Ross Wollman

chat: require Agent Host for managed permissions (#340617) <!-- Thank you for submitting a Pull Request. Please: * Read our Pull Request guidelines: https://github.com/microsoft/vscode/wiki/How-to-Contribute#pull-requests * Associate an issue with the Pull Request. * Ensure that the code is up-to-date with the `main` branch. * Include a description of the proposed changes and how to test them. --> Supersedes #340408. Builds on the automatic migration and cleanup in #340585 and #340596. Any nonempty managed `permissions` object now requires Copilot Agent Host, including defaults, explicit `false` / `"enable"`, and empty rule lists. This reuses the existing Local chat migration without sending anything automatically. Copilot's permission picker reflects runtime restrictions and defaults, allowing admins to block Allow All while keeping Assisted available. Explicit new mode restrictions replace the legacy blanket restriction; `defaultMode` alone does not. Empty `permissions: {}` and legacy policy alone retain existing Local behavior. Editor Inline Chat keeps its limited read/edit exception. Sandboxing remains independent. ## Policy behavior **Legacy `ChatToolsAutoApprove: false` with no managed permissions still blocks both Allow All and Assisted in Copilot Agent Host.** It does not force users off Local. A nonempty `permissions` object determines harness eligibility; only an explicit new mode restriction replaces the legacy blanket mode restriction. The table shows selectable modes, not the starting selection. It assumes all modes are supported and no additional restrictions. Legacy JSON represents policy values, not OS-specific deployment syntax. Local does not support Assisted. | # | Legacy policy JSON | Managed-settings JSON | Full Local chat | AH: Allow All | AH: Assisted | AH: Manual | |---|---|---|---|:---:|:---:|:---:| | 1 | `{}` | `{}` | Available | ✅ | ✅ | ✅ | | 2 | `{"ChatToolsAutoApprove":false}` | `{}` | Available, legacy restrictions | ❌ | ❌ | ✅ | | 3 | `{}` | `{"permissions":{"disableBypassPermissionsMode":"disable"}}` | Migrate to Copilot | ❌ | ✅ | ✅ | | 4 | `{"ChatToolsAutoApprove":false}` | `{"permissions":{"disableBypassPermissionsMode":"disable"}}` | Migrate to Copilot | ❌ | ✅ | ✅ | | 5 | `{}` | `{"permissions":{"disableAssistedPermissionsMode":true}}` | Migrate to Copilot | ✅ | ❌ | ✅ | | 6 | `{"ChatToolsAutoApprove":false}` | `{"permissions":{"disableAssistedPermissionsMode":true}}` | Migrate to Copilot | ✅ | ❌ | ✅ | | 7 | `{"ChatToolsAutoApprove":false}` | `{"permissions":{"disableBypassPermissionsMode":"disable","disableAssistedPermissionsMode":true}}` | Migrate to Copilot | ❌ | ❌ | ✅ | | 8 | `{"ChatToolsAutoApprove":false}` | `{"permissions":{"disableBypassPermissionsMode":"enable"}}` | Migrate to Copilot | ✅ | ✅ | ✅ | | 9 | `{"ChatToolsAutoApprove":false}` | `{"permissions":{"disableAssistedPermissionsMode":false}}` | Migrate to Copilot | ✅ | ✅ | ✅ | | 10 | `{}` | `{"permissions":{"defaultMode":"assisted"}}` | Migrate to Copilot | ✅ | ✅ | ✅ | | 11 | `{"ChatToolsAutoApprove":false}` | `{"permissions":{"defaultMode":"assisted"}}` | Migrate to Copilot | ❌ | ❌ | ✅ | | 12 | `{"ChatToolsAutoApprove":false}` | `{"permissions":{"ask":[]}}` | Migrate to Copilot | ❌ | ❌ | ✅ | `permissions: {}` behaves like no permissions object. Rows 6, 8, and 9 intentionally replace the legacy restriction with the explicitly configured new mode controls. Rows 11 and 12 require Agent Host but retain the legacy mode restriction. In row 10, Assisted is the starting default unless an explicit or remembered choice takes precedence; in row 11 it is unavailable, so the default falls back to Manual. “Migrate to Copilot” means full Local execution is unavailable: new chats use Copilot and existing Local chats migrate when displayed. The editor-inline exception above remains. Managed `sandbox.enabled: true` independently requires Agent Host even when permissions are absent. ## Testing Test with only `permissions.disableBypassPermissionsMode: "disable"`: full Local chats should move to Copilot, Allow All should be unavailable, and Assisted should remain selectable. Also test policy removal and an empty permissions object. Relates https://github.com/microsoft/vscode/issues/338932. Relates https://github.com/microsoft/vscode-internalbacklog/issues/9987. *🤖 Authored with GitHub Copilot on behalf of @rwoll.*

