@codingame/monaco-vscode-api 36.2.7 → 37.1.0

package/vscode/src/vs/workbench/services/accounts/browser/defaultAccount.js

@@ -15,11 +15,15 @@ import { ICommandService } from '../../../../platform/commands/common/commands.s
 import { IConfigurationService } from '../../../../platform/configuration/common/configuration.service.js';
 import { RawContextKey } from '../../../../platform/contextkey/common/contextkey.js';
 import { IContextKeyService } from '../../../../platform/contextkey/common/contextkey.service.js';
+import { MANAGED_SETTINGS_UPDATE_REQUIRED_ERROR_CODE } from '../../../../platform/defaultAccount/common/defaultAccount.js';
 import { IDefaultAccountService } from '../../../../platform/defaultAccount/common/defaultAccount.service.js';
 import { IInstantiationService } from '../../../../platform/instantiation/common/instantiation.js';
 import { ILogService } from '../../../../platform/log/common/log.service.js';
+import { resolveForceRemoteSettingsRefresh } from '../../../../platform/policy/common/copilotManagedSettings.js';
+import { INativeManagedSettingsService, IFileManagedSettingsService } from '../../../../platform/policy/common/copilotManagedSettings.service.js';
+import { MANAGED_SETTINGS_FRESHNESS_NOT_REQUIRED, ManagedSettingsFreshnessState, isManagedSettingsFreshnessBlocking, ManagedSettingsFreshnessFailure, isManagedSettingsFreshnessSatisfiedFor } from '../../../../platform/policy/common/managedSettingsFreshness.js';
 import { IProductService } from '../../../../platform/product/common/productService.service.js';
-import { asJson, isSuccess, isClientError, readHeader, retryAfterFromHeaders } from '../../../../platform/request/common/request.js';
+import { asJson, isSuccess, isClientError, asText, readHeader, retryAfterFromHeaders } from '../../../../platform/request/common/request.js';
 import { IRequestService } from '../../../../platform/request/common/request.service.js';
 import { StorageScope, StorageTarget } from '../../../../platform/storage/common/storage.js';
 import { IStorageService } from '../../../../platform/storage/common/storage.service.js';
@@ -29,7 +33,7 @@ import { IAuthenticationService, IAuthenticationExtensionsService } from '../../
 import { IWorkbenchEnvironmentService } from '../../environment/common/environmentService.service.js';
 import { IExtensionService } from '../../extensions/common/extensions.service.js';
 import { IHostService } from '../../host/browser/host.service.js';
-import { adaptManagedSettings } from './managedSettings.js';
+import { appendManagedSettingsClientIdentity, adaptManagedSettings, parseManagedSettingsCompatibilityError } from './managedSettings.js';
 
 const DEFAULT_ACCOUNT_SIGN_IN_COMMAND = "workbench.actions.accounts.signIn";
 var DefaultAccountStatus;
@@ -83,6 +87,12 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
     get managedSettingsRawResponse() {
         return this._managedSettingsRawResponse;
     }
+    get managedSettingsCompatibilityError() {
+        return this._managedSettingsCompatibilityError;
+    }
+    get managedSettingsFreshness() {
+        return this._managedSettingsFreshness;
+    }
     constructor(
         defaultAccountConfig,
         configurationService,
@@ -93,10 +103,13 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
         requestService,
         logService,
         environmentService,
+        productService,
         contextKeyService,
         storageService,
         hostService,
-        commandService
+        commandService,
+        nativeManagedSettingsService,
+        fileManagedSettingsService
     ) {
         super();
         this.defaultAccountConfig = defaultAccountConfig;
@@ -108,28 +121,50 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
         this.requestService = requestService;
         this.logService = logService;
         this.environmentService = environmentService;
+        this.productService = productService;
         this.storageService = storageService;
         this.hostService = hostService;
         this.commandService = commandService;
+        this.nativeManagedSettingsService = nativeManagedSettingsService;
+        this.fileManagedSettingsService = fileManagedSettingsService;
         this._defaultAccount = null;
         this._policyData = null;
         this._copilotTokenInfo = null;
         this._managedSettingsFetchStatus = null;
         this._managedSettingsRawResponse = null;
+        this._managedSettingsCompatibilityError = null;
+        this._managedSettingsFreshness = MANAGED_SETTINGS_FRESHNESS_NOT_REQUIRED;
         this._onDidChangeDefaultAccount = this._register(( new Emitter()));
         this.onDidChangeDefaultAccount = this._onDidChangeDefaultAccount.event;
         this._onDidChangePolicyData = this._register(( new Emitter()));
         this.onDidChangePolicyData = this._onDidChangePolicyData.event;
         this._onDidChangeCopilotTokenInfo = this._register(( new Emitter()));
         this.onDidChangeCopilotTokenInfo = this._onDidChangeCopilotTokenInfo.event;
+        this._onDidChangeManagedSettingsCompatibilityError = this._register(( new Emitter()));
+        this.onDidChangeManagedSettingsCompatibilityError = this._onDidChangeManagedSettingsCompatibilityError.event;
+        this._onDidChangeManagedSettingsFreshness = this._register(( new Emitter()));
+        this.onDidChangeManagedSettingsFreshness = this._onDidChangeManagedSettingsFreshness.event;
         this.initialized = false;
         this.updateThrottler = this._register(( new ThrottledDelayer(100)));
         this.accountDataPollScheduler = this._register(( new RunOnceScheduler(() => this.refetchDefaultAccount(), ACCOUNT_DATA_POLL_INTERVAL_MS)));
+        this.failedManagedSettingsFreshness = ( new Map());
         this._rateLimitBackoffUntil = 0;
