@codingame/monaco-vscode-chat-service-override 37.2.0 → 37.3.1

package/vscode/src/vs/platform/agentHost/common/agentHostFileSystemProvider.js

@@ -1,440 +0,0 @@
-
-import { decodeBase64, VSBuffer } from '@codingame/monaco-vscode-api/vscode/vs/base/common/buffer';
-import { disposableTimeout } from '@codingame/monaco-vscode-api/vscode/vs/base/common/async';
-import { Emitter } from '@codingame/monaco-vscode-api/vscode/vs/base/common/event';
-import { Disposable, MutableDisposable, toDisposable, DisposableStore } from '@codingame/monaco-vscode-api/vscode/vs/base/common/lifecycle';
-import { URI } from '@codingame/monaco-vscode-api/vscode/vs/base/common/uri';
-import { FileChangeType, FileSystemProviderCapabilities, FilePermission, FileType, FileSystemProviderErrorCode, createFileSystemProviderError } from '@codingame/monaco-vscode-api/vscode/vs/platform/files/common/files';
-import { isAgentHostContentRefUri, fromAgentHostUri, toAgentHostUri } from '@codingame/monaco-vscode-api/vscode/vs/platform/agentHost/common/agentHostUri';
-import { ContentEncoding } from '@codingame/monaco-vscode-api/vscode/vs/platform/agentHost/common/state/protocol/common/commands';
-import '@codingame/monaco-vscode-api/vscode/vs/platform/agentHost/common/state/protocol/channels-session/commands';
-import '@codingame/monaco-vscode-api/vscode/vs/platform/agentHost/common/state/protocol/channels-chat/commands';
-import '@codingame/monaco-vscode-api/vscode/vs/platform/agentHost/common/state/protocol/channels-changeset/commands';
-import { AhpErrorCodes } from '@codingame/monaco-vscode-api/vscode/vs/platform/agentHost/common/state/protocol/common/errors';
-import { ProtocolError } from '@codingame/monaco-vscode-api/vscode/vs/platform/agentHost/common/state/sessionProtocol';
-import { ActionType } from '@codingame/monaco-vscode-api/vscode/vs/platform/agentHost/common/state/protocol/common/actions';
-import '@codingame/monaco-vscode-api/vscode/vs/platform/agentHost/common/state/protocol/common/notifications';
-import { ROOT_STATE_URI } from '@codingame/monaco-vscode-api/vscode/vs/platform/agentHost/common/state/sessionState';
-
-async function createRemoteWatchHandle(primitives, params) {
-    const {
-        channel
-    } = await primitives.createResourceWatch(params);
-    const channelUri = ( URI.parse(channel));
-    await primitives.subscribe(channelUri);
-    const onDidChangeEmitter = ( new Emitter());
-    const listener = primitives.onDidAction(envelope => {
-        if (envelope.channel !== channel || envelope.action.type !== ActionType.ResourceWatchChanged) {
-            return;
-        }
-        const items = envelope.action.changes?.items ?? [];
-        if (items.length === 0) {
-            return;
-        }
-        onDidChangeEmitter.fire(( items.map(item => ({
-            resource: ( URI.parse(item.uri)),
-            type: item.type === "added" ? FileChangeType.ADDED : item.type === "deleted" ? FileChangeType.DELETED : FileChangeType.UPDATED
-        }))));
-    });
-    let disposed = false;
-    return {
-        onDidChange: onDidChangeEmitter.event,
-        dispose: () => {
-            if (disposed) {
-                return;
-            }
-            disposed = true;
-            listener.dispose();
-            onDidChangeEmitter.dispose();
-            try {
-                primitives.unsubscribe(channelUri);
-            } catch {}
-        }
-    };
-}
-class AHPFileSystemProvider extends Disposable {
-    static {
-        this._DEFAULT_CONNECTION_GRACE_MS = 5000;
-    }
-    constructor(_connectionGraceMs = AHPFileSystemProvider._DEFAULT_CONNECTION_GRACE_MS) {
-        super();
-        this._connectionGraceMs = _connectionGraceMs;
-        this.capabilities = FileSystemProviderCapabilities.PathCaseSensitive | FileSystemProviderCapabilities.FileReadWrite | FileSystemProviderCapabilities.FileFolderCopy | FileSystemProviderCapabilities.FileRealpath;
-        this._onDidChangeCapabilities = this._register(( new Emitter()));
-        this.onDidChangeCapabilities = this._onDidChangeCapabilities.event;
-        this._onDidChangeFile = this._register(( new Emitter()));
-        this.onDidChangeFile = this._onDidChangeFile.event;
-        this._onDidWatchError = this._register(( new Emitter()));
-        this.onDidWatchError = this._onDidWatchError.event;
-        this._authorities = ( new Map());
-        this._onDidChangeConnection = this._register(( new Emitter()));
-    }
-    registerAuthority(authority, connection) {
-        let entry = this._authorities.get(authority);
-        if (!entry) {
-            entry = {
-                connections: [connection],
-                expiry: ( new MutableDisposable())
-            };