chat: require Agent Host for managed sandbox and permission rules (#340529) <!-- Thank you for submitting a Pull Request. Please: * Read our Pull Request guidelines: https://github.com/microsoft/vscode/wiki/How-to-Contribute#pull-requests * Associate an issue with the Pull Request. * Ensure that the code is up-to-date with the `main` branch. * Include a description of the proposed changes and how to test them. --> Local, Claude, and Codex harnesses cannot enforce certain Enterprise Managed Settings (e.g. non-empty `permissions.ask`, `permissions.allow`, or `permissions.deny` lists, or `sandbox.enabled: true`) while Copilot Agent Host can. When an organization has incompatible settings enabled, we need to deal with older chats that were started in an unsupported harness: 1. Local: 1. A banner at the top reads: > This chat is read-only because your organization requires the new Copilot experience. **Move to Copilot** 2. If the user clicks the migration button in the banner, VS Code automatically: 1. Imports their chat to a Copilot Agent Host Session. 2. Opens and focuses the new chat with the transcript and unsent draft/attachments. Nothing is sent automatically. 3. Archives the old Local session after the new chat opens successfully. Reopening the archived original shows the normal read-only banner while the policy requirement remains, without another migration button. We do not migrate the model choice or permission settings. Instead, the new chat uses its normal defaults under current organization policy, and the user can change them in the pickers where permitted. 2. Claude and Codex: completely disabled and filtered out from the sidebar/Sessions list. Based on offline discussion we've chosen to preserve this existing behavior. Making their transcripts available without re-enabling execution needs separate read-only support that is out of scope here. It's not 100% ideal, but is a tradeoff. 3. Inline Chat: still available since it's a widely used feature and only uses limited tools. 4. Terminal Chat: disabled. ## Demos **Migration banner**: <img width="1007" height="341" alt="Screenshot 2026-10-08 at 10 54 28 AM" src="https://github.com/user-attachments/assets/eaa626aa-329f-4ff5-8343-7a2a964a8a6b" /> **Post-Migration: new and archived chat**: <img width="317" height="244" alt="Screenshot 2026-10-08 at 10 54 56 AM" src="https://github.com/user-attachments/assets/e3763770-683f-4e9b-b862-53d648ae7804" /> **End to End Video**: https://github.com/user-attachments/assets/cd6a2fee-94bd-4ecc-8e4d-7cd350fd73fa Editor inline chat's limited read/edit flow remains available as an explicit exception. This gate does not enforce runtime permission rules on inline edits; Local-backed terminal chat remains subject to the requirement. Resolves https://github.com/microsoft/vscode/issues/338932. Resolves https://github.com/microsoft/vscode-internalbacklog/issues/9987. ## Manual Testing 1. Launch VS Code (without any Enterprise Managed Settings), and start a few chats with Local and any enabled Claude/Codex harnesses. The following settings restore the Local choice (though they won't work if enterprise policy forcibly disables it): ```json { "chat.editor.localAgent.enabled": true, "chat.editor.preferCopilotHarness": false, "chat.defaultToCopilotHarness": false } ``` 2. Apply an Enterprise Managed Policy with at least something like: ```json { "permissions": { "ask": ["Shell"] } } ``` 3. Run **Developer: Sync Account Policy** and confirm the effective policy in **Developer: Policy Diagnostics**. Local chats should show the migration banner; Claude/Codex sessions remain hidden while disabled. Before starting the destination chat, run **Developer: Restart Local Agent Host** so its runtime picks up the changed policy. 5. Click **Move to Copilot**. Confirm the transcript and draft arrive without sending, the original is archived, and the new conversation stays in history when switching back to the original before sending. The migration and navigation flow was manually verified. After the CI/review fixes: - `npm run build-fast -- --client-only`: passed. - `npm run define-class-fields-check`: passed. - Targeted `npm run eslint -- ...` and staged-file `node build/hygiene.ts`: passed. - ChatService, ChatWidget, constants, and editor regression suites passed; the final editor rerun passed 24 tests. - `./node_modules/.bin/component-explorer render --project ./test/componentFixtures/component-explorer.json --fixture-id-regex '^editor/inlineChatZoneWidget/InlineChatZoneWidget(Terminated)?/(Light|Dark)$'`: all four fixtures rendered without errors. No baseline hashes or PNGs were committed. *🤖 Authored with GitHub Copilot on behalf of @rwoll.*

