@codingame/monaco-vscode-api 34.1.3 → 35.0.0

package/vscode/src/vs/platform/policy/common/copilotManagedSettings.d.ts

@@ -0,0 +1,201 @@
+import { Event } from "../../../base/common/event.js";
+import { IPolicyData } from "../../../base/common/defaultAccount.js";
+import { IManagedSettingsPolicyDefinitions, ManagedSettingValue, ManagedSettingsData } from "../../../base/common/policy.js";
+import { IStringDictionary } from "../../../base/common/collections.js";
+import { PolicyDefinition } from "./policy.js";
+import { INativeManagedSettingsService, type IFileManagedSettingsService } from "./copilotManagedSettings.service.js";
+export type { ManagedSettingsData } from "../../../base/common/policy.js";
+/** Windows registry root for GitHub Copilot policies. */
+export declare const GITHUB_COPILOT_WIN32_REGISTRY_PATH = "SOFTWARE\\Policies\\GitHubCopilot";
+/** Windows product name passed to the native policy watcher. */
+export declare const GITHUB_COPILOT_WIN32_POLICY_NAME = "GitHubCopilot";
+/** macOS CFPreferences application ID for GitHub Copilot managed preferences. */
+export declare const GITHUB_COPILOT_MACOS_BUNDLE_ID = "com.github.copilot";
+/** MDM key for the V0 managed setting. */
+export declare const COPILOT_DISABLE_BYPASS_PERMISSIONS_MODE_KEY = "permissions.disableBypassPermissionsMode";
+/** Managed-settings key for enterprise plugin enablement (carried as a JSON-encoded `{ [pluginId]: boolean }`). */
+export declare const COPILOT_ENABLED_PLUGINS_KEY = "enabledPlugins";
+/** Managed-settings key for enterprise marketplaces (carried as a JSON-encoded `{ [name]: url-or-shorthand }`). */
+export declare const COPILOT_EXTRA_MARKETPLACES_KEY = "extraKnownMarketplaces";
+/** Managed-settings key for the strict-marketplace allowlist (carried as a JSON-encoded array of source entries; absent = no restrictions, `[]` = lockdown). */
+export declare const COPILOT_STRICT_MARKETPLACES_KEY = "strictKnownMarketplaces";
+/** Managed-settings key for the default chat model (carried as a plain string: `auto`, a model family name, or a full model id). */
+export declare const COPILOT_MODEL_KEY = "model";
+/**
+ * Enterprise OTel managed-settings keys. These are the scalar leaves of the canonical
+ * `telemetry` block from the cross-client managed-settings schema (see the CLI
+ * `ManagedTelemetrySettings`); they flatten to dot-path bag keys via
+ * {@link normalizeManagedSettings}, so no {@link STRUCTURED_MANAGED_SETTINGS} entry is needed.
+ * The `telemetry.resourceAttributes` and `telemetry.headers` map fields are structured
+ * ({@link STRUCTURED_MANAGED_SETTINGS} rows carry them as JSON-encoded objects under their nested
+ * keys); `telemetry.serviceName` is a scalar.
+ */
+/** Managed-settings key for enterprise OTel enablement. */
+export declare const COPILOT_OTEL_ENABLED_KEY = "telemetry.enabled";
+/** Managed-settings key for the enterprise OTLP collector endpoint. */
+export declare const COPILOT_OTEL_ENDPOINT_KEY = "telemetry.endpoint";
+/** Managed-settings key for the enterprise OTLP protocol (`http/json`, `http/protobuf`, or `grpc`). */
+export declare const COPILOT_OTEL_PROTOCOL_KEY = "telemetry.protocol";
+/** Managed-settings key for enterprise OTel content capture. */
+export declare const COPILOT_OTEL_CAPTURE_CONTENT_KEY = "telemetry.captureContent";
+/** Managed-settings key that prevents users from enabling OTel content capture themselves. */
+export declare const COPILOT_OTEL_LOCK_CAPTURE_CONTENT_KEY = "telemetry.lockCaptureContent";
+/** Managed-settings key for the OTel `service.name` resource attribute. */
+export declare const COPILOT_OTEL_SERVICE_NAME_KEY = "telemetry.serviceName";
+/** Managed-settings key for additional OTel resource attributes (a `{ [k]: string }` map). */
+export declare const COPILOT_OTEL_RESOURCE_ATTRIBUTES_KEY = "telemetry.resourceAttributes";
+/** Managed-settings key for extra OTLP exporter headers (a `{ [k]: string }` map). */
+export declare const COPILOT_OTEL_HEADERS_KEY = "telemetry.headers";
+/**
+ * Standard pass-through `value` callback for a managed-settings-driven policy: locks the setting
+ * to the managed value when the enterprise has set it, and returns `undefined` otherwise so the
+ * user's own setting falls through. Use for the common case; policies that combine the managed
+ * value with other conditions (e.g. `chat_preview_features_enabled`) keep a custom callback.
+ *
+ * The callback is memoized per key, so repeated calls for the same key return the SAME function
+ * reference. That reference identity is what lets `isSamePolicyDefinition` skip needless
+ * re-registration, and memoizing makes the guarantee hold regardless of where the helper is called.
+ */
