Test-VSCodeCapabilities.ps1

<#
.SYNOPSIS
    VS Code + GitHub Copilot capability probe for locked-down environments.

.DESCRIPTION
    Read-only diagnostic. Collects:
      Plane 1 - How locked down the VS Code IDE / machine is.
      Plane 2 - Which AI extensions are present (Copilot, Foundry Toolkit, WorkIQ CLI plugin).
      Plane 3 - Whether the machine can reach the inference + tooling endpoints (egress + TLS inspection).

    It makes NO changes, installs nothing, and collects NO secrets. Proxy credentials
    are masked. It only HEAD/GET-probes the endpoints listed in endpoints.json.

    Some checks (the Copilot model picker, sign-in state, inference-time web access)
    can only be seen in the UI - those are covered by MANUAL-CHECKS.md.

.PARAMETER OutputPath
    Folder for the report files. Defaults to a 'results' folder next to this script.

.PARAMETER EndpointsFile
    JSON file listing endpoints to probe. Defaults to endpoints.json next to this script.
    If missing, a built-in default list is used.

.PARAMETER TimeoutSeconds
    Per-endpoint network timeout. Default 8.

.PARAMETER SkipNetwork
    Skip all network egress tests (collect IDE/lockdown signals only).

.EXAMPLE
    powershell -ExecutionPolicy Bypass -File .\Test-VSCodeCapabilities.ps1

.NOTES
    Author: UngerAI   |   Read-only   |   Works on Windows PowerShell 5.1 and PowerShell 7+
#>
#Requires -Version 5.1
[CmdletBinding()]
param(
    [string]$OutputPath,
    [string]$EndpointsFile,
    [int]$TimeoutSeconds = 8,
    [switch]$SkipNetwork
)

$ErrorActionPreference = 'Continue'
$ProgressPreference    = 'SilentlyContinue'

# ----------------------------------------------------------------------------
# Base paths (handle being run via file OR pasted/Invoke-Expression)
# ----------------------------------------------------------------------------
$baseDir = if ($PSScriptRoot) { $PSScriptRoot } else { (Get-Location).Path }
if (-not $OutputPath)    { $OutputPath    = Join-Path $baseDir 'results' }
if (-not $EndpointsFile) { $EndpointsFile = Join-Path $baseDir 'endpoints.json' }

# ----------------------------------------------------------------------------
# OS / edition detection (works on 5.1 where $IsWindows does not exist)
# ----------------------------------------------------------------------------
$isWin = $false
if ($PSVersionTable.PSVersion.Major -lt 6) { $isWin = $true }
elseif (Get-Variable -Name IsWindows -ErrorAction SilentlyContinue) { $isWin = [bool]$IsWindows }

$isMac = $false
if ($PSVersionTable.PSVersion.Major -ge 6 -and (Get-Variable -Name IsMacOS -ErrorAction SilentlyContinue)) { $isMac = [bool]$IsMacOS }

$userHome = if ($isWin) { $env:USERPROFILE } else { $HOME }
if (-not $userHome) { $userHome = [Environment]::GetFolderPath('UserProfile') }

# Best-effort: enable modern TLS so probes are not false-negatives on 5.1
try {
    [Net.ServicePointManager]::SecurityProtocol = `
        [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
} catch {}

# ----------------------------------------------------------------------------
# Console helpers
# ----------------------------------------------------------------------------
function Write-Head([string]$Text) {
    Write-Host ''
    Write-Host ('=' * 72) -ForegroundColor DarkCyan
    Write-Host "  $Text" -ForegroundColor Cyan
    Write-Host ('=' * 72) -ForegroundColor DarkCyan
}
function Write-KV([string]$Key, $Value, [string]$Color = 'Gray') {
    Write-Host ('  {0,-26}' -f $Key) -NoNewline -ForegroundColor DarkGray
    Write-Host (": " + ($Value)) -ForegroundColor $Color
}
function Write-Verdict([string]$Label, [string]$State, [string]$Detail = '') {
    $c = switch ($State) { 'PASS' {'Green'} 'WARN' {'Yellow'} 'FAIL' {'Red'} default {'Gray'} }
    Write-Host ('  [{0,-4}] ' -f $State) -NoNewline -ForegroundColor $c
    Write-Host ('{0}' -f $Label) -NoNewline -ForegroundColor White
    if ($Detail) { Write-Host ("  $Detail") -ForegroundColor DarkGray } else { Write-Host '' }
}

# ----------------------------------------------------------------------------
# JSONC (settings.json may contain // and /* */ comments) tolerant parse
# ----------------------------------------------------------------------------
function Remove-JsonComments([string]$Text) {
    $sb = New-Object System.Text.StringBuilder
    $inStr = $false; $esc = $false; $i = 0; $n = $Text.Length
    while ($i -lt $n) {
        $ch = $Text[$i]; $nx = if ($i + 1 -lt $n) { $Text[$i + 1] } else { [char]0 }
        if ($inStr) {
            [void]$sb.Append($ch)
            if ($esc) { $esc = $false } elseif ($ch -eq '\') { $esc = $true } elseif ($ch -eq '"') { $inStr = $false }
            $i++; continue
        }
        if ($ch -eq '"') { $inStr = $true; [void]$sb.Append($ch); $i++; continue }
        if ($ch -eq '/' -and $nx -eq '/') { while ($i -lt $n -and $Text[$i] -ne "`n") { $i++ }; continue }
        if ($ch -eq '/' -and $nx -eq '*') { $i += 2; while ($i + 1 -lt $n -and -not ($Text[$i] -eq '*' -and $Text[$i + 1] -eq '/')) { $i++ }; $i += 2; continue }
        [void]$sb.Append($ch); $i++
    }
    # Strip trailing commas which settings.json tolerates but ConvertFrom-Json does not
    return ($sb.ToString() -replace ',(\s*[}\]])', '$1')
}
function Read-JsonFile([string]$Path) {
    if (-not (Test-Path -LiteralPath $Path)) { return $null }
    try {
        $raw = Get-Content -LiteralPath $Path -Raw -ErrorAction Stop
        try { return $raw | ConvertFrom-Json -ErrorAction Stop }
        catch { return (Remove-JsonComments $raw) | ConvertFrom-Json -ErrorAction Stop }
    } catch { return $null }
}
function Get-Prop($Obj, [string]$Name) {
    if ($null -eq $Obj) { return [pscustomobject]@{ Set = $false; Value = $null } }
    $p = $Obj.PSObject.Properties[$Name]
    if ($p) { return [pscustomobject]@{ Set = $true; Value = $p.Value } }
    return [pscustomobject]@{ Set = $false; Value = $null }
}
function Format-Value($v) {
    if ($null -eq $v) { return '(null)' }
    if ($v -is [string]) { return $v }
    try { return ($v | ConvertTo-Json -Compress -Depth 4) } catch { return [string]$v }
}
function Protect-Secret([string]$s) {
    if (-not $s) { return $s }
    # Mask user:pass@ in proxy URLs and anything that looks like a token/key
    $s = [regex]::Replace($s, '(?<=://)([^:@/\s]+):([^@/\s]+)@', '$1:****@')
    $s = [regex]::Replace($s, '(?i)(authorization|token|key|secret|password)\s*[:=]\s*\S+', '$1=****')
    return $s
}