Apply managed Auto tier startup defaults in Local and Agent Host (#337177) Fixes #336829

Add governed OTel identity capture for Local agents (#336814) Resolves #302930. Target: **1.140.0**. Builds on #336701. ## Summary Adds opt-in, enterprise-governed identity capture to **Local Copilot Chat**: - `user.name` on agent invocation spans, including subagents and inline agents. - `process.user.name` and `host.name` on resources. Identity is **off by default and independent of content capture**. Explicit managed policy wins over environment and personal preferences. Denial strips identity from subsequent exports, including queued data and SQLite, and stays latched until reload. Explicit resource attributes cannot bypass it. Managed telemetry selects one whole block in priority order: native MDM > server > file. Omitted fields are not inherited from lower-priority sources. Resource batching is preserved; unavailable OS usernames do not stop telemetry. **Scope:** Local only. Agent Host endpoint routing and native identity validation are tracked in #337413. ## Validation - 314 focused tests, extension type-check, and targeted lint passed. - Live Local checks passed: identity/content enabled, content disabled, and identity denied without reload. Re-enable/reload behavior has automated coverage, not live validation. - Opus 5.5 re-review found no remaining issues; renewed signed approval is pushed. - Latest CI status is tracked in the checks below.

minVersion UI: enterprised managed users not satisfying minVersion get explanatory overlay and banner Fixes #337086 Enterprise Managed Settings `minVersion` lets administrators block AI features on outdated VS Code clients until users update—for example, to require newer sandboxing protections. This PR explains that existing restriction without changing enforcement. Chat shows an update notice. **Agents shows one blocking overlay, without a redundant banner.** The editor retains a Workspace Trust-style banner even when Chat is closed, because other editing features remain available. Native update actions are offered when available. If enterprise policy disables built-in updates, the notice directs users to their administrator for an approved update. Other unavailable-updater states do not imply administrator management, and **no generic fallback link is shown**. **Open Editor Window** opens a fresh editor window, preserving the existing recovery behavior. ## Screenshots **Controlled simulations, real rendered UI.** Code - OSS Dev, isolated HTTP 466 requirement (installed 1.140.0; required 1.141.0), with the existing updater service temporarily set to `Idle` or `Disabled(Policy)` and then restored to `Disabled(NotBuilt)`. Agents captures were regenerated at the final review-fix head and matched the published PNGs byte-for-byte; unchanged Editor captures are retained. No DOM/text substitution, composites, shipping test switches, or actual update installation. Editor captures exclude the account area and show only a synthetic example file. ### Native updater available — simulated `Idle` **Chat closed: the editor banner remains visible, with Check for Updates.**  **Chat open: the same requirement and native update action appear beside the editor.**  **Agents: overlay only, with Check for Updates and Open Editor Window.**  ### Enterprise-managed updates — simulated `Disabled(Policy)` **Chat closed: the editor banner explains that an administrator manages the update path; no generic link.**  **Chat open: administrator guidance, without a misleading fallback action.**  **Agents: administrator guidance and Open Editor Window; no redundant banner or generic link.