@codingame/monaco-vscode-api 33.0.9 → 34.0.0

package/vscode/src/vs/workbench/contrib/welcomeOnboarding/common/onboardingTypes.d.ts

@@ -50,3 +50,33 @@ export declare const ONBOARDING_AI_PREFERENCE_OPTIONS: readonly IAiPreferenceOpt
  * Storage key for persisting onboarding completion state.
  */
 export declare const ONBOARDING_STORAGE_KEY = "welcomeOnboarding.state";
+/**
+ * Regex matching a single-word GHE instance slug (e.g. "octocat").
+ * Only allows characters valid in DNS hostnames (letters, digits, hyphens).
+ */
+export declare const GHE_DOMAIN_REGEX: RegExp;
+/**
+ * Regex matching a full GHE instance URI (e.g. "https://octocat.ghe.com").
+ */
+export declare const GHE_FULL_URI_REGEX: RegExp;
+export declare enum GheParseResultKind {
+    Empty = "empty",
+    SingleWord = "singleWord",
+    FullUri = "fullUri",
+    Invalid = "invalid"
+}
+export type GheParseResult = {
+    readonly kind: GheParseResultKind.Empty;
+} | {
+    readonly kind: GheParseResultKind.SingleWord;
+    readonly resolvedUri: string;
+} | {
+    readonly kind: GheParseResultKind.FullUri;
+    readonly resolvedUri: string;
+} | {
+    readonly kind: GheParseResultKind.Invalid;
+};
+/**
+ * Parses a GHE instance input value and returns the result kind and resolved URI.
+ */
+export declare function parseGheInstanceInput(value: string): GheParseResult;

package/vscode/src/vs/workbench/contrib/welcomeOnboarding/common/onboardingTypes.js

@@ -12,25 +12,25 @@ var OnboardingStepId;
 function getOnboardingStepTitle(stepId) {
     switch (stepId) {
     case OnboardingStepId.SignIn:
-        return localize(16159, "Sign In");
+        return localize(16370, "Sign In");
     case OnboardingStepId.Personalize:
-        return localize(16160, "Make It Yours");
+        return localize(16371, "Make It Yours");
     case OnboardingStepId.AiPreference:
-        return localize(16161, "Your AI Style");
+        return localize(16372, "Your AI Style");
     case OnboardingStepId.AgentSessions:
-        return localize(16162, "Build with AI Agents");
+        return localize(16373, "Build with AI Agents");
     }
 }
 function getOnboardingStepSubtitle(stepId) {
     switch (stepId) {
     case OnboardingStepId.SignIn:
-        return localize(16163, "Sync settings, unlock AI features, and connect to GitHub");
+        return localize(16374, "Sync settings, unlock AI features, and connect to GitHub");
     case OnboardingStepId.Personalize:
-        return localize(16164, "Choose your theme and keyboard mapping");
+        return localize(16375, "Choose your theme and keyboard mapping");
     case OnboardingStepId.AiPreference:
-        return localize(16165, "Choose how much AI collaboration fits your workflow");
+        return localize(16376, "Choose how much AI collaboration fits your workflow");
     case OnboardingStepId.AgentSessions:
-        return localize(16166, "Open Chat anytime with {0}", isMacintosh ? "⌘⌃I" : "Ctrl+Alt+I");
+        return localize(16377, "Open Chat anytime with {0}", isMacintosh ? "⌘⌃I" : "Ctrl+Alt+I");
     }
 }
 const ONBOARDING_STEPS = [
@@ -46,29 +46,62 @@ var AiCollaborationMode;
 })(AiCollaborationMode || (AiCollaborationMode = {}));
 const ONBOARDING_AI_PREFERENCE_OPTIONS = [{
     id: AiCollaborationMode.CodeFirst,
-    label: ( localize(16167, "I Write the Code")),
+    label: ( localize(16378, "I Write the Code")),
     description: ( localize(
-        16168,
+        16379,
         "AI assists with suggestions and answers questions when you ask. You stay in control of every edit."
     )),
     icon: "edit"
 }, {
     id: AiCollaborationMode.Balanced,
-    label: ( localize(16169, "Side by Side")),
+    label: ( localize(16380, "Side by Side")),
     description: ( localize(
-        16170,
+        16381,
         "Inline suggestions plus a chat panel for deeper collaboration. A balance of writing and delegating."
     )),
     icon: "layoutSidebarRight"
 }, {
     id: AiCollaborationMode.AgentForward,
-    label: ( localize(16171, "AI Takes the Lead")),
+    label: ( localize(16382, "AI Takes the Lead")),
     description: ( localize(
-        16172,
+        16383,
         "Let the agent drive — describe what you want and review the result. Great for scaffolding and exploration."
     )),
     icon: "copilot"
 }];
 const ONBOARDING_STORAGE_KEY = "welcomeOnboarding.state";
+const GHE_DOMAIN_REGEX = /^[a-zA-Z0-9-]+$/;
+const GHE_FULL_URI_REGEX = /^(https:\/\/)?([a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]+\.ghe\.com\/?$/;
+var GheParseResultKind;
+(function(GheParseResultKind) {
+    GheParseResultKind["Empty"] = "empty";
+    GheParseResultKind["SingleWord"] = "singleWord";
+    GheParseResultKind["FullUri"] = "fullUri";
+    GheParseResultKind["Invalid"] = "invalid";
+})(GheParseResultKind || (GheParseResultKind = {}));
+function parseGheInstanceInput(value) {
+    const trimmed = value.trim();
+    if (!trimmed) {
+        return {
+            kind: GheParseResultKind.Empty
+        };
+    }
+    if (GHE_DOMAIN_REGEX.test(trimmed)) {
+        return {
+            kind: GheParseResultKind.SingleWord,
+            resolvedUri: `https://${trimmed}.ghe.com`
+        };
+    }
+    if (GHE_FULL_URI_REGEX.test(trimmed)) {
+        const resolvedUri = trimmed.toLowerCase().startsWith("https://") ? trimmed : `https://${trimmed}`;
+        return {
+            kind: GheParseResultKind.FullUri,
+            resolvedUri
+        };
+    }
+    return {
+        kind: GheParseResultKind.Invalid
+    };
+}
 