+export declare function managedSettingValue(key: string): (policyData: IPolicyData) => ManagedSettingValue | undefined;
+/**
+ * `value` callback for the default-chat-model managed setting ({@link COPILOT_MODEL_KEY}). Like
+ * {@link managedSettingValue} it locks the setting to the managed value and otherwise falls through
+ * to the user's own value, but it additionally trims the string and treats a blank/whitespace-only
+ * value as "unset" (returns `undefined`) — an admin clearing the field must not lock the setting to
+ * an empty string. The model-specific normalization lives here, alongside the other managed-settings
+ * handling, rather than inline at the policy declaration, so every managed-settings control is wired
+ * the same way.
+ *
+ * Memoized (single key) so repeated calls return the SAME function reference, matching the
+ * reference-identity contract {@link managedSettingValue} relies on for `isSamePolicyDefinition`.
+ */
+export declare function managedModelValue(): (policyData: IPolicyData) => ManagedSettingValue | undefined;
+export declare class NullNativeManagedSettingsService implements INativeManagedSettingsService {
+    readonly _serviceBrand: undefined;
+    readonly managedSettings: ManagedSettingsData;
+    readonly onDidChangeManagedSettings: Event<any>;
+    updatePolicyDefinitions(): Promise<ManagedSettingsData>;
+}
+/**
+ * Aggregate the `managedSettings` declarations of every policy definition into a single
+ * key -> definition map. This is the single source of truth for which Copilot managed-settings
+ * keys (and their value types) are honored, and it drives both delivery channels: the native
+ * MDM watcher and the server `managed_settings` endpoint projection.
+ */
+export declare function collectManagedSettingsDefinitions(policyDefinitions: IStringDictionary<PolicyDefinition>): IManagedSettingsPolicyDefinitions;
+/**
+ * Whether any policy in `policyDefinitions` declares at least one managed-settings key. Cheap
+ * existence check (short-circuits) used to decide whether the native MDM watcher is needed at all,
+ * without aggregating the full {@link collectManagedSettingsDefinitions} map.
+ */
+export declare function hasManagedSettingsDefinitions(policyDefinitions: IStringDictionary<PolicyDefinition>): boolean;
+/**
+ * Project a raw managed-settings bag onto the declared schema: keep only keys declared by a
+ * policy definition whose runtime value matches the declared type. Undeclared keys and
+ * type-mismatched values are dropped (with an optional warning). Values are validated, never
+ * coerced, so a key declared as `string` keeps its string value untouched.
+ *
+ * This keeps the server endpoint and native MDM delivery aligned on the same
+ * declaration-driven key set and value types.
+ */
+export declare function projectManagedSettings(values: ManagedSettingsData, definitions: IManagedSettingsPolicyDefinitions, onWarn?: (msg: string) => void): ManagedSettingsData;
+/**
+ * A delivery channel that can provide managed settings. Managed settings can be delivered by more
+ * than one channel, so this names the known sources to give policy evaluation and the Policy
+ * Diagnostics report one shared vocabulary. Extend this union (and {@link MANAGED_SETTINGS_CHANNELS}
+ * / {@link pickManagedSettings}) when adding a new channel.
+ */
+export type ManagedSettingsChannel = 
+/** GitHub `/copilot_internal/managed_settings` endpoint (server-delivered). */
+"server"
+/** Native MDM: OS registry (Windows) / managed preferences (macOS) via `@vscode/policy-watcher`. */
+ | "nativeMdm"
+/** File on a well-known disk path (`managed-settings.json`). */
+ | "file";
+/**
+ * The source attributed to an effective managed setting (or to the overall report). A
+ * {@link ManagedSettingsChannel} once a channel has won, or `'none'` when no channel contributes.
+ */
+export type ManagedSettingsSource = ManagedSettingsChannel | "none";
+/**
+ * The delivery channels in fixed precedence order (highest first): native MDM → server-delivered →
+ * file on disk. This single ordered list drives the per-key resolution in {@link pickManagedSettings}
+ * and is the one place to extend when a new channel is introduced. Rationale for the order: the
+ * server is harder to bypass than local MDM, and a local file is the most easily tampered with.
+ */
+export declare const MANAGED_SETTINGS_CHANNELS: readonly ManagedSettingsChannel[];
+/** A single channel's contribution to a managed-settings key, for provenance in the resolution. */
+export interface IManagedSettingsContribution {
+    /** The channel that supplied this value. */
+    readonly channel: ManagedSettingsChannel;
+    /** The value the channel supplied for the key. */
