managed settings: forceRemoteSettingsRefresh fails closed

.github/skills/policy-and-managed-settings/github-managed-settings.md

@@ -372,10 +372,13 @@ constant, configuration policy, or policy-data export.
 
 `forceRemoteSettingsRefresh` is not a user configuration setting. It controls whether the
 server-managed-settings cache may satisfy startup, so VS Code preserves it in the cached raw server
-bag and always includes it in the native MDM watch schema. `DefaultAccountProvider` resolves an
-explicit native MDM boolean ahead of the cached server value; when the result is `true`, it bypasses
-an otherwise-fresh server cache for the first fetch for that account in the current process. The
-cache remains available as the normal fetch-failure fallback.
+bag and always includes it in the native MDM watch schema. `DefaultAccountProvider` resolves the
+control across native MDM, cached server, and managed-file delivery before using the server cache.
+When the result is `true`, only a fresh successful server response for the current account,
+authentication provider, and endpoint satisfies the requirement. A failed refresh may retain cached
+restrictions and the flag itself, but the Account Policy gate keeps AI features disabled until a
+retry succeeds. Authentication remains available so users can recover from missing or expired
+credentials.
 
 Reference tests:
 - `src/vs/platform/policy/test/common/copilotManagedSettings.test.ts`

.github/skills/policy-and-managed-settings/local-testing.md

@@ -31,6 +31,14 @@ Use **Clear Policy Cache** when the runtime's fresh managed-settings cache
 prevents a network request. The live request log confirms whether the client
 reached the server.
 
+To test `forceRemoteSettingsRefresh` fail-closed behavior, apply the
+`customization-lockdown` managed-settings preset and sync once successfully.
+Then select the `server-error` preset or choose the `malformed-json`,
+`disconnect`, or `timeout` response behavior and sync again. The successful
+first response seeds the cached refresh requirement; the second response
+exercises HTTP, parse, immediate-network, or client-timeout failure without
+manually editing payloads.
+
 Other Copilot clients share the default cache. For deterministic testing, start
 both Code OSS and the mock server with the same isolated `COPILOT_CACHE_HOME`.
 

scripts/mock-policy-server/README.md

@@ -12,7 +12,7 @@ npm run mock-policy-server
 
 Open `http://127.0.0.1:3000`. Managed settings is mocked by default. Use the
 switch beside each endpoint tab to choose mock or passthrough. Presets apply
-immediately; status and JSON edits auto-save.
+immediately; response behavior, status, and JSON edits auto-save.
 
