@codingame/monaco-vscode-api 36.2.7 → 37.0.0

package/vscode/src/vs/platform/policy/common/copilotManagedSettings.d.ts

@@ -3,8 +3,11 @@ import { IPolicyData } from "../../../base/common/defaultAccount.js";
 import { IManagedSettingsPolicyDefinitions, ManagedSettingValue, ManagedSettingsData } from "../../../base/common/policy.js";
 import { IStringDictionary } from "../../../base/common/collections.js";
 import { PolicyDefinition } from "./policy.js";
-import { INativeManagedSettingsService, type IFileManagedSettingsService } from "./copilotManagedSettings.service.js";
+import { IManagedSettingsService, type IFileManagedSettingsService, type INativeManagedSettingsService } from "./copilotManagedSettings.service.js";
 export type { ManagedSettingsData } from "../../../base/common/policy.js";
+export type RawManagedSettingsData = Readonly<Record<string, unknown>>;
+/** Whether a raw managed-settings document contains at least one top-level setting. */
+export declare function hasRawManagedSettings(data: RawManagedSettingsData | undefined): boolean;
 /** Windows registry root for GitHub Copilot policies. */
 export declare const GITHUB_COPILOT_WIN32_REGISTRY_PATH = "SOFTWARE\\Policies\\GitHubCopilot";
 /** Windows product name passed to the native policy watcher. */
@@ -19,8 +22,50 @@ export declare const COPILOT_ENABLED_PLUGINS_KEY = "enabledPlugins";
 export declare const COPILOT_EXTRA_MARKETPLACES_KEY = "extraKnownMarketplaces";
 /** Managed-settings key for the strict-marketplace allowlist (carried as a JSON-encoded array of source entries; absent = no restrictions, `[]` = lockdown). */
 export declare const COPILOT_STRICT_MARKETPLACES_KEY = "strictKnownMarketplaces";
-/** Managed-settings key for the default chat model (carried as a plain string: `auto`, a model family name, or a full model id). */
-export declare const COPILOT_MODEL_KEY = "model";
+/** Managed-settings key for the per-server MCP allowlist (carried as a JSON-encoded array of matcher entries; absent = no allow restriction, `[]` = only servers matching an entry, i.e. block all). */
+export declare const COPILOT_ALLOWED_MCP_SERVERS_KEY = "allowedMcpServers";
+/** Managed-settings key for the per-server MCP denylist (carried as a JSON-encoded array of matcher entries; deny always takes precedence over allow). */
+export declare const COPILOT_DENIED_MCP_SERVERS_KEY = "deniedMcpServers";
+/** Managed-settings key that blocks standalone user/workspace customizations. */
+export declare const COPILOT_STRICT_PLUGIN_ONLY_CUSTOMIZATION_KEY = "strictPluginOnlyCustomization";
+/** Managed-settings key that makes the enterprise MCP allowlist authoritative. */
+export declare const COPILOT_ALLOW_MANAGED_MCP_SERVERS_ONLY_KEY = "allowManagedMcpServersOnly";
+/** Managed-settings key that allows hooks only from managed sources. */
+export declare const COPILOT_ALLOW_MANAGED_HOOKS_ONLY_KEY = "allowManagedHooksOnly";
+/** Managed-settings transport control that requires a fresh server fetch on startup. */
+export declare const COPILOT_FORCE_REMOTE_SETTINGS_REFRESH_KEY = "forceRemoteSettingsRefresh";
+/**
+ * Enterprise-mandated sandbox floor (`sandbox.enabled` in the runtime's managed-settings schema).
+ * The runtime owns composing and enforcing this floor — it is `force-on-wins`, so a managed `true`
+ * cannot be loosened by the user. VS Code only *reads* it to decide which chat harness to offer,
+ * and deliberately declares no configuration policy for it: the control is runtime-owned, and
+ * mirroring it as a VS Code policy would invert ownership.
+ */
+export declare const COPILOT_SANDBOX_ENABLED_KEY = "sandbox.enabled";
+/** Managed-settings key that permits explicitly bypassing the sandbox. */
+export declare const COPILOT_SANDBOX_ALLOW_BYPASS_KEY = "sandbox.allowBypass";
+/**
+ * Managed-settings controls consumed by the delivery pipeline itself rather than by a
+ * configuration policy. Native MDM must watch these even though no setting declares them.
+ */
+export declare const MANAGED_SETTINGS_CONTROL_DEFINITIONS: IManagedSettingsPolicyDefinitions;
+/** Policy-only configuration delivery slot for {@link COPILOT_STRICT_PLUGIN_ONLY_CUSTOMIZATION_KEY}. */
+export declare const COPILOT_STRICT_PLUGIN_ONLY_CUSTOMIZATION_CONFIG = "chat.customizations.strictPluginOnlyCustomization";
+/** Policy-only configuration delivery slot for {@link COPILOT_ALLOW_MANAGED_MCP_SERVERS_ONLY_KEY}. */
+export declare const COPILOT_ALLOW_MANAGED_MCP_SERVERS_ONLY_CONFIG = "chat.mcp.allowManagedServersOnly";
+/** Policy-only configuration delivery slot for {@link COPILOT_ALLOW_MANAGED_HOOKS_ONLY_KEY}. */
