chore: update vsce to 4 and fix the msal-node advisory (#1927)

## Motivation

Two Dependabot alerts cannot be fixed automatically:

- `@azure/msal-node` [GHSA-xcx6-jx8p-x3h5](GHSA-xcx6-jx8p-x3h5) (fixed in 7.1.0), pulled in by `@vscode/vsce` and `ovsx` through `@azure/identity@4.13.3`.
- `minimatch` [GHSA-g3hv-75wg-m249](GHSA-g3hv-75wg-m249) (affects `>=7.0.0 <11.0.1`, no fixed 10.x release).

## Changes

- Update `@azure/identity` in the lockfile to 4.14.1. It depends on `@azure/msal-node` `^7.1.0`, so `@azure/msal-node` is now 7.2.1. This fixes the msal-node alert without changing any version range in `package.json`.
- Update `@vscode/vsce` from `^3.6.0` to `^4.1.0`. `ovsx@1.3.0` already depends on vsce 4, so two vsce trees were installed. vsce 4 needs Node.js 22 or later (CI uses 24). It replaces glob with tinyglobby and no longer depends on `keytar`, so `keytar` is removed from `allowBuilds`. The lockfile loses about 1,000 lines.
- Remove `src/test/suite/index.ts`. It is the old Mocha runner from before `@vscode/test-cli`, and `.vscode-test.mjs` does not use it. The root `glob` dev dependency was only used there, so it is removed too.
- TypeScript 7 defaults `types` to `[]`. The removed runner's `import Mocha from 'mocha'` was what loaded the Mocha globals (`suite`, `test`) for the other test files, so `tsconfig.json` now lists `mocha` and `node` in `types`.

No CHANGELOG entry, as this is an internal change.

## Notes: minimatch alert stays open

This PR does not fix the minimatch alert, and it cannot be fixed with an `overrides` entry:

- `vscode-languageclient` (10.1.2, and also the latest 11.0.0) depends on `minimatch ^10.2.6` and calls `Minimatch#makeRe()`. minimatch 11 removes `makeRe()`, so forcing 11 would throw a `TypeError` at runtime in the bundled extension. Upstream tracks this in `microsoft/vscode-languageserver-node#1938` (the fix PR `microsoft/vscode-languageserver-node#1935` currently fails CI).
- glob 10 and 13 (via mocha, `@vscode/test-cli` and `test-exclude`) need glob 14 for minimatch 11, so the dev tools would need several more overrides. The alert would still stay open because of `vscode-languageclient`.

The vulnerable code (`firstPhasePreProcess`) only runs with `optimizationLevel >= 2`. `vscode-languageclient` uses the default level 1, and its patterns come from the R language server. glob uses level 2, but only with the repository's own test globs. Once `vscode-languageclient` releases a version on minimatch 11, the alert should be fixable with a normal update.


## Update: debugging extension tests

The **Extension Tests** launch configuration in `.vscode/launch.json` still pointed at the removed runner (`out/test/suite/index`), so it could no longer run any tests. It now uses js-debug's `testConfiguration` option (VS Code 1.87+) with `.vscode-test.mjs`:

- After the `pretest` pre-launch task, js-debug runs `vscode-test --list-configuration`, asks which configuration to run, and launches `@vscode/test-cli`'s own runner with that configuration's files, Mocha options and launch arguments. F5 debugging works as before, without a second hand-written runner or the `glob` dependency.
- This is also more accurate than the old runner, which ran every `src/test/suite/` file in one window without `out/test/common/extensionSetup.js` or the per-suite profiles.
- Unlike the CLI, it runs in the current VS Code and does not install extension dependencies, so R Syntax must already be installed. `CONTRIBUTING.md` says this.

[Extension Test Runner](https://marketplace.visualstudio.com/items?itemName=ms-vscode.extension-test-runner) (`ms-vscode.extension-test-runner`) is added to the workspace recommendations as an optional way to run or debug individual tests from the Testing view. Neither the debugger nor the CLI requires it.

The `sess-install-tasks` configuration is removed. Its only test (`src/test/integration/sessInstall.test.ts`) was removed in #1856, so it ran 0 tests. Its temporary workspace was also deleted on process exit, so it was gone when a separate `--list-configuration` process (as used by the debugger and Extension Test Runner) exited.

## Update: working-directory-independent test profiles

Test profile directories in `.vscode-test.mjs` now resolve relative to the configuration file's `import.meta.url`, using `fileURLToPath` for native filesystem paths. js-debug can load the configuration from a working directory outside the checkout, including the VS Code installation directory on Windows. Profiles now consistently stay under the checkout's `.vscode-test/user-data` directory.

