/ and exercise the pure-function surface (argv builder, exit-code descriptions, binary path resolution). Anything that needs the actual vscode namespace is covered by the bats round-trip suite.

Reporting bugs

Run the Megaport: Copilot Adapter Doctor command — it dumps a redacted diagnostic to the output channel.
Open an issue at https://github.com/megaport/megaport-copilot-tools/issues and paste the doctor output.

Megaport Copilot Adapter

Megaport