+export declare const COPILOT_ALLOW_MANAGED_HOOKS_ONLY_CONFIG = "chat.hooks.allowManagedOnly";
+/**
+ * Legacy managed-settings key for the default chat model, nested under `permissions` so it flattens
+ * to `permissions.model`. Retained for original-schema deployments; superseded by the top-level
+ * {@link COPILOT_TOP_LEVEL_MODEL_KEY}, which wins when both are present (see {@link managedModelValue}).
+ */
+export declare const COPILOT_MODEL_KEY = "permissions.model";
+/**
+ * Canonical top-level managed-settings key for the default chat model (flattens to the bag key
+ * `model`). Supersedes the legacy nested {@link COPILOT_MODEL_KEY} when both are present.
+ */
+export declare const COPILOT_TOP_LEVEL_MODEL_KEY = "model";
 /**
  * Enterprise OTel managed-settings keys. These are the scalar leaves of the canonical
  * `telemetry` block from the cross-client managed-settings schema (see the CLI
@@ -57,36 +102,62 @@ export declare const COPILOT_OTEL_HEADERS_KEY = "telemetry.headers";
  * re-registration, and memoizing makes the guarantee hold regardless of where the helper is called.
  */
 export declare function managedSettingValue(key: string): (policyData: IPolicyData) => ManagedSettingValue | undefined;
+export type IForceRemoteSettingsRefreshResolution = {
+    readonly effective: true;
+    readonly source: ManagedSettingsChannel;
+} | {
+    readonly effective: false;
+};
 /**
- * `value` callback for the default-chat-model managed setting ({@link COPILOT_MODEL_KEY}). Like
- * {@link managedSettingValue} it locks the setting to the managed value and otherwise falls through
- * to the user's own value, but it additionally trims the string and treats a blank/whitespace-only
- * value as "unset" (returns `undefined`) — an admin clearing the field must not lock the setting to
- * an empty string. The model-specific normalization lives here, alongside the other managed-settings
- * handling, rather than inline at the policy declaration, so every managed-settings control is wired
- * the same way.
- *
- * Memoized (single key) so repeated calls return the SAME function reference, matching the
- * reference-identity contract {@link managedSettingValue} relies on for `isSamePolicyDefinition`.
+ * Resolve the fail-closed startup refresh control across every delivery channel, reusing
+ * {@link pickManagedSettings} precedence rather than re-implementing it. A non-boolean value is
+ * treated as absent, so a malformed high-precedence value cannot mask a well-formed lower one.
+ */
+export declare function resolveForceRemoteSettingsRefresh(nativeMdm: ManagedSettingsData | undefined, server: ManagedSettingsData | undefined, file: ManagedSettingsData | undefined): IForceRemoteSettingsRefreshResolution;
+export declare class NullManagedSettingsService implements IManagedSettingsService {
+    readonly _serviceBrand: undefined;
+    readonly onDidChangeManagedSettings: Event<any>;
+    getManagedSettingValue(): ManagedSettingValue | undefined;
+}
+/**
+ * `value` callback for the default-chat-model managed setting: resolves the top-level
+ * {@link COPILOT_TOP_LEVEL_MODEL_KEY} first, falling back to the legacy nested {@link COPILOT_MODEL_KEY}
+ * (each trimmed, blank treated as unset), so the top-level value wins when both are present. Memoized
+ * so repeated calls return the same reference, matching the identity contract {@link managedSettingValue}
+ * relies on for `isSamePolicyDefinition`.
  */
 export declare function managedModelValue(): (policyData: IPolicyData) => ManagedSettingValue | undefined;
+/** Forces a boolean setting off while the user is governed by managed settings. */
+export declare function managedSettingsDisabledValue(policyData: IPolicyData): boolean | undefined;
+/**
+ * `value` callback shared by the third-party agent harness policies (`Claude3PIntegration`,
+ * `Codex3PIntegration`): forces the harness off when the account disables chat preview features,
+ * or when the user is governed by managed settings at all.
+ *
+ * Managed settings are composed and enforced by the Copilot runtime and never reach the Claude or
+ * Codex harnesses, so leaving them available would hand a governed user an ungoverned path around
+ * every managed control the enterprise set.
+ */
+export declare function thirdPartyAgentEnabledValue(policyData: IPolicyData): boolean | undefined;
 export declare class NullNativeManagedSettingsService implements INativeManagedSettingsService {
     readonly _serviceBrand: undefined;
     readonly managedSettings: ManagedSettingsData;
     readonly onDidChangeManagedSettings: Event<any>;
+    initialize(): Promise<ManagedSettingsData>;
     updatePolicyDefinitions(): Promise<ManagedSettingsData>;