# ----------------------------------------------------------------------------
# TLS certificate inspection (best-effort; degrades under ConstrainedLanguage)
# ----------------------------------------------------------------------------
$KnownPublicCAs = @(
    'DigiCert','Microsoft','GlobalSign','Sectigo','Comodo','USERTrust','Let''s Encrypt','ISRG',
    'Amazon','Google Trust','Entrust','GoDaddy','Starfield','Baltimore','GeoTrust','RapidSSL',
    'Thawte','Cloudflare','Actalis','Buypass','SSL.com','Certum','QuoVadis','IdenTrust','VeriSign'
)
function Test-IssuerInspected([string]$Issuer) {
    if (-not $Issuer) { return 'unknown' }
    foreach ($ca in $KnownPublicCAs) { if ($Issuer -like "*$ca*") { return 'none' } }
    return 'possible'
}
function Get-TlsCertInfo([string]$HostName, [int]$Port = 443, [int]$TimeoutMs = 6000) {
    $tcp = $null; $ssl = $null
    try {
        $tcp = New-Object System.Net.Sockets.TcpClient
        $iar = $tcp.BeginConnect($HostName, $Port, $null, $null)
        if (-not $iar.AsyncWaitHandle.WaitOne($TimeoutMs)) { return $null }
        $tcp.EndConnect($iar)
        $cb  = [System.Net.Security.RemoteCertificateValidationCallback] { param($a, $b, $c, $d) $true }
        $ssl = New-Object System.Net.Security.SslStream($tcp.GetStream(), $false, $cb)
        $ssl.AuthenticateAsClient($HostName)
        $cert = $ssl.RemoteCertificate
        if ($cert) {
            $x = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($cert)
            return [pscustomobject]@{ Issuer = $x.Issuer; Subject = $x.Subject }
        }
    } catch { return $null }
    finally { if ($ssl) { $ssl.Dispose() }; if ($tcp) { $tcp.Dispose() } }
    return $null
}
function Get-HttpStatusFromError($ErrorRecord) {
    $ex = $ErrorRecord.Exception
    try { if ($ex.Response -and $null -ne $ex.Response.StatusCode) { return [int]$ex.Response.StatusCode } } catch {}
    try { if ($null -ne $ex.StatusCode) { return [int]$ex.StatusCode } } catch {}
    return $null
}

# ----------------------------------------------------------------------------
# Endpoint probe
# ----------------------------------------------------------------------------
function Test-Endpoint([pscustomobject]$Endpoint, [int]$TimeoutSec) {
    $url = [string]$Endpoint.url
    $uri = $null; try { $uri = [Uri]$url } catch {}
    $hostName = if ($uri) { $uri.Host } else { $url }
    $port     = if ($uri -and $uri.Port -gt 0) { $uri.Port } else { 443 }

    $r = [ordered]@{
        name = $Endpoint.name; url = $url; category = $Endpoint.category
        required = [bool]$Endpoint.required
        dns = 'unknown'; tcp = 'unknown'; http = 'unknown'; httpStatus = $null
        tlsIssuer = $null; tlsInspection = 'unknown'; note = $null; status = 'UNKNOWN'
    }

    # DNS
    try {
        $addrs = [System.Net.Dns]::GetHostAddresses($hostName) | ForEach-Object { $_.IPAddressToString }
        if ($addrs) { $r.dns = 'ok' } else { $r.dns = 'fail' }
    } catch { $r.dns = 'fail'; $r.note = 'DNS resolution failed'; $r.status = 'FAIL'; return [pscustomobject]$r }

    # TLS handshake (also confirms TCP) + issuer
    if ($uri -and $uri.Scheme -eq 'https') {
        $tls = Get-TlsCertInfo -HostName $hostName -Port $port -TimeoutMs ($TimeoutSec * 1000)
        if ($tls) {
            $r.tcp = 'ok'
            $r.tlsIssuer = $tls.Issuer
            $r.tlsInspection = Test-IssuerInspected $tls.Issuer
        }
    }

    # HTTP HEAD (any HTTP response = reachable, even 401/403/404)
    try {
        $resp = Invoke-WebRequest -Uri $url -Method Head -TimeoutSec $TimeoutSec -UseBasicParsing -MaximumRedirection 2 -ErrorAction Stop
        $r.tcp = 'ok'; $r.http = 'ok'; $r.httpStatus = [int]$resp.StatusCode
    } catch {
        $code = Get-HttpStatusFromError $_
        if ($code) { $r.tcp = 'ok'; $r.http = 'ok'; $r.httpStatus = $code }
        else {
            $r.http = 'fail'
            if ($r.tcp -ne 'ok') { $r.tcp = 'fail' }
            $msg = ($_.Exception.Message -replace '\s+', ' ').Trim()
            $r.note = $msg.Substring(0, [Math]::Min(160, $msg.Length))
        }
    }