         this.accountStatusContext = CONTEXT_DEFAULT_ACCOUNT_STATE.bindTo(contextKeyService);
         const cachedAccountData = this.getCachedAccountData();
         this._policyData = cachedAccountData?.accountPolicyData ?? null;
         this._copilotTokenInfo = cachedAccountData?.copilotTokenInfo ?? null;
+        this._managedSettingsCompatibilityError = cachedAccountData?.accountPolicyData.managedSettingsCompatibilityError ?? null;
+        this.updateManagedSettingsFreshnessRequirement(
+            this.nativeManagedSettingsService.managedSettings,
+            this.getCachedServerManagedSettings(this.getDefaultAccountAuthenticationProvider()),
+            this.fileManagedSettingsService.managedSettings
+        );
+        this._register(
+            this.nativeManagedSettingsService.onDidChangeManagedSettings(() => this.onManagedSettingsSourceChanged())
+        );
+        this._register(
+            this.fileManagedSettingsService.onDidChangeManagedSettings(() => this.onManagedSettingsSourceChanged())
+        );
         this.initPromise = this.init().finally(() => {
             this.telemetryService.publicLog2("defaultaccount:status", {
                 status: this.defaultAccount ? "available" : "unavailable",
@@ -211,12 +246,21 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
             if (e.providerId !== defaultAccountProvider.id) {
                 return;
             }
-            if (this.defaultAccount && e.event.removed?.some(session => session.id === this.defaultAccount?.sessionId)) {
+            const added = e.event.added?.length ?? 0;
+            const removed = e.event.removed?.length ?? 0;
+            const changed = e.event.changed?.length ?? 0;
+            const currentSessionRemoved = this.defaultAccount !== null && (e.event.removed?.some(session => session.id === this.defaultAccount?.sessionId) ?? false);
+            const hasReplacementCandidates = added > 0 || changed > 0;
+            const clearDefaultAccount = currentSessionRemoved && !hasReplacementCandidates;
+            const message = `[DefaultAccount] Authentication sessions changed: added=${added}, removed=${removed}, changed=${changed}, currentSessionRemoved=${currentSessionRemoved}, hasReplacementCandidates=${hasReplacementCandidates}, decision=${clearDefaultAccount ? "clear" : "reconcile"}`;
+            if (currentSessionRemoved || (added > 0 && removed > 0)) {
+                this.logService.info(message);
+            } else {
+                this.logService.trace(message);
+            }
+            if (clearDefaultAccount) {
                 this.setDefaultAccount(null);
             } else {
-                this.logService.debug(
-                    "[DefaultAccount] Sessions changed for default account provider, updating default account"
-                );
                 this.updateDefaultAccount();
             }
         }));
@@ -330,8 +374,15 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
         await this.updateThrottler.trigger(() => this.doUpdateDefaultAccount(options));
     }
     async doUpdateDefaultAccount(options) {
+        const currentSessionId = this.defaultAccount?.sessionId;
         try {
             const defaultAccount = await this.fetchDefaultAccount(options);
+            if (currentSessionId && this.defaultAccount?.sessionId !== currentSessionId) {
+                this.logService.info(
+                    "[DefaultAccount] Discarding default account update because the current session changed while the update was in progress"
+                );
+                return;
+            }
             this.setDefaultAccount(defaultAccount);
             this.scheduleAccountDataPoll();
         } catch (error) {
@@ -339,19 +390,35 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
                 "[DefaultAccount] Error while updating default account",
                 getErrorMessage(error)
             );
+            this.blockPendingManagedSettingsFreshness();
         }
     }
     async fetchDefaultAccount(options) {
         const defaultAccountProvider = this.getDefaultAccountAuthenticationProvider();
         this.logService.debug("[DefaultAccount] Default account provider ID:", defaultAccountProvider.id);
+        const managedSettingsSources = await this.initializeManagedSettingsSources();
+        const refreshRequirement = resolveForceRemoteSettingsRefresh(
+            managedSettingsSources.nativeMdm,
+            this.getCachedServerManagedSettings(defaultAccountProvider),
+            managedSettingsSources.file
+        );
+        if (!refreshRequirement.effective) {
+            this.setManagedSettingsFreshness(MANAGED_SETTINGS_FRESHNESS_NOT_REQUIRED);
+        }
         if (!this.isAccountProviderAvailable(defaultAccountProvider)) {
             this.logService.info(
                 `[DefaultAccount] Authentication provider is not available.`,
                 defaultAccountProvider
             );
+            this.blockManagedSettingsFreshnessWithoutToken(refreshRequirement);
             return null;
         }
-        return await this.getDefaultAccountForAuthenticationProvider(defaultAccountProvider, options);
+        return await this.getDefaultAccountForAuthenticationProvider(
+            defaultAccountProvider,
+            managedSettingsSources,
+            refreshRequirement,
+            options
+        );
     }
     isAccountProviderAvailable(accountProvider) {
         return ( this.authenticationService.declaredProviders.some(p => p.id === accountProvider.id)) || this.authenticationService.isAuthenticationProviderRegistered(accountProvider.id);
@@ -365,12 +432,21 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
             this._defaultAccount = account;
             this.setCopilotTokenInfo(account.copilotTokenInfo);