 }
 /**
  * Aggregate the `managedSettings` declarations of every policy definition into a single
- * key -> definition map. This is the single source of truth for which Copilot managed-settings
- * keys (and their value types) are honored, and it drives both delivery channels: the native
- * MDM watcher and the server `managed_settings` endpoint projection.
+ * key -> definition map. This is the single source of truth for policy-backed Copilot
+ * managed-settings keys and drives both server projection and the declaration-driven portion of
+ * the native MDM watcher. Transport controls are declared separately.
  */
 export declare function collectManagedSettingsDefinitions(policyDefinitions: IStringDictionary<PolicyDefinition>): IManagedSettingsPolicyDefinitions;
 /**
  * Whether any policy in `policyDefinitions` declares at least one managed-settings key. Cheap
- * existence check (short-circuits) used to decide whether the native MDM watcher is needed at all,
- * without aggregating the full {@link collectManagedSettingsDefinitions} map.
+ * existence check (short-circuits) used to decide whether the declaration-driven portion of the
+ * native MDM watcher needs updating, without aggregating the full
+ * {@link collectManagedSettingsDefinitions} map.
  */
 export declare function hasManagedSettingsDefinitions(policyDefinitions: IStringDictionary<PolicyDefinition>): boolean;
 /**
@@ -135,9 +206,9 @@ export interface IManagedSettingsContribution {
 export interface IManagedSettingResolution {
     /** The effective (winning) value applied for the key. */
     readonly value: ManagedSettingValue;
-    /** The channel whose value won (always the first {@link contributions} entry's channel). */
+    /** The highest-precedence channel supplying the effective value. */
     readonly source: ManagedSettingsChannel;
-    /** Every channel that supplied this key, in precedence order (winner first, overridden after). */
+    /** Every channel that supplied this key, in delivery precedence order. */
     readonly contributions: readonly IManagedSettingsContribution[];
 }
 /** The result of merging managed settings from every delivery channel on a per-key basis. */
@@ -155,8 +226,8 @@ export interface IManagedSettingsPick {
  * Precedence (highest first): native MDM → server-delivered → file on disk. Unlike a single
  * authoritative source, the channels *are* merged key-by-key: for each key the highest-precedence
  * channel that supplies it wins, but a key that the higher channels never set is still filled in by
- * a lower channel. A value an admin locks via native MDM therefore cannot be overwritten by the
- * server or a file, while keys those higher channels leave unset remain available to lower ones.
+ * a lower channel. The runtime-owned `sandbox.enabled` control is the exception: any managed
+ * `true` wins, so harness selection cannot discard a sandbox requirement from another channel.
  *
  * The parameter order matches the precedence so call sites read top-to-bottom. Centralizing the
  * resolution here (rather than inlining it at each call site) keeps policy evaluation
@@ -187,8 +258,8 @@ export declare const MANAGED_SETTINGS_FILE_NAME = "managed-settings.json";
  * - Structured settings (declared in {@link STRUCTURED_MANAGED_SETTINGS}) are carried as canonical
  *   JSON strings under a single key each — the same shape an admin authors via native MDM.
  *   `PolicyConfiguration` parses the JSON back into the object-typed setting on read.
- *   `extraKnownMarketplaces` is normalized from the schema's `{ [id]: { source } }` map to the
- *   `{ [name]: url-or-shorthand }` dict.
+ *   `extraKnownMarketplaces` is normalized from the schema's `{ [id]: { source, autoUpdate? } }`
+ *   map to the policy-backed marketplace dict.
  *
  * Malformed marketplace entries are dropped (with an optional warning via {@link onWarn}) rather
  * than throwing, so a bad enterprise settings file degrades gracefully instead of blocking startup.
@@ -196,6 +267,9 @@ export declare const MANAGED_SETTINGS_FILE_NAME = "managed-settings.json";
 export declare function normalizeManagedSettings(parsed: Record<string, unknown>, onWarn?: (msg: string) => void): ManagedSettingsData;
 export declare class NullFileManagedSettingsService implements IFileManagedSettingsService {
     readonly _serviceBrand: undefined;
+    readonly rawManagedSettings: RawManagedSettingsData;
     readonly managedSettings: ManagedSettingsData;
+    readonly onDidChangeRawManagedSettings: Event<any>;
     readonly onDidChangeManagedSettings: Event<any>;
+    initialize(): Promise<ManagedSettingsData>;
 }