-export { AiCollaborationMode, ONBOARDING_AI_PREFERENCE_OPTIONS, ONBOARDING_STEPS, ONBOARDING_STORAGE_KEY, OnboardingStepId, getOnboardingStepSubtitle, getOnboardingStepTitle };
+export { AiCollaborationMode, GHE_DOMAIN_REGEX, GHE_FULL_URI_REGEX, GheParseResultKind, ONBOARDING_AI_PREFERENCE_OPTIONS, ONBOARDING_STEPS, ONBOARDING_STORAGE_KEY, OnboardingStepId, getOnboardingStepSubtitle, getOnboardingStepTitle, parseGheInstanceInput };

package/vscode/src/vs/workbench/contrib/workspace/common/workspace.js

@@ -3,8 +3,8 @@ import { localize } from '../../../../nls.js';
 import { RawContextKey } from '../../../../platform/contextkey/common/contextkey.js';
 
 const WorkspaceTrustContext = {
-    IsEnabled: ( new RawContextKey("isWorkspaceTrustEnabled", false, ( localize(16327, "Whether the workspace trust feature is enabled.")))),
-    IsTrusted: ( new RawContextKey("isWorkspaceTrusted", false, ( localize(16328, "Whether the current workspace has been trusted by the user."))))
+    IsEnabled: ( new RawContextKey("isWorkspaceTrustEnabled", false, ( localize(16538, "Whether the workspace trust feature is enabled.")))),
+    IsTrusted: ( new RawContextKey("isWorkspaceTrusted", false, ( localize(16539, "Whether the current workspace has been trusted by the user."))))
 };
 const MANAGE_TRUST_COMMAND_ID = "workbench.trust.manage";
 