             this.setPolicyData(account.policyData);
+            this.setManagedSettingsCompatibilityError(account.policyData?.managedSettingsCompatibilityError ?? null);
             this._onDidChangeDefaultAccount.fire(this._defaultAccount.defaultAccount);
             this.accountStatusContext.set(DefaultAccountStatus.Available);
             this.logService.debug("[DefaultAccount] Account status set to Available");
         } else {
             this._defaultAccount = null;
-            this.setPolicyData(null);
+            const refreshRequirement = resolveForceRemoteSettingsRefresh(
+                this.nativeManagedSettingsService.managedSettings,
+                this.getCachedServerManagedSettings(this.getDefaultAccountAuthenticationProvider()),
+                this.fileManagedSettingsService.managedSettings
+            );
+            this.blockManagedSettingsFreshnessWithoutToken(refreshRequirement);
+            const retainedPolicyData = this._managedSettingsFreshness.state !== ManagedSettingsFreshnessState.NotRequired && isManagedSettingsFreshnessBlocking(this._managedSettingsFreshness) && this._managedSettingsFreshness.source === "server" ? this._policyData : null;
+            this.setPolicyData(retainedPolicyData);
+            this.setManagedSettingsCompatibilityError(null);
             this.setCopilotTokenInfo(null);
             this._onDidChangeDefaultAccount.fire(null);
             this.accountDataPollScheduler.cancel();
@@ -386,6 +462,92 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
         this.cachePolicyData(accountPolicyData);
         this._onDidChangePolicyData.fire(this._policyData?.policyData ?? null);
     }
+    setManagedSettingsCompatibilityError(error) {
+        if (equals(this._managedSettingsCompatibilityError, error)) {
+            return;
+        }
+        this._managedSettingsCompatibilityError = error;
+        this._onDidChangeManagedSettingsCompatibilityError.fire(error);
+    }
+    setManagedSettingsFreshness(freshness) {
+        if (equals(this._managedSettingsFreshness, freshness)) {
+            return;
+        }
+        this._managedSettingsFreshness = freshness;
+        this._onDidChangeManagedSettingsFreshness.fire(freshness);
+    }
+    blockPendingManagedSettingsFreshness() {
+        if (this._managedSettingsFreshness.state === ManagedSettingsFreshnessState.Pending) {
+            this.setManagedSettingsFreshness({
+                ...this._managedSettingsFreshness,
+                state: ManagedSettingsFreshnessState.Blocked,
+                failure: ManagedSettingsFreshnessFailure.Network
+            });
+        }
+    }
+    updateManagedSettingsFreshnessRequirement(nativeMdm, server, file) {
+        const requirement = resolveForceRemoteSettingsRefresh(nativeMdm, server, file);
+        this.setManagedSettingsFreshness(requirement.effective ? {
+            state: ManagedSettingsFreshnessState.Pending,
+            source: requirement.source
+        } : MANAGED_SETTINGS_FRESHNESS_NOT_REQUIRED);
+    }
+    onManagedSettingsSourceChanged() {
+        if (this.initialized) {
+            void this.updateDefaultAccount();
+        }
+    }
+    async initializeManagedSettingsSources() {
+        let nativeMdm = this.nativeManagedSettingsService.managedSettings;
+        try {
+            nativeMdm = await this.nativeManagedSettingsService.initialize();
+        } catch (error) {
+            this.logService.warn(
+                "[DefaultAccount] Failed to initialize native managed settings before resolving forceRemoteSettingsRefresh; using available values",
+                getErrorMessage(error)
+            );
+        }
+        let file = this.fileManagedSettingsService.managedSettings;
+        try {
+            file = await this.fileManagedSettingsService.initialize();
+        } catch (error) {
+            this.logService.warn(
+                "[DefaultAccount] Failed to initialize file managed settings before resolving forceRemoteSettingsRefresh; using available values",
+                getErrorMessage(error)
+            );
+        }
+        return {
+            nativeMdm,
+            file
+        };
+    }
+    blockManagedSettingsFreshnessWithoutToken(requirement) {
+        if (requirement.effective) {
+            this.setManagedSettingsFreshness({
+                state: ManagedSettingsFreshnessState.Blocked,
+                source: requirement.source,
+                failure: ManagedSettingsFreshnessFailure.NoToken
+            });
+        }
+    }
+    getCachedServerManagedSettings(authenticationProvider) {
+        return this.getScopedServerManagedSettings(
+            this._policyData ?? undefined,
+            authenticationProvider,
+            this._policyData?.accountId
+        );
+    }
+    getScopedServerManagedSettings(accountPolicyData, authenticationProvider, accountId) {
+        if (!accountPolicyData || accountPolicyData.accountId !== accountId) {
+            return undefined;
+        }
+        const scope = accountPolicyData.managedSettingsScope;
+        const managedSettingsUrl = this.getManagedSettingsUrl();
+        if (scope && (scope.accountId !== accountId || scope.authenticationProviderId !== authenticationProvider.id || (managedSettingsUrl ? scope.endpointOrigin !== this.createManagedSettingsFreshnessScope(scope.accountId, authenticationProvider.id, managedSettingsUrl).endpointOrigin : false))) {
+            return undefined;
+        }
+        return accountPolicyData.policyData.managedSettings;
+    }
     setCopilotTokenInfo(copilotTokenInfo) {
         if (equals(this._copilotTokenInfo, copilotTokenInfo)) {
             return;
@@ -433,7 +595,12 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
         );
         return result;
     }