package/vscode/src/vs/platform/policy/common/copilotManagedSettings.js

@@ -1,13 +1,28 @@
 
-import '../../../base/common/event.js';
+import { Event } from '../../../base/common/event.js';
 import { extraKnownMarketplacesToConfigDict } from '../../../base/common/managedSettings.js';
 import { isObject, isString } from '../../../base/common/types.js';
 
+function hasRawManagedSettings(data) {
+    return data !== undefined && ( Object.keys(data)).length > 0;
+}
 const COPILOT_DISABLE_BYPASS_PERMISSIONS_MODE_KEY = "permissions.disableBypassPermissionsMode";
 const COPILOT_ENABLED_PLUGINS_KEY = "enabledPlugins";
 const COPILOT_EXTRA_MARKETPLACES_KEY = "extraKnownMarketplaces";
 const COPILOT_STRICT_MARKETPLACES_KEY = "strictKnownMarketplaces";
-const COPILOT_MODEL_KEY = "model";
+const COPILOT_ALLOWED_MCP_SERVERS_KEY = "allowedMcpServers";
+const COPILOT_DENIED_MCP_SERVERS_KEY = "deniedMcpServers";
+const COPILOT_STRICT_PLUGIN_ONLY_CUSTOMIZATION_KEY = "strictPluginOnlyCustomization";
+const COPILOT_ALLOW_MANAGED_MCP_SERVERS_ONLY_KEY = "allowManagedMcpServersOnly";
+const COPILOT_ALLOW_MANAGED_HOOKS_ONLY_KEY = "allowManagedHooksOnly";
+const COPILOT_FORCE_REMOTE_SETTINGS_REFRESH_KEY = "forceRemoteSettingsRefresh";
+const COPILOT_SANDBOX_ENABLED_KEY = "sandbox.enabled";
+const COPILOT_SANDBOX_ALLOW_BYPASS_KEY = "sandbox.allowBypass";
+const COPILOT_STRICT_PLUGIN_ONLY_CUSTOMIZATION_CONFIG = "chat.customizations.strictPluginOnlyCustomization";
+const COPILOT_ALLOW_MANAGED_MCP_SERVERS_ONLY_CONFIG = "chat.mcp.allowManagedServersOnly";
+const COPILOT_ALLOW_MANAGED_HOOKS_ONLY_CONFIG = "chat.hooks.allowManagedOnly";
+const COPILOT_MODEL_KEY = "permissions.model";
+const COPILOT_TOP_LEVEL_MODEL_KEY = "model";
 const COPILOT_OTEL_ENABLED_KEY = "telemetry.enabled";
 const COPILOT_OTEL_ENDPOINT_KEY = "telemetry.endpoint";
 const COPILOT_OTEL_PROTOCOL_KEY = "telemetry.protocol";
@@ -25,17 +40,61 @@ function managedSettingValue(key) {
     }
     return callback;
 }
+function resolveForceRemoteSettingsRefresh(nativeMdm, server, file) {
+    const resolution = pickManagedSettings(nativeMdm, server, file).resolutions.get(COPILOT_FORCE_REMOTE_SETTINGS_REFRESH_KEY);
+    const contribution = resolution?.contributions.find(candidate => typeof candidate.value === "boolean");
+    if (!contribution) {
+        return {
+            effective: false
+        };
+    }
+    return contribution.value === true ? {
+        effective: true,
+        source: contribution.channel
+    } : {
+        effective: false
+    };
+}
+class NullManagedSettingsService {
+    constructor() {
+        this.onDidChangeManagedSettings = Event.None;
+    }
+    getManagedSettingValue() {
+        return undefined;
+    }
+}
 let managedModelValueCallback;
+function normalizeModelValue(value) {
+    const trimmed = typeof value === "string" ? value.trim() : undefined;
+    return trimmed ? trimmed : undefined;
+}
 function managedModelValue() {
     if (!managedModelValueCallback) {
         managedModelValueCallback = policyData => {
-            const model = policyData.managedSettings?.[COPILOT_MODEL_KEY];
-            const trimmed = typeof model === "string" ? model.trim() : undefined;
-            return trimmed ? trimmed : undefined;
+            const topLevel = normalizeModelValue(policyData.managedSettings?.[COPILOT_TOP_LEVEL_MODEL_KEY]);
+            return topLevel ?? normalizeModelValue(policyData.managedSettings?.[COPILOT_MODEL_KEY]);
         };
     }
     return managedModelValueCallback;
 }
+function managedSettingsDisabledValue(policyData) {
+    return policyData.managedSettingsActive === true ? false : undefined;
+}
+function thirdPartyAgentEnabledValue(policyData) {
+    return policyData.chat_preview_features_enabled === false ? false : managedSettingsDisabledValue(policyData);
+}
+class NullNativeManagedSettingsService {
+    constructor() {
+        this.managedSettings = {};
+        this.onDidChangeManagedSettings = Event.None;
+    }
+    async initialize() {
+        return this.managedSettings;
+    }
+    async updatePolicyDefinitions() {
+        return this.managedSettings;
+    }
+}
 function flattenManagedSettings(object) {
     const result = {};
     flattenManagedSettingsValue(object, undefined, result);
@@ -99,6 +158,10 @@ function pickManagedSettings(nativeMdm, server, file) {
                     channel,
                     value
                 });
+                if (key === COPILOT_SANDBOX_ENABLED_KEY && value === true && existing.value !== true) {
+                    existing.value = value;
+                    existing.source = channel;
+                }
             } else {
                 resolutions.set(key, {
                     value,
@@ -155,6 +218,12 @@ const STRUCTURED_MANAGED_SETTINGS = [{
 }, {
     key: COPILOT_STRICT_MARKETPLACES_KEY,
     encode: encodeArray
+}, {
+    key: COPILOT_ALLOWED_MCP_SERVERS_KEY,
+    encode: encodeArray
+}, {
+    key: COPILOT_DENIED_MCP_SERVERS_KEY,
+    encode: encodeArray
 }, {
     key: COPILOT_EXTRA_MARKETPLACES_KEY,
     encode: encodeExtraMarketplaces
@@ -225,11 +294,21 @@ function normalizeExtraKnownMarketplaces(value, onWarn) {
             );
             continue;
         }
-        const src = entry.source;
+        const rawEntry = entry;
+        const src = rawEntry.source;
+        const autoUpdate = typeof rawEntry.autoUpdate === "boolean" ? rawEntry.autoUpdate : undefined;
+        if (rawEntry.autoUpdate !== undefined && autoUpdate === undefined) {
+            onWarn?.(
+                `Ignoring invalid autoUpdate for extraKnownMarketplaces entry "${name}": expected boolean`
+            );
+        }
         let normalized;
         if (src.source === "github" && isString(src.repo)) {
             normalized = {
                 name,
+                ...(autoUpdate === undefined ? {} : {
+                    autoUpdate
+                }),
                 source: {
                     source: "github",
                     repo: src.repo,
@@ -241,6 +320,9 @@ function normalizeExtraKnownMarketplaces(value, onWarn) {
         } else if (src.source === "git" && isString(src.url)) {
             normalized = {
                 name,
+                ...(autoUpdate === undefined ? {} : {
+                    autoUpdate
+                }),
                 source: {
                     source: "git",
                     url: src.url,
@@ -265,5 +347,16 @@ function normalizeExtraKnownMarketplaces(value, onWarn) {
     }
     return entries;
 }
+class NullFileManagedSettingsService {
+    constructor() {
+        this.rawManagedSettings = {};
+        this.managedSettings = {};
+        this.onDidChangeRawManagedSettings = Event.None;
+        this.onDidChangeManagedSettings = Event.None;
+    }
+    async initialize() {
+        return this.managedSettings;
+    }
+}
 