-            this._authorities.set(authority, entry);
-        } else {
-            entry.expiry.clear();
-            entry.connections.push(connection);
-        }
-        const adopted = entry;
-        this._onDidChangeConnection.fire(authority);
-        return toDisposable(() => {
-            const idx = adopted.connections.indexOf(connection);
-            if (idx === -1) {
-                return;
-            }
-            const wasActive = idx === adopted.connections.length - 1;
-            adopted.connections.splice(idx, 1);
-            if (adopted.connections.length === 0) {
-                adopted.expiry.value = disposableTimeout(
-                    () => this._expireAuthority(authority, adopted),
-                    this._connectionGraceMs,
-                    this._store
-                );
-            }
-            if (wasActive) {
-                this._onDidChangeConnection.fire(authority);
-            }
-        });
-    }
-    _expireAuthority(authority, entry) {
-        if (this._authorities.get(authority) !== entry || entry.connections.length > 0) {
-            return;
-        }
-        this._authorities.delete(authority);
-        entry.expiry.dispose();
-        this._onDidChangeConnection.fire(authority);
-    }
-    dispose() {
-        for (const entry of ( this._authorities.values())) {
-            entry.expiry.dispose();
-            entry.connections.length = 0;
-        }
-        this._authorities.clear();
-        super.dispose();
-    }
-    watch(resource, opts) {
-        const store = ( new DisposableStore());
-        const handleHolder = store.add(( new MutableDisposable()));
-        const authority = resource.authority;
-        const params = {
-            channel: ROOT_STATE_URI,
-            uri: ( this._decodeUri(resource).toString()),
-            recursive: opts.recursive,
-            ...(opts.excludes.length > 0 ? {
-                excludes: {
-                    items: [...opts.excludes]
-                }
-            } : {}),
-            ...(opts.includes && opts.includes.length > 0 ? {
-                includes: {
-                    items: ( opts.includes.map(p => typeof p === "string" ? p : p.pattern))
-                }
-            } : {})
-        };
-        let attached;
-        let attaching = false;
-        let pendingReattach = false;
-        const reattach = async () => {
-            if (store.isDisposed) {
-                return;
-            }
-            if (attaching) {
-                pendingReattach = true;
-                return;
-            }
-            const entry = this._authorities.get(authority);
-            const next = entry?.connections.at(-1);
-            if (next === attached) {
-                return;
-            }
-            handleHolder.clear();
-            attached = undefined;
-            const watchResource = next?.watchResource;
-            if (!next || !watchResource) {
-                return;
-            }
-            attaching = true;
-            const target = next;
-            try {
-                const handle = await watchResource.call(target, params);
-                if (store.isDisposed) {
-                    handle.dispose();
-                    return;
-                }
-                const current = this._authorities.get(authority);
-                if (!current || current.connections.at(-1) !== target) {
-                    handle.dispose();
-                    return;
-                }
-                const sub = handle.onDidChange(changes => this._onDidChangeFile.fire(( changes.map(c => ({
-                    resource: this._encodeUri(c.resource, resource.authority),
-                    type: c.type
-                })))));
-                handleHolder.value = toDisposable(() => {
-                    sub.dispose();
-                    handle.dispose();
-                });
-                attached = target;
-            } catch (err) {
-                this._onDidWatchError.fire(err instanceof Error ? err.message : String(err));
-            } finally {
-                attaching = false;
-                if (pendingReattach) {
-                    pendingReattach = false;
-                    void reattach();
-                }
-            }
-        };
-        store.add(this._onDidChangeConnection.event(a => {
-            if (a === authority) {
-                void reattach();
-            }
-        }));
-        void reattach();
-        return store;
-    }
-    _isContentRef(resource, decoded) {
-        return isAgentHostContentRefUri(resource) || decoded.scheme === "session-db" || decoded.scheme === "git-blob";
-    }
-    async stat(resource) {
-        const path = resource.path;