Author: eitsupi

.vscode-test.mjs

@@ -1,18 +1,7 @@
 import { defineConfig } from '@vscode/test-cli';
-import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { mkdirSync, writeFileSync } from 'node:fs';
 import * as path from 'node:path';
-
-// A separate window keeps the real multi-folder task tests isolated from mocks.
-const taskRoot = mkdtempSync(path.join(tmpdir(), 'vscode-r sess tasks '));
-for (const project of ['project A', 'project B']) {
-	mkdirSync(path.join(taskRoot, project));
-}
-const workspaceFile = path.join(taskRoot, 'projects.code-workspace');
-writeFileSync(workspaceFile, JSON.stringify({
-	folders: [{ path: 'project A' }, { path: 'project B' }]
-}));
-process.on('exit', () => rmSync(taskRoot, { recursive: true, force: true }));
+import { fileURLToPath } from 'node:url';
 
 const common = {
 	mocha: {
@@ -26,7 +15,7 @@ const common = {
 // command tests also need a fresh window after fixtures create terminals and
 // webviews. The real Interactive suite has its own window with the LSP enabled.
 function testProfile(name, lspEnabled) {
-	const directory = path.resolve('.vscode-test/user-data', name);
+	const directory = fileURLToPath(new URL(`.vscode-test/user-data/${name}/`, import.meta.url));
 	mkdirSync(path.join(directory, 'User'), { recursive: true });
 	writeFileSync(path.join(directory, 'User/settings.json'), JSON.stringify({ 'r.lsp.enabled': lspEnabled }));
 	// Unattended runs can be occluded by another app. Keep browser paint and
@@ -62,15 +51,5 @@ export default defineConfig([
 		label: 'interactive-integration',
 		files: 'out/test/suite/interactiveEditor.test.js',
 		launchArgs: testProfile('interactive-tests', true)
-	},
-	{
-		...common,
-		label: 'sess-install-tasks',
-		files: 'out/test/integration/**/*.test.js',
-		workspaceFolder: workspaceFile,
-		launchArgs: ['--disable-workspace-trust'],
-		// Let each project's .Rprofile select its library, even when the caller
-		// runs from an existing managed R terminal with R_PROFILE_USER set.
-		env: { R_PROFILE_USER: undefined, VSCODE_R_SESS_PKG_PATH: undefined, VSCODE_R_SESS_REPO: undefined }
 	}
 ]);

.vscode/extensions.json

@@ -1,3 +1,3 @@
 {
-    "recommendations": ["oxc.oxc-vscode", "TypeScriptTeam.native-preview"]
+    "recommendations": ["oxc.oxc-vscode", "TypeScriptTeam.native-preview", "ms-vscode.extension-test-runner"]
 }

.vscode/launch.json

@@ -39,10 +39,7 @@
       "type": "extensionHost",
       "request": "launch",
       "runtimeExecutable": "${execPath}",
-      "args": [
-        "--extensionDevelopmentPath=${workspaceFolder}",
-        "--extensionTestsPath=${workspaceFolder}/out/test/suite/index"
-      ],
+      "testConfiguration": "${workspaceFolder}/.vscode-test.mjs",
       "outFiles": [
         "${workspaceFolder}/dist/**/*.js",
         "${workspaceFolder}/out/**/*.js"

CONTRIBUTING.md

@@ -17,7 +17,7 @@ If a command reports `pnpm: command not found`, ensure pnpm's installation direc
 2. Select **Launch Extension** in Run and Debug, then press **F5**. The pre-launch task runs `pnpm run compile` to build the extension and webviews in `dist`, including source maps for TypeScript breakpoints.
 3. Open an R file or run an R command in the Extension Development Host to activate vscode-R. Ensure the **R Syntax** extension (`REditorSupport.r-syntax`) is installed and enabled there.
 
-For continuous rebuilding, run `pnpm run watch`. `pnpm run build` additionally installs the bundled `sess` R package; this is not required just to launch the extension debugger. **Extension Tests** builds both the bundle and the TypeScript test files before launching.
+For continuous rebuilding, run `pnpm run watch`. `pnpm run build` additionally installs the bundled `sess` R package; this is not required just to launch the extension debugger.
 
