aws · chunqilu · Jan 27, 2026 · Jan 26, 2026
@@ -0,0 +1,158 @@
+Index: third-party-src/src/bootstrap-fork.ts
+===================================================================
+--- third-party-src.orig/src/bootstrap-fork.ts
++++ third-party-src/src/bootstrap-fork.ts
+@@ -123,7 +123,7 @@ function pipeLoggingToParent(): void {
+
+ 		Object.defineProperty(stream, 'write', {
+ 			set: () => { },
+-			get: () => (chunk: string | Buffer | Uint8Array, encoding: BufferEncoding | undefined, callback: ((err?: Error | undefined) => void) | undefined) => {
++			get: () => (chunk: string | Buffer | Uint8Array, encoding: BufferEncoding | undefined, callback: ((err?: Error | null) => void) | undefined) => {
+ 				buf += chunk.toString(encoding);
+ 				const eol = buf.length > MAX_STREAM_BUFFER_LENGTH ? buf.length : buf.lastIndexOf('\n');
+ 				if (eol !== -1) {
+Index: third-party-src/src/vs/platform/environment/test/node/nativeModules.integrationTest.ts
+===================================================================
+--- third-party-src.orig/src/vs/platform/environment/test/node/nativeModules.integrationTest.ts
++++ third-party-src/src/vs/platform/environment/test/node/nativeModules.integrationTest.ts
+@@ -120,6 +120,7 @@ flakySuite('Native Modules (all platforms)', () => {
+ 		const proxyAgent = await import('@vscode/proxy-agent');
+ 		// This call will load `@vscode/proxy-agent` which is a native module that we want to test on Windows
+ 		const windowsCerts = await proxyAgent.loadSystemCertificates({
++			loadSystemCertificatesFromNode: () => undefined,
+ 			log: {
+ 				trace: () => { },
+ 				debug: () => { },
+Index: third-party-src/src/vs/platform/request/common/request.ts
+===================================================================
+--- third-party-src.orig/src/vs/platform/request/common/request.ts
++++ third-party-src/src/vs/platform/request/common/request.ts
+@@ -146,8 +146,10 @@ export const USER_LOCAL_AND_REMOTE_SETTINGS = [
+ 	'http.proxyAuthorization',
+ 	'http.proxySupport',
+ 	'http.systemCertificates',
++	'http.systemCertificatesNode',
+ 	'http.experimental.systemCertificatesV2',
+ 	'http.fetchAdditionalSupport',
++	'http.experimental.networkInterfaceCheckInterval',
+ ];
+
+ let proxyConfiguration: IConfigurationNode[] = [];
+@@ -249,6 +251,13 @@ function registerProxyConfigurations(useHostProxy = true, useHostProxyDefault =
+ 					markdownDescription: localize('systemCertificates', "Controls whether CA certificates should be loaded from the OS. On Windows and macOS, a reload of the window is required after turning this off. When during [remote development](https://aka.ms/vscode-remote) the {0} setting is disabled this setting can be configured in the local and the remote settings separately.", '`#http.useLocalProxyConfiguration#`'),
+ 					restricted: true
+ 				},
++				'http.systemCertificatesNode': {
++					type: 'boolean',
++					tags: ['experimental'],
++					default: false,
++					markdownDescription: localize('systemCertificatesNode', "Controls whether system certificates should be loaded using Node.js built-in support. Reload the window after changing this setting. When during [remote development](https://aka.ms/vscode-remote) the {0} setting is disabled this setting can be configured in the local and the remote settings separately.", '`#http.useLocalProxyConfiguration#`'),
++					restricted: true
++				},
+ 				'http.experimental.systemCertificatesV2': {
+ 					type: 'boolean',
+ 					tags: ['experimental'],
+@@ -261,6 +270,14 @@ function registerProxyConfigurations(useHostProxy = true, useHostProxyDefault =
+ 					default: true,
+ 					markdownDescription: localize('fetchAdditionalSupport', "Controls whether Node.js' fetch implementation should be extended with additional support. Currently proxy support ({1}) and system certificates ({2}) are added when the corresponding settings are enabled. When during [remote development](https://aka.ms/vscode-remote) the {0} setting is disabled this setting can be configured in the local and the remote settings separately.", '`#http.useLocalProxyConfiguration#`', '`#http.proxySupport#`', '`#http.systemCertificates#`'),
+ 					restricted: true
++				},
++				'http.experimental.networkInterfaceCheckInterval': {
++					type: 'number',
++					default: 300,
++					minimum: -1,
++					tags: ['experimental'],