-        const decoded = this._decodeUri(resource);
-        if (this._isContentRef(resource, decoded)) {
-            return {
-                type: FileType.File,
-                mtime: 0,
-                ctime: 0,
-                size: 0,
-                permissions: FilePermission.Readonly
-            };
-        }
-        if (path === "/" || path === "") {
-            return {
-                type: FileType.Directory,
-                mtime: 0,
-                ctime: 0,
-                size: 0,
-                permissions: FilePermission.Readonly
-            };
-        }
-        if (decoded.path === "/" || decoded.path === "") {
-            return {
-                type: FileType.Directory,
-                mtime: 0,
-                ctime: 0,
-                size: 0,
-                permissions: FilePermission.Readonly
-            };
-        }
-        const connection = await this._getConnection(resource.authority);
-        try {
-            const resolved = await this._resolve(connection, decoded);
-            return {
-                type: resolved.type === "directory" ? FileType.Directory : resolved.type === "symlink" ? FileType.SymbolicLink : FileType.File,
-                mtime: resolved.mtime ? Date.parse(resolved.mtime) : 0,
-                ctime: resolved.ctime ? Date.parse(resolved.ctime) : 0,
-                size: resolved.size ?? 0
-            };
-        } catch (err) {
-            throw this._mapError(err, FileSystemProviderErrorCode.FileNotFound);
-        }
-    }
-    async realpath(resource) {
-        const path = resource.path;
-        if (path === "/" || path === "") {
-            return path;
-        }
-        const decoded = this._decodeUri(resource);
-        if (this._isContentRef(resource, decoded) || decoded.path === "/" || decoded.path === "") {
-            return path;
-        }
-        const connection = await this._getConnection(resource.authority);
-        try {
-            const resolved = await this._resolve(connection, decoded);
-            return this._encodeUri(( URI.parse(resolved.uri)), resource.authority).path;
-        } catch (err) {
-            throw this._mapError(err, FileSystemProviderErrorCode.FileNotFound);
-        }
-    }
-    async readdir(resource) {
-        const entries = await this._listDirectory(resource.authority, resource);
-        return ( entries.map(e => [e.name, e.type === "directory" ? FileType.Directory : FileType.File]));
-    }
-    async readFile(resource) {
-        const connection = await this._getConnection(resource.authority);
-        try {
-            const originalUri = this._decodeUri(resource);
-            const result = await connection.resourceRead(originalUri, ContentEncoding.Base64);
-            if (result.encoding === ContentEncoding.Base64) {
-                return decodeBase64(result.data).buffer;
-            }
-            return VSBuffer.fromString(result.data).buffer;
-        } catch (err) {
-            throw this._mapError(err, FileSystemProviderErrorCode.FileNotFound);
-        }
-    }
-    async writeFile(resource, content, _opts) {
-        const connection = await this._getConnection(resource.authority);
-        try {
-            const originalUri = this._decodeUri(resource);
-            await connection.resourceWrite({
-                channel: ROOT_STATE_URI,
-                uri: ( originalUri.toString()),
-                data: ( VSBuffer.wrap(content).toString()),
-                encoding: ContentEncoding.Utf8
-            });
-        } catch (err) {
-            throw this._mapError(err, FileSystemProviderErrorCode.NoPermissions);
-        }
-    }
-    async mkdir(resource) {
-        const connection = await this._getConnection(resource.authority);
-        try {
-            const originalUri = this._decodeUri(resource);
-            await connection.resourceMkdir({
-                channel: ROOT_STATE_URI,
-                uri: ( originalUri.toString())
-            });
-        } catch (err) {
-            throw this._mapError(err, FileSystemProviderErrorCode.NoPermissions);
-        }
-    }
-    async delete(resource, opts) {
-        const connection = await this._getConnection(resource.authority);
-        try {
-            const originalUri = this._decodeUri(resource);
-            await connection.resourceDelete({
-                channel: ROOT_STATE_URI,
-                uri: ( originalUri.toString()),
-                recursive: opts.recursive
-            });
-        } catch (err) {
-            throw this._mapError(err, FileSystemProviderErrorCode.NoPermissions);
-        }
-    }
-    async rename(from, to, opts) {
-        const connection = await this._getConnection(from.authority);
-        try {