+    readonly value: ManagedSettingValue;
+}
+/** How a single managed-settings key was resolved across the delivery channels. */
+export interface IManagedSettingResolution {
+    /** The effective (winning) value applied for the key. */
+    readonly value: ManagedSettingValue;
+    /** The channel whose value won (always the first {@link contributions} entry's channel). */
+    readonly source: ManagedSettingsChannel;
+    /** Every channel that supplied this key, in precedence order (winner first, overridden after). */
+    readonly contributions: readonly IManagedSettingsContribution[];
+}
+/** The result of merging managed settings from every delivery channel on a per-key basis. */
+export interface IManagedSettingsPick {
+    /** The effective merged bag: the winning value for each key contributed by any channel. */
+    readonly values: ManagedSettingsData;
+    /** Per-key provenance: how each key resolved and which channels were overridden. */
+    readonly resolutions: ReadonlyMap<string, IManagedSettingResolution>;
+    /** The channels that supplied at least one *winning* key, in precedence order. */
+    readonly activeSources: readonly ManagedSettingsChannel[];
+}
+/**
+ * Merge the managed-settings bags from every delivery channel on a **per-key** basis.
+ *
+ * Precedence (highest first): native MDM → server-delivered → file on disk. Unlike a single
+ * authoritative source, the channels *are* merged key-by-key: for each key the highest-precedence
+ * channel that supplies it wins, but a key that the higher channels never set is still filled in by
+ * a lower channel. A value an admin locks via native MDM therefore cannot be overwritten by the
+ * server or a file, while keys those higher channels leave unset remain available to lower ones.
+ *
+ * The parameter order matches the precedence so call sites read top-to-bottom. Centralizing the
+ * resolution here (rather than inlining it at each call site) keeps policy evaluation
+ * ({@link AccountPolicyService.getPolicyData}) and the Policy Diagnostics report from drifting apart,
+ * and gives one obvious place to extend when a new channel is introduced. Empty or absent channels
+ * contribute nothing.
+ */
+export declare function pickManagedSettings(nativeMdm: ManagedSettingsData | undefined, server: ManagedSettingsData | undefined, file: ManagedSettingsData | undefined): IManagedSettingsPick;
+/** macOS well-known path for file-based managed settings. */
+export declare const MANAGED_SETTINGS_MACOS_FILE_PATH = "/Library/Application Support/GitHubCopilot/managed-settings.json";
+/** Linux well-known path for file-based managed settings. */
+export declare const MANAGED_SETTINGS_LINUX_FILE_PATH = "/etc/github-copilot/managed-settings.json";
+/** Windows directory name under %ProgramFiles% for file-based managed settings. */
+export declare const MANAGED_SETTINGS_WINDOWS_DIR = "GitHubCopilot";
+/** Managed settings file name. */
+export declare const MANAGED_SETTINGS_FILE_NAME = "managed-settings.json";
+/**
+ * Normalize a parsed managed-settings object (from the server `managed_settings` API, a file on
+ * disk, or any other source using the managed-settings schema) into the canonical
+ * `ManagedSettingsData` bag that the policy framework consumes. This is the **single**
+ * normalization path for all delivery channels, so downstream projection and policy `value()`
+ * callbacks behave identically regardless of source. It does not enforce the declared
+ * `managedSettings` schema — dropping undeclared or type-mismatched keys happens later, at
+ * {@link projectManagedSettings}.
+ *
+ * - Scalar leaves (`permissions.*` and any forward-compatible scalar keys) are flattened into
+ *   dot-separated keys.
+ * - Structured settings (declared in {@link STRUCTURED_MANAGED_SETTINGS}) are carried as canonical
+ *   JSON strings under a single key each — the same shape an admin authors via native MDM.
+ *   `PolicyConfiguration` parses the JSON back into the object-typed setting on read.
+ *   `extraKnownMarketplaces` is normalized from the schema's `{ [id]: { source } }` map to the
+ *   `{ [name]: url-or-shorthand }` dict.
+ *
+ * Malformed marketplace entries are dropped (with an optional warning via {@link onWarn}) rather
+ * than throwing, so a bad enterprise settings file degrades gracefully instead of blocking startup.
+ */
+export declare function normalizeManagedSettings(parsed: Record<string, unknown>, onWarn?: (msg: string) => void): ManagedSettingsData;
+export declare class NullFileManagedSettingsService implements IFileManagedSettingsService {
+    readonly _serviceBrand: undefined;
+    readonly managedSettings: ManagedSettingsData;
+    readonly onDidChangeManagedSettings: Event<any>;
+}

