fix(agent-host): use canonical managed shell rule

Emit the runtime's kind-only Shell rule for terminal managed policy, validate the supported managed permission grammar in policy diagnostics, and distinguish client injection from the provider account/device baseline.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: joshspicer

src/vs/platform/agentHost/common/agentHostSchema.ts

@@ -319,12 +319,12 @@ export interface IManagedPermissions {
 
 /**
  * The runtime permission-rule string emitted when managed
- * `chat.tools.terminal.enableAutoApprove` is `false`. `Shell(*)` is the exact
- * all-shell boundary confirmed by the runtime managed-permission parser.
+ * `chat.tools.terminal.enableAutoApprove` is `false`. The kind-only `Shell`
+ * rule matches all shell commands in the runtime managed-permission parser.
  * Centralized as a single constant so the grammar lives in one place. Generic
  * `Tool(...)` rules are NOT supported by the runtime and must never be emitted.
  */
-export const MANAGED_PERMISSION_TERMINAL_ASK_RULE = 'Shell(*)';
+export const MANAGED_PERMISSION_TERMINAL_ASK_RULE = 'Shell';
 
 /**
  * The enterprise-policy inputs — read exclusively from
@@ -345,7 +345,7 @@ export interface IManagedPermissionPolicyInputs {
  * runtime-supported permission rules are emitted:
  *
  * - managed `chat.tools.global.autoApprove === false` → `disableBypassPermissionsMode: "disable"`;
- * - managed `chat.tools.terminal.enableAutoApprove === false` → the all-shell `ask` rule `Shell(*)`.
+ * - managed `chat.tools.terminal.enableAutoApprove === false` → the all-shell `ask` rule `Shell`.
  *
  * Per-tool eligibility (`chat.tools.eligibleForAutoApproval`) is intentionally
  * NOT mapped: the runtime rejects generic `Tool(...)` rules, so there is no
@@ -388,6 +388,66 @@ export function normalizeManagedPermissions(permissions: IManagedPermissions | u
 	return permissions && Object.keys(permissions).length > 0 ? permissions : undefined;
 }
 
+const managedPermissionRuleFamilies = new Set(['bash', 'shell', 'powershell', 'read', 'edit', 'write', 'domain']);
+const managedPermissionShellRuleFamilies = new Set(['bash', 'shell', 'powershell']);
+
+/**
+ * Return parser-compatible validation issues for managed permission rules.
+ * Provider runtimes remain authoritative for family-specific path and domain patterns.
+ */
+export function validateManagedPermissionRules(permissions: IManagedPermissions | undefined): readonly string[] {
+	if (!permissions) {
+		return [];
+	}
+
+	const issues: string[] = [];
+	for (const list of ['deny', 'ask', 'allow'] as const) {
+		for (const [index, rule] of (permissions[list] ?? []).entries()) {
+			const issue = validateManagedPermissionRule(rule);
+			if (issue) {
+				issues.push(`${list}.${index}: ${issue}`);
+			}
+		}
+	}
+	return issues;
+}
+
+function validateManagedPermissionRule(rule: string): string | undefined {
+	const openParenthesis = rule.indexOf('(');
+	let family = rule;
+	let argument: string | undefined;
+	if (openParenthesis !== -1) {
+		if (!rule.endsWith(')')) {
+			return `Invalid rule format: ${rule}`;
+		}
+		family = rule.slice(0, openParenthesis);
+		argument = rule.slice(openParenthesis + 1, -1);
+		if (!argument || argument.includes(')')) {
+			return `Invalid rule format: ${rule}`;
+		}
+	}
+	if (!family || ![...family].every(character => /[a-zA-Z0-9_./@-]/.test(character))) {
+		return `Invalid rule format: ${rule}`;
+	}
+
+	const normalizedFamily = family.toLowerCase();
+	if (!managedPermissionRuleFamilies.has(normalizedFamily)) {
+		return `Unsupported managed permission rule family '${family}'; expected Bash, Shell, PowerShell, Read, Edit, Write, or Domain`;
+	}
+	if (!argument || !managedPermissionShellRuleFamilies.has(normalizedFamily)) {
+		return undefined;
+	}
+	if (argument.endsWith(' *')) {
+		return argument.slice(0, -2).trimEnd()
+			? undefined
+			: 'Invalid managed shell permission rule: wildcard requires a command prefix';
+	}
+	if (argument.includes('*') && !argument.endsWith(':*')) {
+		return `Unsupported managed shell wildcard pattern '${argument}'; use '<command> *' or the canonical '<command>:*' suffix`;
+	}
+	return undefined;
+}
+
 const managedPermissionsProperty = schemaProperty<IManagedPermissions>({
 	type: 'object',
 	title: localize('agentHost.config.managedPermissions.title', "Managed Permissions"),