package/vscode/src/vs/workbench/services/accounts/browser/defaultAccount.d.ts

@@ -1,6 +1,7 @@
 import { ICopilotTokenInfo, IDefaultAccount, IDefaultAccountAuthenticationProvider, IPolicyData } from "../../../../base/common/defaultAccount.js";
+import { Event } from "../../../../base/common/event.js";
 import { Disposable } from "../../../../base/common/lifecycle.js";
-import { IDefaultAccountProvider } from "../../../../platform/defaultAccount/common/defaultAccount.js";
+import { IDefaultAccountProvider, ManagedSettingsFetchStatus } from "../../../../platform/defaultAccount/common/defaultAccount.js";
 import { IDefaultAccountService } from "../../../../platform/defaultAccount/common/defaultAccount.service.js";
 import { IProductService } from "../../../../platform/product/common/productService.service.js";
 export declare const DEFAULT_ACCOUNT_SIGN_IN_COMMAND = "workbench.actions.accounts.signIn";
@@ -10,13 +11,15 @@ export declare class DefaultAccountService extends Disposable implements IDefaul
     get currentDefaultAccount(): IDefaultAccount | null;
     get policyData(): IPolicyData | null;
     get copilotTokenInfo(): ICopilotTokenInfo | null;
+    get managedSettingsFetchStatus(): ManagedSettingsFetchStatus;
+    get managedSettingsFetchedAt(): number | null;
     private readonly initBarrier;
     private readonly _onDidChangeDefaultAccount;
-    readonly onDidChangeDefaultAccount: import("../../../../base/common/event.js").Event<IDefaultAccount | null>;
+    readonly onDidChangeDefaultAccount: Event<IDefaultAccount | null>;
     private readonly _onDidChangePolicyData;
-    readonly onDidChangePolicyData: import("../../../../base/common/event.js").Event<IPolicyData | null>;
+    readonly onDidChangePolicyData: Event<IPolicyData | null>;
     private readonly _onDidChangeCopilotTokenInfo;
-    readonly onDidChangeCopilotTokenInfo: import("../../../../base/common/event.js").Event<ICopilotTokenInfo | null>;
+    readonly onDidChangeCopilotTokenInfo: Event<ICopilotTokenInfo | null>;
     private readonly defaultAccountConfig?;
     private defaultAccountProvider;
     constructor(productService: IProductService);

package/vscode/src/vs/workbench/services/accounts/browser/defaultAccount.js

@@ -4,8 +4,8 @@ import { distinct } from '../../../../base/common/arrays.js';
 import { ThrottledDelayer, RunOnceScheduler, timeout } from '../../../../base/common/async.js';
 import { CancellationToken } from '../../../../base/common/cancellation.js';
 import { getErrorMessage } from '../../../../base/common/errors.js';
-import { Emitter } from '../../../../base/common/event.js';
-import { Disposable } from '../../../../base/common/lifecycle.js';
+import { Emitter, Event } from '../../../../base/common/event.js';
+import { Disposable, DisposableStore } from '../../../../base/common/lifecycle.js';
 import { equals } from '../../../../base/common/objects.js';
 import { isWeb } from '../../../../base/common/platform.js';
 import { isUndefined, isString } from '../../../../base/common/types.js';
@@ -19,7 +19,7 @@ import { IDefaultAccountService } from '../../../../platform/defaultAccount/comm
 import { IInstantiationService } from '../../../../platform/instantiation/common/instantiation.js';
 import { ILogService } from '../../../../platform/log/common/log.service.js';
 import { IProductService } from '../../../../platform/product/common/productService.service.js';
-import { asJson, isSuccess, isClientError } from '../../../../platform/request/common/request.js';
+import { asJson, isSuccess, isClientError, readHeader, retryAfterFromHeaders } from '../../../../platform/request/common/request.js';
 import { IRequestService } from '../../../../platform/request/common/request.service.js';
 import { StorageScope, StorageTarget } from '../../../../platform/storage/common/storage.js';
 import { IStorageService } from '../../../../platform/storage/common/storage.service.js';
@@ -29,6 +29,7 @@ import { IAuthenticationService, IAuthenticationExtensionsService } from '../../
 import { IWorkbenchEnvironmentService } from '../../environment/common/environmentService.service.js';
 import { IExtensionService } from '../../extensions/common/extensions.service.js';
 import { IHostService } from '../../host/browser/host.service.js';
+import { adaptManagedSettings } from './managedSettings.js';
 