-            const originalFrom = this._decodeUri(from);
-            const originalTo = this._decodeUri(to);
-            await connection.resourceMove({
-                channel: ROOT_STATE_URI,
-                source: ( originalFrom.toString()),
-                destination: ( originalTo.toString()),
-                failIfExists: !opts.overwrite
-            });
-        } catch (err) {
-            throw this._mapError(err, FileSystemProviderErrorCode.NoPermissions);
-        }
-    }
-    async copy(from, to, opts) {
-        const connection = await this._getConnection(from.authority);
-        try {
-            const originalFrom = this._decodeUri(from);
-            const originalTo = this._decodeUri(to);
-            await connection.resourceCopy({
-                channel: ROOT_STATE_URI,
-                source: ( originalFrom.toString()),
-                destination: ( originalTo.toString()),
-                failIfExists: !opts.overwrite
-            });
-        } catch (err) {
-            throw this._mapError(err, FileSystemProviderErrorCode.NoPermissions);
-        }
-    }
-    async requestResourceAccess(resource, opts) {
-        const connection = await this._getConnection(resource.authority);
-        if (!connection.resourceRequest) {
-            throw createFileSystemProviderError(
-                `Connection for ${resource.authority} does not support resourceRequest`,
-                FileSystemProviderErrorCode.Unavailable
-            );
-        }
-        const originalUri = this._decodeUri(resource);
-        try {
-            await connection.resourceRequest({
-                channel: ROOT_STATE_URI,
-                uri: ( originalUri.toString()),
-                read: opts.read,
-                write: opts.write
-            });
-        } catch (err) {
-            throw this._mapError(err, FileSystemProviderErrorCode.NoPermissions);
-        }
-    }
-    _getConnection(authority) {
-        const entry = this._authorities.get(authority);
-        if (!entry) {
-            return Promise.reject(createFileSystemProviderError(
-                `No connection for authority: ${authority}`,
-                FileSystemProviderErrorCode.Unavailable
-            ));
-        }
-        const active = entry.connections.at(-1);
-        if (active) {
-            return Promise.resolve(active);
-        }
-        return ( new Promise((resolve, reject) => {
-            const settle = () => {
-                const current = this._authorities.get(authority);
-                if (!current) {
-                    sub.dispose();
-                    reject(createFileSystemProviderError(
-                        `No connection for authority: ${authority}`,
-                        FileSystemProviderErrorCode.Unavailable
-                    ));
-                    return;
-                }
-                const c = current.connections.at(-1);
-                if (c) {
-                    sub.dispose();
-                    resolve(c);
-                }
-            };
-            const sub = this._onDidChangeConnection.event(a => {
-                if (a === authority) {
-                    settle();
-                }
-            });
-            settle();
-        }));
-    }
-    _mapError(err, defaultCode) {
-        if (err instanceof ProtocolError && err.code === AhpErrorCodes.PermissionDenied) {
-            return createFileSystemProviderError(err.message, FileSystemProviderErrorCode.NoPermissions);
-        }
-        return createFileSystemProviderError(err instanceof Error ? err.message : String(err), defaultCode);
-    }
-    _resolve(connection, decoded) {
-        return connection.resourceResolve({
-            channel: ROOT_STATE_URI,
-            uri: ( decoded.toString())
-        });
-    }
-    async _listDirectory(authority, resource) {
-        const connection = await this._getConnection(authority);
-        try {
-            const originalUri = this._decodeUri(resource);
-            const result = await connection.resourceList(originalUri);
-            return result.entries;
-        } catch (err) {
-            throw this._mapError(err, FileSystemProviderErrorCode.Unavailable);
-        }
-    }
-}
-class AgentHostFileSystemProvider extends AHPFileSystemProvider {
-    _decodeUri(resource) {
-        return fromAgentHostUri(resource);
-    }
-    _encodeUri(resource, authority) {
-        return toAgentHostUri(resource, authority);
-    }
-}
-
-export { AHPFileSystemProvider, AgentHostFileSystemProvider, createRemoteWatchHandle };

package/vscode/src/vs/platform/agentHost/common/agentHostManagedRules.d.ts

@@ -1,47 +0,0 @@
-/**
- * Construction and validation of Copilot SDK managed permission rules.
