Update VS Code LLM integration

.github/workflows/lint.yml

@@ -19,7 +19,7 @@ jobs:
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           # go.mod's directive, not 'stable': golangci-lint is pinned below
-          # v2.13.0 (see the version comment further down), and that older
+          # (see the version comment further down), and the pinned
           # release's bundled type-checker cannot parse the newer Go
           # toolchain's stdlib (e.g. a generic-method signature in
           # math/rand/v2 under Go 1.27), so linting must run on the Go
@@ -45,12 +45,9 @@ jobs:
             ${{ runner.os }}-go-build-
 
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
-          # Pin to a known-good release: v2.13.0 bundles honnef.co/go/tools
-          # v0.8.0-rc.1, whose nilness analyzer panics ("unhandled builtin
-          # recover") analyzing github.com/getsentry/sentry-go. Unpin once
-          # upstream ships a fixed release.
-          version: v2.12.2
+          # Pin to a known-good release so lint behavior is reproducible.
+          version: v2.13.2
           # Enable golangci-lint's built-in caching (removes skip-cache: true)
           args: --timeout=5m

cmd/thv-operator/controllers/mcpgroup_controller.go

@@ -285,6 +285,7 @@ func (r *MCPGroupReconciler) handleDeletion(ctx context.Context, mcpGroup *mcpv1
 		if err := r.Update(ctx, mcpGroup); err != nil {
 			if errors.IsConflict(err) {
 				// Requeue to retry with fresh data
+				//nolint:staticcheck // Requeue preserves the controller's rate-limited conflict retry behavior.
 				return ctrl.Result{Requeue: true}, nil
 			}
 			ctxLogger.Error(err, "Failed to remove finalizer")

cmd/thv-operator/controllers/mcpremoteproxy_controller.go

@@ -557,6 +557,7 @@ func (r *MCPRemoteProxyReconciler) ensureDeployment(
 			ctxLogger.Error(err, "Failed to update Deployment")
 			return ctrl.Result{}, err
 		}
+		//nolint:staticcheck // Requeue preserves the controller's existing rate-limited update behavior.
 		return ctrl.Result{Requeue: true}, nil
 	}
 
@@ -608,6 +609,7 @@ func (r *MCPRemoteProxyReconciler) ensureService(
 			ctxLogger.Error(err, "Failed to update Service")
 			return ctrl.Result{}, err
 		}
+		//nolint:staticcheck // Requeue preserves the controller's existing rate-limited update behavior.
 		return ctrl.Result{Requeue: true}, nil
 	}
 

cmd/thv-operator/controllers/mcpremoteproxy_reconciler_test.go

@@ -939,7 +939,8 @@ func TestMCPRemoteProxy_ValidateAuthzPrimaryUpstreamProviderIgnored(t *testing.T
 			authzConfig: &mcpv1beta1.AuthzConfigRef{
 				Type: mcpv1beta1.AuthzConfigTypeInline,
 				Inline: &mcpv1beta1.InlineAuthzConfig{
-					Policies:                []string{`permit(principal, action, resource);`},
+					Policies: []string{`permit(principal, action, resource);`},
+					//nolint:staticcheck // Exercises backward compatibility for the deprecated field.
 					PrimaryUpstreamProvider: "okta",
 				},
 			},

cmd/thv-operator/controllers/mcpserver_authz_test.go

@@ -355,7 +355,8 @@ func TestValidateAuthzPrimaryUpstreamProviderIgnored(t *testing.T) {
 			authzConfig: &mcpv1beta1.AuthzConfigRef{
 				Type: mcpv1beta1.AuthzConfigTypeInline,
 				Inline: &mcpv1beta1.InlineAuthzConfig{
-					Policies:                []string{`permit(principal, action, resource);`},
+					Policies: []string{`permit(principal, action, resource);`},
+					//nolint:staticcheck // Exercises the advisory emitted for the deprecated field.
 					PrimaryUpstreamProvider: "okta",
 				},
 			},

cmd/thv-operator/controllers/mcpserver_controller.go

@@ -288,6 +288,7 @@ func (r *MCPServerReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
 		return ctrl.Result{}, err
 	} else if shouldTriggerRestart {
 		// Return and requeue to avoid double-processing after triggering restart
+		//nolint:staticcheck // Requeue preserves the controller's existing rate-limited update behavior.
 		return ctrl.Result{Requeue: true}, nil
 	}
 
