mirror of
https://github.com/microsoft/vscode.git
synced 2026-08-25 10:25:41 +01:00
fa5d013e93
* policy: disable 3P harnesses under managed settings Managed settings are composed and enforced by the Copilot runtime, so they never reach the Claude or Codex harnesses. An enterprise that sets any managed setting was therefore left with an ungoverned path around every control it configured. Add `IPolicyData.managedSettingsActive` — true when any delivery channel supplies any managed setting. Unlike `managedSettings` it is not projected onto the keys VS Code declares, so runtime-owned keys VS Code never reads still count as governance. Both `Claude3PIntegration` and `Codex3PIntegration` now share `thirdPartyAgentEnabledValue`, which forces the harness off when preview features are disabled or when the user is governed at all. The rule keys off presence rather than a value, so the policies deliberately declare no `managedSettings` keys and nothing new joins the native MDM watcher schema. Policy value attribution gains a matching presence probe so Developer: Policy Diagnostics blames the governing channel instead of the account. This mirrors the runtime-owned `sandbox.enabled` floor retiring the local harness via `managedSandboxEnforced`. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * policy: trim verbose comments on managed-settings harness gating Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>