 const DEFAULT_ACCOUNT_SIGN_IN_COMMAND = "workbench.actions.accounts.signIn";
 var DefaultAccountStatus;
@@ -40,6 +41,7 @@ var DefaultAccountStatus;
 const CONTEXT_DEFAULT_ACCOUNT_STATE = ( new RawContextKey("defaultAccountStatus", DefaultAccountStatus.Uninitialized));
 const CACHED_POLICY_DATA_KEY = "defaultAccount.cachedPolicyData";
 const ACCOUNT_DATA_POLL_INTERVAL_MS = 60 * 60 * 1000;
+const MANAGED_SETTINGS_REQUEST_TIMEOUT_MS = 5000;
 function toDefaultAccountConfig(defaultChatAgent) {
     return {
         preferredExtensions: [defaultChatAgent.chatExtensionId, defaultChatAgent.extensionId],
@@ -58,7 +60,8 @@ function toDefaultAccountConfig(defaultChatAgent) {
         },
         entitlementUrl: defaultChatAgent.entitlementUrl,
         tokenEntitlementUrl: defaultChatAgent.tokenEntitlementUrl,
-        mcpRegistryDataUrl: defaultChatAgent.mcpRegistryDataUrl
+        mcpRegistryDataUrl: defaultChatAgent.mcpRegistryDataUrl,
+        managedSettingsUrl: defaultChatAgent.managedSettingsUrl
     };
 }
 let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
@@ -71,6 +74,12 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
     get copilotTokenInfo() {
         return this._copilotTokenInfo;
     }
+    get managedSettingsFetchStatus() {
+        return this._managedSettingsFetchStatus;
+    }
+    get managedSettingsFetchedAt() {
+        return this._policyData?.managedSettingsFetchedAt ?? null;
+    }
     constructor(
         defaultAccountConfig,
         configurationService,
@@ -102,6 +111,7 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
         this._defaultAccount = null;
         this._policyData = null;
         this._copilotTokenInfo = null;
+        this._managedSettingsFetchStatus = null;
         this._onDidChangeDefaultAccount = this._register(( new Emitter()));
         this.onDidChangeDefaultAccount = this._onDidChangeDefaultAccount.event;
         this._onDidChangePolicyData = this._register(( new Emitter()));
@@ -111,6 +121,7 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
         this.initialized = false;
         this.updateThrottler = this._register(( new ThrottledDelayer(100)));
         this.accountDataPollScheduler = this._register(( new RunOnceScheduler(() => this.refetchDefaultAccount(), ACCOUNT_DATA_POLL_INTERVAL_MS)));
+        this._rateLimitBackoffUntil = 0;
         this.accountStatusContext = CONTEXT_DEFAULT_ACCOUNT_STATE.bindTo(contextKeyService);
         const cachedAccountData = this.getCachedAccountData();
         this._policyData = cachedAccountData?.accountPolicyData ?? null;
@@ -181,15 +192,7 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
             this.logService.debug("[DefaultAccount] Running in web without remote, skipping initialization");
             return;
         }
-        try {
-            await this.extensionService.whenInstalledExtensionsRegistered();
-            this.logService.debug("[DefaultAccount] Installed extensions registered.");
-        } catch (error) {
-            this.logService.error(
-                "[DefaultAccount] Error while waiting for installed extensions to be registered",
-                getErrorMessage(error)
-            );
-        }
+        await this.whenDefaultAccountAuthenticationProviderAvailable();
         this.logService.debug("[DefaultAccount] Starting initialization");
         await this.doUpdateDefaultAccount();
         this.logService.debug("[DefaultAccount] Initialization complete");
@@ -251,6 +254,51 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
             }
         }));
     }
+    async whenDefaultAccountAuthenticationProviderAvailable() {
+        const provider = this.getDefaultAccountAuthenticationProvider();
+        this.logService.debug(
+            "[DefaultAccount] Waiting for default account authentication provider to be available."
+        );
+        const disposables = ( new DisposableStore());
+        try {
+            await ( new Promise(resolve => {
+                if (this.isAccountProviderAvailable(provider)) {
+                    this.logService.debug(
+                        "[DefaultAccount] Default account authentication provider is now available."
+                    );
+                    resolve();
+                    return;
+                }
+                disposables.add(Event.any(
+                    this.authenticationService.onDidChangeDeclaredProviders,
+                    this.authenticationService.onDidRegisterAuthenticationProvider
+                )(() => {
+                    if (this.isAccountProviderAvailable(provider)) {
+                        this.logService.debug(
+                            "[DefaultAccount] Default account authentication provider is now available."
+                        );