**  <details> <summary>Validation and remaining checks</summary> - 158 focused tests passed in **each of Chromium and WebKit**, including focus ownership/restoration, startup fallback, long tokens and viewport resizing, available-action help, all disabled-updater reasons, and the unchanged fresh-editor-window action. - Before the final push, all eight Compile & Hygiene scripts passed across documented runs: `core-ci`, `hygiene`, `eslint`, `valid-layers-check`, `define-class-fields-check`, `vscode-dts-compile-check`, `tsec-compile-check`, and `test-build-scripts`. The original aggregate hit environment blockers; it is not claimed as one successful unmodified run. The same `core-ci` command passed after GitHub's rate-limit reset. Build-script tests passed 462/462 with command-scoped empty Git configuration for synthetic fixture repos and canonical `/private/tmp`; the other checks used normal Git configuration. User signing settings were unchanged. - Build-tool typecheck, Markdown manifest checks, conditional Codex protocol check (no changed inputs), and cyclic-dependency check (9,174 files) passed or correctly skipped before that push. - Real Electron checks covered both updater states and editor-banner independence from Chat. A long version token at a 600×320 renderer viewport wrapped without horizontal overflow, and the focused recovery action remained visible after shrinking the viewport. Mock settings, updater state, and viewport were restored afterward. - Earlier validation covered actual 320/480/900px Chat widths and HTTP 466 → `200 {}` → 466 recovery in both windows. All three Copilot review threads have concise inline replies and are resolved. - Presentation consumes the existing compatibility signal; it does not invent extension/runtime-specific metadata. VoiceOver and full light/dark/high-contrast coverage remain pending. - Draft review and a trusted signed approval checkpoint at the new head remain outstanding. No automatic merge. </details>

chat: Explain disabled permission modes instead of hiding them (#343302) Keep supported permission modes discoverable when enterprise or host restrictions prevent selection, with truthful disabled explanations and unchanged enforcement. Suppress the Assisted New badge while unavailable and document the discoverability pattern. 🤖 Authored with GitHub Copilot on behalf of @rwoll. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

chat: Make mandatory Copilot harness adoption an explicit admin choice (for now) (#342623) chat: Make mandatory Copilot harness adoption an explicit admin choice Keep Local eligibility independent of managed permission and sandbox settings while preserving normal rollout and harness-selection behavior. Require explicit temporaryAllowLocalHarness=false to prohibit Local and also disable Claude and Codex through their existing integration policies. Fixes #342599. 🤖 Authored with GitHub Copilot on behalf of @rwoll. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

chat: Show slow organization settings in chat instead of stacked toasts (#342937) Follow-up to #342167. When an organization's managed settings load slowly, users saw several identical "Loading your organization's managed settings" toasts stacked up. Most were for background work they weren't waiting on. The message now appears only in the chat that is waiting for these settings, inline in its progress row like "Working…". It disappears when the settings load. Background loading no longer interrupts the user. Known gap (follow-up): the first send in a new chat can still pause before the message moves into the chat while settings load, now without a toast. The mock policy server also gets a **Response delay (ms)** setting (`delayMs`, default 0) to reproduce slow delivery. ## Screenshot <img width="582" height="224" alt="Screenshot 2026-10-20 at 9 26 54 AM" src="https://github.com/user-attachments/assets/5ca50e4b-5231-48d2-8cdb-051d61832963" /> ## How to test 1. Run `npm run mock-policy-server` and route the client to it. 2. Clear the policy cache in the GUI, then set **Response delay (ms)** to `8000` for Managed Settings. 3. Send a message in a new chat. After about 3.5 seconds the loading message appears inline in the chat, and no toasts appear. *🤖 Authored with GitHub Copilot on behalf of @rwoll.*