-    async getDefaultAccountForAuthenticationProvider(authenticationProvider, options) {
+    async getDefaultAccountForAuthenticationProvider(
+        authenticationProvider,
+        managedSettingsSources,
+        refreshRequirement,
+        options
+    ) {
         try {
             this.logService.debug(
                 "[DefaultAccount] Getting Default Account from authenticated sessions for provider:",
@@ -448,31 +615,59 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
                     "[DefaultAccount] No matching session found for provider:",
                     authenticationProvider.id
                 );
+                this.blockManagedSettingsFreshnessWithoutToken(refreshRequirement);
                 return null;
             }
-            return this.getDefaultAccountFromAuthenticatedSessions(authenticationProvider, sessions, options);
+            return this.getDefaultAccountFromAuthenticatedSessions(authenticationProvider, sessions, options, managedSettingsSources);
         } catch (error) {
             this.logService.error(
                 "[DefaultAccount] Failed to get default account for provider:",
                 authenticationProvider.id,
                 getErrorMessage(error)
             );
+            this.blockManagedSettingsFreshnessWithoutToken(refreshRequirement);
             return null;
         }
     }
-    async getDefaultAccountFromAuthenticatedSessions(authenticationProvider, sessions, options) {
+    async getDefaultAccountFromAuthenticatedSessions(authenticationProvider, sessions, options, managedSettingsSources) {
         try {
             const accountId = sessions[0].account.id;
             const accountPolicyData = this._policyData?.accountId === accountId ? this._policyData : undefined;
+            const sources = managedSettingsSources ?? (await this.initializeManagedSettingsSources());
+            const requirement = resolveForceRemoteSettingsRefresh(
+                sources.nativeMdm,
+                this.getScopedServerManagedSettings(accountPolicyData, authenticationProvider, accountId),
+                sources.file
+            );
+            const managedSettingsUrl = this.getManagedSettingsUrl();
+            const scope = managedSettingsUrl ? this.createManagedSettingsFreshnessScope(accountId, authenticationProvider.id, managedSettingsUrl) : undefined;
+            if (!requirement.effective) {
+                this.setManagedSettingsFreshness(MANAGED_SETTINGS_FRESHNESS_NOT_REQUIRED);
+            } else if ((!scope || !isManagedSettingsFreshnessSatisfiedFor(this._managedSettingsFreshness, scope) || options?.forceRefresh) && this.canRequestManagedSettings(options, scope)) {
+                this.setManagedSettingsFreshness({
+                    state: ManagedSettingsFreshnessState.Pending,
+                    source: requirement.source,
+                    scope
+                });
+            }
             const entitlementsResult = await this.getEntitlements(sessions, accountPolicyData, options);
             const entitlementsData = entitlementsResult?.data;
             const entitlementsFetchedAt = entitlementsResult?.fetchedAt;
-            const [tokenEntitlementsResult, managedSettingsResult] = entitlementsData?.chat_enabled ? await Promise.all([
-                this.getTokenEntitlements(sessions, accountPolicyData, options),
-                this.getManagedSettings(sessions, accountPolicyData, options)
-            ]) : [undefined, undefined];
+            const [tokenEntitlementsResult, managedSettingsResult] = await Promise.all([
+                entitlementsData?.chat_enabled ? this.getTokenEntitlements(sessions, accountPolicyData, options) : undefined,
+                entitlementsData?.chat_enabled || requirement.effective ? this.getManagedSettings(
+                    sessions,
+                    accountPolicyData,
+                    options,
+                    authenticationProvider,
+                    sources,
+                    requirement
+                ) : undefined
+            ]);
             const tokenEntitlementsFetchedAt = tokenEntitlementsResult?.fetchedAt;
             const managedSettingsFetchedAt = managedSettingsResult?.fetchedAt;
+            const managedSettingsScope = managedSettingsResult?.scope ?? accountPolicyData?.managedSettingsScope;
+            const managedSettingsCompatibilityError = managedSettingsResult ? managedSettingsResult.compatibilityError : this._managedSettingsCompatibilityError;
             let mcpRegistryDataFetchedAt;
             let policyData = accountPolicyData?.policyData ? {
                 ...accountPolicyData.policyData
@@ -520,7 +715,9 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
                 entitlementsFetchedAt,
                 tokenEntitlementsFetchedAt,
                 mcpRegistryDataFetchedAt,
-                managedSettingsFetchedAt
+                managedSettingsFetchedAt,
+                managedSettingsScope,
+                managedSettingsCompatibilityError: managedSettingsCompatibilityError ?? undefined
             } : null;
             return {
                 defaultAccount,
@@ -534,20 +731,16 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
                 authenticationProvider.id,
                 getErrorMessage(error)
             );
+            this.blockPendingManagedSettingsFreshness();
             return null;
         }
     }
     async findMatchingProviderSession(authProviderId, allScopes) {
         const sessions = await this.getSessions(authProviderId);
-        const matchingSessions = [];
-        for (const session of sessions) {
+        const matchingSessions = sessions.filter(session => {
             this.logService.debug("[DefaultAccount] Checking session with scopes", session.scopes);
-            for (const scopes of allScopes) {