+                        resolve();
+                    }
+                }));
+                if (this.environmentService.remoteAuthority) {
+                    void this.authenticationService.getSessions(provider.id, undefined, {}, true);
+                }
+                this.extensionService.whenInstalledExtensionsRegistered().then(() => {
+                    disposables.dispose();
+                    this.logService.debug("[DefaultAccount] Installed extensions registered.");
+                    resolve();
+                }, error => {
+                    this.logService.error(
+                        "[DefaultAccount] Error while waiting for installed extensions to be registered",
+                        getErrorMessage(error)
+                    );
+                    resolve();
+                });
+            }));
+        } finally {
+            disposables.dispose();
+        }
+    }
     async refresh(options) {
         if (!this.initialized) {
             await this.initPromise;
@@ -292,16 +340,18 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
     async fetchDefaultAccount(options) {
         const defaultAccountProvider = this.getDefaultAccountAuthenticationProvider();
         this.logService.debug("[DefaultAccount] Default account provider ID:", defaultAccountProvider.id);
-        const declaredProvider = this.authenticationService.declaredProviders.find(provider => provider.id === defaultAccountProvider.id);
-        if (!declaredProvider) {
+        if (!this.isAccountProviderAvailable(defaultAccountProvider)) {
             this.logService.info(
-                `[DefaultAccount] Authentication provider is not declared.`,
+                `[DefaultAccount] Authentication provider is not available.`,
                 defaultAccountProvider
             );
             return null;
         }
         return await this.getDefaultAccountForAuthenticationProvider(defaultAccountProvider, options);
     }
+    isAccountProviderAvailable(accountProvider) {
+        return ( this.authenticationService.declaredProviders.some(p => p.id === accountProvider.id)) || this.authenticationService.isAuthenticationProviderRegistered(accountProvider.id);
+    }
     setDefaultAccount(account) {
         if (equals(this._defaultAccount, account)) {
             return;
@@ -413,18 +463,25 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
             const entitlementsResult = await this.getEntitlements(sessions, accountPolicyData, options);
             const entitlementsData = entitlementsResult?.data;
             const entitlementsFetchedAt = entitlementsResult?.fetchedAt;
-            const tokenEntitlementsResult = entitlementsData?.chat_enabled ? await this.getTokenEntitlements(sessions, accountPolicyData, options) : undefined;
+            const [tokenEntitlementsResult, managedSettingsResult] = entitlementsData?.chat_enabled ? await Promise.all([
+                this.getTokenEntitlements(sessions, accountPolicyData, options),
+                this.getManagedSettings(sessions, accountPolicyData, options)
+            ]) : [undefined, undefined];
             const tokenEntitlementsFetchedAt = tokenEntitlementsResult?.fetchedAt;
+            const managedSettingsFetchedAt = managedSettingsResult?.fetchedAt;
             let mcpRegistryDataFetchedAt;
             let policyData = accountPolicyData?.policyData ? {
                 ...accountPolicyData.policyData
             } : undefined;
+            if (entitlementsData) {
+                policyData = policyData ?? {};
+                policyData.cloud_session_storage_enabled = entitlementsData.cloud_session_storage_enabled;
+            }
             if (tokenEntitlementsResult?.data) {
                 const tokenEntitlementsData = tokenEntitlementsResult.data;
                 policyData = policyData ?? {};
                 policyData.chat_agent_enabled = tokenEntitlementsData.policyData.chat_agent_enabled;
                 policyData.chat_preview_features_enabled = tokenEntitlementsData.policyData.chat_preview_features_enabled;
-                policyData.cloud_session_storage_enabled = tokenEntitlementsData.policyData.cloud_session_storage_enabled;
                 policyData.mcp = tokenEntitlementsData.policyData.mcp;
                 if (policyData.mcp) {
                     const mcpRegistryResult = await this.getMcpRegistryProvider(sessions, accountPolicyData, options);
@@ -436,6 +493,12 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
                     policyData.mcpAccess = undefined;
                 }
             }
+            if (managedSettingsResult?.data) {
+                policyData = {
+                    ...(policyData ?? {}),
+                    ...managedSettingsResult.data
+                };
