agentHost: bridge managed permission settings

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: joshspicer

src/vs/platform/agentHost/browser/remoteAgentHostProtocolClient.ts

@@ -358,6 +358,16 @@ export class RemoteAgentHostService extends Disposable implements IRemoteAgentHo
 				this._onDidChangeConnections.fire();
 			}
 		}));
+		store.add(protocolClient.onDidChangeConnectionState(state => {
+			if (this._entries.get(address) !== connEntry || state !== AgentHostClientState.Incompatible) {
+				return;
+			}
+			connEntry.connected = false;
+			connEntry.status = protocolClient.connectionError
+				? RemoteAgentHostConnectionStatus.fromConnectError(protocolClient.connectionError, [PROTOCOL_VERSION]) ?? RemoteAgentHostConnectionStatus.disconnected
+				: RemoteAgentHostConnectionStatus.disconnected;
+			this._onDidChangeConnections.fire();
+		}));
 
 		const config = getEntryTypeConfig(entry.connection.type);
 		if (config.store !== 'runtime') {
@@ -568,8 +578,15 @@ export class RemoteAgentHostService extends Disposable implements IRemoteAgentHo
 					entry.status = RemoteAgentHostConnectionStatus.connected;
 					this._onDidChangeConnections.fire();
 					break;
-				case AgentHostClientState.Connecting:
 				case AgentHostClientState.Incompatible:
+					entry.connected = false;
+					entry.status = client.connectionError
+						? RemoteAgentHostConnectionStatus.fromConnectError(client.connectionError, [PROTOCOL_VERSION]) ?? RemoteAgentHostConnectionStatus.disconnected
+						: RemoteAgentHostConnectionStatus.disconnected;
+					this._reconnectAttempts.delete(address);
+					this._onDidChangeConnections.fire();
+					break;
+				case AgentHostClientState.Connecting:
 				case AgentHostClientState.Closed:
 					break;
 			}

src/vs/platform/agentHost/browser/remoteAgentHostServiceImpl.ts

@@ -0,0 +1,47 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+import { IConfigurationService, IConfigurationValue } from '../../configuration/common/configuration.js';
+import { GLOBAL_AUTO_APPROVE_SETTING_ID, IManagedPermissions, MANAGED_PERMISSION_TERMINAL_ASK_RULE, TERMINAL_AUTO_APPROVE_ENABLED_SETTING_ID } from './agentHostSchema.js';
+
+export interface IManagedPermissionsSettingMapping {
+	readonly settingId: string;
+	readonly transform: (value: unknown) => IManagedPermissions | undefined;
+}
+
+export function createManagedPermissionsSettingMapping<T>(settingId: string, transform: (value: T | undefined) => IManagedPermissions | undefined): IManagedPermissionsSettingMapping {
+	return { settingId, transform: value => transform(value as T | undefined) };
+}
+
+export const managedPermissionsSettingMappings: readonly IManagedPermissionsSettingMapping[] = [
+	createManagedPermissionsSettingMapping<boolean>(GLOBAL_AUTO_APPROVE_SETTING_ID, value => value === false ? { disableBypassPermissionsMode: 'disable' } : undefined),
+	createManagedPermissionsSettingMapping<boolean>(TERMINAL_AUTO_APPROVE_ENABLED_SETTING_ID, value => value === false ? { ask: [MANAGED_PERMISSION_TERMINAL_ASK_RULE] } : undefined),
+];
+
+function getExplicitValue<T>(inspection: IConfigurationValue<T>): T | undefined {
+	const hasConfiguredValue = inspection.policyValue !== undefined
+		|| inspection.memoryValue !== undefined
+		|| inspection.workspaceFolderValue !== undefined
+		|| inspection.workspaceValue !== undefined
+		|| inspection.userRemoteValue !== undefined
+		|| inspection.userLocalValue !== undefined
+		|| inspection.userValue !== undefined
+		|| inspection.applicationValue !== undefined;
+	return hasConfiguredValue ? inspection.value : undefined;
+}
+
+export function resolveManagedPermissions(configurationService: IConfigurationService): IManagedPermissions | undefined {
+	let disableBypassPermissionsMode: 'disable' | undefined;
+	let askForShell = false;
+	for (const entry of managedPermissionsSettingMappings) {
+		const contribution = entry.transform(getExplicitValue(configurationService.inspect(entry.settingId)));
+		disableBypassPermissionsMode ??= contribution?.disableBypassPermissionsMode;
+		askForShell ||= contribution?.ask?.includes(MANAGED_PERMISSION_TERMINAL_ASK_RULE) === true;
+	}
+	return disableBypassPermissionsMode || askForShell ? {
+		...(disableBypassPermissionsMode ? { disableBypassPermissionsMode } : {}),
+		...(askForShell ? { ask: [MANAGED_PERMISSION_TERMINAL_ASK_RULE] as const } : {}),
+	} : undefined;
+}

src/vs/platform/agentHost/common/agentHostManagedSettings.ts

@@ -297,6 +297,52 @@ const permissionsProperty = schemaProperty<IPermissionsValue>({
 	sessionMutable: true,
 });
 
