Fix: Restrict Set-ExecutionPolicy to Windows in PowerShell env activation (microsoft#1477)

fixes
microsoft#1470
`Set-ExecutionPolicy` was unconditionally prepended to PowerShell
activation commands, causing `Operation is not supported on this
platform.` errors on macOS/Linux where the command is not available.

## Changes

- **`src/managers/common/utils.ts`**: Extracted
`buildPwshActivationCommands(ps1Path)` helper that only emits
`Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned` when
`isWindows()` is true. On non-Windows, only `& activate.ps1` is emitted.
Also eliminates duplication between the `Activate.ps1`/`activate.ps1`
branches.

```typescript
// Before: always emitted on all platforms
shellActivation.set(ShellConstants.PWSH, [
    { executable: 'Set-ExecutionPolicy', args: ['-Scope', 'Process', '-ExecutionPolicy', 'RemoteSigned'] },
    { executable: '&', args: [path.join(binDir, 'Activate.ps1')] },
]);

// After: Set-ExecutionPolicy only on Windows
function buildPwshActivationCommands(ps1Path: string): PythonCommandRunConfiguration[] {
    const commands: PythonCommandRunConfiguration[] = [];
    if (isWindows()) {
        commands.push({ executable: 'Set-ExecutionPolicy', args: ['-Scope', 'Process', '-ExecutionPolicy', 'RemoteSigned'] });
    }
    commands.push({ executable: '&', args: [ps1Path] });
    return commands;
}
```

-
**`src/test/managers/common/utils.getShellActivationCommands.unit.test.ts`**:
Adds tests asserting non-Windows PowerShell activation produces exactly
one command (`& activate.ps1`) with no `Set-ExecutionPolicy`.

> [!WARNING]
>
> <details>
> <summary>Firewall rules blocked me from connecting to one or more
addresses (expand for details)</summary>
>
> #### I tried to connect to the following addresses, but was blocked by
firewall rules:
>
> - `https://api.github.com/graphql`
> - Triggering command: `/usr/bin/gh gh issue list --state open --limit
5 --json number,title,labels` (http block)
>
> If you need me to access, download, or install something from one of
these locations, you can either:
>
> - Configure [Actions setup
steps](https://gh.io/copilot/actions-setup-steps) to set up my
environment, which run before the firewall is enabled
> - Add the appropriate URLs or hosts to the custom allowlist in this
repository's [Copilot coding agent
settings](https://github.com/microsoft/vscode-python-environments/settings/copilot/coding_agent)
(admins only)
>
> </details>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: eleanorjboyd <26030610+eleanorjboyd@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: 3 people

src/managers/common/utils.ts

@@ -139,6 +139,18 @@ export function compareVersions(version1: string, version2: string): number {
     return 0;
 }
 
+function buildPwshActivationCommands(ps1Path: string): PythonCommandRunConfiguration[] {
+    const commands: PythonCommandRunConfiguration[] = [];
+    if (isWindows()) {
+        commands.push({
+            executable: 'Set-ExecutionPolicy',
+            args: ['-Scope', 'Process', '-ExecutionPolicy', 'RemoteSigned'],
+        });
+    }
+    commands.push({ executable: '&', args: [ps1Path] });
+    return commands;
+}
+
 export async function getShellActivationCommands(binDir: string): Promise<{
     shellActivation: Map<string, PythonCommandRunConfiguration[]>;
     shellDeactivation: Map<string, PythonCommandRunConfiguration[]>;
@@ -172,22 +184,10 @@ export async function getShellActivationCommands(binDir: string): Promise<{
     shellDeactivation.set(ShellConstants.KSH, [{ executable: 'deactivate' }]);
 
     if (await fs.pathExists(path.join(binDir, 'Activate.ps1'))) {
-        shellActivation.set(ShellConstants.PWSH, [
-            {
-                executable: 'Set-ExecutionPolicy',
-                args: ['-Scope', 'Process', '-ExecutionPolicy', 'RemoteSigned'],
-            },
-            { executable: '&', args: [path.join(binDir, `Activate.ps1`)] },
-        ]);
+        shellActivation.set(ShellConstants.PWSH, buildPwshActivationCommands(path.join(binDir, 'Activate.ps1')));
         shellDeactivation.set(ShellConstants.PWSH, [{ executable: 'deactivate' }]);
     } else if (await fs.pathExists(path.join(binDir, 'activate.ps1'))) {
-        shellActivation.set(ShellConstants.PWSH, [
-            {
-                executable: 'Set-ExecutionPolicy',
-                args: ['-Scope', 'Process', '-ExecutionPolicy', 'RemoteSigned'],
-            },
-            { executable: '&', args: [path.join(binDir, `activate.ps1`)] },
-        ]);
+        shellActivation.set(ShellConstants.PWSH, buildPwshActivationCommands(path.join(binDir, 'activate.ps1')));
         shellDeactivation.set(ShellConstants.PWSH, [{ executable: 'deactivate' }]);
     }
 

src/test/managers/common/utils.getShellActivationCommands.unit.test.ts

@@ -80,6 +80,42 @@ suite('getShellActivationCommands', () => {
         });
     });
 
+    suite('PowerShell activation on non-Windows omits Set-ExecutionPolicy', () => {
+        test('Activate.ps1 (capitalized) on non-Windows has only the activation command', async () => {
+            isWindowsStub.returns(false);
+            await fs.writeFile(path.join(tmpDir, 'Activate.ps1'), '');
+
+            const result = await getShellActivationCommands(tmpDir);
+            const pwshActivation = result.shellActivation.get(ShellConstants.PWSH);
+
+            assert.ok(pwshActivation, 'PowerShell activation should be defined');
+            assert.strictEqual(pwshActivation.length, 1, 'Should have only 1 command: activate (no Set-ExecutionPolicy)');
+            assert.strictEqual(pwshActivation[0].executable, '&');
+            assert.ok(pwshActivation[0].args);
+            assert.ok(
+                pwshActivation[0].args[0].endsWith('Activate.ps1'),
+                `Expected path ending with Activate.ps1, got: ${pwshActivation[0].args[0]}`,
+            );
+        });
+
+        test('activate.ps1 (lowercase) on non-Windows has only the activation command', async () => {
+            isWindowsStub.returns(false);
+            await fs.writeFile(path.join(tmpDir, 'activate.ps1'), '');
+
+            const result = await getShellActivationCommands(tmpDir);
+            const pwshActivation = result.shellActivation.get(ShellConstants.PWSH);
+
+            assert.ok(pwshActivation, 'PowerShell activation should be defined');
+            assert.strictEqual(pwshActivation.length, 1, 'Should have only 1 command: activate (no Set-ExecutionPolicy)');
+            assert.strictEqual(pwshActivation[0].executable, '&');
+            assert.ok(pwshActivation[0].args);
+            assert.ok(
+                pwshActivation[0].args[0].toLowerCase().endsWith('activate.ps1'),
+                `Expected path ending with activate.ps1, got: ${pwshActivation[0].args[0]}`,
+            );
+        });
+    });
+
     suite('No PowerShell activation when Activate.ps1 is absent', () => {
         test('No pwsh activation when no ps1 file exists', async () => {
             isWindowsStub.returns(true);