+            }
             const defaultAccount = {
                 authenticationProvider,
                 accountName: sessions[0].account.label,
@@ -452,7 +515,8 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
                 policyData: policyData ?? {},
                 entitlementsFetchedAt,
                 tokenEntitlementsFetchedAt,
-                mcpRegistryDataFetchedAt
+                mcpRegistryDataFetchedAt,
+                managedSettingsFetchedAt
             } : null;
             return {
                 defaultAccount,
@@ -567,8 +631,7 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
                     policyData: {
                         chat_preview_features_enabled: tokenMap.get("editor_preview_features") !== "0",
                         chat_agent_enabled: tokenMap.get("agent_mode") !== "0",
-                        mcp: tokenMap.get("mcp") === "1",
-                        cloud_session_storage_enabled: ( tokenMap.has("cloud_session_storage_enabled")) ? tokenMap.get("cloud_session_storage_enabled") === "1" : undefined
+                        mcp: tokenMap.get("mcp") === "1"
                     },
                     copilotTokenInfo: {
                         sn: tokenMap.get("sn"),
@@ -705,7 +768,117 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
             return undefined;
         }
     }
-    async request(url, type, body, sessions, token, callSite) {
+    async getManagedSettings(sessions, accountPolicyData, options) {
+        if (!options?.forceRefresh && accountPolicyData?.managedSettingsFetchedAt && !this.isDataStale(accountPolicyData.managedSettingsFetchedAt)) {
+            this.logService.debug("[DefaultAccount] Using last fetched managed settings data");
+            this._managedSettingsFetchStatus = "ok";
+            return {
+                data: {
+                    enabledPlugins: accountPolicyData.policyData.enabledPlugins,
+                    extraKnownMarketplaces: accountPolicyData.policyData.extraKnownMarketplaces,
+                    strictKnownMarketplaces: accountPolicyData.policyData.strictKnownMarketplaces
+                },
+                fetchedAt: accountPolicyData.managedSettingsFetchedAt
+            };
+        }
+        const data = await this.requestManagedSettings(sessions);
+        return {
+            data,
+            fetchedAt: Date.now()
+        };
+    }
+    async requestManagedSettings(sessions) {
+        const managedSettingsUrl = this.getManagedSettingsUrl();
+        if (!managedSettingsUrl) {
+            this.logService.debug(
+                "[DefaultAccount] No managed settings URL configured; skipping enterprise policy fetch"
+            );
+            this._managedSettingsFetchStatus = "no-url";
+            return undefined;
+        }
+        this.logService.debug("[DefaultAccount] Fetching managed settings from:", managedSettingsUrl);
+        const rateLimitBackoffActive = Date.now() < this._rateLimitBackoffUntil;
+        const response = await this.request(
+            managedSettingsUrl,
+            "GET",
+            undefined,
+            sessions,
+            CancellationToken.None,
+            "defaultAccount.managedSettings",
+            MANAGED_SETTINGS_REQUEST_TIMEOUT_MS
+        );
+        if (!response) {
+            this.logService.debug(
+                "[DefaultAccount] Managed settings fetch returned no response (network error, all sessions rejected, or active rate-limit backoff); falling back to local-only policy"
+            );
+            this.reportManagedSettingsOutcome("no-response", rateLimitBackoffActive);
+            return undefined;
+        }
+        if (!isSuccess(response)) {
+            const status = response.res.statusCode ?? 0;
+            this.logService.warn(
+                `[DefaultAccount] Managed settings fetch returned non-success status ${status}; falling back to local-only policy`
+            );
+            this.reportManagedSettingsOutcome(status, rateLimitBackoffActive);
+            return undefined;
+        }
+        try {
+            const data = await asJson(response);
+            this.logService.trace(
+                "[DefaultAccount] Managed settings raw response:",
+                JSON.stringify(data ?? null)
+            );
+            const adapted = adaptManagedSettings(data ?? {}, msg => this.logService.warn(msg));
+            const pluginCount = adapted.enabledPlugins ? ( Object.keys(adapted.enabledPlugins)).length : 0;
+            const marketplaceCount = adapted.extraKnownMarketplaces?.length ?? 0;
+            const strictSet = adapted.strictKnownMarketplaces !== undefined;
+            if (pluginCount === 0 && marketplaceCount === 0 && !strictSet) {
+                this.logService.debug(