@@ -513,6 +514,7 @@ func (r *MCPServerReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
 			return ctrl.Result{}, err
 		}
 		// Deployment created successfully - return and requeue
+		//nolint:staticcheck // Requeue preserves the controller's existing rate-limited update behavior.
 		return ctrl.Result{Requeue: true}, nil
 	} else if err != nil {
 		ctxLogger.Error(err, "Failed to get Deployment")
@@ -533,6 +535,7 @@ func (r *MCPServerReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
 			return ctrl.Result{}, err
 		}
 		// Spec updated - return and requeue
+		//nolint:staticcheck // Requeue preserves the controller's existing rate-limited update behavior.
 		return ctrl.Result{Requeue: true}, nil
 	}
 
@@ -554,6 +557,7 @@ func (r *MCPServerReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
 			return ctrl.Result{}, err
 		}
 		// Service created successfully - return and requeue
+		//nolint:staticcheck // Requeue preserves the controller's existing rate-limited create behavior.
 		return ctrl.Result{Requeue: true}, nil
 	} else if err != nil {
 		ctxLogger.Error(err, "Failed to get Service")
@@ -612,6 +616,7 @@ func (r *MCPServerReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
 			return ctrl.Result{}, err
 		}
 		// Spec updated - return and requeue
+		//nolint:staticcheck // Requeue preserves the controller's existing rate-limited update behavior.
 		return ctrl.Result{Requeue: true}, nil
 	}
 
@@ -632,6 +637,7 @@ func (r *MCPServerReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
 			return ctrl.Result{}, err
 		}
 		// Spec updated - return and requeue
+		//nolint:staticcheck // Requeue preserves the controller's existing rate-limited update behavior.
 		return ctrl.Result{Requeue: true}, nil
 	}
 

cmd/thv-operator/controllers/virtualmcpserver_controller_test.go

@@ -3530,7 +3530,8 @@ func TestVirtualMCPServerValidateAuthzUpstreamAvailable(t *testing.T) {
 		return &mcpv1beta1.AuthzConfigRef{
 			Type: "inline",
 			Inline: &mcpv1beta1.InlineAuthzConfig{
-				Policies:                []string{`permit(principal, action, resource);`},
+				Policies: []string{`permit(principal, action, resource);`},
+				//nolint:staticcheck // Exercises backward compatibility for the deprecated field.
 				PrimaryUpstreamProvider: primary,
 			},
 		}
@@ -3829,7 +3830,8 @@ func TestVirtualMCPServerValidateAuthzUpstreamAvailable_DeprecationEvent(t *test
 	inlineAuthzRefWithDeprecatedPrimary := &mcpv1beta1.AuthzConfigRef{
 		Type: "inline",
 		Inline: &mcpv1beta1.InlineAuthzConfig{
-			Policies:                []string{`permit(principal, action, resource);`},
+			Policies: []string{`permit(principal, action, resource);`},
+			//nolint:staticcheck // Exercises backward compatibility for the deprecated field.
 			PrimaryUpstreamProvider: "okta",
 		},
 	}

