[pull] main from microsoft:main

.github/skills/add-policy/SKILL.md

@@ -15,6 +15,7 @@ Policies allow enterprise administrators to lock configuration settings via OS-l
 - Adding account-based policy support via `IPolicyData`
 - Wiring an enterprise **managed setting** (native MDM / GitHub server) — see **[github-managed-settings.md](./github-managed-settings.md)**
 - Having one policy govern **multiple** settings via `policyReference`
+- **Testing** account/managed-settings policies locally without the real backend — see **[local-testing.md](./local-testing.md)**
 
 ## Architecture Overview
 
@@ -24,7 +25,7 @@ Policies allow enterprise administrators to lock configuration settings via OS-l
 |--------|---------------|----------------------|
 | **OS-level** (Windows registry, macOS plist) | `NativePolicyService` via `@vscode/policy-watcher` | Watches `Software\Policies\Microsoft\{productName}` (Windows) or bundle identifier prefs (macOS) |
 | **Linux file** | `FilePolicyService` | Reads `/etc/vscode/policy.json` |
-| **Account/GitHub** | `AccountPolicyService` | Reads `IPolicyData` from `IDefaultAccountService.policyData`, applies `value()` function. Server-delivered managed settings arrive on `policyData.managedSettings`; native MDM is a **separate** input (`ICopilotManagedSettingsService`) that `AccountPolicyService` merges in `getPolicyData()` |
+| **Account/GitHub** | `AccountPolicyService` | Reads `IPolicyData` from `IDefaultAccountService.policyData`, applies `value()` function. Server-delivered managed settings arrive on `policyData.managedSettings`; native MDM is a **separate** input (`ICopilotManagedSettingsService`) that `AccountPolicyService` selects between in `getPolicyData()` (server wins when present; no merging between layers) |
 | **Copilot managed settings (native MDM)** | `CopilotManagedSettingsService` via `@vscode/policy-watcher` | Watches `SOFTWARE\Policies\GitHubCopilot` (Windows) / `com.github.copilot` prefs (macOS); feeds the canonical `managedSettings` bag — see [github-managed-settings.md](./github-managed-settings.md) |
 | **Multiplex** | `MultiplexPolicyService` | In the main process, combines multiple OS/file policy readers; in desktop and Agents-window renderers, combines the main-process `PolicyChannelClient` with `AccountPolicyService` |
 
@@ -38,7 +39,7 @@ Policies allow enterprise administrators to lock configuration settings via OS-l
 | `src/vs/platform/policy/node/copilotManagedSettingsService.ts` | Native MDM watcher (`@vscode/policy-watcher`) for Copilot managed settings |
 | `src/vs/platform/configuration/common/configurations.ts` | `PolicyConfiguration` — bridges policies to configuration values; parses JSON-string managed settings back to typed values; applies values to `policyReference` settings |
 | `src/vs/platform/configuration/common/configurationRegistry.ts` | `policy` / `policyReference` registration; `getPolicyReferenceConfigurations()` (name → subordinate settings) |
-| `src/vs/workbench/services/policies/common/accountPolicyService.ts` | Account/GitHub-based policy evaluation; merges + projects managed settings (MDM over server) |
+| `src/vs/workbench/services/policies/common/accountPolicyService.ts` | Account/GitHub-based policy evaluation; selects + projects managed settings (server over MDM; single authoritative layer) |
 | `src/vs/workbench/services/accounts/browser/managedSettings.ts` | `adaptManagedSettings` — normalizes the server `managed_settings` response into the canonical bag |
 | `src/vs/workbench/services/policies/common/multiplexPolicyService.ts` | Combines multiple policy services |
 | `src/vs/workbench/contrib/policyExport/electron-browser/policyExport.contribution.ts` | `--export-policy-data` CLI handler |
@@ -269,6 +270,10 @@ policy: {
 the new-key checklist are in [github-managed-settings.md](./github-managed-settings.md).**
 Read it before adding or reviewing any managed-settings key.
 