+                    "[DefaultAccount] Managed settings fetched (empty response — no enterprise policy file present)"
+                );
+            } else {
+                this.logService.info("[DefaultAccount] Managed settings applied");
+                this.logService.trace("[DefaultAccount] Managed settings payload:", JSON.stringify(adapted));
+            }
+            this.reportManagedSettingsOutcome("ok", rateLimitBackoffActive);
+            return adapted;
+        } catch (error) {
+            this.logService.error(
+                "[DefaultAccount] Failed to parse managed settings response",
+                getErrorMessage(error)
+            );
+            this.reportManagedSettingsOutcome("parse-error", rateLimitBackoffActive);
+            return undefined;
+        }
+    }
+    reportManagedSettingsOutcome(status, rateLimitBackoffActive) {
+        this._managedSettingsFetchStatus = status;
+        this.telemetryService.publicLog2("defaultaccount:managedSettings:fetch", {
+            outcome: typeof status === "number" ? `status:${status}` : status,
+            rateLimitBackoffActive
+        });
+    }
+    isRateLimited(response) {
+        const status = response.res.statusCode;
+        if (status === 429) {
+            return true;
+        }
+        if (status === 403 && readHeader(response.res.headers, "x-ratelimit-remaining") === "0") {
+            return true;
+        }
+        if (!isSuccess(response) && readHeader(response.res.headers, "retry-after") !== undefined) {
+            return true;
+        }
+        return false;
+    }
+    async request(url, type, body, sessions, token, callSite, requestTimeoutMs) {
+        if (Date.now() < this._rateLimitBackoffUntil) {
+            const remainingSec = Math.ceil((this._rateLimitBackoffUntil - Date.now()) / 1000);
+            this.logService.debug(
+                `[DefaultAccount] Skipping request to ${url} — rate-limit backoff active for ${remainingSec}s more`
+            );
+            return undefined;
+        }
         let lastResponse;
         for (const session of sessions) {
             if (token.isCancellationRequested) {
@@ -717,12 +890,21 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
                     url,
                     data: type === "POST" ? JSON.stringify(body) : undefined,
                     disableCache: true,
+                    timeout: requestTimeoutMs,
                     headers: {
                         "Authorization": `Bearer ${session.accessToken}`
                     },
                     callSite
                 }, token);
                 const status = response.res.statusCode;
+                if (this.isRateLimited(response)) {
+                    const retryAfterSec = retryAfterFromHeaders(response.res.headers) ?? 60;
+                    this._rateLimitBackoffUntil = Date.now() + retryAfterSec * 1000;
+                    this.logService.warn(
+                        `[DefaultAccount] Rate limited by ${url} (status ${status}); backing off for ${retryAfterSec}s`
+                    );
+                    return response;
+                }
                 if (status === 401 || status === 404) {
                     this.logService.debug(
                         `[DefaultAccount] Received ${status} for URL ${url} with session ${session.id}, likely due to expired/revoked token or insufficient permissions.`,
@@ -789,6 +971,20 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
         }
         return this.defaultAccountConfig.mcpRegistryDataUrl;
     }
+    getManagedSettingsUrl() {
+        if (this.getDefaultAccountAuthenticationProvider().enterprise) {
+            try {
+                const enterpriseUrl = this.getEnterpriseUrl();
+                if (!enterpriseUrl) {
+                    return undefined;
+                }
+                return `${enterpriseUrl.protocol}//api.${enterpriseUrl.hostname}${enterpriseUrl.port ? ":" + enterpriseUrl.port : ""}/copilot_internal/managed_settings`;
+            } catch (error) {
+                this.logService.error(error);
+            }
+        }
+        return this.defaultAccountConfig.managedSettingsUrl;
+    }
     getDefaultAccountAuthenticationProvider() {
         if (this.configurationService.getValue(this.defaultAccountConfig.authenticationProvider.enterpriseProviderConfig) === this.defaultAccountConfig.authenticationProvider.enterprise.id) {
             return {
@@ -870,7 +1066,7 @@ registerAction2(class extends Action2 {
     constructor() {
         super({
             id: DEFAULT_ACCOUNT_SIGN_IN_COMMAND,
-            title: ( localize2(16335, "Sign In"))
+            title: ( localize2(16546, "Sign In"))
         });
     }
     async run(accessor) {