src/vs/platform/agentHost/test/common/agentHostSchema.test.ts

@@ -6,7 +6,7 @@
 import assert from 'assert';
 import { ensureNoDisposablesAreLeakedInTestSuite } from '../../../../base/test/common/utils.js';
 import type { IConfigurationValue } from '../../../configuration/common/configuration.js';
-import { createSchema, deriveManagedPermissions, migrateLegacyAutopilotConfig, normalizeAgentHostTerminalAutoApproveRulesConfig, normalizeManagedPermissions, platformRootSchema, platformSessionSchema, schemaProperty, AgentHostManagedPermissionsConfigKey, MANAGED_PERMISSION_TERMINAL_ASK_RULE, type AgentHostTerminalAutoApproveRules, type AutoApproveLevel, type IManagedPermissions, type IPermissionsValue, type SessionMode } from '../../common/agentHostSchema.js';
+import { createSchema, deriveManagedPermissions, migrateLegacyAutopilotConfig, normalizeAgentHostTerminalAutoApproveRulesConfig, normalizeManagedPermissions, platformRootSchema, platformSessionSchema, schemaProperty, AgentHostManagedPermissionsConfigKey, MANAGED_PERMISSION_TERMINAL_ASK_RULE, validateManagedPermissionRules, type AgentHostTerminalAutoApproveRules, type AutoApproveLevel, type IManagedPermissions, type IPermissionsValue, type SessionMode } from '../../common/agentHostSchema.js';
 import { SessionConfigKey } from '../../common/sessionConfigKeys.js';
 import { JsonRpcErrorCodes, ProtocolError } from '../../common/state/sessionProtocol.js';
 
@@ -452,7 +452,7 @@ suite('agentHostSchema', () => {
 			assert.deepStrictEqual(deriveManagedPermissions({
 				globalAutoApprove: undefined,
 				terminalAutoApproveEnabled: false,
-			}), { ask: ['Shell(*)'] } satisfies IManagedPermissions);
+			}), { ask: ['Shell'] } satisfies IManagedPermissions);
 		});
 
 		test('derived value validates against the managed-permissions root schema', () => {
@@ -461,7 +461,21 @@ suite('agentHostSchema', () => {
 				terminalAutoApproveEnabled: false,
 			});
 			assert.ok(permissions);
-			assert.strictEqual(platformRootSchema.validate(AgentHostManagedPermissionsConfigKey, permissions), true);
+			assert.deepStrictEqual({
+				schema: platformRootSchema.validate(AgentHostManagedPermissionsConfigKey, permissions),
+				rules: validateManagedPermissionRules(permissions),
+			}, {
+				schema: true,
+				rules: [],
+			});
+		});
+
+		test('reports runtime-incompatible managed shell wildcards', () => {
+			assert.deepStrictEqual(validateManagedPermissionRules({
+				ask: ['Shell(*)', 'Shell(git *)', 'PowerShell(Get-Item:*)'],
+			}), [
+				`ask.0: Unsupported managed shell wildcard pattern '*'; use '<command> *' or the canonical '<command>:*' suffix`,
+			]);
 		});
 
 		test('normalizes the root-config clear sentinel to no policy', () => {

src/vs/platform/agentHost/test/node/agentService.test.ts

@@ -932,7 +932,7 @@ suite('AgentService (node dispatcher)', () => {
 			await readStarted.p;
 			svc.dispatchAction(ROOT_STATE_URI, {
 				type: ActionType.RootConfigChanged,
-				config: { [AgentHostManagedPermissionsConfigKey]: { ask: ['Shell(*)'] } },
+				config: { [AgentHostManagedPermissionsConfigKey]: { ask: ['Shell'] } },
 			}, clientId, 2);
 			svc.removeClientManagedPermissions(clientId);
 			const queueDrained = Event.toPromise(Event.filter(svc.onDidAction, envelope => envelope.origin?.clientId === clientId && envelope.origin.clientSeq === 3));
@@ -1052,7 +1052,7 @@ suite('AgentService (node dispatcher)', () => {
 					type: ActionType.RootConfigChanged,
 					config: {
 						customizations: [customization],
-						[AgentHostManagedPermissionsConfigKey]: { ask: ['Shell(*)'] },
+						[AgentHostManagedPermissionsConfigKey]: { ask: ['Shell'] },
 					},
 				}, 'test-client', 1);
 