-                if (this.scopesMatch(session.scopes, scopes)) {
-                    matchingSessions.push(session);
-                }
-            }
-        }
+            return ( allScopes.some(scopes => this.scopesMatch(session.scopes, scopes)));
+        });
         return matchingSessions.length > 0 ? matchingSessions : undefined;
     }
     async getSessions(authProviderId) {
@@ -652,7 +845,7 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
     async getEntitlements(sessions, accountPolicyData, options) {
         const accountId = sessions[0].account.id;
         const existingData = this._defaultAccount?.accountId === accountId ? this._defaultAccount?.defaultAccount.entitlementsData : undefined;
-        if (!options?.forceRefresh && existingData && accountPolicyData?.entitlementsFetchedAt && !this.isDataStale(accountPolicyData.entitlementsFetchedAt)) {
+        if (!options?.forceRefresh && !options?.refreshEntitlements && existingData && accountPolicyData?.entitlementsFetchedAt && !this.isDataStale(accountPolicyData.entitlementsFetchedAt)) {
             this.logService.debug("[DefaultAccount] Using last fetched entitlements data");
             return {
                 data: existingData,
@@ -772,57 +965,297 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
             return undefined;
         }
     }
-    async getManagedSettings(sessions, accountPolicyData, options) {
-        if (!options?.forceRefresh && accountPolicyData?.managedSettingsFetchedAt && !this.isDataStale(accountPolicyData.managedSettingsFetchedAt)) {
-            this.logService.debug("[DefaultAccount] Using last fetched managed settings data");
-            this._managedSettingsFetchStatus = "ok";
+    async getManagedSettings(
+        sessions,
+        accountPolicyData,
+        options,
+        authenticationProvider = this.getDefaultAccountAuthenticationProvider(),
+        managedSettingsSources,
+        refreshRequirement
+    ) {
+        const accountId = sessions[0].account.id;
+        const sources = managedSettingsSources ?? (await this.initializeManagedSettingsSources());
+        const requirement = refreshRequirement ?? resolveForceRemoteSettingsRefresh(
+            sources.nativeMdm,
+            this.getScopedServerManagedSettings(accountPolicyData, authenticationProvider, accountId),
+            sources.file
+        );
+        const cachedManagedSettings = accountPolicyData?.managedSettingsFetchedAt !== undefined && !this.isDataStale(accountPolicyData.managedSettingsFetchedAt) ? {
+            data: {
+                managedSettings: accountPolicyData.policyData.managedSettings
+            },
+            fetchedAt: accountPolicyData.managedSettingsFetchedAt
+        } : undefined;
+        const managedSettingsUrl = this.getManagedSettingsUrl();
+        if (!managedSettingsUrl) {
+            this.logService.debug(
+                "[DefaultAccount] No managed settings URL configured; skipping enterprise policy fetch"
+            );
+            this._managedSettingsFetchStatus = "no-url";
+            if (requirement.effective) {
+                this.setManagedSettingsFreshness({
+                    state: ManagedSettingsFreshnessState.Blocked,
+                    source: requirement.source,
+                    failure: ManagedSettingsFreshnessFailure.NoUrl
+                });
+            }
+            const retained = requirement.effective ? {
+                data: {
+                    managedSettings: accountPolicyData?.policyData.managedSettings
+                },
+                fetchedAt: accountPolicyData?.managedSettingsFetchedAt
+            } : cachedManagedSettings;
+            return {
+                data: retained?.data,
+                fetchedAt: retained?.fetchedAt,
+                scope: accountPolicyData?.managedSettingsScope,
+                compatibilityError: this._managedSettingsCompatibilityError
+            };
+        }
+        const scope = this.createManagedSettingsFreshnessScope(accountId, authenticationProvider.id, managedSettingsUrl);
+        const cachedScope = accountPolicyData?.managedSettingsScope;
+        const cacheScopeMatches = !cachedScope || this.getManagedSettingsScopeKey(cachedScope) === this.getManagedSettingsScopeKey(scope);
+        const scopedManagedSettings = cacheScopeMatches ? accountPolicyData?.policyData.managedSettings : undefined;
+        const scopedManagedSettingsFetchedAt = cacheScopeMatches ? accountPolicyData?.managedSettingsFetchedAt : undefined;
+        const scopedCachedManagedSettings = cacheScopeMatches ? cachedManagedSettings : undefined;
+        if (requirement.effective && !this.canRequestManagedSettings(options, scope)) {
+            this.logService.debug(
+                "[DefaultAccount] Skipping automatic managed settings retry after a prior failure"
+            );
+            const failedFreshness = this.failedManagedSettingsFreshness.get(this.getManagedSettingsScopeKey(scope));
+            if (failedFreshness) {
+                this.setManagedSettingsFreshness({
+                    ...failedFreshness,
+                    source: requirement.source
+                });
+            }
             return {
                 data: {
-                    managedSettings: accountPolicyData.policyData.managedSettings
+                    managedSettings: scopedManagedSettings
                 },
-                fetchedAt: accountPolicyData.managedSettingsFetchedAt
+                fetchedAt: scopedManagedSettingsFetchedAt,
+                scope,
+                compatibilityError: this._managedSettingsCompatibilityError
             };
         }
-        const data = await this.requestManagedSettings(sessions);
+        const freshnessSatisfied = requirement.effective && isManagedSettingsFreshnessSatisfiedFor(this._managedSettingsFreshness, scope);