 The GUI opens on the **Policies** workspace. Select **Setup** in the header to
 open a modal that guides you through either connection method:
@@ -91,9 +91,38 @@ curl -X POST "$BASE/api/state" \
   ]}'
 ```
 
-A preset sets its status and body and enables mocking. Explicit `status`, `body`,
-or `active` values in the same update override the preset. Invalid requests are
-rejected before any endpoint changes.
+A preset sets the status and body and enables mocking. Response behavior is
+configured independently with `mode`, including when a preset and mode are sent
+in the same update. Explicit `status`, `body`, or `active` values override the
+preset. Invalid requests are rejected before any endpoint changes. Supported
+response modes are `json`, `malformed-json`, `disconnect`, and `timeout`.
+
+### Test fail-closed managed-settings refresh
+
+First serve a successful policy that enables the forced-refresh requirement and
+sync it into VS Code. Then configure an HTTP error preset or a failing response
+behavior and sync again. Seeding the requirement first mirrors a real deployment
+where the cached control self-perpetuates through an outage.
+
+```sh
+curl -X POST "$BASE/api/state" \
+  -H 'Content-Type: application/json' \
+  -d '{"endpoint":"managedSettings","preset":"customization-lockdown"}'
+
+# Run "Developer: Sync Account Policy" in VS Code, then choose one:
+curl -X POST "$BASE/api/state" -H 'Content-Type: application/json' \
+  -d '{"endpoint":"managedSettings","preset":"server-error"}'
+curl -X POST "$BASE/api/state" -H 'Content-Type: application/json' \
+  -d '{"endpoint":"managedSettings","mode":"malformed-json","status":200}'
+curl -X POST "$BASE/api/state" -H 'Content-Type: application/json' \
+  -d '{"endpoint":"managedSettings","mode":"disconnect"}'
+curl -X POST "$BASE/api/state" -H 'Content-Type: application/json' \
+  -d '{"endpoint":"managedSettings","mode":"timeout"}'
+```
+
+These configurations exercise HTTP error, malformed response, immediate network
+failure, and client-timeout paths respectively. Clear the policy cache if the
+request does not appear in **Live Requests**.
 
 | Method | Route | Purpose |
 | --- | --- | --- |

scripts/mock-policy-server/endpoints.ts

@@ -32,6 +32,8 @@ export interface EndpointPreset {
 	body: unknown;
 }
 
+export type EndpointResponseMode = 'json' | 'malformed-json' | 'disconnect' | 'timeout';
+
 export interface EndpointDef {
 	/** Stable id used by the API + GUI. */
 	id: string;
@@ -239,6 +241,13 @@ declare var MOCK_POLICY_ENDPOINTS: EndpointDef[];
 						client_version: '1.132.0',
 						minimum_client_version: '1.133.0'
 					}
+				},
+				{
+					id: 'server-error',
+					label: 'Server error (500)',
+					description: 'Returns an HTTP 500 response to exercise the fail-closed HTTP error path.',
+					status: 500,
+					body: { error: 'mock_managed_settings_failure' }
 				}
 			]
 		},

scripts/mock-policy-server/public/app.ts

@@ -12,6 +12,7 @@
  * `endpoints.ts` (loaded via an earlier `<script>` tag).
  */
 type EndpointDef = import('../endpoints').EndpointDef;
+type EndpointResponseMode = import('../endpoints').EndpointResponseMode;
 
 declare const MOCK_POLICY_ENDPOINTS: EndpointDef[];
 
@@ -22,6 +23,7 @@ declare const MOCK_POLICY_ENDPOINTS: EndpointDef[];
 		url?: string;
 		status?: number;
 		body?: unknown;
+		mode?: EndpointResponseMode;
 		active?: boolean;
 	}
 
@@ -80,6 +82,7 @@ declare const MOCK_POLICY_ENDPOINTS: EndpointDef[];
 		endpoint: string;
 		status: number;
 		body: unknown;
+		mode: EndpointResponseMode;
 		active: boolean;
 		editorText: string;
 	}
@@ -90,6 +93,8 @@ declare const MOCK_POLICY_ENDPOINTS: EndpointDef[];
 	const tabs = $('tabs');
 	const editor = $('editor') as HTMLTextAreaElement;
 	const responseStatusInput = $('response-status') as HTMLInputElement;
+	const responseModeSelect = $('response-mode') as HTMLSelectElement;
+	const responseConfiguration = $('response-configuration');
 	const responseStatusValidation = $('response-status-validation');
 	const presetSelect = $('preset') as HTMLSelectElement;
 	const endpointMeta = $('endpoint-meta');
@@ -402,6 +407,8 @@ declare const MOCK_POLICY_ENDPOINTS: EndpointDef[];
 
 		endpointMeta.replaceChildren(routeSpan);
 		responseStatusInput.value = String(endpoint.status ?? 200);
+		responseModeSelect.value = endpoint.mode ?? 'json';
+		updateResponseConfigurationVisibility();
 		parseResponseStatus();
 		editor.value = drafts[id] ?? JSON.stringify(endpoint.body ?? {}, null, '\t');
 		renderTabs();
@@ -455,6 +462,34 @@ declare const MOCK_POLICY_ENDPOINTS: EndpointDef[];
 		updateReadiness();
 	}
 
+	function updateResponseConfigurationVisibility(): void {
+		responseConfiguration.hidden = responseModeSelect.value !== 'json';
+	}
+
+	async function setResponseMode(endpoint: Endpoint, mode: EndpointResponseMode): Promise<void> {
+		const previousMode = endpoint.mode ?? 'json';
+		endpoint.mode = mode;
+		updateResponseConfigurationVisibility();
+		const snapshot = captureSaveSnapshot();
+		clearPendingSave(endpoint.id);
+		if (snapshot) {
+			if (!await saveSnapshot(snapshot)) {
+				endpoint.mode = previousMode;
+				responseModeSelect.value = previousMode;
+				updateResponseConfigurationVisibility();
+			}
+			return;
+		}
+		try {
+			applyState(await updateState({ endpoint: endpoint.id, mode }));