package/vscode/src/vs/platform/policy/common/copilotManagedSettings.js

@@ -0,0 +1,269 @@
+
+import '../../../base/common/event.js';
+import { extraKnownMarketplacesToConfigDict } from '../../../base/common/managedSettings.js';
+import { isObject, isString } from '../../../base/common/types.js';
+
+const COPILOT_DISABLE_BYPASS_PERMISSIONS_MODE_KEY = "permissions.disableBypassPermissionsMode";
+const COPILOT_ENABLED_PLUGINS_KEY = "enabledPlugins";
+const COPILOT_EXTRA_MARKETPLACES_KEY = "extraKnownMarketplaces";
+const COPILOT_STRICT_MARKETPLACES_KEY = "strictKnownMarketplaces";
+const COPILOT_MODEL_KEY = "model";
+const COPILOT_OTEL_ENABLED_KEY = "telemetry.enabled";
+const COPILOT_OTEL_ENDPOINT_KEY = "telemetry.endpoint";
+const COPILOT_OTEL_PROTOCOL_KEY = "telemetry.protocol";
+const COPILOT_OTEL_CAPTURE_CONTENT_KEY = "telemetry.captureContent";
+const COPILOT_OTEL_LOCK_CAPTURE_CONTENT_KEY = "telemetry.lockCaptureContent";
+const COPILOT_OTEL_SERVICE_NAME_KEY = "telemetry.serviceName";
+const COPILOT_OTEL_RESOURCE_ATTRIBUTES_KEY = "telemetry.resourceAttributes";
+const COPILOT_OTEL_HEADERS_KEY = "telemetry.headers";
+const managedSettingValueCallbacks = ( new Map());
+function managedSettingValue(key) {
+    let callback = managedSettingValueCallbacks.get(key);
+    if (!callback) {
+        callback = policyData => policyData.managedSettings?.[key];
+        managedSettingValueCallbacks.set(key, callback);
+    }
+    return callback;
+}
+let managedModelValueCallback;
+function managedModelValue() {
+    if (!managedModelValueCallback) {
+        managedModelValueCallback = policyData => {
+            const model = policyData.managedSettings?.[COPILOT_MODEL_KEY];
+            const trimmed = typeof model === "string" ? model.trim() : undefined;
+            return trimmed ? trimmed : undefined;
+        };
+    }
+    return managedModelValueCallback;
+}
+function flattenManagedSettings(object) {
+    const result = {};
+    flattenManagedSettingsValue(object, undefined, result);
+    return result;
+}
+function flattenManagedSettingsValue(value, prefix, result) {
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+        if (prefix !== undefined) {
+            result[prefix] = value;
+        }
+        return;
+    }
+    if (!isManagedSettingsObject(value)) {
+        return;
+    }
+    for (const key in value) {
+        flattenManagedSettingsValue(value[key], prefix ? `${prefix}.${key}` : key, result);
+    }
+}
+function isManagedSettingsObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function projectManagedSettings(values, definitions, onWarn) {
+    const projected = {};
+    for (const key in definitions) {
+        const value = values[key];
+        if (value === undefined) {
+            continue;
+        }
+        if (typeof value === definitions[key].type) {
+            projected[key] = value;
+        } else {
+            onWarn?.(
+                `Ignoring managed setting "${key}": expected ${definitions[key].type}, got ${typeof value}`
+            );
+        }
+    }
+    return projected;
+}
+const MANAGED_SETTINGS_CHANNELS = ["nativeMdm", "server", "file"];
+function pickManagedSettings(nativeMdm, server, file) {