    # Verdict: reachable if we got any HTTP status OR completed a TLS handshake
    if ($r.http -eq 'ok' -or $r.tcp -eq 'ok') {
        $r.status = 'PASS'
        if ($r.tlsInspection -eq 'possible') { $r.status = 'WARN' }
        if ($r.httpStatus -in 401, 403, 407) {
            if (-not $r.note) { $r.note = "HTTP $($r.httpStatus) - reachable but auth/proxy challenge" }
        }
    } else {
        $r.status = 'FAIL'
    }
    return [pscustomobject]$r
}

# ============================================================================
#  START
# ============================================================================
Write-Head "VS Code + Copilot Capability Probe   (read-only)"
$startedUtc = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
Write-Host "  Started: $startedUtc" -ForegroundColor DarkGray

# ----------------------------------------------------------------------------
# Plane 1a - Machine / shell / lockdown context
# ----------------------------------------------------------------------------
Write-Head "1. Environment and lockdown signals"

$languageMode = $ExecutionContext.SessionState.LanguageMode
$execPolicies = @{}
try { Get-ExecutionPolicy -List | ForEach-Object { $execPolicies[[string]$_.Scope] = [string]$_.ExecutionPolicy } } catch {}

$appLocker = 'unknown'
if ($isWin) {
    try {
        $svc = Get-Service -Name AppIDSvc -ErrorAction SilentlyContinue
        if ($svc) { $appLocker = "AppIDSvc:$($svc.Status)" }
    } catch {}
}

# Machine / user name (env vars are Windows-centric; fall back on macOS/Linux)
$computerName = $env:COMPUTERNAME
if (-not $computerName) { try { $computerName = [System.Net.Dns]::GetHostName() } catch {} }
if (-not $computerName) { $computerName = 'unknown-host' }
$userName = $env:USERNAME
if (-not $userName) { $userName = $env:USER }
if (-not $userName) { try { $userName = [Environment]::UserName } catch {} }

$osStr = [string][System.Environment]::OSVersion.VersionString
if ($isMac) { try { $pn = (sw_vers -productName 2>$null); $pv = (sw_vers -productVersion 2>$null); $bv = (sw_vers -buildVersion 2>$null); if ($pn) { $osStr = "$pn $pv ($bv)" } } catch {} }

# macOS lockdown signals (analogues to Windows WDAC/AppLocker/GPO)
$macSecurity = [ordered]@{ sip = $null; gatekeeper = $null; mdmEnrollment = $null }
if ($isMac) {
    try { $s = (csrutil status 2>$null | Out-String); if ($s -match 'enabled') { $macSecurity.sip = 'enabled' } elseif ($s -match 'disabled') { $macSecurity.sip = 'disabled' } } catch {}
    try { $g = (spctl --status 2>$null | Out-String); if ($g -match 'assessments enabled') { $macSecurity.gatekeeper = 'enabled' } elseif ($g -match 'assessments disabled') { $macSecurity.gatekeeper = 'disabled' } } catch {}
    try { $p = (profiles status -type enrollment 2>$null | Out-String); if ($p -match 'MDM enrollment:\s*Yes' -or $p -match 'Enrolled via DEP:\s*Yes') { $macSecurity.mdmEnrollment = 'yes' } elseif ($p -match 'MDM enrollment:\s*No' -or $p -match 'Not enrolled') { $macSecurity.mdmEnrollment = 'no' } } catch {}
}

$ctx = [ordered]@{
    timestampUtc   = $startedUtc
    computerName   = $computerName
    userName       = $userName
    os             = $osStr
    is64BitOS      = [System.Environment]::Is64BitOperatingSystem
    psVersion      = [string]$PSVersionTable.PSVersion
    psEdition      = [string]$PSVersionTable.PSEdition
    languageMode   = [string]$languageMode
    executionPolicy = $execPolicies
    appLockerSvc   = $appLocker
    macSecurity    = $macSecurity
}

$lmColor = if ($languageMode -ne 'FullLanguage') { 'Yellow' } else { 'Gray' }
Write-KV 'Computer'        $ctx.computerName
Write-KV 'OS'              $ctx.os
Write-KV 'PowerShell'      "$($ctx.psVersion) ($($ctx.psEdition))"
Write-KV 'Language mode'   $ctx.languageMode $lmColor
foreach ($k in $execPolicies.Keys) { Write-KV "ExecPolicy/$k" $execPolicies[$k] }
if ($isMac) {
    Write-KV 'macOS SIP'       ($(if ($macSecurity.sip) { $macSecurity.sip } else { 'unknown' }))
    Write-KV 'Gatekeeper'      ($(if ($macSecurity.gatekeeper) { $macSecurity.gatekeeper } else { 'unknown' }))
    $mdmColor = if ($macSecurity.mdmEnrollment -eq 'yes') { 'Yellow' } else { 'Gray' }
    Write-KV 'MDM enrollment'  ($(if ($macSecurity.mdmEnrollment) { $macSecurity.mdmEnrollment } else { 'unknown' })) $mdmColor
}
if ($languageMode -ne 'FullLanguage') {
    Write-Host "  -> ConstrainedLanguage indicates WDAC/AppLocker lockdown; some checks degrade gracefully." -ForegroundColor Yellow
}

# ----------------------------------------------------------------------------
# Plane 1b - VS Code install + CLI + policies
# ----------------------------------------------------------------------------
Write-Head "2. VS Code, extensions and policies"