+**Testing locally:** to exercise the account/managed-settings flow without the real
+GitHub backend, use the mock policy server — see
+**[local-testing.md](./local-testing.md)**.
+
 ## One Policy for Many Settings (`policyReference`)
 
 A single policy can govern multiple settings (e.g. gate an agent in both the editor
@@ -321,3 +326,4 @@ Search the codebase for `policy:` to find all the examples of different policy c
 ## Learnings
 
 * Never hand-edit `build/lib/policies/policyData.jsonc` (its header explicitly forbids it). If `npm run export-policy-data` is failing, fix the script — don't patch the JSON. Common cause: running it in the wrong working directory (e.g. main repo instead of a worktree), which silently exports the wrong source tree.
+* Document **behavior and business-logic expectations**, not copy-pasted implementation. Reproducing internal code (e.g. the `getPolicyData()` merge body) in the skill rots the moment the source changes and adds no information beyond the source itself. State the contract in prose (e.g. "server-delivered managed settings win over native MDM; the two layers are never merged") and point to the source for the implementation. Reserve code blocks for the **author-facing API contract** a contributor must follow — how to *declare* a `policy` / `managedSettings` / `value` callback — not for restating runtime plumbing.

.github/skills/add-policy/github-managed-settings.md

@@ -51,21 +51,16 @@ does **not** read today (no `managed-settings.json` reader exists in `src/`).
 | **Server-managed** (`/copilot_internal/managed_settings`) | GitHub endpoint; per the code comment in `managedSettings.ts`, it returns the enterprise's `.github/copilot/settings.json` content | `adaptManagedSettings` (`src/vs/workbench/services/accounts/browser/managedSettings.ts`) → `DefaultAccountService.policyData` | `accountPolicyData.managedSettings` |
 | **File-based** (`managed-settings.json`) | external schema only | *not implemented in VS Code* | — |
 
-Both VS Code channels converge in `AccountPolicyService.getPolicyData()`:
+Both VS Code channels converge in `AccountPolicyService.getPolicyData()`.
 
-```ts
-// MDM overrides server; then project onto the declared schema.
-const managedSettingsData = projectManagedSettings(
-    { ...accountPolicyData?.managedSettings, ...managedPolicyData },
-    collectManagedSettingsDefinitions(this.policyDefinitions),
-    msg => this.logService.warn(`[AccountPolicy] ${msg}`)
-);
-return { ...accountPolicyData, managedSettings: managedSettingsData };
-```
-
-**Merge order: native MDM (`managedPolicyData`) wins over server-delivered
-(`accountPolicyData?.managedSettings`)** — it is spread last. Then everything is
-projected onto the declared schema (see below).
+**Precedence: server-delivered managed settings win over native MDM.** There is a
+single authoritative source at any point in time — the two layers are **not** merged.
+When the server delivers managed settings, native MDM (`nativeManagedSettings`) is
+ignored entirely; native MDM applies only when the server provides no managed settings.
+Rationale: the server is harder to bypass than local MDM/file policies, and admins need
+one authoritative source to reason about. The winning layer is then projected onto the
+declared schema (see below). Client-side merging still happens *within* the winning
+layer (e.g. `enabledPlugins`, `extraKnownMarketplaces`).
 
 ## Schema source of truth
 
@@ -242,6 +237,10 @@ Reference tests:
   (includes an end-to-end equivalence test: a server JSON string and a native MDM JSON
   string resolve to the **identical** typed object).
 
+**Manual/local testing:** use the mock policy server to serve arbitrary
+`managed_settings` (and entitlement/token) responses and apply them via
+**Developer: Sync Account Policy** — see [local-testing.md](./local-testing.md).
+
 ## Related: one policy governing many settings (`policyReference`)
 
 A single enterprise policy can lock **more than one setting** — e.g. gate an agent in