+    const bags = {
+        nativeMdm,
+        server,
+        file
+    };
+    const resolutions = ( new Map());
+    for (const channel of MANAGED_SETTINGS_CHANNELS) {
+        const bag = bags[channel];
+        if (!bag) {
+            continue;
+        }
+        for (const key of ( Object.keys(bag))) {
+            const value = bag[key];
+            if (value === undefined) {
+                continue;
+            }
+            const existing = resolutions.get(key);
+            if (existing) {
+                existing.contributions.push({
+                    channel,
+                    value
+                });
+            } else {
+                resolutions.set(key, {
+                    value,
+                    source: channel,
+                    contributions: [{
+                        channel,
+                        value
+                    }]
+                });
+            }
+        }
+    }
+    const activeSources = ( new Set());
+    const entries = [];
+    for (const [key, resolution] of resolutions) {
+        entries.push([key, resolution.value]);
+        activeSources.add(resolution.source);
+    }
+    return {
+        values: Object.fromEntries(entries),
+        resolutions,
+        activeSources: MANAGED_SETTINGS_CHANNELS.filter(channel => ( activeSources.has(channel)))
+    };
+}
+function encodeStringMap(value) {
+    if (!isObject(value)) {
+        return undefined;
+    }
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+        if (k === "__proto__" || k === "constructor" || k === "prototype") {
+            continue;
+        }
+        if (isString(v)) {
+            out[k] = v;
+        } else if (typeof v === "number" || typeof v === "boolean") {
+            out[k] = String(v);
+        }
+    }
+    return out;
+}
+function encodeObject(value) {
+    return isObject(value) ? value : undefined;
+}
+function encodeArray(value) {
+    return Array.isArray(value) ? value : undefined;
+}
+function encodeExtraMarketplaces(value, onWarn) {
+    return extraKnownMarketplacesToConfigDict(normalizeExtraKnownMarketplaces(value, onWarn));
+}
+const STRUCTURED_MANAGED_SETTINGS = [{
+    key: COPILOT_ENABLED_PLUGINS_KEY,
+    encode: encodeObject
+}, {
+    key: COPILOT_STRICT_MARKETPLACES_KEY,
+    encode: encodeArray
+}, {
+    key: COPILOT_EXTRA_MARKETPLACES_KEY,
+    encode: encodeExtraMarketplaces
+}, {
+    key: COPILOT_OTEL_RESOURCE_ATTRIBUTES_KEY,
+    encode: encodeStringMap
+}, {
+    key: COPILOT_OTEL_HEADERS_KEY,
+    encode: encodeStringMap
+}];
+function readNestedManagedKey(obj, dottedKey) {
+    let current = obj;
+    for (const segment of dottedKey.split(".")) {
+        if (!isObject(current)) {
+            return undefined;
+        }
+        current = current[segment];
+    }
+    return current;
+}
+function withNestedManagedKeyDeleted(obj, dottedKey) {
+    const dot = dottedKey.indexOf(".");
+    if (dot === -1) {
+        const clone = {
+            ...obj
+        };
+        delete clone[dottedKey];
+        return clone;
+    }
+    const head = dottedKey.slice(0, dot);
+    const child = obj[head];