$vscode = [ordered]@{
    cliFound = $false; cliCommand = $null; version = $null; commit = $null; arch = $null
    insidersCliFound = $false
}
foreach ($cmd in 'code', 'code-insiders') {
    try {
        $c = Get-Command $cmd -ErrorAction SilentlyContinue
        if ($c) {
            $out = & $cmd --version 2>$null
            if ($out) {
                if ($cmd -eq 'code') {
                    $vscode.cliFound = $true; $vscode.cliCommand = $cmd
                    $vscode.version = [string]$out[0]
                    if ($out.Count -gt 1) { $vscode.commit = [string]$out[1] }
                    if ($out.Count -gt 2) { $vscode.arch = [string]$out[2] }
                } else { $vscode.insidersCliFound = $true }
            }
        }
    } catch {}
}
Write-KV 'code CLI on PATH'   ($(if ($vscode.cliFound) { 'yes' } else { 'no' })) ($(if ($vscode.cliFound) { 'Green' } else { 'Yellow' }))
if ($vscode.version) { Write-KV 'VS Code version' $vscode.version }
if ($vscode.insidersCliFound) { Write-KV 'code-insiders CLI' 'present' }

# Extensions: prefer CLI, fall back to scanning the extensions folder
$extensions = @()
if ($vscode.cliFound) {
    try { $extensions = @(& $vscode.cliCommand --list-extensions --show-versions 2>$null) } catch {}
}
if (-not $extensions -or $extensions.Count -eq 0) {
    $extDir = Join-Path $userHome '.vscode\extensions'
    if (Test-Path -LiteralPath $extDir) {
        try {
            $extensions = @(Get-ChildItem -LiteralPath $extDir -Directory -ErrorAction SilentlyContinue |
                Where-Object { $_.Name -notlike '.*' } | ForEach-Object { $_.Name })
        } catch {}
    }
}
# Normalize each entry to a bare extension id (strip @version or -x.y.z[-platform])
$extIds = @($extensions | ForEach-Object {
    $e = ([string]$_).Trim()
    if ($e -match '@') { $e = ($e -split '@')[0] }
    else { $e = ($e -replace '-\d+\.\d+\.\d+.*$', '') }
    $e.ToLowerInvariant()
})

# Built-in (bundled) extensions are NOT returned by --list-extensions. Modern VS Code
# ships Copilot Chat as a built-in, located at <install>\<commit-hash>\resources\app\extensions.
function Get-BuiltinExtNames {
    try {
        $extDirs = @()
        # Derive from the code CLI location (resolve symlinks on Unix)
        try {
            $src = (Get-Command $vscode.cliCommand -ErrorAction SilentlyContinue).Source
            if ($src) {
                try { $li = Get-Item -LiteralPath $src -ErrorAction SilentlyContinue; if ($li -and $li.Target) { $src = $li.Target } } catch {}
                $binParent = Split-Path $src -Parent
                $appDir    = Split-Path $binParent -Parent      # macOS: .../Contents/Resources/app ; Win: install root
                $up2       = Split-Path $appDir -Parent
                foreach ($cand in @(
                    (Join-Path $appDir 'extensions'),
                    (Join-Path $appDir 'resources/app/extensions'),
                    (Join-Path $up2   'resources/app/extensions')
                )) { if ($cand) { $extDirs += $cand } }
            }
        } catch {}
        if ($isWin) {
            foreach ($root in @(
                (Join-Path $env:LOCALAPPDATA 'Programs/Microsoft VS Code'),
                (Join-Path $env:LOCALAPPDATA 'Programs/Microsoft VS Code Insiders'),
                'C:/Program Files/Microsoft VS Code',
                'C:/Program Files/Microsoft VS Code Insiders'
            )) {
                if (-not $root -or -not (Test-Path -LiteralPath $root)) { continue }
                $extDirs += (Join-Path $root 'resources/app/extensions')
                Get-ChildItem -LiteralPath $root -Directory -ErrorAction SilentlyContinue | ForEach-Object {
                    $p = Join-Path $_.FullName 'resources/app/extensions'
                    if (Test-Path -LiteralPath $p) { $extDirs += $p }
                }
            }
        } elseif ($isMac) {
            $extDirs += @(
                '/Applications/Visual Studio Code.app/Contents/Resources/app/extensions',
                '/Applications/Visual Studio Code - Insiders.app/Contents/Resources/app/extensions',
                (Join-Path $userHome 'Applications/Visual Studio Code.app/Contents/Resources/app/extensions')
            )
        } else {
            $extDirs += @(
                '/usr/share/code/resources/app/extensions',
                '/usr/share/code-insiders/resources/app/extensions',
                '/snap/code/current/usr/share/code/resources/app/extensions',
                '/opt/visual-studio-code/resources/app/extensions'
            )
        }
        $names = @()
        foreach ($ed in ($extDirs | Where-Object { $_ } | Select-Object -Unique)) {
            if (-not (Test-Path -LiteralPath $ed)) { continue }
            Get-ChildItem -LiteralPath $ed -Directory -ErrorAction SilentlyContinue | ForEach-Object { $names += $_.Name.ToLowerInvariant() }
        }
        return @($names | Select-Object -Unique)
    } catch { return @() }
}
$builtinExt = @(Get-BuiltinExtNames)

# Returns 'marketplace' | 'built-in' | 'not-detected'
function Get-ExtStatus([string[]]$MarketIds, [string[]]$BuiltinNames) {
    foreach ($id in $MarketIds) { if ($extIds -contains $id.ToLowerInvariant()) { return 'marketplace' } }
    foreach ($bn in $BuiltinNames) { if ($builtinExt -contains $bn.ToLowerInvariant()) { return 'built-in' } }
    return 'not-detected'
}
$copilotChat = Get-ExtStatus @('github.copilot-chat') @('github.copilot-chat','copilot-chat','copilot')
$copilotCore = Get-ExtStatus @('github.copilot')      @('github.copilot','copilot')
$foundryTk   = Get-ExtStatus @('ms-windows-ai-studio.windows-ai-studio') @()
$azureExt    = Get-ExtStatus @('ms-vscode.azure-account','ms-azuretools.vscode-azureresourcegroups') @()