+        if (!options?.forceRefresh && !options?.retryManagedSettings && scopedCachedManagedSettings && (!requirement.effective || freshnessSatisfied) && !this._managedSettingsCompatibilityError) {
+            this.logService.debug("[DefaultAccount] Using last fetched managed settings data");
+            return {
+                ...scopedCachedManagedSettings,
+                scope,
+                compatibilityError: this._managedSettingsCompatibilityError
+            };
+        }
+        const lastAttemptAt = Date.now();
+        if (requirement.effective) {
+            this.setManagedSettingsFreshness({
+                state: ManagedSettingsFreshnessState.Pending,
+                source: requirement.source,
+                scope,
+                lastAttemptAt
+            });
+        }
+        const sharedBackoffActive = Date.now() < this._rateLimitBackoffUntil;
+        const result = await this.requestManagedSettings(requirement.effective ? [sessions[0]] : sessions, managedSettingsUrl);
+        if (requirement.effective && !sharedBackoffActive) {
+            this.updateFailedManagedSettingsFreshness(scope, requirement.source, result, lastAttemptAt);
+        }
+        switch (result.kind) {
+        case "success":
+            {
+                const fetchedAt = Date.now();
+                this.resolveManagedSettingsFreshnessAfterSuccess(result.data.managedSettings, scope, lastAttemptAt, fetchedAt);
+                return {
+                    data: result.data,
+                    fetchedAt,
+                    scope,
+                    compatibilityError: null
+                };
+            }
+        case "noSettings":
+            {
+                const fetchedAt = Date.now();
+                this.resolveManagedSettingsFreshnessAfterSuccess(undefined, scope, lastAttemptAt, fetchedAt);
+                return {
+                    data: {
+                        managedSettings: undefined
+                    },
+                    fetchedAt,
+                    scope,
+                    compatibilityError: null
+                };
+            }
+        case "updateRequired":
+            if (requirement.effective) {
+                this.setManagedSettingsFreshness({
+                    state: ManagedSettingsFreshnessState.Blocked,
+                    source: requirement.source,
+                    scope,
+                    lastAttemptAt,
+                    failure: ManagedSettingsFreshnessFailure.UpdateRequired
+                });
+            }
+            return {
+                data: requirement.effective ? {
+                    managedSettings: scopedManagedSettings
+                } : {
+                    managedSettings: undefined
+                },
+                fetchedAt: requirement.effective ? scopedManagedSettingsFetchedAt : Date.now(),
+                scope,
+                compatibilityError: result.error
+            };
+        case "network":
+        case "rateLimited":
+        case "httpError":
+        case "malformed":
+            {
+                if (requirement.effective) {
+                    this.setManagedSettingsFreshness(
+                        this.toBlockedManagedSettingsFreshness(requirement.source, result, lastAttemptAt, scope)
+                    );
+                    return {
+                        data: {
+                            managedSettings: scopedManagedSettings
+                        },
+                        fetchedAt: scopedManagedSettingsFetchedAt,
+                        scope,
+                        compatibilityError: this._managedSettingsCompatibilityError
+                    };
+                }
+                const retained = this._managedSettingsCompatibilityError ? undefined : scopedCachedManagedSettings;
+                return {
+                    data: {
+                        managedSettings: retained?.data.managedSettings
+                    },
+                    fetchedAt: retained?.fetchedAt,
+                    scope,
+                    compatibilityError: this._managedSettingsCompatibilityError
+                };
+            }
+        }
+    }
+    createManagedSettingsFreshnessScope(accountId, authenticationProviderId, managedSettingsUrl) {
+        let endpointOrigin = managedSettingsUrl;
+        try {
+            endpointOrigin = ( new URL(managedSettingsUrl)).origin;
+        } catch {}
         return {
-            data,
-            fetchedAt: Date.now()
+            accountId,
+            authenticationProviderId,
+            endpointOrigin
         };
     }
-    async requestManagedSettings(sessions) {
-        const managedSettingsUrl = this.getManagedSettingsUrl();
-        if (!managedSettingsUrl) {
-            this.logService.debug(
-                "[DefaultAccount] No managed settings URL configured; skipping enterprise policy fetch"
-            );
-            this._managedSettingsFetchStatus = "no-url";
-            return undefined;
+    resolveManagedSettingsFreshnessAfterSuccess(server, scope, lastAttemptAt, satisfiedAt) {
+        const freshRequirement = resolveForceRemoteSettingsRefresh(
+            this.nativeManagedSettingsService.managedSettings,
+            server,
+            this.fileManagedSettingsService.managedSettings
+        );
+        this.setManagedSettingsFreshness(freshRequirement.effective ? {
+            state: ManagedSettingsFreshnessState.Satisfied,
+            source: freshRequirement.source,
+            scope,
+            lastAttemptAt,
+            satisfiedAt
+        } : MANAGED_SETTINGS_FRESHNESS_NOT_REQUIRED);
+    }
+    toBlockedManagedSettingsFreshness(source, result, lastAttemptAt, scope) {
+        switch (result.kind) {