+    if (!isObject(child)) {
+        return obj;
+    }
+    return {
+        ...obj,
+        [head]: withNestedManagedKeyDeleted(child, dottedKey.slice(dot + 1))
+    };
+}
+function normalizeManagedSettings(parsed, onWarn) {
+    let scalarRest = {
+        ...parsed
+    };
+    for (const setting of STRUCTURED_MANAGED_SETTINGS) {
+        scalarRest = withNestedManagedKeyDeleted(scalarRest, setting.key);
+    }
+    const result = {
+        ...flattenManagedSettings(scalarRest)
+    };
+    for (const setting of STRUCTURED_MANAGED_SETTINGS) {
+        const encoded = setting.encode(readNestedManagedKey(parsed, setting.key), onWarn);
+        if (encoded !== undefined) {
+            result[setting.key] = JSON.stringify(encoded);
+        }
+    }
+    return result;
+}
+function normalizeExtraKnownMarketplaces(value, onWarn) {
+    if (!isObject(value)) {
+        return undefined;
+    }
+    const seen = ( new Set());
+    const entries = [];
+    for (const [name, entry] of Object.entries(value)) {
+        if (!isObject(entry) || !isObject(entry.source)) {
+            onWarn?.(
+                `Skipping malformed extraKnownMarketplaces entry "${name}": expected { source: { source, repo|url } }`
+            );
+            continue;
+        }
+        const src = entry.source;
+        let normalized;
+        if (src.source === "github" && isString(src.repo)) {
+            normalized = {
+                name,
+                source: {
+                    source: "github",
+                    repo: src.repo,
+                    ...(src.ref ? {
+                        ref: src.ref
+                    } : {})
+                }
+            };
+        } else if (src.source === "git" && isString(src.url)) {
+            normalized = {
+                name,
+                source: {
+                    source: "git",
+                    url: src.url,
+                    ...(src.ref ? {
+                        ref: src.ref
+                    } : {})
+                }
+            };
+        } else if (src.source === "github" || src.source === "git") {
+            onWarn?.(
+                `Skipping extraKnownMarketplaces entry "${name}": source "${src.source}" requires ${src.source === "github" ? "\"repo\"" : "\"url\""}`
+            );
+        } else {
+            onWarn?.(
+                `Skipping extraKnownMarketplaces entry "${name}": unknown source type "${src.source}"`
+            );
+        }
+        if (normalized && !( seen.has(name))) {
+            seen.add(name);
+            entries.push(normalized);
+        }
+    }
+    return entries;
+}
+
+export { COPILOT_DISABLE_BYPASS_PERMISSIONS_MODE_KEY, COPILOT_ENABLED_PLUGINS_KEY, COPILOT_EXTRA_MARKETPLACES_KEY, COPILOT_MODEL_KEY, COPILOT_OTEL_CAPTURE_CONTENT_KEY, COPILOT_OTEL_ENABLED_KEY, COPILOT_OTEL_ENDPOINT_KEY, COPILOT_OTEL_HEADERS_KEY, COPILOT_OTEL_LOCK_CAPTURE_CONTENT_KEY, COPILOT_OTEL_PROTOCOL_KEY, COPILOT_OTEL_RESOURCE_ATTRIBUTES_KEY, COPILOT_OTEL_SERVICE_NAME_KEY, COPILOT_STRICT_MARKETPLACES_KEY, MANAGED_SETTINGS_CHANNELS, managedModelValue, managedSettingValue, normalizeManagedSettings, pickManagedSettings, projectManagedSettings };