$keyExt = [ordered]@{
    'GitHub Copilot Chat'          = $copilotChat
    'GitHub Copilot (completions)' = $copilotCore
    'Foundry Toolkit (AI Toolkit)' = $foundryTk
    'Azure extensions'             = $azureExt
}
Write-KV 'Extensions found' ("$($extensions.Count) marketplace + $($builtinExt.Count) built-in")
foreach ($k in $keyExt.Keys) {
    $st = $keyExt[$k]
    $v  = if ($st -eq 'not-detected') { 'WARN' } else { 'PASS' }
    Write-Verdict $k $v $st
}

# Copilot CLI + WorkIQ plugin
$copilotCli = [ordered]@{ found = $false; plugins = @() }
try {
    $cc = Get-Command copilot -ErrorAction SilentlyContinue
    if ($cc) { $copilotCli.found = $true }
} catch {}
$pluginDir = Join-Path $userHome '.copilot\installed-plugins'
if (Test-Path -LiteralPath $pluginDir) {
    try {
        $copilotCli.plugins = @(Get-ChildItem -LiteralPath $pluginDir -Recurse -Directory -ErrorAction SilentlyContinue |
            Where-Object { $_.Name -match 'workiq|copilot-plugins' -or (Test-Path (Join-Path $_.FullName 'plugin.json')) } |
            ForEach-Object { $_.Name } | Select-Object -Unique)
    } catch {}
}
$workIqPresent = [bool](@($copilotCli.plugins | Where-Object { $_ -match 'workiq' }).Count)
Write-Verdict 'Copilot CLI' ($(if ($copilotCli.found) { 'PASS' } else { 'WARN' })) ($(if ($copilotCli.found) { 'on PATH' } else { 'not on PATH' }))
Write-Verdict 'WorkIQ CLI plugin' ($(if ($workIqPresent) { 'PASS' } else { 'WARN' })) ($(if ($workIqPresent) { 'installed' } else { 'not detected' }))

# Settings of interest (allowlist only - never dump the whole file)
$settingsPaths = @()
if ($isWin) {
    $settingsPaths += (Join-Path $env:APPDATA 'Code\User\settings.json')
    $settingsPaths += (Join-Path $env:APPDATA 'Code - Insiders\User\settings.json')
} else {
    $settingsPaths += (Join-Path $userHome 'Library/Application Support/Code/User/settings.json')
    $settingsPaths += (Join-Path $userHome '.config/Code/User/settings.json')
}
$settingsFile = $settingsPaths | Where-Object { Test-Path -LiteralPath $_ } | Select-Object -First 1
$settings = Read-JsonFile $settingsFile
$settingKeys = @(
    'http.proxy','http.proxyStrictSSL','http.proxySupport','http.proxyAuthorization','http.electronFetch',
    'telemetry.telemetryLevel','telemetry.enableTelemetry',
    'update.mode','extensions.autoUpdate','extensions.autoCheckUpdates','extensions.allowed','extensions.gallery',
    'security.workspace.trust.enabled',
    'github.copilot.enable','chat.agent.enabled','chat.mcp.enabled','chat.tools.autoApprove','workbench.enableExperiments'
)
$settingsReport = [ordered]@{}
foreach ($key in $settingKeys) {
    $p = Get-Prop $settings $key
    if ($p.Set) {
        $val = Format-Value $p.Value
        if ($key -match 'proxy|authorization') { $val = Protect-Secret $val }
        $settingsReport[$key] = $val
    } else { $settingsReport[$key] = '(not set)' }
}
Write-KV 'Settings file' ($(if ($settingsFile) { $settingsFile } else { '(none found)' }))
foreach ($k in 'http.proxy','http.proxyStrictSSL','telemetry.telemetryLevel','extensions.allowed','update.mode') {
    if ($settingsReport[$k] -ne '(not set)') { Write-KV "  $k" $settingsReport[$k] }
}

# Enterprise policies (Windows registry)
$policies = [ordered]@{}
if ($isWin) {
    foreach ($root in 'HKLM:\SOFTWARE\Policies\Microsoft\VSCode', 'HKCU:\SOFTWARE\Policies\Microsoft\VSCode') {
        try {
            if (Test-Path $root) {
                $props = Get-ItemProperty -Path $root -ErrorAction SilentlyContinue
                foreach ($pp in $props.PSObject.Properties) {
                    if ($pp.Name -notmatch '^PS(Path|ParentPath|ChildName|Drive|Provider)$') {
                        $policies["$root\$($pp.Name)"] = Protect-Secret ([string]$pp.Value)
                    }
                }
            }
        } catch {}
    }
}
if ($policies.Count -gt 0) {
    Write-Host "  Enterprise VS Code policies detected:" -ForegroundColor Yellow
    foreach ($k in $policies.Keys) { Write-KV "  policy" "$k = $($policies[$k])" 'Yellow' }
} else {
    Write-KV 'VS Code GPO policies' 'none detected'
}