cmd/thv-operator/pkg/vmcpconfig/converter_test.go

@@ -2127,7 +2127,8 @@ func TestConvertIncomingAuth_PrimaryUpstreamProvider(t *testing.T) {
 			authzConfig: &mcpv1beta1.AuthzConfigRef{
 				Type: "inline",
 				Inline: &mcpv1beta1.InlineAuthzConfig{
-					Policies:                []string{`permit(principal, action, resource);`},
+					Policies: []string{`permit(principal, action, resource);`},
+					//nolint:staticcheck // Exercises conversion of the deprecated field.
 					PrimaryUpstreamProvider: "okta",
 				},
 			},
@@ -2162,7 +2163,8 @@ func TestConvertIncomingAuth_PrimaryUpstreamProvider(t *testing.T) {
 			authzConfig: &mcpv1beta1.AuthzConfigRef{
 				Type: "inline",
 				Inline: &mcpv1beta1.InlineAuthzConfig{
-					Policies:                []string{`permit(principal, action, resource);`},
+					Policies: []string{`permit(principal, action, resource);`},
+					//nolint:staticcheck // Exercises conversion of the deprecated field.
 					PrimaryUpstreamProvider: "github",
 				},
 			},
@@ -2182,7 +2184,8 @@ func TestConvertIncomingAuth_PrimaryUpstreamProvider(t *testing.T) {
 			authzConfig: &mcpv1beta1.AuthzConfigRef{
 				Type: "inline",
 				Inline: &mcpv1beta1.InlineAuthzConfig{
-					Policies:                []string{`permit(principal, action, resource);`},
+					Policies: []string{`permit(principal, action, resource);`},
+					//nolint:staticcheck // Exercises conversion of the deprecated field.
 					PrimaryUpstreamProvider: "okta",
 				},
 			},

cmd/thv/app/llm.go

@@ -374,7 +374,10 @@ func oidcLogin(ctx context.Context, cfg *llm.Config, skipBrowser bool) error {
 	if err != nil {
 		return fmt.Errorf("building token source: %w", err)
 	}
-	_, err = ts.Token(ctx)
+	token, err := ts.Token(ctx)
+	if err == nil {
+		cfg.SetDiscoveryAccessToken(token)
+	}
 	return err
 }
 

pkg/authserver/spiffe_trust_test.go

@@ -86,19 +86,19 @@ func TestValidateSPIFFETrust(t *testing.T) {
 
 	valid := func() ([]SPIFFETrustDomainRunConfig, *InboundGrantsRunConfig) {
 		return []SPIFFETrustDomainRunConfig{{
-				Name:         "production",
-				TrustDomain:  "example.org",
-				Methods:      []SPIFFEAuthenticationMethod{SPIFFEAuthenticationMethodX509, SPIFFEAuthenticationMethodJWT},
-				BundleSource: validWorkloadAPIBundleSource(),
-			}}, &InboundGrantsRunConfig{SPIFFEClientAuth: []SPIFFEClientAuthRunConfig{{
-				TrustDomainRef:   "production",
-				PrincipalPattern: "spiffe://example.org/ns/default/*",
-				ClientID:         "agent-client",
-				Methods:          []SPIFFEAuthenticationMethod{SPIFFEAuthenticationMethodX509},
-				Audiences:        []string{"https://mcp.example.org/resource"},
-				Scopes:           []string{"openid"},
-				GrantTypes:       []string{SPIFFEGrantTypeTokenExchange},
-			}}}
+			Name:         "production",
+			TrustDomain:  "example.org",
+			Methods:      []SPIFFEAuthenticationMethod{SPIFFEAuthenticationMethodX509, SPIFFEAuthenticationMethodJWT},
+			BundleSource: validWorkloadAPIBundleSource(),
+		}}, &InboundGrantsRunConfig{SPIFFEClientAuth: []SPIFFEClientAuthRunConfig{{
+			TrustDomainRef:   "production",
+			PrincipalPattern: "spiffe://example.org/ns/default/*",
+			ClientID:         "agent-client",
+			Methods:          []SPIFFEAuthenticationMethod{SPIFFEAuthenticationMethodX509},
+			Audiences:        []string{"https://mcp.example.org/resource"},
+			Scopes:           []string{"openid"},
+			GrantTypes:       []string{SPIFFEGrantTypeTokenExchange},
+		}}}
 	}
 