Preserve managed policy and Chat selection during refresh Only affects configurations where `forceRemoteSettingsRefresh` is effective and set to `true`. Addresses two related causes of Chat resetting from Agent to Ask: 1. **Background policy refresh:** After a successful fetch, keep the last accepted policy active while refreshing for the same account, authentication provider, and endpoint. In other words, don't temporarily drop the active policy while the refresh request is in flight. Failures and timeouts still fail closed until a retry succeeds. 2. **Startup and blocked/retry UI state:** Preserve the selected Chat mode while the freshness gate is pending or blocked, rather than persisting a temporary Ask/Edit fallback. Keep submission blocked, including after asynchronous saves and attachment preparation and before custom submit handlers. Revalidate when the gate resolves so an accepted policy that disables Agent still takes effect. Startup and scope changes still require a successful fetch before AI use. Polling and cache expiry are unchanged. Unrelated model/custom-agent loading races are out of scope. **Validation:** 187 targeted tests, client type check, and targeted ESLint pass. Covers initial fetch, forced/hourly background refresh, accepted Agent disablement, failure/retry, draft persistence, and submission races. Full-editor restart testing remains a manual follow-up. Consolidates #338839. Includes the selection/submission guards adapted from #338826; no dependency on that PR merging. *🤖 Authored with GitHub Copilot on behalf of @rwoll.*

chat: Restore enterprise harness enforcement and explain disabled Local (#342670) ## Why Partially reverts #342623 following internal discussions about how best to address the enterprise rollout issues. We restore harness enforcement while retaining the Claude/Codex policy fix, and explain why Local is disabled rather than hiding it. Local cannot enforce runtime-only permission and sandbox controls. ## Changes - Show policy-disabled Local greyed out with a briefcase indicator and a visible [Learn why](https://aka.ms/vscode-copilot-harness-policy) link. The link supports mouse and keyboard activation without selecting Local; the detailed hover remains available. - Require Copilot for Local chats only when managed `permissions.deny` is non-empty or `sandbox.enabled: true`, rather than any `permissions.*` setting. Malformed deny values remain fail-closed. Routing, request blocking, and migration use the same trigger. - Preserve Claude/Codex restrictions, including the #342599 fix for `vscode.temporaryAllowLocalHarness: false`. - Retain the `vscode.temporaryDefaultToLocalHarness: true` escape hatch; explicit `temporaryAllowLocalHarness: false` still wins. ## Manual policy checks Test each snippet independently as managed settings, with other policy sources cleared, then reload. “No” means this snippet does not disable the harness; normal availability still applies. Disabled Local remains visible with **Learn why**. | Managed-settings JSON | Local disabled? | Claude/Codex disabled? | |---|:---:|:---:| | `{}` | No | No | | `{"permissions":{"deny":[]}}` | No | Yes | | `{"permissions":{"deny":["Shell"]}}` | Yes | Yes | | `{"permissions":{"ask":["Shell"],"allow":["Read"],"defaultMode":"manual"}}` | No | Yes | | `{"sandbox":{"enabled":false,"allowBypass":false}}` | No | Yes | | `{"sandbox":{"enabled":true}}` | Yes | Yes | | `{"vscode":{"temporaryAllowLocalHarness":true}}` | No | No | | `{"vscode":{"temporaryAllowLocalHarness":false}}` | Yes | Yes | | `{"permissions":{"deny":["Shell"]},"vscode":{"temporaryDefaultToLocalHarness":true}}` | No | Yes | | `{"sandbox":{"enabled":true},"vscode":{"temporaryDefaultToLocalHarness":true}}` | No | Yes | | `{"vscode":{"temporaryAllowLocalHarness":false,"temporaryDefaultToLocalHarness":true}}` | Yes | Yes | Malformed `permissions.deny` values also disable Local unless the escape hatch applies. ## Screenshot <img width="627" height="144" alt="Screenshot 2026-10-19 at 3 50 41 PM" src="https://github.com/user-attachments/assets/a95ebaee-d176-4a44-8682-99af6d67c31d" /> *🤖 Authored with GitHub Copilot on behalf of @rwoll.*