# ----------------------------------------------------------------------------
# Plane 3 prelim - Proxy configuration
# ----------------------------------------------------------------------------
Write-Head "3. Proxy / network configuration"
$proxy = [ordered]@{
    envHttp  = Protect-Secret ([string]$env:HTTP_PROXY);  envHttps = Protect-Secret ([string]$env:HTTPS_PROXY)
    envNo    = [string]$env:NO_PROXY
    winInetEnable = $null; winInetServer = $null; winInetAutoConfig = $null
    winHttp  = $null; effectiveForGitHub = $null
}
if ($isWin) {
    try {
        $ie = Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -ErrorAction SilentlyContinue
        if ($ie) {
            $proxy.winInetEnable     = [string]$ie.ProxyEnable
            $proxy.winInetServer     = Protect-Secret ([string]$ie.ProxyServer)
            $proxy.winInetAutoConfig = [string]$ie.AutoConfigURL
        }
    } catch {}
    try { $proxy.winHttp = (netsh winhttp show proxy 2>$null | Out-String).Trim() } catch {}
}
if ($isMac) {
    try {
        $sc = (scutil --proxy 2>$null | Out-String)
        if ($sc) {
            if ($sc -match 'HTTPSEnable\s*:\s*1') { $proxy.winInetEnable = '1' }
            $mh = [regex]::Match($sc, 'HTTPSProxy\s*:\s*([^\s]+)')
            if ($mh.Success) {
                $srv = $mh.Groups[1].Value
                $mport = [regex]::Match($sc, 'HTTPSPort\s*:\s*([0-9]+)')
                if ($mport.Success) { $srv = "$srv`:$($mport.Groups[1].Value)" }
                $proxy.winInetServer = Protect-Secret $srv
            }
            $mpac = [regex]::Match($sc, 'ProxyAutoConfigURLString\s*:\s*([^\s]+)')
            if ($mpac.Success) { $proxy.winInetAutoConfig = $mpac.Groups[1].Value }
        }
    } catch {}
}
try {
    $sp = [System.Net.WebRequest]::GetSystemWebProxy()
    $proxy.effectiveForGitHub = Protect-Secret ([string]$sp.GetProxy([Uri]'https://api.githubcopilot.com'))
} catch {}
Write-KV 'env HTTPS_PROXY'   ($(if ($proxy.envHttps) { $proxy.envHttps } else { '(unset)' }))
Write-KV 'WinINET proxy'     ($(if ($proxy.winInetServer) { "enabled=$($proxy.winInetEnable) $($proxy.winInetServer)" } else { '(none)' }))
Write-KV 'WinINET PAC'       ($(if ($proxy.winInetAutoConfig) { $proxy.winInetAutoConfig } else { '(none)' }))
Write-KV 'Effective ->Copilot' ($(if ($proxy.effectiveForGitHub) { $proxy.effectiveForGitHub } else { '(direct)' }))

# ----------------------------------------------------------------------------
# Plane 3 - Endpoint egress tests
# ----------------------------------------------------------------------------
$defaultEndpoints = @(
    @{ name='GitHub.com (auth)';            url='https://github.com';                               category='copilot';   required=$true  },
    @{ name='GitHub API';                   url='https://api.github.com';                           category='copilot';   required=$true  },
    @{ name='Copilot Chat/Agent API';       url='https://api.githubcopilot.com';                    category='copilot';   required=$true  },
    @{ name='Copilot completions proxy';    url='https://copilot-proxy.githubusercontent.com';      category='copilot';   required=$true  },
    @{ name='Copilot Business API';         url='https://api.business.githubcopilot.com';            category='copilot';   required=$false },
    @{ name='Copilot Enterprise API';       url='https://api.enterprise.githubcopilot.com';          category='copilot';   required=$false },
    @{ name='Copilot experimentation';      url='https://default.exp-tas.com';                       category='copilot';   required=$false },
    @{ name='Copilot telemetry';            url='https://copilot-telemetry.githubusercontent.com';   category='copilot';   required=$false },
    @{ name='Microsoft sign-in';            url='https://login.microsoftonline.com';                 category='auth';      required=$true  },
    @{ name='VS Marketplace';               url='https://marketplace.visualstudio.com';              category='vscode';    required=$true  },
    @{ name='VS Code update';               url='https://update.code.visualstudio.com';              category='vscode';    required=$false },
    @{ name='VS Code CDN';                  url='https://main.vscode-cdn.net';                       category='vscode';    required=$false },
    @{ name='Azure AI Foundry portal';      url='https://ai.azure.com';                              category='foundry';   required=$false },
    @{ name='Azure Resource Manager';       url='https://management.azure.com';                      category='foundry';   required=$false },
    @{ name='Azure AI model inference';     url='https://models.inference.ai.azure.com';             category='foundry';   required=$false },
    @{ name='GitHub Models';                url='https://models.github.ai';                          category='foundry';   required=$false },
    @{ name='Hugging Face (Toolkit DL)';    url='https://huggingface.co';                            category='foundry';   required=$false },
    @{ name='OpenAI API (BYOM)';            url='https://api.openai.com';                            category='byom';      required=$false },
    @{ name='Anthropic API (BYOM)';         url='https://api.anthropic.com';                         category='byom';      required=$false },
    @{ name='Google Gemini API (BYOM)';     url='https://generativelanguage.googleapis.com';         category='byom';      required=$false },
    @{ name='OpenRouter (BYOM)';            url='https://openrouter.ai';                             category='byom';      required=$false },
    @{ name='Your Azure OpenAI (EDIT ME)';      url='https://YOUR-RESOURCE.openai.azure.com';        category='foundry';   required=$false },
    @{ name='Your Azure AI Foundry (EDIT ME)';  url='https://YOUR-PROJECT.services.ai.azure.com';    category='foundry';   required=$false }
)
$endpointConfig = Read-JsonFile $EndpointsFile
$endpoints = if ($endpointConfig -and $endpointConfig.endpoints) { $endpointConfig.endpoints } else { $defaultEndpoints | ForEach-Object { [pscustomobject]$_ } }

$netResults = @()
if ($SkipNetwork) {
    Write-Head "4. Network egress tests   (SKIPPED via -SkipNetwork)"
} else {
    Write-Head "4. Network egress tests"
    Write-Host "  Probing $($endpoints.Count) endpoints (timeout ${TimeoutSeconds}s each)..." -ForegroundColor DarkGray
    foreach ($ep in $endpoints) {
        if (-not $ep.url -or $ep.url -match 'YOUR-|EDIT-ME' -or ([string]$ep.name) -match '(?i)EDIT ME') {
            Write-Verdict ([string]$ep.name) 'WARN' 'skipped placeholder - edit endpoints.json to add your resource'
            continue
        }
        $res = Test-Endpoint -Endpoint $ep -TimeoutSec $TimeoutSeconds
        $netResults += $res
        $detail = @()
        if ($res.httpStatus) { $detail += "HTTP $($res.httpStatus)" }
        if ($res.tlsInspection -eq 'possible') { $detail += "TLS-inspected" }
        if ($res.note) { $detail += $res.note }
        Write-Verdict ("{0,-30} {1}" -f $res.name, $res.url) $res.status ($detail -join ' | ')
    }
}