+        case "network":
+            return {
+                state: ManagedSettingsFreshnessState.Blocked,
+                source,
+                scope,
+                lastAttemptAt,
+                failure: ManagedSettingsFreshnessFailure.Network
+            };
+        case "rateLimited":
+            return {
+                state: ManagedSettingsFreshnessState.Blocked,
+                source,
+                scope,
+                lastAttemptAt,
+                failure: ManagedSettingsFreshnessFailure.RateLimited
+            };
+        case "httpError":
+            return {
+                state: ManagedSettingsFreshnessState.Blocked,
+                source,
+                scope,
+                lastAttemptAt,
+                failure: ManagedSettingsFreshnessFailure.HttpError,
+                httpStatus: result.status
+            };
+        case "malformed":
+            return {
+                state: ManagedSettingsFreshnessState.Blocked,
+                source,
+                scope,
+                lastAttemptAt,
+                failure: ManagedSettingsFreshnessFailure.Malformed
+            };
         }
-        this.logService.debug("[DefaultAccount] Fetching managed settings from:", managedSettingsUrl);
+    }
+    async requestManagedSettings(sessions, managedSettingsUrl) {
+        const requestUrl = appendManagedSettingsClientIdentity(managedSettingsUrl, this.productService);
+        this.logService.debug("[DefaultAccount] Fetching managed settings from:", requestUrl);
         const rateLimitBackoffActive = Date.now() < this._rateLimitBackoffUntil;
         const response = await this.request(
-            managedSettingsUrl,
+            requestUrl,
             "GET",
             undefined,
             sessions,
             CancellationToken.None,
             "defaultAccount.managedSettings",
-            MANAGED_SETTINGS_REQUEST_TIMEOUT_MS
+            {
+                requestTimeoutMs: MANAGED_SETTINGS_REQUEST_TIMEOUT_MS,
+                retryNotFound: false
+            }
         );
         if (!response) {
             this.logService.debug(
-                "[DefaultAccount] Managed settings fetch returned no response (network error, all sessions rejected, or active rate-limit backoff); falling back to local-only policy"
+                "[DefaultAccount] Managed settings fetch returned no response (network error, all selected sessions rejected, or active rate-limit backoff); falling back to local-only policy"
             );
             this.reportManagedSettingsOutcome("no-response", rateLimitBackoffActive);
-            return undefined;
+            return rateLimitBackoffActive ? {
+                kind: "rateLimited"
+            } : {
+                kind: "network"
+            };
+        }
+        const status = response.res.statusCode ?? 0;
+        if (status === 404) {
+            this.reportManagedSettingsOutcome(status, rateLimitBackoffActive);
+            return {
+                kind: "noSettings"
+            };
+        }
+        if (status === 466) {
+            const error = await this.readManagedSettingsCompatibilityError(response);
+            this.setManagedSettingsCompatibilityError(error);
+            this.reportManagedSettingsOutcome(status, rateLimitBackoffActive);
+            return {
+                kind: "updateRequired",
+                error
+            };
+        }
+        if (this.isRateLimited(response)) {
+            this.reportManagedSettingsOutcome(status, rateLimitBackoffActive);
+            return {
+                kind: "rateLimited"
+            };
         }
         if (!isSuccess(response)) {
-            const status = response.res.statusCode ?? 0;
             this.logService.warn(
                 `[DefaultAccount] Managed settings fetch returned non-success status ${status}; falling back to local-only policy`
             );
             this.reportManagedSettingsOutcome(status, rateLimitBackoffActive);
-            return undefined;
+            return {
+                kind: "httpError",
+                status
+            };
         }
         try {
             const data = await asJson(response);
@@ -833,7 +1266,7 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
             this._managedSettingsRawResponse = data ?? null;
             const adapted = adaptManagedSettings(data ?? {}, msg => this.logService.warn(msg));
             const managedSettingsCount = adapted.managedSettings ? ( Object.keys(adapted.managedSettings)).length : 0;
-            if (managedSettingsCount === 0) {
+            if (managedSettingsCount === 0 && adapted.managedSettingsActive !== true) {
                 this.logService.debug(
                     "[DefaultAccount] Managed settings fetched (empty response — no enterprise policy file present)"
                 );
@@ -842,15 +1275,78 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
                 this.logService.trace("[DefaultAccount] Managed settings payload:", JSON.stringify(adapted));
             }
             this.reportManagedSettingsOutcome("ok", rateLimitBackoffActive);
-            return adapted;
+            return {
+                kind: "success",
+                data: adapted
+            };
         } catch (error) {
             this.logService.error(
                 "[DefaultAccount] Failed to parse managed settings response",
                 getErrorMessage(error)
             );
             this.reportManagedSettingsOutcome("parse-error", rateLimitBackoffActive);
-            return undefined;
+            return {
+                kind: "malformed"
+            };
+        }
+    }
+    canRequestManagedSettings(options, scope) {
+        return options?.retryManagedSettings === true || scope === undefined || !( this.failedManagedSettingsFreshness.has(this.getManagedSettingsScopeKey(scope)));