.github/skills/add-policy/local-testing.md

@@ -0,0 +1,23 @@
+# Local Testing: Mock Policy Server
+
+Use the mock policy server to serve arbitrary Copilot policy responses locally.
+It mocks the four `defaultChatAgent` endpoints that `DefaultAccountService` calls.
+
+## Quick start
+
+```sh
+npm run mock-policy-server          # http://127.0.0.1:3000
+```
+
+Open the GUI, edit the JSON response for any endpoint, **Save**, then click
+**Wire all endpoints** (writes `product.overrides.json`). Reload Code OSS,
+sign in, and run **Developer: Sync Account Policy** to pull the mocked data.
+
+Click **Unwire** when done — it restores the original `product.overrides.json`
+from a backup. Use **Copy overrides JSON** if you prefer to paste manually.
+
+## Schema validation (Managed Settings tab)
+
+Expand the **Schema** section, point the path at a local
+`managed-settings-schema.json`, and click **Load**. The path is saved in
+localStorage across reloads. Click **Validate** to check for unknown keys.

build/lib/policies/policyData.jsonc

@@ -357,21 +357,6 @@
             "default": [],
             "included": true
         },
-        {
-            "key": "chat.editMode.hidden",
-            "name": "DeprecatedEditModeHidden",
-            "category": "InteractiveSession",
-            "minimumVersion": "1.112",
-            "localization": {
-                "description": {
-                    "key": "chat.editMode.hidden",
-                    "value": "When enabled, hides the Edit mode from the chat mode picker."
-                }
-            },
-            "type": "boolean",
-            "default": true,
-            "included": true
-        },
         {
             "key": "chat.useHooks",
             "name": "ChatHooks",
@@ -495,21 +480,6 @@
             "default": true,
             "included": true
         },
-        {
-            "key": "chat.agent.sandbox.autoApproveUnsandboxedCommands",
-            "name": "ChatAgentSandboxAutoApproveUnsandboxedCommands",
-            "category": "IntegratedTerminal",
-            "minimumVersion": "1.116",
-            "localization": {
-                "description": {
-                    "key": "agentSandbox.autoApproveUnsandboxedCommands",
-                    "value": "Controls whether agent mode terminal commands that run outside the sandbox are auto-approved. This applies only when both `#chat.agent.sandbox.enabled#` and `#chat.agent.sandbox.allowUnsandboxedCommands#` are enabled."
-                }
-            },
-            "type": "boolean",
-            "default": false,
-            "included": true
-        },
         {
             "key": "chat.agent.sandbox.allowAutoApprove",
             "name": "ChatAgentSandboxAllowAutoApprove",

build/lib/stylelint/vscode-known-variables.json

@@ -999,6 +999,8 @@
 		"--reveal-button-size",
 		"--part-background",
 		"--part-border-color",
+		"--pane-header-size",
+		"--scroll-shadow-surface",
 		"--vscode-chat-list-background",
 		"--vscode-editorCodeLens-fontFamily",
 		"--vscode-editorCodeLens-fontFamilyDefault",

extensions/copilot/src/extension/agents/vscode-node/promptFileContrib.ts

@@ -11,7 +11,6 @@ import { SyncDescriptor } from '../../../util/vs/platform/instantiation/common/d
 import { IInstantiationService } from '../../../util/vs/platform/instantiation/common/instantiation';
 import { IExtensionContribution } from '../../common/contributions';
 import { AskAgentProvider } from './askAgentProvider';
-import { EditModeAgentProvider } from './editModeAgentProvider';
 import { ExploreAgentProvider } from './exploreAgentProvider';
 import { GitHubOrgCustomAgentProvider } from './githubOrgCustomAgentProvider';
 import { GitHubOrgInstructionsProvider } from './githubOrgInstructionsProvider';
@@ -29,26 +28,6 @@ export class PromptFileContribution extends Disposable implements IExtensionCont
 
