policy: resolve managed settings per-key across delivery channels

[joshspicer]

What

Managed settings previously used a single authoritative source: the first non-empty delivery channel (native MDM > server > file) won wholesale and the others were ignored entirely. This switches to per-key precedence — the same order is honored, but resolved key-by-key:

• A key set/locked by a higher-precedence channel still cannot be overwritten by a lower one.
• A key a higher channel leaves unset is now filled in by a lower channel.

How

• Centralized merge — replaced selectManagedSettings with pickManagedSettings() in copilotManagedSettings.ts. It walks MANAGED_SETTINGS_CHANNELS highest-first and returns:
  • values — the effective merged bag,
  • resolutions — per-key provenance (winning source + every channel's contribution, winner first),
  • activeSources — channels that won at least one key, in precedence order.
  • The merged bag is built with Object.fromEntries so an untrusted __proto__ key can't corrupt its prototype chain.
• AccountPolicyService.getPolicyData consumes the picker; activeSources.length === 0 replaces the old source === 'none' short-circuit.
• Policy Diagnostics report reworked to make what came from where, what's effective, and why explicit: plural "active sources", a per-key Resolution table (effective value, winning source, and per-channel values with overridden ones struck through), and per-key policy attribution.

Tests

• New dedicated pickManagedSettings unit suite: per-key resolution + provenance, mid-tier (server) winning when native is absent, distinct keys winning from distinct channels, falsy-but-present values winning, undefined-hole fall-through, precedence-ordered activeSources, fresh-object guarantee, empty/all-empty, and a prototype-pollution guard.
• New end-to-end test in accountPolicyService.test.ts: native MDM wins one key and the file wins another — both reach policy evaluation (per-key fill-down across the full stack).

Notes for reviewers

• Precedence order and within-channel merge semantics (e.g. enabledPlugins deny-wins) are unchanged.
• The prototype-pollution guard fixes a subtle hygiene regression the new test surfaced: bracket assignment (values[key] = …) invoked the __proto__ setter on the returned bag; Object.fromEntries (define-property semantics) does not. The global prototype was never at risk and downstream reads only declared keys, so no functional bug shipped.
• Docs updated: .github/skills/add-policy/SKILL.md and github-managed-settings.md.
• Validation: ESLint clean, tsgo typecheck clean. The repo's gulp hygiene hook and the live Mocha suite couldn't run in this worktree (missing build deps / no out/ build); the per-key algorithm was additionally verified against a faithful functional port.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

This pull request updates VS Code’s Copilot managed-settings handling so that precedence is resolved per key across delivery channels (native MDM → server → file), and upgrades Policy Diagnostics to explain per-key provenance and effective values.

Changes:

• Replaces the “single authoritative bag” selection logic with pickManagedSettings() that merges managed settings key-by-key and records per-key resolutions + active sources.
• Updates AccountPolicyService and Developer: Policy Diagnostics to consume the new per-key resolution output and report per-key attribution.
• Adds new unit tests for pickManagedSettings() plus an end-to-end test validating that different keys can win from different channels.

Show a summary per file

File	Description
src/vs/workbench/services/policies/test/browser/accountPolicyService.test.ts	Adds an end-to-end test validating per-key fill-down across native MDM + file managed settings.
src/vs/workbench/services/policies/common/accountPolicyService.ts	Switches policy evaluation from whole-bag selection to per-key resolution (pickManagedSettings).
src/vs/workbench/browser/actions/developerActions.ts	Reworks Policy Diagnostics to display plural active sources and a per-key resolution table + attribution.
src/vs/platform/policy/test/common/copilotManagedSettings.test.ts	Adds a dedicated test suite for per-key resolution behavior and provenance.
src/vs/platform/policy/common/copilotManagedSettings.ts	Introduces ManagedSettingsChannel, MANAGED_SETTINGS_CHANNELS, resolution/provenance types, and pickManagedSettings().
.github/skills/add-policy/SKILL.md	Updates policy skill documentation to reflect per-key managed-settings precedence.
.github/skills/add-policy/github-managed-settings.md	Updates managed-settings documentation to reflect the new per-key merge/precedence model.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 1
• Review effort level: Low

[Copilot]

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 0 new
• Review effort level: Low