# ----------------------------------------------------------------------------
# Findings (auto-generated, actionable)
# ----------------------------------------------------------------------------
Write-Head "5. Findings and guidance hints"
$findings = New-Object System.Collections.ArrayList
function Add-Finding([string]$Sev, [string]$Text) { [void]$findings.Add([pscustomobject]@{ severity = $Sev; text = $Text }) }

if ($languageMode -ne 'FullLanguage') { Add-Finding 'HIGH' "PowerShell LanguageMode=$languageMode (WDAC/AppLocker). Strong machine lockdown; prefer the manual checklist where scripts are blocked." }
if ($policies.Count -gt 0) { Add-Finding 'INFO' "Enterprise VS Code GPO policies are applied ($($policies.Count) value(s)); user settings may be overridden." }
if ($isMac -and $macSecurity.mdmEnrollment -eq 'yes') { Add-Finding 'INFO' "macOS device is MDM-enrolled; configuration profiles may enforce VS Code / network policy." }
switch ($copilotChat) {
    'not-detected' { Add-Finding 'WARN' "Copilot Chat not found via CLI or built-in scan - it may still be bundled. Confirm in the Extensions view (filter @builtin) and via the model picker in MANUAL-CHECKS.md." }
    'built-in'     { Add-Finding 'OK'   "Copilot Chat is present (built-in / bundled with VS Code)." }
    'marketplace'  { Add-Finding 'OK'   "Copilot Chat is installed (marketplace extension)." }
}
if ($foundryTk -eq 'not-detected') { Add-Finding 'INFO' "Foundry Toolkit (ms-windows-ai-studio.windows-ai-studio) not detected - install it to enumerate/run Foundry models." }

if (-not $SkipNetwork -and $netResults.Count -gt 0) {
    $byCat = @{}
    foreach ($r in $netResults) { if (-not $byCat.ContainsKey($r.category)) { $byCat[$r.category] = @() }; $byCat[$r.category] += $r }

    $copilotFails = @($byCat['copilot'] | Where-Object { $_.status -eq 'FAIL' -and $_.required })
    if ($copilotFails.Count -gt 0) { Add-Finding 'HIGH' "Copilot egress BLOCKED: $((@($copilotFails | ForEach-Object { $_.url })) -join ', '). Copilot Chat will not work until these are allow-listed." }
    elseif ($byCat.ContainsKey('copilot')) { Add-Finding 'OK' "Copilot inference endpoints are reachable from this machine." }

    $mk = @($netResults | Where-Object { $_.url -like '*marketplace.visualstudio.com*' })
    if ($mk.Count -gt 0 -and $mk[0].status -eq 'FAIL') { Add-Finding 'HIGH' "VS Marketplace blocked - extensions must be side-loaded as approved VSIX files or mirrored internally." }

    $inspected = @($netResults | Where-Object { $_.tlsInspection -eq 'possible' })
    if ($inspected.Count -gt 0) { Add-Finding 'WARN' "TLS interception likely on $($inspected.Count) endpoint(s) (corporate root CA). Trust the CA for VS Code/Node (NODE_EXTRA_CA_CERTS) and align http.proxyStrictSSL." }

    if ($byCat.ContainsKey('foundry')) {
        $foundryAll  = @($byCat['foundry'])
        $foundryFails = @($foundryAll | Where-Object { $_.status -eq 'FAIL' })
        if ($foundryAll.Count -gt 0 -and $foundryFails.Count -eq $foundryAll.Count) { Add-Finding 'INFO' "All Foundry/model endpoints unreachable - bring-your-own-model via Foundry will need egress or a brokered gateway." }
    }
    if ($byCat.ContainsKey('byom')) {
        $byomReach = @($byCat['byom'] | Where-Object { $_.status -ne 'FAIL' })
        if ($byomReach.Count -gt 0) { Add-Finding 'OK' "BYOM provider endpoint(s) reachable: $((@($byomReach | ForEach-Object { ([Uri]$_.url).Host })) -join ', '). These can back custom models in Copilot 'Manage Models'." }
    }
} elseif ($SkipNetwork) {
    Add-Finding 'INFO' "Network egress tests were skipped (-SkipNetwork); endpoint reachability not assessed."
}

if ($findings.Count -eq 0) { Add-Finding 'OK' "No blocking issues detected by the automated checks." }
foreach ($f in $findings) {
    $c = switch ($f.severity) { 'HIGH' {'Red'} 'WARN' {'Yellow'} 'OK' {'Green'} default {'Gray'} }
    Write-Host ("  [{0,-4}] {1}" -f $f.severity, $f.text) -ForegroundColor $c
}
Write-Host ''
Write-Host "  -> Now complete MANUAL-CHECKS.md (Copilot model picker, sign-in, inference-time web access)." -ForegroundColor Cyan

# ----------------------------------------------------------------------------
# Write reports
# ----------------------------------------------------------------------------
if (-not (Test-Path -LiteralPath $OutputPath)) { New-Item -ItemType Directory -Path $OutputPath -Force | Out-Null }
$stamp = (Get-Date).ToString('yyyyMMdd-HHmmss')
$slug  = "$($ctx.computerName)_$stamp"
$jsonPath = Join-Path $OutputPath "capability-report_$slug.json"
$mdPath   = Join-Path $OutputPath "capability-report_$slug.md"

$report = [ordered]@{
    schema      = 'vscode-capability-probe/v1'
    context     = $ctx
    vscode      = $vscode
    extensions  = @{ count = $extensions.Count; key = $keyExt; builtin = $builtinExt; marketplace = $extensions }
    copilotCli  = $copilotCli
    settings    = $settingsReport
    policies    = $policies
    proxy       = $proxy
    network     = $netResults
    findings    = $findings
}
try { $report | ConvertTo-Json -Depth 8 | Set-Content -LiteralPath $jsonPath -Encoding UTF8 } catch { Write-Warning "JSON write failed: $($_.Exception.Message)" }