 		// Register custom agent provider
 		if ('registerCustomAgentProvider' in vscode.chat) {
-			const editModeProviderRegistration = this._register(new MutableDisposable<vscode.Disposable>());
-			const editModeHiddenSetting = 'chat.editMode.hidden';
-			const updateEditModeProvider = () => {
-				const isEditModeHidden = configurationService.getNonExtensionConfig<boolean>(editModeHiddenSetting);
-				if (!isEditModeHidden) {
-					if (!editModeProviderRegistration.value) {
-						editModeProviderRegistration.value = vscode.chat.registerCustomAgentProvider(instantiationService.createInstance(EditModeAgentProvider));
-					}
-				} else {
-					editModeProviderRegistration.clear();
-				}
-			};
-
-			updateEditModeProvider();
-			this._register(configurationService.onDidChangeConfiguration(e => {
-				if (e.affectsConfiguration(editModeHiddenSetting)) {
-					updateEditModeProvider();
-				}
-			}));
-
 			// Only register the provider if the setting is enabled
 			if (configurationService.getConfig(ConfigKey.EnableOrganizationCustomAgents)) {
 				const githubOrgAgentProvider: vscode.ChatCustomAgentProvider = instantiationService.createInstance(new SyncDescriptor(GitHubOrgCustomAgentProvider));

extensions/copilot/src/extension/intents/node/agentIntent.ts

@@ -82,6 +82,34 @@ function isResponsesCompactionContextManagementEnabled(endpoint: IChatEndpoint,
 		&& !modelsWithoutResponsesContextManagement.has(endpoint.family);
 }
 
+/**
+ * Applies the user's "Context Size" model-picker selection to the endpoint used
+ * for the agent's model requests.
+ *
+ * The picker offers two tiers — the model's default context max and its full
+ * native window (see `getContextSizeOptions`). For server-managed context (the
+ * Responses-API compaction path) the request endpoint's `modelMaxPromptTokens`
+ * is what drives the `compact_threshold` sent to the server. If the default
+ * tier is not propagated to the request endpoint, the server compacts against
+ * the model's full window and the stateful conversation grows far past the
+ * user's selection — billing them for the larger context. Mirrors the override
+ * applied on the `vscode.lm` path in `languageModelAccess.ts`.
+ *
+ * Only clamps when the selection is strictly smaller than the model window so
+ * the full tier ("Longer sessions without compaction") stays uncompacted.
+ *
+ * @internal - exported for testing
+ */
+export function applyContextSizeOverride(endpoint: IChatEndpoint, request: vscode.ChatRequest): IChatEndpoint {
+	const contextSize = request.modelConfiguration?.contextSize;
+	// Guard against non-positive / non-finite selections (e.g. 0, -1, NaN, Infinity):
+	// a non-positive token budget would produce an invalid endpoint configuration.
+	if (typeof contextSize === 'number' && Number.isFinite(contextSize) && contextSize > 0 && contextSize < endpoint.modelMaxPromptTokens) {
+		return endpoint.cloneWithTokenOverride(contextSize);
+	}
+	return endpoint;
+}
+
 /**
  * Returns true when the user explicitly referenced the todo tool (e.g. typed
  * `#todo` in their message) or a custom agent configuration includes it as a
@@ -613,7 +641,11 @@ export class AgentIntentInvocation extends EditCodeIntentInvocation implements I
 		@IAutomaticInstructionsCollector private readonly _automaticInstructionsCollector: IAutomaticInstructionsCollector,
 		@IAuthenticationService private readonly authenticationService: IAuthenticationService,
 	) {
-		super(intent, location, endpoint, request, intentOptions, instantiationService, codeMapperService, envService, promptPathRepresentationService, _endpointProvider, workspaceService, toolsService, configurationService, editLogService, commandService, telemetryService, notebookService, otelService);
+		// Apply the user's "Context Size" picker selection to the request endpoint
+		// so the server-managed compaction threshold (Responses API) is keyed to the
+		// selected tier rather than the model's full native window. See
+		// applyContextSizeOverride for the cost rationale.
+		super(intent, location, applyContextSizeOverride(endpoint, request), request, intentOptions, instantiationService, codeMapperService, envService, promptPathRepresentationService, _endpointProvider, workspaceService, toolsService, configurationService, editLogService, commandService, telemetryService, notebookService, otelService);
 	}
 
 	public override getAvailableTools(): Promise<vscode.LanguageModelToolInformation[]> {