-export { COPILOT_DISABLE_BYPASS_PERMISSIONS_MODE_KEY, COPILOT_ENABLED_PLUGINS_KEY, COPILOT_EXTRA_MARKETPLACES_KEY, COPILOT_MODEL_KEY, COPILOT_OTEL_CAPTURE_CONTENT_KEY, COPILOT_OTEL_ENABLED_KEY, COPILOT_OTEL_ENDPOINT_KEY, COPILOT_OTEL_HEADERS_KEY, COPILOT_OTEL_LOCK_CAPTURE_CONTENT_KEY, COPILOT_OTEL_PROTOCOL_KEY, COPILOT_OTEL_RESOURCE_ATTRIBUTES_KEY, COPILOT_OTEL_SERVICE_NAME_KEY, COPILOT_STRICT_MARKETPLACES_KEY, MANAGED_SETTINGS_CHANNELS, managedModelValue, managedSettingValue, normalizeManagedSettings, pickManagedSettings, projectManagedSettings };
+export { COPILOT_ALLOWED_MCP_SERVERS_KEY, COPILOT_ALLOW_MANAGED_HOOKS_ONLY_CONFIG, COPILOT_ALLOW_MANAGED_HOOKS_ONLY_KEY, COPILOT_ALLOW_MANAGED_MCP_SERVERS_ONLY_CONFIG, COPILOT_ALLOW_MANAGED_MCP_SERVERS_ONLY_KEY, COPILOT_DENIED_MCP_SERVERS_KEY, COPILOT_DISABLE_BYPASS_PERMISSIONS_MODE_KEY, COPILOT_ENABLED_PLUGINS_KEY, COPILOT_EXTRA_MARKETPLACES_KEY, COPILOT_FORCE_REMOTE_SETTINGS_REFRESH_KEY, COPILOT_MODEL_KEY, COPILOT_OTEL_CAPTURE_CONTENT_KEY, COPILOT_OTEL_ENABLED_KEY, COPILOT_OTEL_ENDPOINT_KEY, COPILOT_OTEL_HEADERS_KEY, COPILOT_OTEL_LOCK_CAPTURE_CONTENT_KEY, COPILOT_OTEL_PROTOCOL_KEY, COPILOT_OTEL_RESOURCE_ATTRIBUTES_KEY, COPILOT_OTEL_SERVICE_NAME_KEY, COPILOT_SANDBOX_ALLOW_BYPASS_KEY, COPILOT_SANDBOX_ENABLED_KEY, COPILOT_STRICT_MARKETPLACES_KEY, COPILOT_STRICT_PLUGIN_ONLY_CUSTOMIZATION_CONFIG, COPILOT_STRICT_PLUGIN_ONLY_CUSTOMIZATION_KEY, COPILOT_TOP_LEVEL_MODEL_KEY, MANAGED_SETTINGS_CHANNELS, NullFileManagedSettingsService, NullManagedSettingsService, NullNativeManagedSettingsService, hasRawManagedSettings, managedModelValue, managedSettingValue, managedSettingsDisabledValue, normalizeManagedSettings, pickManagedSettings, projectManagedSettings, resolveForceRemoteSettingsRefresh, thirdPartyAgentEnabledValue };