# Markdown report
function Esc([string]$s) { if ($null -eq $s) { return '' }; return ($s -replace '\|', '\|') }
function Disp($v) { $s = [string]$v; if ([string]::IsNullOrWhiteSpace($s)) { return '(none)' } return (Esc $s) }
$md = New-Object System.Collections.ArrayList
[void]$md.Add("# VS Code + Copilot Capability Report")
[void]$md.Add("")
[void]$md.Add("**Author:** UngerAI  |  **Generated:** $startedUtc  |  **Machine:** $($ctx.computerName)  |  **User:** $($ctx.userName)")
[void]$md.Add("")
[void]$md.Add("> Read-only probe. No changes were made and no secrets were collected (proxy/auth values are masked).")
[void]$md.Add("")
[void]$md.Add("## Summary findings")
[void]$md.Add("")
[void]$md.Add("| Severity | Finding |")
[void]$md.Add("|----------|---------|")
foreach ($f in $findings) { [void]$md.Add("| $($f.severity) | $(Esc $f.text) |") }
[void]$md.Add("")
[void]$md.Add("## 1. Environment and lockdown")
[void]$md.Add("")
[void]$md.Add("| Signal | Value |")
[void]$md.Add("|--------|-------|")
[void]$md.Add("| OS | $(Esc $ctx.os) |")
[void]$md.Add("| PowerShell | $($ctx.psVersion) ($($ctx.psEdition)) |")
[void]$md.Add("| Language mode | $($ctx.languageMode) |")
foreach ($k in $execPolicies.Keys) { [void]$md.Add("| ExecutionPolicy ($k) | $($execPolicies[$k]) |") }
[void]$md.Add("| VS Code GPO policies | $($policies.Count) value(s) |")
[void]$md.Add("")
[void]$md.Add("## 2. VS Code and extensions")
[void]$md.Add("")
[void]$md.Add("| Item | Value |")
[void]$md.Add("|------|-------|")
[void]$md.Add("| code CLI on PATH | $($vscode.cliFound) |")
[void]$md.Add("| VS Code version | $(Disp $vscode.version) |")
[void]$md.Add("| Extensions installed | $($extensions.Count) |")
foreach ($k in $keyExt.Keys) { [void]$md.Add("| $(Esc $k) | $($keyExt[$k]) |") }
[void]$md.Add("| Copilot CLI on PATH | $($copilotCli.found) |")
[void]$md.Add("| WorkIQ CLI plugin | $workIqPresent |")
[void]$md.Add("")
[void]$md.Add("### Settings of interest")
[void]$md.Add("")
[void]$md.Add("| Setting | Value |")
[void]$md.Add("|---------|-------|")
foreach ($k in $settingsReport.Keys) { [void]$md.Add("| $(Esc $k) | $(Esc ([string]$settingsReport[$k])) |") }
if ($policies.Count -gt 0) {
    [void]$md.Add("")
    [void]$md.Add("### Enterprise policies (GPO)")
    [void]$md.Add("")
    [void]$md.Add("| Policy | Value |")
    [void]$md.Add("|--------|-------|")
    foreach ($k in $policies.Keys) { [void]$md.Add("| $(Esc $k) | $(Esc ([string]$policies[$k])) |") }
}
[void]$md.Add("")
[void]$md.Add("## 3. Proxy")
[void]$md.Add("")
[void]$md.Add("| Item | Value |")
[void]$md.Add("|------|-------|")
[void]$md.Add("| env HTTPS_PROXY | $(Disp $proxy.envHttps) |")
[void]$md.Add("| WinINET proxy | $(Disp $proxy.winInetServer) (enable=$($proxy.winInetEnable)) |")
[void]$md.Add("| WinINET PAC | $(Disp $proxy.winInetAutoConfig) |")
[void]$md.Add("| Effective proxy to Copilot | $(Disp $proxy.effectiveForGitHub) |")
[void]$md.Add("")
[void]$md.Add("## 4. Network egress")
[void]$md.Add("")
if ($SkipNetwork) {
    [void]$md.Add("_Skipped (-SkipNetwork)._")
} else {
    [void]$md.Add("| Verdict | Endpoint | Category | DNS | TCP | HTTP | TLS issuer | Inspection | Note |")
    [void]$md.Add("|---------|----------|----------|-----|-----|------|------------|------------|------|")
    foreach ($r in $netResults) {
        $issuerShort = if ($r.tlsIssuer) { (([string]$r.tlsIssuer) -split ',')[0] } else { '' }
        $httpCell = if ($r.httpStatus) { [string]$r.httpStatus } else { $r.http }
        [void]$md.Add("| $($r.status) | $(Esc $r.name)<br>$(Esc $r.url) | $($r.category) | $($r.dns) | $($r.tcp) | $(Esc ([string]$httpCell)) | $(Esc $issuerShort) | $($r.tlsInspection) | $(Esc ([string]$r.note)) |")
    }
}
[void]$md.Add("")
[void]$md.Add("## 5. Next step - manual checks")
[void]$md.Add("")
[void]$md.Add("Open **MANUAL-CHECKS.md** and complete the UI-only checks: Copilot sign-in, the model picker list, a per-model reply test, and inference-time web access. Send both the filled checklist and the JSON report back.")
[void]$md.Add("")
try { ($md -join "`n") | Set-Content -LiteralPath $mdPath -Encoding UTF8 } catch { Write-Warning "MD write failed: $($_.Exception.Message)" }

Write-Head "Done"
Write-Host "  JSON report : $jsonPath" -ForegroundColor Green
Write-Host "  Readable    : $mdPath"  -ForegroundColor Green
Write-Host "  Next        : complete MANUAL-CHECKS.md, then send both files back." -ForegroundColor Cyan
Write-Host ''