++					markdownDescription: localize('networkInterfaceCheckInterval', "Controls the interval in seconds for checking network interface changes to invalidate the proxy cache. Set to -1 to disable. When during [remote development](https://aka.ms/vscode-remote) the {0} setting is disabled this setting can be configured in the local and the remote settings separately.", '`#http.useLocalProxyConfiguration#`'),
++					restricted: true
+ 				}
+ 			}
+ 		}
+Index: third-party-src/src/vs/platform/request/node/requestService.ts
+===================================================================
+--- third-party-src.orig/src/vs/platform/request/node/requestService.ts
++++ third-party-src/src/vs/platform/request/node/requestService.ts
+@@ -119,15 +119,18 @@ export class RequestService extends AbstractRequestService implements IRequestSe
+
+ 	async loadCertificates(): Promise<string[]> {
+ 		const proxyAgent = await import('@vscode/proxy-agent');
+-		return proxyAgent.loadSystemCertificates({ log: this.logService });
++		return proxyAgent.loadSystemCertificates({
++			loadSystemCertificatesFromNode: () => this.getConfigValue<boolean>('http.systemCertificatesNode', false),
++			log: this.logService,
++		});
+ 	}
+
+-	private getConfigValue<T>(key: string): T | undefined {
++	private getConfigValue<T>(key: string, fallback?: T): T | undefined {
+ 		if (this.machine === 'remote') {
+ 			return this.configurationService.getValue<T>(key);
+ 		}
+ 		const values = this.configurationService.inspect<T>(key);
+-		return values.userLocalValue || values.defaultValue;
++		return values.userLocalValue ?? values.defaultValue ?? fallback;
+ 	}
+ }
+
+Index: third-party-src/src/vs/workbench/api/node/extHostConsoleForwarder.ts
+===================================================================
+--- third-party-src.orig/src/vs/workbench/api/node/extHostConsoleForwarder.ts
++++ third-party-src/src/vs/workbench/api/node/extHostConsoleForwarder.ts
+@@ -47,7 +47,7 @@ export class ExtHostConsoleForwarder extends AbstractExtHostConsoleForwarder {
+
+ 		Object.defineProperty(stream, 'write', {
+ 			set: () => { },
+-			get: () => (chunk: Uint8Array | string, encoding?: BufferEncoding, callback?: (err?: Error) => void) => {
++			get: () => (chunk: Uint8Array | string, encoding?: BufferEncoding, callback?: (err?: Error | null) => void) => {
+ 				if (!this._isMakingConsoleCall) {
+ 					buf += (chunk as any).toString(encoding);
+ 					const eol = buf.length > MAX_STREAM_BUFFER_LENGTH ? buf.length : buf.lastIndexOf('\n');
+Index: third-party-src/src/vs/workbench/api/node/proxyResolver.ts
+===================================================================
+--- third-party-src.orig/src/vs/workbench/api/node/proxyResolver.ts
++++ third-party-src/src/vs/workbench/api/node/proxyResolver.ts
+@@ -53,6 +53,7 @@ export function connectProxyResolver(
+ 		isAdditionalFetchSupportEnabled: () => getExtHostConfigValue<boolean>(configProvider, isRemote, 'http.fetchAdditionalSupport', true),
+ 		addCertificatesV1: () => certSettingV1(configProvider, isRemote),
+ 		addCertificatesV2: () => certSettingV2(configProvider, isRemote),
++		loadSystemCertificatesFromNode: () => getExtHostConfigValue<boolean>(configProvider, isRemote, 'http.systemCertificatesNode', false),
+ 		log: extHostLogService,
+ 		getLogLevel: () => {
+ 			const level = extHostLogService.getLevel();
+@@ -72,16 +73,31 @@ export function connectProxyResolver(
+ 		},
+ 		proxyResolveTelemetry: () => { },
+ 		isUseHostProxyEnabled,
++		getNetworkInterfaceCheckInterval: () => {
++			const intervalSeconds = getExtHostConfigValue<number>(configProvider, isRemote, 'http.experimental.networkInterfaceCheckInterval', 300);
++			return intervalSeconds * 1000;
++		},
+ 		loadAdditionalCertificates: async () => {
++			const useNodeSystemCerts = getExtHostConfigValue<boolean>(configProvider, isRemote, 'http.systemCertificatesNode', false);
+ 			const promises: Promise<string[]>[] = [];
+-			if (initData.remote.isRemote) {
+-				promises.push(loadSystemCertificates({ log: extHostLogService }));
++			if (isRemote) {
++				promises.push(loadSystemCertificates({
++					loadSystemCertificatesFromNode: () => useNodeSystemCerts,
++					log: extHostLogService,
++				}));
+ 			}
+ 			if (loadLocalCertificates) {
+-				extHostLogService.trace('ProxyResolver#loadAdditionalCertificates: Loading certificates from main process');
+-				const certs = extHostWorkspace.loadCertificates(); // Loading from main process to share cache.