package/vscode/src/vs/platform/policy/common/copilotManagedSettings.service.d.ts

@@ -1,17 +1,29 @@
 import { IStringDictionary } from "../../../base/common/collections.js";
 import { Event } from "../../../base/common/event.js";
-import { ManagedSettingsData } from "./copilotManagedSettings.js";
+import { ManagedSettingValue, type ManagedSettingsData } from "../../../base/common/policy.js";
+import { RawManagedSettingsData } from "./copilotManagedSettings.js";
 import { PolicyDefinition } from "./policy.js";
+export declare const IManagedSettingsService: import("../../instantiation/common/instantiation.js").ServiceIdentifier<IManagedSettingsService>;
+/** Read-only access to effective managed settings after channel resolution. */
+export interface IManagedSettingsService {
+    readonly _serviceBrand: undefined;
+    readonly onDidChangeManagedSettings: Event<void>;
+    getManagedSettingValue(key: string): ManagedSettingValue | undefined;
+}
 export declare const INativeManagedSettingsService: import("../../instantiation/common/instantiation.js").ServiceIdentifier<INativeManagedSettingsService>;
 export interface INativeManagedSettingsService {
     readonly _serviceBrand: undefined;
     readonly managedSettings: ManagedSettingsData;
     readonly onDidChangeManagedSettings: Event<ManagedSettingsData>;
+    initialize(): Promise<ManagedSettingsData>;
     updatePolicyDefinitions(policyDefinitions: IStringDictionary<PolicyDefinition>): Promise<ManagedSettingsData>;
 }
 export declare const IFileManagedSettingsService: import("../../instantiation/common/instantiation.js").ServiceIdentifier<IFileManagedSettingsService>;
 export interface IFileManagedSettingsService {
     readonly _serviceBrand: undefined;
+    readonly rawManagedSettings: RawManagedSettingsData;
     readonly managedSettings: ManagedSettingsData;
+    readonly onDidChangeRawManagedSettings: Event<RawManagedSettingsData>;
     readonly onDidChangeManagedSettings: Event<ManagedSettingsData>;
+    initialize(): Promise<ManagedSettingsData>;
 }

package/vscode/src/vs/platform/policy/common/copilotManagedSettings.service.js

@@ -1,7 +1,8 @@
 
 import { createDecorator } from '../../instantiation/common/instantiation.js';
 
+const IManagedSettingsService = ( createDecorator("managedSettingsService"));
 const INativeManagedSettingsService = ( createDecorator("nativeManagedSettingsService"));
 const IFileManagedSettingsService = ( createDecorator("fileManagedSettingsService"));
 
-export { IFileManagedSettingsService, INativeManagedSettingsService };
+export { IFileManagedSettingsService, IManagedSettingsService, INativeManagedSettingsService };

package/vscode/src/vs/platform/policy/common/managedSettingsFreshness.d.ts

@@ -0,0 +1,58 @@
+import type { ManagedSettingsChannel } from "./copilotManagedSettings.js";
+/** Lifecycle of the `forceRemoteSettingsRefresh` fail-closed gate. */
+export declare enum ManagedSettingsFreshnessState {
+    /** The control is not effective. */
+    NotRequired = "notRequired",
+    /** A fresh response is required and the request has not completed. */
+    Pending = "pending",
+    /** A fresh response, including a fresh 404, was received for the current scope. */
+    Satisfied = "satisfied",
+    /** The required refresh failed. */
+    Blocked = "blocked"
+}
+/** Failure categories that require distinct remediation or diagnostics. */
+export declare enum ManagedSettingsFreshnessFailure {
+    NoUrl = "noUrl",
+    NoToken = "noToken",
+    Network = "network",
+    RateLimited = "rateLimited",
+    HttpError = "httpError",
+    /** JSON parsing failed; runtime-owned schema validation is not duplicated here. */
+    Malformed = "malformed",
+    UpdateRequired = "updateRequired"
+}
+/** Account, provider, and endpoint for which freshness was attempted or satisfied. */
+export interface IManagedSettingsFreshnessScope {
+    readonly accountId: string;
+    readonly authenticationProviderId: string;
+    readonly endpointOrigin: string;
+}
+interface IManagedSettingsFreshnessEffective {
+    readonly source: ManagedSettingsChannel;
+    readonly scope?: IManagedSettingsFreshnessScope;
+    readonly lastAttemptAt?: number;
+}
+type ManagedSettingsFreshnessBlocked = IManagedSettingsFreshnessEffective & {
+    readonly state: ManagedSettingsFreshnessState.Blocked;
+} & ({
+    readonly failure: ManagedSettingsFreshnessFailure.HttpError;
+    readonly httpStatus: number;
+} | {
+    readonly failure: Exclude<ManagedSettingsFreshnessFailure, ManagedSettingsFreshnessFailure.HttpError>;
+});
+/** Observable freshness state shared by fetching, gating, and diagnostics. */
+export type IManagedSettingsFreshness = {
+    readonly state: ManagedSettingsFreshnessState.NotRequired;
+} | (IManagedSettingsFreshnessEffective & {
+    readonly state: ManagedSettingsFreshnessState.Pending;
+}) | (IManagedSettingsFreshnessEffective & {
+    readonly state: ManagedSettingsFreshnessState.Satisfied;
+    readonly scope: IManagedSettingsFreshnessScope;
+    readonly satisfiedAt: number;
+}) | ManagedSettingsFreshnessBlocked;
+export declare const MANAGED_SETTINGS_FRESHNESS_NOT_REQUIRED: IManagedSettingsFreshness;
+/** Whether AI functionality must be withheld until freshness is established. */
+export declare function isManagedSettingsFreshnessBlocking(freshness: IManagedSettingsFreshness): boolean;
+/** Whether the satisfied result belongs to `scope`. */
+export declare function isManagedSettingsFreshnessSatisfiedFor(freshness: IManagedSettingsFreshness, scope: IManagedSettingsFreshnessScope): boolean;
+export {};