+    }
+    updateFailedManagedSettingsFreshness(scope, source, result, lastAttemptAt) {
+        const scopeKey = this.getManagedSettingsScopeKey(scope);
+        switch (result.kind) {
+        case "success":
+        case "noSettings":
+            this.failedManagedSettingsFreshness.delete(scopeKey);
+            break;
+        case "updateRequired":
+            {
+                this.failedManagedSettingsFreshness.set(scopeKey, {
+                    state: ManagedSettingsFreshnessState.Blocked,
+                    source,
+                    scope,
+                    lastAttemptAt,
+                    failure: ManagedSettingsFreshnessFailure.UpdateRequired
+                });
+                break;
+            }
+        case "network":
+        case "rateLimited":
+        case "httpError":
+        case "malformed":
+            {
+                this.failedManagedSettingsFreshness.set(
+                    scopeKey,
+                    this.toBlockedManagedSettingsFreshness(source, result, lastAttemptAt, scope)
+                );
+                break;
+            }
+        }
+    }
+    getManagedSettingsScopeKey(scope) {
+        return `${scope.authenticationProviderId}\n${scope.accountId}\n${scope.endpointOrigin}`;
+    }
+    async readManagedSettingsCompatibilityError(response) {
+        try {
+            const text = await asText(response);
+            const body = text ? JSON.parse(text) : undefined;
+            const parsed = parseManagedSettingsCompatibilityError(body);
+            if (parsed) {
+                return parsed;
+            }
+            this.logService.error(
+                "[DefaultAccount] Managed settings compatibility response did not contain the expected error code"
+            );
+        } catch (error) {
+            this.logService.error(
+                "[DefaultAccount] Failed to parse managed settings compatibility response",
+                getErrorMessage(error)
+            );
         }
+        return {
+            errorCode: MANAGED_SETTINGS_UPDATE_REQUIRED_ERROR_CODE
+        };
     }
     reportManagedSettingsOutcome(status, rateLimitBackoffActive) {
         this._managedSettingsFetchStatus = status;
@@ -872,7 +1368,7 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
         }
         return false;
     }
-    async request(url, type, body, sessions, token, callSite, requestTimeoutMs) {
+    async request(url, type, body, sessions, token, callSite, options) {
         if (Date.now() < this._rateLimitBackoffUntil) {
             const remainingSec = Math.ceil((this._rateLimitBackoffUntil - Date.now()) / 1000);
             this.logService.debug(
@@ -891,7 +1387,7 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
                     url,
                     data: type === "POST" ? JSON.stringify(body) : undefined,
                     disableCache: true,
-                    timeout: requestTimeoutMs,
+                    timeout: options?.requestTimeoutMs,
                     headers: {
                         "Authorization": `Bearer ${session.accessToken}`
                     },
@@ -906,7 +1402,7 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
                     );
                     return response;
                 }
-                if (status === 401 || status === 404) {
+                if (status === 401 || (status === 404 && options?.retryNotFound !== false)) {
                     this.logService.debug(
                         `[DefaultAccount] Received ${status} for URL ${url} with session ${session.id}, likely due to expired/revoked token or insufficient permissions.`,
                         "Trying next session if available."
@@ -1046,7 +1542,7 @@ let DefaultAccountProvider = class DefaultAccountProvider extends Disposable {
         });
     }
 };
-DefaultAccountProvider = ( __decorate([( __param(1, IConfigurationService)), ( __param(2, IAuthenticationService)), ( __param(3, IAuthenticationExtensionsService)), ( __param(4, ITelemetryService)), ( __param(5, IExtensionService)), ( __param(6, IRequestService)), ( __param(7, ILogService)), ( __param(8, IWorkbenchEnvironmentService)), ( __param(9, IContextKeyService)), ( __param(10, IStorageService)), ( __param(11, IHostService)), ( __param(12, ICommandService))], DefaultAccountProvider));
+DefaultAccountProvider = ( __decorate([( __param(1, IConfigurationService)), ( __param(2, IAuthenticationService)), ( __param(3, IAuthenticationExtensionsService)), ( __param(4, ITelemetryService)), ( __param(5, IExtensionService)), ( __param(6, IRequestService)), ( __param(7, ILogService)), ( __param(8, IWorkbenchEnvironmentService)), ( __param(9, IProductService)), ( __param(10, IContextKeyService)), ( __param(11, IStorageService)), ( __param(12, IHostService)), ( __param(13, ICommandService)), ( __param(14, INativeManagedSettingsService)), ( __param(15, IFileManagedSettingsService))], DefaultAccountProvider));
 let DefaultAccountProviderContribution = class DefaultAccountProviderContribution extends Disposable {
     static {
         this.ID = "workbench.contributions.defaultAccountProvider";
@@ -1067,7 +1563,7 @@ registerAction2(class extends Action2 {
     constructor() {
         super({
             id: DEFAULT_ACCOUNT_SIGN_IN_COMMAND,
-            title: ( localize2(17209, "Sign In"))
+            title: ( localize2(19261, "Sign In"))
         });
     }
     async run(accessor) {
@@ -1081,4 +1577,4 @@ registerWorkbenchContribution2(
     WorkbenchPhase.BlockStartup
 );
 
-export { CONTEXT_DEFAULT_ACCOUNT_STATE, DEFAULT_ACCOUNT_SIGN_IN_COMMAND, DefaultAccountStatus };
+export { CONTEXT_DEFAULT_ACCOUNT_STATE, DEFAULT_ACCOUNT_SIGN_IN_COMMAND, DefaultAccountProvider, DefaultAccountStatus };