[pull] main from microsoft:main

.github/skills/agent-host-e2e-tests/SKILL.md

@@ -19,6 +19,7 @@ It documents the mental model, the fixture format, every config flag, and a symp
 3. **Recording needs a real token** (`GITHUB_TOKEN` or `gh auth token`) and talks to real CAPI. Only run it intentionally, with trivial/read-only prompts in temp dirs.
 4. **Never hand-write or hand-edit fixture contents** (especially not secrets/paths). Fixtures are always produced by recording; normalization/redaction is the proxy's job.
 5. **Gate, don't fight.** If a behavior can't replay deterministically, gate the test (see Workflow C) instead of loosening timeouts or the strict check.
+6. **Track every disabled variant.** Keep `e2e/KNOWN_ISSUES.md` current with the test title, scope, expected and observed behavior, and a focused reproduction command. Record symptoms, not speculative root causes.
 
 ## Workflow A — Add a cross-provider test
 
@@ -54,7 +55,7 @@ Real-time streaming, mid-turn aborts, and POSIX-specific local execution (shell
 - **POSIX-only** (fails on Windows): gate with `!isWindows`, or a targeted per-provider flag when only one provider diverges. See the worktree and subagent-reopen tests.
 - **Provider/OS-specific replay**: add a targeted config gate that still permits recording and unaffected platforms. See the Codex shell-tool Linux gate.
 
-Always add a comment explaining *why* the gate exists.
+Always add a comment explaining *why* the gate exists. Also add or update the corresponding entry in `e2e/KNOWN_ISSUES.md`. When the variant is enabled again, remove or update the entry in the same change.
 
 ## Verifying & troubleshooting
 

.github/skills/flaky-smoke-tests/SKILL.md

@@ -29,6 +29,17 @@ iterations sequentially in one job.
   directory. The artifact is job-scoped, not iteration-scoped:
   `smoke-test-runner.log` can contain multiple iterations, and suite
   directories are not separated by iteration.
+- Do not cancel a platform job while investigating if you still need its logs
+  artifact. Cancellation can skip the publish steps entirely, even when one or
+  more failed iteration task logs are already available. If a validation run
+  has become predictably red, either let the current job finish or queue a
+  single diagnostic iteration and let that job publish before iterating.
+- Later iterations can overwrite or truncate files in the shared logs
+  directory. The final artifact may therefore contain the last iteration's
+  suite directory or runner log but not the failed iteration's detailed
+  diagnostics. Preserve the exact task log, and use a one-iteration diagnostic
+  run when extension-host, renderer, mock-server, screenshot, or trace evidence
+  from the failed attempt is required.
 - The exact iteration task log is authoritative for its failure summary and
   time range. Correlate that range with the job-level artifact.
 - Iterations can see persisted smoke-test state from earlier iterations, such
@@ -138,8 +149,11 @@ Bash:
 jq -r '.value[]' task-log.json > task-log.txt
 ```
 
-The task log provides the concise Mocha failure, stack, active-view dump, and
-the iteration's exact time range even before platform artifacts are published.
+The task log provides the concise Mocha failure, stack, and the iteration's
+exact time range even before platform artifacts are published. Diagnostics
+written through the smoke runner's `Logger` (including
+`dumpFailureDiagnostics`) may exist only in `smoke-test-runner.log`, so do not
+assume they will be present in the Azure task log.
 
 ## 4. Download the Platform Logs Artifact
 
@@ -165,6 +179,8 @@ az pipelines runs artifact download \
 ```
 
 Artifacts are available after the platform job publishes its outputs.
+An absent platform artifact after a canceled run is expected; it is not
+evidence that the artifact name was wrong.
 
 ## 5. Correlate the Failure
 
@@ -225,6 +241,16 @@ Session-list text and active-view text answer different questions:
   iteration.
 - Reusing a fixed warm-up scenario marker can let a later warm-up wait match an
   earlier response and abandon the actually-running warm-up.
+- Standard smoke suites created through `installAllHandlers` use distinct
+  randomized user-data directories. Do not attribute a setting from the
+  preceding suite to the failing suite without comparing the actual
+  `vscode-userdata:` or `--user-data-dir` paths in their logs. Iterations share
+  broader job state, but sibling suites normally do not share the same profile.
+- A setup change can alter rather than fix the symptom. Re-check the exact
+  stack and the gesture/dispatch/request/rendering chain on every validation
+  run. For example, moving extension enablement before startup can eliminate an
+  editor-open timeout while activating the extension before test settings are
+  written, producing a later request or response timeout instead.
 