- *
- * The SDK parses every rule it receives with a strict grammar, and a single
- * malformed rule rejects the **entire** managed permissions document rather
- * than just the offending entry. Because VS Code sends this document as part of
- * session create/resume, an untranslatable rule derived from a user's settings
- * would fail the session outright. Everything this bridge emits therefore goes
- * through {@link buildManagedRule}, which returns `undefined` for anything the
- * SDK would reject so the caller can drop it and continue.
- *
- * The grammar mirrored here is `parse_managed_rule` in the agent runtime
- * (`src/runtime/src/permissions/managed.rs`).
- */
-/**
- * Rule families the SDK understands. Any other family is a parse error for the
- * whole document, so there is deliberately no escape hatch for arbitrary tool
- * names — see `parse_managed_rule`'s "Unsupported managed permission rule
- * family" branch.
- */
-export declare enum ManagedRuleFamily {
-    /** Shell/terminal commands. Matches `Bash` and `PowerShell` on the SDK side too. */
-    Shell = "Shell",
-    /** File reads. */
-    Read = "Read",
-    /** File writes. The SDK treats `Edit` as an alias. */
-    Write = "Write",
-    /** Network access, matched as a URL pattern. */
-    Domain = "Domain"
-}
-/**
- * A rule with no argument, which matches **every** request in its family — the
- * SDK's matchers return `true` as soon as the family matches and the argument is
- * absent. This is the only correct way to express "all of X"; an argument of
- * `*` is *not* a universal wildcard for {@link ManagedRuleFamily.Domain},
- * because domain arguments are normalized as URL patterns whose only wildcard
- * form is a `*.host` subdomain match.
- */
-export declare function buildManagedFamilyRule(family: ManagedRuleFamily): string;
-/**
- * Builds a single managed permission rule, or returns `undefined` when the
- * argument cannot be expressed in the SDK grammar.
- *
- * Callers must treat `undefined` as "this restriction is not translatable" and
- * skip it — never fall back to a broader rule, which would silently over-restrict.
- */
-export declare function buildManagedRule(family: ManagedRuleFamily, argument: string): string | undefined;

package/vscode/src/vs/platform/agentHost/common/agentHostManagedRules.js

@@ -1,75 +0,0 @@
-
-
-var ManagedRuleFamily;
-(function(ManagedRuleFamily) {
-    ManagedRuleFamily["Shell"] = "Shell";
-    ManagedRuleFamily["Read"] = "Read";
-    ManagedRuleFamily["Write"] = "Write";
-    ManagedRuleFamily["Domain"] = "Domain";
-})(ManagedRuleFamily || (ManagedRuleFamily = {}));
-function buildManagedFamilyRule(family) {
-    return family;
-}
-function buildManagedRule(family, argument) {
-    if (!argument.trim() || !isValidRuleArgument(argument)) {
-        return undefined;
-    }
-    switch (family) {
-    case ManagedRuleFamily.Shell:
-        return isValidShellArgument(argument) ? `${family}(${argument})` : undefined;
-    case ManagedRuleFamily.Read:
-    case ManagedRuleFamily.Write:
-        return isValidPathArgument(argument) ? `${family}(${normalizePathSeparators(argument)})` : undefined;
-    case ManagedRuleFamily.Domain:
-        return isValidDomainArgument(argument) ? `${family}(${argument})` : undefined;
-    }
-}
-function isValidRuleArgument(argument) {
-    return !argument.includes(")") && !argument.includes("\n");
-}
-function isValidShellArgument(argument) {
-    if (argument === "*") {
-        return true;
-    }
-    const prefix = argument.endsWith(" *") ? argument.slice(0, -2).trimEnd() : argument;
-    return prefix.length > 0;
-}
-function isValidPathArgument(argument) {
-    if (argument.startsWith("!")) {
-        return false;
-    }
-    let depth = 0;
-    for (const char of argument) {
-        if (char === "{") {
-            depth++;
-        } else if (char === "}") {
-            if (--depth < 0) {
-                return false;
-            }
-        }
-    }
-    return depth === 0;
-}
-function normalizePathSeparators(argument) {
-    return argument.replace(/\\/g, "/");
-}
-function isValidDomainArgument(argument) {
-    if (argument.includes("$(") || argument.includes("${") || argument.includes("`")) {
-        return false;
-    }
-    const hasScheme = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(argument);
-    if (!hasScheme && argument.includes("//")) {
-        return false;
-    }
-    if (argument === "*") {
-        return false;
-    }
-    try {
-        const url = ( new URL(hasScheme ? argument : `https://${argument}`));
-        return url.hostname.length > 0;
-    } catch {
-        return false;
-    }
-}
-
-export { ManagedRuleFamily, buildManagedFamilyRule, buildManagedRule };

package/vscode/src/vs/platform/agentHost/common/agentHostManagedSettings.d.ts

@@ -1,68 +0,0 @@
-/**
- * Compatibility bridge from legacy VS Code settings to Copilot SDK managed
- * settings.