package/vscode/src/vs/platform/policy/common/copilotManagedSettings.service.d.ts

@@ -0,0 +1,17 @@
+import { IStringDictionary } from "../../../base/common/collections.js";
+import { Event } from "../../../base/common/event.js";
+import { ManagedSettingsData } from "./copilotManagedSettings.js";
+import { PolicyDefinition } from "./policy.js";
+export declare const INativeManagedSettingsService: import("../../instantiation/common/instantiation.js").ServiceIdentifier<INativeManagedSettingsService>;
+export interface INativeManagedSettingsService {
+    readonly _serviceBrand: undefined;
+    readonly managedSettings: ManagedSettingsData;
+    readonly onDidChangeManagedSettings: Event<ManagedSettingsData>;
+    updatePolicyDefinitions(policyDefinitions: IStringDictionary<PolicyDefinition>): Promise<ManagedSettingsData>;
+}
+export declare const IFileManagedSettingsService: import("../../instantiation/common/instantiation.js").ServiceIdentifier<IFileManagedSettingsService>;
+export interface IFileManagedSettingsService {
+    readonly _serviceBrand: undefined;
+    readonly managedSettings: ManagedSettingsData;
+    readonly onDidChangeManagedSettings: Event<ManagedSettingsData>;
+}

package/vscode/src/vs/platform/policy/common/copilotManagedSettings.service.js

@@ -0,0 +1,7 @@
+
+import { createDecorator } from '../../instantiation/common/instantiation.js';
+
+const INativeManagedSettingsService = ( createDecorator("nativeManagedSettingsService"));
+const IFileManagedSettingsService = ( createDecorator("fileManagedSettingsService"));
+
+export { IFileManagedSettingsService, INativeManagedSettingsService };

package/vscode/src/vs/platform/policy/common/policy.d.ts

@@ -2,14 +2,17 @@ import { IStringDictionary } from "../../../base/common/collections.js";
 import { IPolicyData } from "../../../base/common/defaultAccount.js";
 import { Emitter, Event } from "../../../base/common/event.js";
 import { Disposable } from "../../../base/common/lifecycle.js";
-import { PolicyName } from "../../../base/common/policy.js";
+import { IManagedSettingsPolicyDefinitions, PolicyName } from "../../../base/common/policy.js";
 import { IPolicyService } from "./policy.service.js";
 export type PolicyValue = string | number | boolean;
 export type PolicyDefinition = {
     type: "string" | "number" | "boolean";
     value?: (policyData: IPolicyData) => string | number | boolean | undefined;
+    managedSettings?: IManagedSettingsPolicyDefinitions;
     restrictedValue?: PolicyValue;
 };
+/** Returns a structured-clone-safe copy of `definition`, dropping the non-cloneable `value` callback. */
+export declare function toSerializablePolicyDefinition(definition: PolicyDefinition): PolicyDefinition;
 /**
  * Returns the value to apply for `definition` when the account-policy gate is active
  * but not satisfied. Uses `definition.restrictedValue` when specified, otherwise falls

package/vscode/src/vs/platform/policy/common/policy.js

@@ -3,6 +3,13 @@ import { Emitter, Event } from '../../../base/common/event.js';
 import { Iterable } from '../../../base/common/iterator.js';
 import { Disposable } from '../../../base/common/lifecycle.js';
 
+function toSerializablePolicyDefinition(definition) {
+    return {
+        type: definition.type,
+        managedSettings: definition.managedSettings,
+        restrictedValue: definition.restrictedValue
+    };
+}
 class AbstractPolicyService extends Disposable {
     constructor() {
         super(...arguments);
@@ -12,12 +19,14 @@ class AbstractPolicyService extends Disposable {
         this.onDidChange = this._onDidChange.event;
     }
     async updatePolicyDefinitions(policyDefinitions) {
-        const size = ( Object.keys(this.policyDefinitions)).length;
-        this.policyDefinitions = {
-            ...policyDefinitions,
-            ...this.policyDefinitions
-        };
-        if (size !== ( Object.keys(this.policyDefinitions)).length) {
+        let changed = false;
+        for (const name of ( Object.keys(policyDefinitions))) {
+            if (this.policyDefinitions[name] !== policyDefinitions[name]) {
+                this.policyDefinitions[name] = policyDefinitions[name];
+                changed = true;
+            }
+        }
+        if (changed) {
             await this._updatePolicyDefinitions(this.policyDefinitions);
         }
         return Iterable.reduce(this.policies.entries(), (r, [name, value]) => ({
@@ -32,7 +41,7 @@ class AbstractPolicyService extends Disposable {
         return Iterable.reduce(Object.entries(this.policyDefinitions), (r, [name, definition]) => ({
             ...r,
             [name]: {
-                definition,
+                definition: toSerializablePolicyDefinition(definition),
                 value: this.policies.get(name)
             }
         }), {});
@@ -54,4 +63,4 @@ class NullPolicyService {
     }
 }
 
-export { AbstractPolicyService, NullPolicyService };
+export { AbstractPolicyService, NullPolicyService, toSerializablePolicyDefinition };

package/vscode/src/vs/platform/product/common/product.js

@@ -4,9 +4,9 @@ import productJson from '../../../../../product.json.js';
 var product = {
   ...productJson,
   quality: 'stable',
-  version: '1.124.2',
-  commit: '6928394f91b684055b873eecb8bc281365131f1c',
-  date: '2026-06-29T17:10:09.046Z',
+  version: '1.128.0',
+  commit: 'fc3def6774c76082adf699d366f31a557ce5573f',
+  date: '2026-07-09T06:27:00.769Z',
   ...(globalThis._VSCODE_PRODUCT_JSON ?? {})
 };
 