+/** Managed runtime restrictions synthesized from effective VS Code settings. */
+export interface IManagedPermissions {
+	readonly disableBypassPermissionsMode?: 'disable';
+	/** Canonical all-shell prompt rule; active runtime rule policy defaults other governed kinds to ask. */
+	readonly ask?: readonly ['Shell'];
+}
+
+export const MANAGED_PERMISSION_TERMINAL_ASK_RULE = 'Shell';
+
+/**
+ * Treat the empty object used as the merge-safe root-config clear sentinel as
+ * no managed policy.
+ */
+export function normalizeManagedPermissions(permissions: IManagedPermissions | undefined): IManagedPermissions | undefined {
+	const disableBypassPermissionsMode = permissions?.disableBypassPermissionsMode === 'disable';
+	const askForShell = permissions?.ask?.includes(MANAGED_PERMISSION_TERMINAL_ASK_RULE) === true;
+	return disableBypassPermissionsMode || askForShell ? {
+		...(disableBypassPermissionsMode ? { disableBypassPermissionsMode: 'disable' as const } : {}),
+		...(askForShell ? { ask: [MANAGED_PERMISSION_TERMINAL_ASK_RULE] as const } : {}),
+	} : undefined;
+}
+
+const managedPermissionsProperty = schemaProperty<IManagedPermissions>({
+	type: 'object',
+	title: localize('agentHost.config.managedPermissions.title', "Managed Permissions"),
+	description: localize('agentHost.config.managedPermissions.description', "Permission restrictions derived from effective VS Code settings and forwarded to the runtime as `managedSettings.permissions` at session startup."),
+	properties: {
+		disableBypassPermissionsMode: {
+			type: 'string',
+			title: localize('agentHost.config.managedPermissions.disableBypass', "Disable bypass permissions mode"),
+			enum: ['disable'],
+		},
+		ask: {
+			type: 'array',
+			title: localize('agentHost.config.managedPermissions.ask', "Required permission prompts"),
+			items: {
+				type: 'string',
+				title: localize('agentHost.config.managedPermissions.rule', "Permission rule"),
+				enum: [MANAGED_PERMISSION_TERMINAL_ASK_RULE],
+			},
+		},
+	},
+	// No default: `{}` is the wire-level clear sentinel and is normalized to
+	// `undefined` before SDK launch, so `managedSettings` is omitted.
+});
+
 /**
  * Session-config properties owned by the platform itself — i.e. consumed
  * by the agent host rather than by any particular agent.
@@ -433,6 +479,24 @@ export const TERMINAL_AUTO_APPROVE_ENABLED_SETTING_ID = 'chat.tools.terminal.ena
  */
 export const AgentHostGlobalAutoApproveEnabledConfigKey = 'globalAutoApproveEnabled';
 
+/**
+ * The VS Code setting ID for global auto approve. Defined here so renderer-side
+ * agent-host clients can forward it without importing from `workbench/contrib/chat`.
+ */
+export const GLOBAL_AUTO_APPROVE_SETTING_ID = 'chat.tools.global.autoApprove';
+
+/**
+ * Root config key forwarded from the renderer holding the {@link IManagedPermissions}
+ * object. Synthesized by VS Code from the effective values of
+ * `chat.tools.global.autoApprove` and
+ * `chat.tools.terminal.enableAutoApprove`, and forwarded to the runtime as
+ * `managedSettings.permissions` at SDK session startup. Absent when no policy applies.
+ */
+export const AgentHostManagedPermissionsConfigKey = 'managedPermissions';
+
+/** Marker written to diagnostic logs instead of enterprise-managed permission rules. */
+export const AgentHostManagedPermissionsLogRedaction = '<redacted>';
+
 /**
  * Root config key forwarded from the renderer when VS Code's `chat.autoReply`
  * setting changes. When `true`, the agent host auto-answers `ask_user`
@@ -714,6 +778,7 @@ export const platformRootSchema = createSchema({
 		description: localize('agentHost.config.globalAutoApproveEnabled.description', "Whether VS Code's global auto-approve setting is enabled. When `true`, every tool call is auto-approved, equivalent to a session using Allow all."),
 		default: false,
 	}),
+	[AgentHostManagedPermissionsConfigKey]: managedPermissionsProperty,
 	[AgentHostAutoReplyEnabledConfigKey]: schemaProperty<boolean>({
 		type: 'boolean',
 		title: localize('agentHost.config.autoReplyEnabled.title', "Auto Reply"),

src/vs/platform/agentHost/common/agentHostSchema.ts

@@ -2125,6 +2125,9 @@ export interface IAgentService {
 	 */
 	dispatchAction(channel: string, action: SessionAction | ChatAction | TerminalAction | ClientChangesetAction | ClientAnnotationsAction | IRootConfigChangedAction, clientId: string, clientSeq: number, clientContext?: IAgentHostClientTelemetryContext): void;
 
+	/** Remove the enterprise-managed permission contribution owned by a disconnected client. */
+	removeClientManagedPermissions(clientId: string): void;
+
 	/**
 	 * List the contents of a directory on the agent host's filesystem.
 	 * Used by the client to drive a remote folder picker before session creation.

src/vs/platform/agentHost/common/agentService.ts

@@ -10,6 +10,7 @@ import { joinPath } from '../../../base/common/resources.js';
 import { isUriComponents, URI, UriComponents } from '../../../base/common/uri.js';
 import { IFileService, IFileStatWithMetadata } from '../../files/common/files.js';
 import { ILogService } from '../../log/common/log.js';
+import { AgentHostManagedPermissionsConfigKey, AgentHostManagedPermissionsLogRedaction } from './agentHostSchema.js';
 
 export type AhpLogDirection = 'c2s' | 's2c';
 
@@ -240,7 +241,10 @@ function stringifyAhpLogEntryTruncated(value: unknown, maxStringLength: number):
  * {@link URI.revive}. This avoids the expensive deep-clone tree walk that
  * would otherwise be required to find every URI in a message payload.
  */
-function _ahpReplacer(this: unknown, _key: string, value: unknown): unknown {
+function _ahpReplacer(this: unknown, key: string, value: unknown): unknown {
+	if (key === AgentHostManagedPermissionsConfigKey) {
+		return AgentHostManagedPermissionsLogRedaction;
+	}
 	if (
 		value
 		&& typeof value === 'object'