 Prefer assertions that establish identity:
 
@@ -312,4 +338,3 @@ Summarize:
 - introducing commit, with why it is causal
 - fix commit
 - focused validation run ID, platforms, iterations, and current result
-

build/azure-pipelines/common/dictation-runtime-produce.yml

@@ -0,0 +1,66 @@
+parameters:
+  - name: vscodePlatform
+    type: string
+    values:
+      - darwin
+      - linux
+      - win32
+
+# Produces the dictation-runtime for ONE VS Code build:
+#   - STAMP: writes the (target-agnostic) product.dictationRuntime results file
+#     and emits `##vso[task.setvariable variable=DICTATION_RUNTIME_RESULTS_FILE]`
+#     on EVERY build that can host dictation, so the downstream gulp packaging
+#     step stamps product.json. Packaged builds strip the SDK's native payload,
+#     so they need this CDN pointer regardless of VSCODE_PUBLISH.
+#   - PAYLOAD: builds this target's tarball and uploads it to the CDN only on
+#     real publish runs (VSCODE_PUBLISH=true). darwin-x64 stamps but uploads
+#     nothing (the darwin-arm64 job publishes the shared Apple Silicon payload).
+#
+# The core libraries are fetched from NuGet for the target's explicit RID (see
+# build/dictation-runtime/nuget.ts), so ARM64 targets build fine on x64 pools;
+# the prebuilt addon is copied from the already-restored node_modules. No npm
+# registry auth is needed.
+#
+# Steps:
+#   1. AzureCLI@2 to fetch the SPN credentials for the CDN storage account —
+#      skipped on non-publish runs (no CDN write to auth for).
+#   2. Run `node build/dictation-runtime/produce.ts`. Always stamps; uploads
+#      only on publish.
+steps:
+  - task: AzureCLI@2
+    displayName: "Dictation runtime: fetch CDN credentials"
+    condition: and(succeeded(), eq(lower(variables['VSCODE_PUBLISH']), 'true'))
+    inputs:
+      azureSubscription: vscode
+      scriptType: pscore
+      scriptLocation: inlineScript
+      addSpnToEnvironment: true
+      inlineScript: |
+        Write-Host "##vso[task.setvariable variable=AZURE_TENANT_ID]$env:tenantId"
+        Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_ID]$env:servicePrincipalId"
+        Write-Host "##vso[task.setvariable variable=AZURE_ID_TOKEN;issecret=true]$env:idToken"
+
+  - ${{ if eq(parameters.vscodePlatform, 'win32') }}:
+    - powershell: |
+        . build/azure-pipelines/win32/exec.ps1
+        $ErrorActionPreference = "Stop"
+        exec { node build/dictation-runtime/produce.ts --vscode-platform=${{ parameters.vscodePlatform }} --arch=$(VSCODE_ARCH) }
+      env:
+        DICTATION_RUNTIME_RESULTS_FILE: $(Build.SourcesDirectory)/.build/dictation-runtime/${{ parameters.vscodePlatform }}-$(VSCODE_ARCH).json
+        AZURE_STORAGE_ACCOUNT: vscodeweb
+        AZURE_TENANT_ID: $(AZURE_TENANT_ID)
+        AZURE_CLIENT_ID: $(AZURE_CLIENT_ID)
+        AZURE_ID_TOKEN: $(AZURE_ID_TOKEN)
+      displayName: "Dictation runtime: build + upload"
+
+  - ${{ if ne(parameters.vscodePlatform, 'win32') }}:
+    - script: |
+        set -e
+        node build/dictation-runtime/produce.ts --vscode-platform=${{ parameters.vscodePlatform }} --arch=$(VSCODE_ARCH)
+      env:
+        DICTATION_RUNTIME_RESULTS_FILE: $(Build.SourcesDirectory)/.build/dictation-runtime/${{ parameters.vscodePlatform }}-$(VSCODE_ARCH).json
+        AZURE_STORAGE_ACCOUNT: vscodeweb
+        AZURE_TENANT_ID: $(AZURE_TENANT_ID)
+        AZURE_CLIENT_ID: $(AZURE_CLIENT_ID)
+        AZURE_ID_TOKEN: $(AZURE_ID_TOKEN)
+      displayName: "Dictation runtime: build + upload"

build/azure-pipelines/darwin/steps/product-build-darwin-compile.yml

@@ -142,6 +142,10 @@ steps:
     parameters:
       vscodePlatform: darwin
 
+  - template: ../../common/dictation-runtime-produce.yml@self
+    parameters:
+      vscodePlatform: darwin
+
   - script: npx deemon --detach --wait -- node build/azure-pipelines/common/downloadCopilotVsix.ts
     env:
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)

build/azure-pipelines/linux/steps/product-build-linux-compile.yml

@@ -190,6 +190,10 @@ steps:
       parameters:
         vscodePlatform: linux
 
+    - template: ../../common/dictation-runtime-produce.yml@self
+      parameters:
+        vscodePlatform: linux
+
   - script: npx deemon --detach --wait -- node build/azure-pipelines/common/downloadCopilotVsix.ts
     env:
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)

build/azure-pipelines/win32/steps/product-build-win32-compile.yml

@@ -131,6 +131,10 @@ steps:
     parameters:
       vscodePlatform: win32
 
+  - template: ../../common/dictation-runtime-produce.yml@self
+    parameters:
+      vscodePlatform: win32
+
   - pwsh: npx deemon --detach --wait -- node build/azure-pipelines/common/downloadCopilotVsix.ts
     env:
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)