+-				certs.then(certs => extHostLogService.trace('ProxyResolver#loadAdditionalCertificates: Loaded certificates from main process', certs.length));
+-				promises.push(certs);
++				if (!isRemote && useNodeSystemCerts) {
++					promises.push(loadSystemCertificates({
++						loadSystemCertificatesFromNode: () => useNodeSystemCerts,
++						log: extHostLogService,
++					}));
++				} else {
++					extHostLogService.trace('ProxyResolver#loadAdditionalCertificates: Loading certificates from main process');
++					const certs = extHostWorkspace.loadCertificates(); // Loading from main process to share cache.
++					certs.then(certs => extHostLogService.trace('ProxyResolver#loadAdditionalCertificates: Loaded certificates from main process', certs.length));
++					promises.push(certs);
++				}
+ 			}
+ 			// Using https.globalAgent because it is shared with proxy.test.ts and mutable.
+ 			if (initData.environment.extensionTestsLocationURI && (https.globalAgent as any).testCertificates?.length) {
@@ -86,6 +86,15 @@ Index: code-editor-src/remote/package.json
 ===================================================================
 --- code-editor-src.orig/remote/package.json
 +++ code-editor-src/remote/package.json
+@@ -8,7 +8,7 @@
+     "@parcel/watcher": "2.5.1",
+     "@vscode/deviceid": "^0.1.1",
+     "@vscode/iconv-lite-umd": "0.7.0",
+-    "@vscode/proxy-agent": "^0.32.0",
++    "@vscode/proxy-agent": "^0.37.0",
+     "@vscode/ripgrep": "^1.15.11",
+     "@vscode/spdlog": "^0.15.2",
+     "@vscode/tree-sitter-wasm": "^0.1.4",
 @@ -29,7 +29,6 @@
      "http-proxy-agent": "^7.0.0",
      "https-proxy-agent": "^7.0.2",

@@ -17,6 +17,7 @@ common/proposed-api.diff
 common/build.diff
 common/integration.diff
 common/replace-gulp-untar.diff
+common/adopt-new-proxy-agent.diff
 web-server/suppress-known-errors-build-integration.diff
 web-server/local-storage.diff
 web-server/base-path.diff

@@ -17,6 +17,7 @@ common/proposed-api.diff
 common/build.diff
 common/integration.diff
 common/replace-gulp-untar.diff
+common/adopt-new-proxy-agent.diff
 web-embedded/readd-workbench.diff
 web-embedded/suppress-known-errors-build-integration.diff
 web-embedded/disable-built-in-walkthroughs-from-c.diff

@@ -17,6 +17,7 @@ common/proposed-api.diff
 common/build.diff
 common/integration.diff
 common/replace-gulp-untar.diff
+common/adopt-new-proxy-agent.diff
 web-embedded/readd-workbench.diff
 web-embedded/suppress-known-errors-build-integration.diff
 web-embedded/disable-built-in-walkthroughs-from-c.diff

@@ -17,6 +17,7 @@ common/proposed-api.diff
 common/build.diff
 common/integration.diff
 common/replace-gulp-untar.diff
+common/adopt-new-proxy-agent.diff
 web-server/suppress-known-errors-build-integration.diff
 web-server/local-storage.diff
 web-server/base-path.diff