 	tests := []struct {

pkg/client/config.go

@@ -425,19 +425,15 @@ var supportedClientIntegrations = []clientAppConfig{
 		SupportsSkills:    true,
 		SkillsGlobalPath:  []string{".copilot", skillsDirName},
 		SkillsProjectPath: []string{".github", skillsDirName},
-		// LLM gateway: patches settings.json (same dir as mcp.json, different file)
-		LLMGatewayMode:     llmgateway.ModeProxy,
-		LLMSettingsFile:    "settings.json",
+		// VS Code reads custom LLM provider groups from chatLanguageModels.json.
+		LLMGatewayMode:     llmgateway.ModeVSCode,
+		LLMSettingsFile:    "chatLanguageModels.json",
 		LLMSettingsRelPath: []string{"Code - Insiders", "User"},
 		LLMSettingsPlatformPrefix: map[Platform][]string{
 			PlatformLinux:   {".config"},
 			PlatformDarwin:  {"Library", "Application Support"},
 			PlatformWindows: {"AppData", "Roaming"},
 		},
-		LLMGatewayKeys: []LLMGatewayKeySpec{
-			{JSONPointer: "/github.copilot.advanced.serverUrl", ValueField: "ProxyBaseURL"},
-			{JSONPointer: "/github.copilot.advanced.apiKey", ValueField: "PlaceholderAPIKey"},
-		},
 	},
 	{
 		ClientType:   VSCode,
@@ -467,19 +463,15 @@ var supportedClientIntegrations = []clientAppConfig{
 		SupportsSkills:    true,
 		SkillsGlobalPath:  []string{".copilot", skillsDirName},
 		SkillsProjectPath: []string{".github", skillsDirName},
-		// LLM gateway: patches settings.json (same dir as mcp.json, different file)
-		LLMGatewayMode:     llmgateway.ModeProxy,
-		LLMSettingsFile:    "settings.json",
+		// VS Code reads custom LLM provider groups from chatLanguageModels.json.
+		LLMGatewayMode:     llmgateway.ModeVSCode,
+		LLMSettingsFile:    "chatLanguageModels.json",
 		LLMSettingsRelPath: []string{"Code", "User"},
 		LLMSettingsPlatformPrefix: map[Platform][]string{
 			PlatformLinux:   {".config"},
 			PlatformDarwin:  {"Library", "Application Support"},
 			PlatformWindows: {"AppData", "Roaming"},
 		},
-		LLMGatewayKeys: []LLMGatewayKeySpec{
-			{JSONPointer: "/github.copilot.advanced.serverUrl", ValueField: "ProxyBaseURL"},
-			{JSONPointer: "/github.copilot.advanced.apiKey", ValueField: "PlaceholderAPIKey"},
-		},
 	},
 	{
 		ClientType:           Cursor,

pkg/client/llm_gateway.go

@@ -52,6 +52,9 @@ func (cm *ClientManager) ConfigureLLMGateway(clientType ClientApp, cfg llmgatewa
 	if appCfg.LLMGatewayMode == llmgateway.ModeCodexAuth {
 		return cm.configureCodexAuth(appCfg, cfg)
 	}
+	if appCfg.LLMGatewayMode == llmgateway.ModeVSCode {
+		return cm.configureVSCode(appCfg, cfg)
+	}
 
 	path := cm.buildLLMSettingsPath(appCfg)
 
@@ -188,6 +191,9 @@ func (cm *ClientManager) RevertLLMGateway(clientType ClientApp, configPath strin
 	if appCfg.LLMGatewayMode == llmgateway.ModeCodexAuth {
 		return cm.revertCodexAuth(appCfg, configPath)
 	}
+	if appCfg.LLMGatewayMode == llmgateway.ModeVSCode {
+		return cm.revertVSCode(appCfg, configPath)
+	}
 
 	return revertJSONPointerGateway(appCfg, configPath)
 }