- *
- * Scope and limits, all deliberate:
- *
- * - **Restrictions only.** Mappings may add `deny`, `ask`, or the bypass lock;
- *   they never widen what a session may do. In particular no `allow` list is
- *   contributed, even to narrow another rule's reach: the SDK's managed `allow`
- *   is not a scoping hint, since a covered request resolves to `managed_allow`,
- *   which the runtime treats as outright approval and returns without prompting.
- *   The runtime also intersects allow lists only when more than one managed
- *   source supplies one, so a lone list from VS Code would grant blanket
- *   auto-approval and could relax an MDM policy rather than reinforce it.
- * - **Global layers only.** Values are read from policy, user, and application;
- *   workspace and folder values are ignored, because the agent host is shared by
- *   every window connected to it and one workspace's settings must not leak into
- *   another window's sessions.
- * - **Only what survives translation.** A setting is mapped only when its VS
- *   Code semantics can be expressed exactly in the SDK's rule grammar. Where
- *   they cannot — a regular-expression terminal rule, an allow list that blocks
- *   what it omits — the restriction is skipped rather than approximated, since a
- *   near-miss silently changes what an administrator configured.
- * - **One deliberate exception, erring more restrictive.**
- *   `chat.tools.eligibleForAutoApproval` marks individual tools ineligible for
- *   auto-approval, but the SDK grammar has no tool-name family ({@link
- *   ManagedRuleFamily} is only `Shell`, `Read`, `Write`, and `Domain`, and an
- *   unknown family rejects the whole document). Rather than skip a genuine
- *   restriction, a policy that marks any tool ineligible maps onto the
- *   family-agnostic bypass lock — coarser and more restrictive, since the lock
- *   is session-wide and does not itself force per-request confirmation (only an
- *   `ask` rule sets `managedApprovalRequired`). A policy that leaves every tool
- *   eligible (all `true`, or empty) expresses no restriction and contributes
- *   nothing. Replace this with a per-tool translation once the grammar gains a
- *   tool-name family.
- * - **Copilot sessions on a local host.** The renderer sends an empty
- *   contribution to remote hosts, and other agents do not consume managed
- *   settings, so restrictions bridged here do not reach them. Those agents
- *   remain governed by the root-config path (see
- *   `AgentHostAutoApprovePolicyRestrictedConfigKey`).
- *
- * New enterprise controls belong directly in the SDK's managed-settings
- * contract; this table exists only so settings that predate it keep working.
- */
-import { IConfigurationService } from "@codingame/monaco-vscode-api/vscode/vs/platform/configuration/common/configuration.service";
-/**
- * The restrictions this bridge contributes to the Copilot SDK. There is
- * deliberately no `allow` list — see the module comment.
- */
-export interface IAgentHostManagedSettingsPermissions {
-    disableBypassPermissionsMode?: "disable";
-    deny?: string[];
-    ask?: string[];
-}
-export declare const AgentHostMapLegacySettingsToManagedSettingsSettingId = "chat.agentHost.copilot.mapLegacySettingsToManagedSettings";
-export declare const managedPermissionsConfigurationIds: string[];
-export declare function isManagedSettingsPermissions(value: unknown): value is IAgentHostManagedSettingsPermissions;
-/**
- * Combines every mapping's contribution into the single document sent to the
- * host, deduplicating rules that more than one setting produced.
- *
- * Contributing any rule at all makes the runtime's managed policy "active",
- * which causes unmatched shell, read, write, URL and factory requests to require
- * approval. That is broader than any individual mapping intends, but it errs
- * toward prompting, and the alternative — an `allow` list — resolves to
- * auto-approval. See the module comment.
- */
-export declare function resolveManagedSettingsPermissions(configurationService: IConfigurationService): IAgentHostManagedSettingsPermissions;