package/vscode/src/vs/platform/policy/common/managedSettingsFreshness.js

@@ -0,0 +1,35 @@
+
+
+var ManagedSettingsFreshnessState;
+(function (ManagedSettingsFreshnessState) {
+    ManagedSettingsFreshnessState["NotRequired"] = "notRequired";
+    ManagedSettingsFreshnessState["Pending"] = "pending";
+    ManagedSettingsFreshnessState["Satisfied"] = "satisfied";
+    ManagedSettingsFreshnessState["Blocked"] = "blocked";
+})(ManagedSettingsFreshnessState || (ManagedSettingsFreshnessState = {}));
+var ManagedSettingsFreshnessFailure;
+(function (ManagedSettingsFreshnessFailure) {
+    ManagedSettingsFreshnessFailure["NoUrl"] = "noUrl";
+    ManagedSettingsFreshnessFailure["NoToken"] = "noToken";
+    ManagedSettingsFreshnessFailure["Network"] = "network";
+    ManagedSettingsFreshnessFailure["RateLimited"] = "rateLimited";
+    ManagedSettingsFreshnessFailure["HttpError"] = "httpError";
+    ManagedSettingsFreshnessFailure["Malformed"] = "malformed";
+    ManagedSettingsFreshnessFailure["UpdateRequired"] = "updateRequired";
+})(ManagedSettingsFreshnessFailure || (ManagedSettingsFreshnessFailure = {}));
+const MANAGED_SETTINGS_FRESHNESS_NOT_REQUIRED = { state: ManagedSettingsFreshnessState.NotRequired };
+function isManagedSettingsFreshnessBlocking(freshness) {
+    return freshness.state === ManagedSettingsFreshnessState.Pending
+        || freshness.state === ManagedSettingsFreshnessState.Blocked;
+}
+function isSameScope(a, b) {
+    return a.accountId === b.accountId
+        && a.authenticationProviderId === b.authenticationProviderId
+        && a.endpointOrigin === b.endpointOrigin;
+}
+function isManagedSettingsFreshnessSatisfiedFor(freshness, scope) {
+    return freshness.state === ManagedSettingsFreshnessState.Satisfied
+        && isSameScope(freshness.scope, scope);
+}
+
+export { MANAGED_SETTINGS_FRESHNESS_NOT_REQUIRED, ManagedSettingsFreshnessFailure, ManagedSettingsFreshnessState, isManagedSettingsFreshnessBlocking, isManagedSettingsFreshnessSatisfiedFor };

package/vscode/src/vs/platform/policy/common/policy.d.ts

@@ -5,8 +5,19 @@ import { Disposable } from "../../../base/common/lifecycle.js";
 import { IManagedSettingsPolicyDefinitions, PolicyName } from "../../../base/common/policy.js";
 import { IPolicyService } from "./policy.service.js";
 export type PolicyValue = string | number | boolean;
+/** The source family that produced an effective policy value. */
+export declare enum PolicyValueSource {
+    Device = "device",
+    NativeMdm = "nativeMdm",
+    ServerManagedSettings = "serverManagedSettings",
+    FileManagedSettings = "fileManagedSettings",
+    MixedManagedSettings = "mixedManagedSettings",
+    Account = "account",
+    AccountGate = "accountGate"
+}
 export type PolicyDefinition = {
     type: "string" | "number" | "boolean";
+    /** Must be pure and deterministic because source attribution can evaluate it more than once. */
     value?: (policyData: IPolicyData) => string | number | boolean | undefined;
     managedSettings?: IManagedSettingsPolicyDefinitions;
     restrictedValue?: PolicyValue;
@@ -23,14 +34,20 @@ export declare abstract class AbstractPolicyService extends Disposable implement
     readonly _serviceBrand: undefined;
     policyDefinitions: IStringDictionary<PolicyDefinition>;
     protected policies: Map<string, PolicyValue>;
+    private readonly policyValueSources;
     protected readonly _onDidChange: Emitter<readonly string[]>;
     readonly onDidChange: Event<readonly string[]>;
     updatePolicyDefinitions(policyDefinitions: IStringDictionary<PolicyDefinition>): Promise<IStringDictionary<PolicyValue>>;
     getPolicyValue(name: PolicyName): PolicyValue | undefined;
+    getPolicyValueSource(name: PolicyName): PolicyValueSource | undefined;
+    private getStoredPolicyValueSource;
     serialize(): IStringDictionary<{
         definition: PolicyDefinition;
         value: PolicyValue;
     }>;
+    protected getPolicyValues(): IStringDictionary<PolicyValue>;
+    protected updatePolicyValue(name: PolicyName, value: PolicyValue | undefined, source?: PolicyValueSource): boolean;
+    protected clearPolicyValues(): void;
     protected abstract _updatePolicyDefinitions(policyDefinitions: IStringDictionary<PolicyDefinition>): Promise<void>;
 }
 export declare class NullPolicyService implements IPolicyService {
@@ -38,6 +55,7 @@ export declare class NullPolicyService implements IPolicyService {
     readonly onDidChange: Event<any>;
     updatePolicyDefinitions(): Promise<{}>;
     getPolicyValue(): undefined;
+    getPolicyValueSource(): undefined;
     serialize(): undefined;
     policyDefinitions: IStringDictionary<PolicyDefinition>;
 }