package/vscode/src/vs/platform/quickinput/browser/quickInput.js

@@ -25,26 +25,26 @@ import { observableValue } from '../../../base/common/observableInternal/observa
 
 registerCss(quickInput);
 const inQuickInputContextKeyValue = "inQuickInput";
-const InQuickInputContextKey = ( new RawContextKey(inQuickInputContextKeyValue, false, ( localize(2127, "Whether keyboard focus is inside the quick input control"))));
+const InQuickInputContextKey = ( new RawContextKey(inQuickInputContextKeyValue, false, ( localize(2201, "Whether keyboard focus is inside the quick input control"))));
 const inQuickInputContext = ( ContextKeyExpr.has(inQuickInputContextKeyValue));
 const quickInputAlignmentContextKeyValue = "quickInputAlignment";
-const QuickInputAlignmentContextKey = ( new RawContextKey(quickInputAlignmentContextKeyValue, "top", ( localize(2128, "The alignment of the quick input"))));
+const QuickInputAlignmentContextKey = ( new RawContextKey(quickInputAlignmentContextKeyValue, "top", ( localize(2202, "The alignment of the quick input"))));
 const quickInputTypeContextKeyValue = "quickInputType";
-const QuickInputTypeContextKey = ( new RawContextKey(quickInputTypeContextKeyValue, undefined, ( localize(2129, "The type of the currently visible quick input"))));
+const QuickInputTypeContextKey = ( new RawContextKey(quickInputTypeContextKeyValue, undefined, ( localize(2203, "The type of the currently visible quick input"))));
 const endOfQuickInputBoxContextKeyValue = "cursorAtEndOfQuickInputBox";
 const EndOfQuickInputBoxContextKey = ( new RawContextKey(endOfQuickInputBoxContextKeyValue, false, ( localize(
-    2130,
+    2204,
     "Whether the cursor in the quick input is at the end of the input box"
 ))));
 const endOfQuickInputBoxContext = ( ContextKeyExpr.has(endOfQuickInputBoxContextKeyValue));
 const backButton = {
     iconClass: ThemeIcon.asClassName(Codicon.quickInputBack),
-    tooltip: ( localize(2131, "Back")),
+    tooltip: ( localize(2205, "Back")),
     handle: -1
 };
 class QuickInput extends Disposable {
     static {
-        this.noPromptMessage = ( localize(2132, "Press 'Enter' to confirm your input or 'Escape' to cancel"));
+        this.noPromptMessage = ( localize(2206, "Press 'Enter' to confirm your input or 'Escape' to cancel"));
     }
     constructor(ui) {
         super();
@@ -320,7 +320,7 @@ class QuickInput extends Disposable {
     }
     getSteps() {
         if (this.step && this.totalSteps) {
-            return localize(2133, "{0}/{1}", this.step, this.totalSteps);
+            return localize(2207, "{0}/{1}", this.step, this.totalSteps);
         }
         if (this.step) {
             return String(this.step);
@@ -350,7 +350,7 @@ class QuickInput extends Disposable {
 }
 class QuickPick extends QuickInput {
     static {
-        this.DEFAULT_ARIA_LABEL = ( localize(2134, "Type to narrow down results."));
+        this.DEFAULT_ARIA_LABEL = ( localize(2208, "Type to narrow down results."));
     }
     constructor(ui) {
         super(ui);
@@ -590,7 +590,7 @@ class QuickPick extends QuickInput {
         this.update();
     }
     get okLabel() {
-        return this._okLabel ?? ( localize(2135, "OK"));
+        return this._okLabel ?? ( localize(2209, "OK"));
     }
     set okLabel(okLabel) {
         this._okLabel = okLabel;
@@ -949,7 +949,7 @@ class InputBox extends QuickInput {
     }
     set prompt(prompt) {
         this._prompt = prompt;
-        this.noValidationMessage = prompt ? ( localize(2136, "{0} (Press 'Enter' to confirm or 'Escape' to cancel)", prompt)) : QuickInput.noPromptMessage;
+        this.noValidationMessage = prompt ? ( localize(2210, "{0} (Press 'Enter' to confirm or 'Escape' to cancel)", prompt)) : QuickInput.noPromptMessage;
         this.update();
     }
     show() {