src/vs/platform/agentHost/test/node/copilotSessionLauncher.test.ts

@@ -463,7 +463,7 @@ suite('CopilotSessionLauncher shared session config', () => {
 				return session;
 			},
 		};
-		const permissions = { disableBypassPermissionsMode: 'disable', ask: ['Shell(*)'] };
+		const permissions = { disableBypassPermissionsMode: 'disable', ask: ['Shell'] };
 		const launcher = createTestLauncherWithRootValues({ [AgentHostManagedPermissionsConfigKey]: permissions });
 		const basePlan = {
 			client,

src/vs/workbench/browser/actions/developerActions.ts

@@ -55,6 +55,7 @@ import * as json from '../../../base/common/json.js';
 import { getParseErrorMessage } from '../../../base/common/jsonErrorMessages.js';
 import { IAgentHostService } from '../../../platform/agentHost/common/agentService.js';
 import { IAgentHostEnablementService } from '../../../platform/agentHost/common/agentHostEnablementService.js';
+import { deriveManagedPermissions, GLOBAL_AUTO_APPROVE_SETTING_ID, TERMINAL_AUTO_APPROVE_ENABLED_SETTING_ID, validateManagedPermissionRules } from '../../../platform/agentHost/common/agentHostSchema.js';
 
 class InspectContextKeysAction extends Action2 {
 
@@ -864,6 +865,7 @@ class PolicyDiagnosticsAction extends Action2 {
 		}
 
 		content += '## Managed Settings\n\n';
+		content += '*This section covers GitHub Copilot managed-settings delivery channels. Traditional VS Code policies from a configuration profile are reported under Policy-Controlled Settings and may synthesize the Agent Host client injection shown below even when no Copilot managed-settings channel is active.*\n\n';
 		try {
 			const policyData = defaultAccountService.policyData;
 			const serverManagedSettings = policyData?.managedSettings ?? {};
@@ -981,11 +983,35 @@ class PolicyDiagnosticsAction extends Action2 {
 				content += '*No managed-settings keys are supplied by any channel.*\n\n';
 			}
 
-			content += '### Agent Runtime Resolution\n\n';
-			content += '*Resolved independently by each provider through its own SDK/runtime. This may include runtime-owned keys that VS Code does not declare as configuration policies.*\n\n';
+			content += '### Agent Host Client Injection\n\n';
+			content += '*Synthesized by VS Code from effective managed policy values and forwarded to supporting Agent Host providers as session-local managed permissions.*\n\n';
+			const agentHostManagedPermissions = deriveManagedPermissions({
+				globalAutoApprove: configurationService.inspect<boolean>(GLOBAL_AUTO_APPROVE_SETTING_ID).policyValue,
+				terminalAutoApproveEnabled: configurationService.inspect<boolean>(TERMINAL_AUTO_APPROVE_ENABLED_SETTING_ID).policyValue,
+			});
+			content += '**Synthesized managed permissions**\n\n';
+			content += jsonBlock(agentHostManagedPermissions ?? {});
+			content += `**Expected session runtime provenance**: ${agentHostManagedPermissions ? '`client` when no account/device policy contributes; `mixed` otherwise' : 'the account/device baseline shown below'}\n\n`;
+			const agentHostManagedPermissionIssues = validateManagedPermissionRules(agentHostManagedPermissions);
+			content += `**Rule validation issues (${agentHostManagedPermissionIssues.length})**\n\n`;
+			if (agentHostManagedPermissionIssues.length > 0) {
+				for (const issue of agentHostManagedPermissionIssues) {
+					content += `- ${issue}\n`;
+					parseErrors.push({ stage: 'agentHost: client permissions', message: issue });
+				}
+				content += '\n';
+			} else {
+				content += '*None.*\n\n';
+			}
+
+			content += '### Agent Runtime Account and Device Baseline\n\n';
+			content += '*Queried from each provider when this report is generated. The SDK query covers account/server and device policy, but intentionally excludes the session-local Agent Host client injection above and may use the provider runtime\'s own policy cache. Therefore `source: none` here does not mean that synthesized client permissions are inactive; a created session reports `client` or `mixed` provenance after applying them.*\n\n';
 			if (!agentHostEnablementService.enabled.get()) {
 				content += '*Agent Host is disabled; runtime managed-settings diagnostics were not queried.*\n\n';
 			} else {
+				content += PROPERTY_VALUE_TABLE_HEADER;
+				content += `| Queried | ${new Date().toISOString()} |\n`;
+				content += '| Force refresh | Not supported by the provider runtime API |\n\n';
 				try {
 					const runtimeDiagnostics = await agentHostService.getManagedSettingsDiagnostics();
 					if (runtimeDiagnostics.length === 0) {