 VS Code 1.140.0 bundles [JavaScript Debugger 1.140.0](https://github.com/microsoft/vscode-js-debug/releases/tag/v1.140.0), which fixes the [extension host attach regression in VS Code 1.139](https://github.com/microsoft/vscode-js-debug/issues/2420). Use the built-in **JavaScript Debugger** on VS Code 1.140.0 or newer. If you previously used **JavaScript Debugger Nightly**, disable Nightly, re-enable the built-in debugger (`ms-vscode.js-debug`) in the Extensions view, and run **Developer: Reload Window**.
 
@@ -100,17 +100,31 @@ VSCR_TEST_TMUX=1 pnpm exec mocha out/test/node/interactiveRuntime.test.js --ui t
 The provider is arf. `ARF_PATH` selects its executable; `VSCR_TEST_STATIC=1` selects standard graphics. The tmux variant needs tmux and exercises a real supervised agent, as Linux CI does. These variables can be combined. Check skipped tests when assessing coverage: a missing optional runtime or package is not a verified pass for that feature.
 
 `pnpm run test` prepares the bundle and test files, runs `src/test/node/` directly
-in Node/Mocha, then runs the extension-host suites and isolated sess task tests.
+in Node/Mocha, then runs the extension-host suites.
 `pnpm run test:interactive` prepares and runs only the Node suites, including
 supervision. After preparing once with `pnpm run pretest`, use `pnpm run test:node`
-and `pnpm run test:extension` to rerun either layer without rebuilding. The
-**Extension Tests** debugger configuration runs only `src/test/suite/`; use the
-CLI for the isolated multi-folder sess task tests.
+and `pnpm run test:extension` to rerun either layer without rebuilding.
+
+To debug extension-host tests, select **Extension Tests** in Run and Debug and
+press **F5**. The pre-launch task runs `pnpm run pretest`, and the debugger then
+asks which `.vscode-test.mjs` configuration to run (`provider-tests`,
+`editor-command-tests` or `interactive-integration`). One launch runs only the
+selected configuration, with the same files, Mocha options and launch arguments
+as `pnpm run test:extension`. Unlike the CLI, it runs in the current VS Code and
+does not install extension dependencies, so the **R Syntax** extension must
+already be installed. `interactive-integration` also needs the R and arf setup
+described above.
+
+Alternatively, the optional
+[Extension Test Runner](https://marketplace.visualstudio.com/items?itemName=ms-vscode.extension-test-runner)
+extension (`ms-vscode.extension-test-runner`, in the workspace recommendations)
+lists the same configurations in the Testing view, so individual tests or suites
+can be run or debugged from there after `pnpm run pretest`.
 
 PR CI, main pushes and manual runs execute the full supported suites on every
-OS. Linux and macOS run the same Node, Interactive editor and isolated sess task
-tests, including the actual VS Code Electron runtime check with no Node executable
-on PATH and successful session creation using the default VS Code runtime.
+OS. Linux and macOS run the same Node and Interactive editor tests, including
+the actual VS Code Electron runtime check with no Node executable on PATH and
+successful session creation using the default VS Code runtime.
 Windows skips the Interactive runtime/editor suites because persistent
 supervision currently requires Linux/macOS. Linux additionally runs the tmux launcher survival case
 once with tmux enabled and uses Xvfb for extension-host tests. Source/bootstrap
@@ -123,7 +137,7 @@ pnpm run pretest
 pnpm exec vscode-test --run out/test/suite/interactiveEditor.test.js
 ```
 
-On headless Linux, run the editor command under `xvfb-run -a`. The test configuration installs R Syntax in the test profile. [runtime-lifecycle.cjs](src/test/examples/README.md#editor-runtime-lifecycle) separately checks persistence across full application exit and different editor versions. Use it with the minimum VS Code version from `package.json` and current stable when changing runtime launch or reconnection.
+On headless Linux, run the editor command under `xvfb-run -a`. When run from the CLI, the test configuration installs R Syntax in the test profile. [runtime-lifecycle.cjs](src/test/examples/README.md#editor-runtime-lifecycle) separately checks persistence across full application exit and different editor versions. Use it with the minimum VS Code version from `package.json` and current stable when changing runtime launch or reconnection.
 
 ### Browser renderer
 

package.json

@@ -2626,10 +2626,9 @@
     "@types/winreg": "^1.2.36",
     "@vscode/test-cli": "^0.0.15",
     "@vscode/test-electron": "^3.1.0",
-    "@vscode/vsce": "^3.6.0",
+    "@vscode/vsce": "^4.1.0",
     "esbuild": "^0.28.1",
     "git-cliff": "^2.12.0",
-    "glob": "^13.0.6",
     "mocha": "^12.0.3",
     "ovsx": "^1.3.0",
     "oxfmt": "0.73.0",