package/vscode/src/vs/workbench/services/accounts/browser/managedSettings.d.ts

@@ -0,0 +1,45 @@
+import { IPolicyData } from "../../../../base/common/defaultAccount.js";
+/**
+ * Response shape from the Copilot `/copilot_internal/managed_settings` endpoint.
+ * The endpoint returns `.github/copilot/settings.json` content from the
+ * enterprise's source org. An empty response (`{}`) is success and means
+ * "no policy file present".
+ *
+ * Unknown keys are silently ignored via the index signature so the client is
+ * forward-compatible with future additions to the registry schema.
+ *
+ * Exported for unit-testing the {@link adaptManagedSettings} shape transformation.
+ */
+export interface IManagedSettingsResponse {
+    readonly enabledPlugins?: Record<string, boolean>;
+    readonly extraKnownMarketplaces?: Record<string, {
+        readonly source: {
+            readonly source: "github";
+            readonly repo: string;
+            readonly ref?: string;
+        } | {
+            readonly source: "git";
+            readonly url: string;
+            readonly ref?: string;
+        };
+    }>;
+    readonly strictKnownMarketplaces?: boolean;
+    /** Any unknown keys in the response are silently ignored for forward compatibility. */
+    readonly [key: string]: unknown;
+}
+/**
+ * Adapt the `managed_settings` API response into the slice of {@link IPolicyData}
+ * that the policy framework consumes. `extraKnownMarketplaces` is converted from
+ * the API's `Record<id, { source }>` map shape to a flat array of
+ * {@link IExtraKnownMarketplaceEntry} objects, preserving the marketplace `name`
+ * (used downstream as `displayLabel` so that `enabledPlugins["plugin@<name>"]`
+ * keys resolve correctly), the source discriminator, and any `ref`.
+ *
+ * Each field is validated independently at runtime — malformed or off-spec
+ * shapes are dropped (with an optional warning via {@link onWarn}) rather than
+ * throwing, so a bad enterprise settings file degrades gracefully instead of
+ * blocking startup.
+ *
+ * Exported for unit-testing the shape transformation independently of network I/O.
+ */
+export declare function adaptManagedSettings(response: IManagedSettingsResponse, onWarn?: (msg: string) => void): Partial<IPolicyData>;