package/vscode/src/vs/platform/policy/common/policy.js

@@ -3,6 +3,16 @@ import { Emitter, Event } from '../../../base/common/event.js';
 import { Iterable } from '../../../base/common/iterator.js';
 import { Disposable } from '../../../base/common/lifecycle.js';
 
+var PolicyValueSource;
+(function(PolicyValueSource) {
+    PolicyValueSource["Device"] = "device";
+    PolicyValueSource["NativeMdm"] = "nativeMdm";
+    PolicyValueSource["ServerManagedSettings"] = "serverManagedSettings";
+    PolicyValueSource["FileManagedSettings"] = "fileManagedSettings";
+    PolicyValueSource["MixedManagedSettings"] = "mixedManagedSettings";
+    PolicyValueSource["Account"] = "account";
+    PolicyValueSource["AccountGate"] = "accountGate";
+})(PolicyValueSource || (PolicyValueSource = {}));
 function toSerializablePolicyDefinition(definition) {
     return {
         type: definition.type,
@@ -15,6 +25,7 @@ class AbstractPolicyService extends Disposable {
         super(...arguments);
         this.policyDefinitions = {};
         this.policies = ( new Map());
+        this.policyValueSources = ( new Map());
         this._onDidChange = this._register(( new Emitter()));
         this.onDidChange = this._onDidChange.event;
     }
@@ -29,14 +40,20 @@ class AbstractPolicyService extends Disposable {
         if (changed) {
             await this._updatePolicyDefinitions(this.policyDefinitions);
         }
-        return Iterable.reduce(this.policies.entries(), (r, [name, value]) => ({
-            ...r,
-            [name]: value
-        }), {});
+        return this.getPolicyValues();
     }
     getPolicyValue(name) {
         return this.policies.get(name);
     }
+    getPolicyValueSource(name) {
+        return this.getStoredPolicyValueSource(name);
+    }
+    getStoredPolicyValueSource(name) {
+        if (!( this.policies.has(name))) {
+            return undefined;
+        }
+        return this.policyValueSources.get(name) ?? PolicyValueSource.Device;
+    }
     serialize() {
         return Iterable.reduce(Object.entries(this.policyDefinitions), (r, [name, definition]) => ({
             ...r,
@@ -46,6 +63,31 @@ class AbstractPolicyService extends Disposable {
             }
         }), {});
     }
+    getPolicyValues() {
+        return Iterable.reduce(this.policies.entries(), (r, [name, value]) => ({
+            ...r,
+            [name]: value
+        }), {});
+    }
+    updatePolicyValue(name, value, source = PolicyValueSource.Device) {
+        if (value === undefined) {
+            const valueDeleted = this.policies.delete(name);
+            const sourceDeleted = this.policyValueSources.delete(name);
+            return valueDeleted || sourceDeleted;
+        }
+        const valueChanged = this.policies.get(name) !== value;
+        const sourceChanged = this.getStoredPolicyValueSource(name) !== source;
+        if (!valueChanged && !sourceChanged) {
+            return false;
+        }
+        this.policies.set(name, value);
+        this.policyValueSources.set(name, source);
+        return true;
+    }
+    clearPolicyValues() {
+        this.policies.clear();
+        this.policyValueSources.clear();
+    }
 }
 class NullPolicyService {
     constructor() {
@@ -58,9 +100,12 @@ class NullPolicyService {
     getPolicyValue() {
         return undefined;
     }
+    getPolicyValueSource() {
+        return undefined;
+    }
     serialize() {
         return undefined;
     }
 }
 
-export { AbstractPolicyService, NullPolicyService, toSerializablePolicyDefinition };
+export { AbstractPolicyService, NullPolicyService, PolicyValueSource, toSerializablePolicyDefinition };