Address review: drop managedPermissions schema default and stale doc

The `managedPermissions` root config key follows omit semantics: it is absent
when no restrictive enterprise policy applies. Its schema property carried a
`default: {}`, which is seeded into stored root config values by
`registerProviderConfiguration` and would let the launcher forward an empty
(and misleading) `managedSettings` even with no policy. Remove the default so
the key stays `undefined` and `managedSettings` is omitted entirely.

Also remove the stale `chat.tools.eligibleForAutoApproval` reference from the
`AgentHostManagedPermissionsConfigKey` doc comment (eligibility is no longer
synthesized after the runtime-contract correction).

Add a launcher test asserting neither create nor resume config carries
`managedSettings` when the root value is unset.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c111c62a-eff3-4ff6-bb8a-8436a1b4babe

Author: joshspicer

src/vs/platform/agentHost/common/agentHostSchema.ts

@@ -406,7 +406,10 @@ const managedPermissionsProperty = schemaProperty<IManagedPermissions>({
 			items: { type: 'string', title: localize('agentHost.config.managedPermissions.rule', "Permission rule") },
 		},
 	},
-	default: {},
+	// Intentionally NO `default`: the key follows omit semantics. When no
+	// restrictive policy applies the renderer forwards `undefined`, so
+	// `getRootValue` stays `undefined` and the launcher omits `managedSettings`
+	// entirely rather than forwarding an empty (and misleading) object.
 });
 
 /**
@@ -557,8 +560,8 @@ export const GLOBAL_AUTO_APPROVE_SETTING_ID = 'chat.tools.global.autoApprove';
 /**
  * Root config key forwarded from the renderer holding the enterprise-policy-derived
  * {@link IManagedPermissions} object. Synthesized by VS Code exclusively from managed
- * (policy) values of `chat.tools.global.autoApprove`, `chat.tools.eligibleForAutoApproval`,
- * and `chat.tools.terminal.enableAutoApprove`, and forwarded to the runtime as
+ * (policy) values of `chat.tools.global.autoApprove` and
+ * `chat.tools.terminal.enableAutoApprove`, and forwarded to the runtime as
  * `managedSettings.permissions` at SDK session startup. Absent when no policy applies.
  */
 export const AgentHostManagedPermissionsConfigKey = 'managedPermissions';

src/vs/platform/agentHost/test/node/copilotSessionLauncher.test.ts

@@ -454,6 +454,59 @@ suite('CopilotSessionLauncher client identity', () => {
 			await launcher.disposeByokProxyHandle();
 		}
 	});
+
+	test('omits managedSettings from create and resume configs when no policy is set', async () => {
+		const createConfigs: Parameters<CopilotClient['createSession']>[0][] = [];
+		const resumeConfigs: Parameters<CopilotClient['resumeSession']>[1][] = [];
+		const session = {
+			sessionId: 'session-1',
+			on: () => () => { },
+			disconnect: async () => { },
+		} as unknown as CopilotSession;
+		const client = {
+			createSession: async (config: Parameters<CopilotClient['createSession']>[0]) => {
+				createConfigs.push(config);
+				return session;
+			},
+			resumeSession: async (_sessionId: string, config: Parameters<CopilotClient['resumeSession']>[1]) => {
+				resumeConfigs.push(config);
+				return session;
+			},
+		};
+		// Root value unset (default launcher's getRootValue returns undefined).
+		const launcher = createTestLauncher();
+		const basePlan = {
+			client,
+			sessionId: 'session-1',
+			workingDirectory: testWorkingDirectory,
+			resolvedAgentName: undefined,
+			snapshot: { tools: [], plugins: [], mcpServers: {} },
+			activeClientToolSet: new ActiveClientToolSet(),
+			shellManager: undefined,
+			githubToken: undefined,
+		};
+		const createPlan: CopilotSessionLaunchPlan = { ...basePlan, kind: 'create', model: undefined };
+		const resumePlan: CopilotSessionLaunchPlan = { ...basePlan, kind: 'resume', fallback: { model: undefined } };
+
+		const sessions = new DisposableStore();
+		try {
+			sessions.add(await launcher.launch(createPlan, testRuntime));
+			sessions.add(await launcher.launch(resumePlan, testRuntime));
+
+			assert.deepStrictEqual({
+				create: (createConfigs[0] as { managedSettings?: unknown }).managedSettings,
+				createEnable: (createConfigs[0] as { enableManagedSettings?: boolean }).enableManagedSettings,
+				resume: (resumeConfigs[0] as { managedSettings?: unknown }).managedSettings,
+			}, {
+				create: undefined,
+				createEnable: true,
+				resume: undefined,
+			});
+		} finally {
+			sessions.dispose();
+			await launcher.disposeByokProxyHandle();
+		}
+	});
 });
 
 suite('CopilotSessionLauncher resume fallback', () => {