1
>
/*---------------------------------------------------------------------------------------------
copilotManagedSettings.ts
2
>
* Copyright (c) Microsoft Corporation. All rights reserved.
3
>
* Licensed under the MIT License. See License.txt in the project root for license information.
4
>
*--------------------------------------------------------------------------------------------*/
5
>
6
>
import { Event } from '../../../base/common/event.js';
7
>
import { IPolicyData } from '../../../base/common/defaultAccount.js';
8
>
import { IExtraKnownMarketplaceEntry, extraKnownMarketplacesToConfigDict } from '../../../base/common/managedSettings.js';
9
>
import { IManagedSettingPolicyDefinition, IManagedSettingsPolicyDefinitions, ManagedSettingValue, ManagedSettingsData } from '../../../base/common/policy.js';
10
>
import { IStringDictionary } from '../../../base/common/collections.js';
11
>
import { isEmptyObject, isObject, isString } from '../../../base/common/types.js';
12
>
import { createDecorator } from '../../instantiation/common/instantiation.js';
13
>
import { PolicyDefinition } from './policy.js';
14
>
15
>
export type { ManagedSettingsData } from '../../../base/common/policy.js';
16
>
17
>
export type RawManagedSettingsData = Readonly<Record<string, unknown>>;
18
>
19
>
/** Windows registry root for GitHub Copilot policies. */
20
>
export const GITHUB_COPILOT_WIN32_REGISTRY_PATH = 'SOFTWARE\\Policies\\GitHubCopilot';
21
>
22
>
/** Windows product name passed to the native policy watcher. */
23
>
export const GITHUB_COPILOT_WIN32_POLICY_NAME = 'GitHubCopilot';
24
>
25
>
/** macOS CFPreferences application ID for GitHub Copilot managed preferences. */
26
>
export const GITHUB_COPILOT_MACOS_BUNDLE_ID = 'com.github.copilot';
27
>
28
>
/** MDM key for the V0 managed setting. */
29
>
export const COPILOT_DISABLE_BYPASS_PERMISSIONS_MODE_KEY = 'permissions.disableBypassPermissionsMode';
30
>
31
>
/** Managed-settings key for enterprise plugin enablement (carried as a JSON-encoded `{ [pluginId]: boolean }`). */
32
>
export const COPILOT_ENABLED_PLUGINS_KEY = 'enabledPlugins';
33
>
34
>
/** Managed-settings key for enterprise marketplaces (carried as a JSON-encoded `{ [name]: url-or-shorthand }`). */
35
>
export const COPILOT_EXTRA_MARKETPLACES_KEY = 'extraKnownMarketplaces';
36
>
37
>
/** Managed-settings key for the strict-marketplace allowlist (carried as a JSON-encoded array of source entries; absent = no restrictions, `[]` = lockdown). */
38
>
export const COPILOT_STRICT_MARKETPLACES_KEY = 'strictKnownMarketplaces';
39
>
40
>
/** Managed-settings key for the per-server MCP allowlist (carried as a JSON-encoded array of matcher entries; absent = no allow restriction, `[]` = only servers matching an entry, i.e. block all). */
41
>
export const COPILOT_ALLOWED_MCP_SERVERS_KEY = 'allowedMcpServers';
42
>
43
>
/** Managed-settings key for the per-server MCP denylist (carried as a JSON-encoded array of matcher entries; deny always takes precedence over allow). */
44
>
export const COPILOT_DENIED_MCP_SERVERS_KEY = 'deniedMcpServers';
45
>
46
>
/**
47
>
* Managed-settings key for the default chat model (carried as a plain string: `auto`, a model
48
>
* family name, or a full model id). Nested under `permissions` in the managed-settings schema
49
>
* (alongside {@link COPILOT_DISABLE_BYPASS_PERMISSIONS_MODE_KEY}), so it flattens to the dot-path
50
>
* `permissions.model` in the normalized bag — the key policy `value()` callbacks must read.
51
>
*/
52
>
export const COPILOT_MODEL_KEY = 'permissions.model';
53
>
54
>
/**
55
>
* Enterprise OTel managed-settings keys. These are the scalar leaves of the canonical
56
>
* `telemetry` block from the cross-client managed-settings schema (see the CLI
57
>
* `ManagedTelemetrySettings`); they flatten to dot-path bag keys via
58
>
* {@link normalizeManagedSettings}, so no {@link STRUCTURED_MANAGED_SETTINGS} entry is needed.
59
>
* The `telemetry.resourceAttributes` and `telemetry.headers` map fields are structured
60
>
* ({@link STRUCTURED_MANAGED_SETTINGS} rows carry them as JSON-encoded objects under their nested
61
>
* keys); `telemetry.serviceName` is a scalar.
62
>
*/
63
>
64
>
/** Managed-settings key for enterprise OTel enablement. */
65
>
export const COPILOT_OTEL_ENABLED_KEY = 'telemetry.enabled';
66
>
67
>
/** Managed-settings key for the enterprise OTLP collector endpoint. */
68
>
export const COPILOT_OTEL_ENDPOINT_KEY = 'telemetry.endpoint';
69
>
70
>
/** Managed-settings key for the enterprise OTLP protocol (`http/json`, `http/protobuf`, or `grpc`). */
71
>
export const COPILOT_OTEL_PROTOCOL_KEY = 'telemetry.protocol';
72
>
73
>
/** Managed-settings key for enterprise OTel content capture. */
74
>
export const COPILOT_OTEL_CAPTURE_CONTENT_KEY = 'telemetry.captureContent';
75
>
76
>
/** Managed-settings key that prevents users from enabling OTel content capture themselves. */
77
>
export const COPILOT_OTEL_LOCK_CAPTURE_CONTENT_KEY = 'telemetry.lockCaptureContent';
78
>
79
>
/** Managed-settings key for the OTel `service.name` resource attribute. */
80
>
export const COPILOT_OTEL_SERVICE_NAME_KEY = 'telemetry.serviceName';
81
>
82
>
/** Managed-settings key for additional OTel resource attributes (a `{ [k]: string }` map). */
83
>
export const COPILOT_OTEL_RESOURCE_ATTRIBUTES_KEY = 'telemetry.resourceAttributes';
84
>
85
>
/** Managed-settings key for extra OTLP exporter headers (a `{ [k]: string }` map). */
86
>
export const COPILOT_OTEL_HEADERS_KEY = 'telemetry.headers';
87
>
88
>
const managedSettingValueCallbacks = new Map<string, (policyData: IPolicyData) => ManagedSettingValue | undefined>();
89
>
90
>
/**
91
>
* Standard pass-through `value` callback for a managed-settings-driven policy: locks the setting
92
>
* to the managed value when the enterprise has set it, and returns `undefined` otherwise so the
93
>
* user's own setting falls through. Use for the common case; policies that combine the managed
94
>
* value with other conditions (e.g. `chat_preview_features_enabled`) keep a custom callback.
95
>
*
96
>
* The callback is memoized per key, so repeated calls for the same key return the SAME function
97
>
* reference. That reference identity is what lets `isSamePolicyDefinition` skip needless
98
>
* re-registration, and memoizing makes the guarantee hold regardless of where the helper is called.
99
>
*/
100
>
export function managedSettingValue(key: string): (policyData: IPolicyData) => ManagedSettingValue | undefined {
101
let callback = managedSettingValueCallbacks.get(key);
102
if (!callback) {