+		} catch (error) {
+			endpoint.mode = previousMode;
+			responseModeSelect.value = previousMode;
+			updateResponseConfigurationVisibility();
+			toast(`Save failed: ${error instanceof Error ? error.message : String(error)}`, true);
+		}
+	}
+
 	function renderProxy(): void {
 		const endpoint = endpoints.find(candidate => candidate.id === 'managedSettings') ?? endpoints[0];
 		$('map-from').textContent = endpoint && proxyUpstream ? `${proxyUpstream}${endpoint.path}` : '';
@@ -620,6 +655,7 @@ declare const MOCK_POLICY_ENDPOINTS: EndpointDef[];
 			endpoint: endpoint.id,
 			status: responseStatus,
 			body: parsed,
+			mode: endpoint.mode ?? 'json',
 			active: endpoint.active === true,
 			editorText: editor.value
 		};
@@ -631,6 +667,7 @@ declare const MOCK_POLICY_ENDPOINTS: EndpointDef[];
 				endpoint: snapshot.endpoint,
 				status: snapshot.status,
 				body: snapshot.body,
+				mode: snapshot.mode,
 				active: snapshot.active
 			});
 			applyState(state);
@@ -894,6 +931,13 @@ declare const MOCK_POLICY_ENDPOINTS: EndpointDef[];
 			parseEditor();
 			debouncedSave();
 		});
+		responseModeSelect.addEventListener('change', () => {
+			const endpoint = activeEndpoint();
+			if (!endpoint) {
+				return;
+			}
+			void setResponseMode(endpoint, responseModeSelect.value as EndpointResponseMode);
+		});
 		presetSelect.addEventListener('change', applyPreset);
 		$('overrides-action').addEventListener('click', () => wire(!overridesWired));
 		$('copy-map').addEventListener('click', e => {
@@ -964,7 +1008,7 @@ declare const MOCK_POLICY_ENDPOINTS: EndpointDef[];
 			selectSetupMethod('proxy');
 			// Fall back to the shared endpoint definitions so the GUI still shows
 			// what exists (read-only) rather than rendering a blank page.
-			endpoints = MOCK_POLICY_ENDPOINTS.map(def => ({ ...def, status: def.presets[0]?.status ?? 200, body: def.presets[0]?.body ?? {} }));
+			endpoints = MOCK_POLICY_ENDPOINTS.map(def => ({ ...def, status: def.presets[0]?.status ?? 200, body: def.presets[0]?.body ?? {}, mode: 'json' }));
 			renderTabs();
 			if (endpoints.length) {
 				selectEndpoint(endpoints[0].id);

scripts/mock-policy-server/public/index.html

@@ -169,42 +169,54 @@ <h2 id="policies-title" class="sr-only" tabindex="-1">Policy Editor</h2>
 						<p id="endpoint-meta" class="endpoint-meta"></p>
 
 						<div class="form-group">
-							<label for="preset">Preset</label>
-							<select id="preset"></select>
+							<label for="response-mode">Response behavior</label>
+							<select id="response-mode">
+								<option value="json">JSON response</option>
+								<option value="malformed-json">Malformed JSON</option>
+								<option value="disconnect">Disconnect without response</option>
+								<option value="timeout">No response (client timeout)</option>
+							</select>
 						</div>
 
-						<div class="form-group">
-							<label for="response-status">HTTP status code</label>
-							<input id="response-status" class="status-code-input" type="number" min="200" max="599" step="1"
-								inputmode="numeric" aria-describedby="response-status-validation">
-							<p id="response-status-validation" class="status" aria-live="polite"></p>
-						</div>
+						<div id="response-configuration" class="response-configuration">
+							<div class="form-group">
+								<label for="preset">Preset</label>
+								<select id="preset"></select>
+							</div>
 
-						<div id="schema-section" class="section-block" hidden>
-							<h2 class="schema-heading">
-								<button type="button" class="section-header section-header-toggle" id="schema-toggle"
-									aria-expanded="false" aria-controls="schema-details">
-									<span class="chevron" id="schema-chevron" aria-hidden="true">&#9654;</span>
-									<span>Schema</span>
-									<span id="schema-badge" class="schema-badge" data-tooltip="">&hellip;</span>
-								</button>
-							</h2>
-							<div id="schema-details" class="schema-details" hidden>
-								<span class="label-small">Schema source</span>
-								<code id="schema-source" class="block"></code>
-								<button id="hydrate-schema" type="button" class="btn-secondary">Generate Example</button>
+							<div class="form-group">
+								<label for="response-status">HTTP status code</label>
+								<input id="response-status" class="status-code-input" type="number" min="200" max="599" step="1"
+									inputmode="numeric" aria-describedby="response-status-validation">
+								<p id="response-status-validation" class="status" aria-live="polite"></p>
 							</div>
-						</div>
 
-						<div class="form-group">
-							<div class="label-row">
-								<label for="editor">Response body (JSON)</label>
-								<span id="save-state" class="save-state" aria-live="polite"></span>
+							<div id="schema-section" class="section-block" hidden>
+								<h2 class="schema-heading">
+									<button type="button" class="section-header section-header-toggle" id="schema-toggle"
+										aria-expanded="false" aria-controls="schema-details">
+										<span class="chevron" id="schema-chevron" aria-hidden="true">&#9654;</span>
+										<span>Schema</span>
+										<span id="schema-badge" class="schema-badge" data-tooltip="">&hellip;</span>
+									</button>
+								</h2>
+								<div id="schema-details" class="schema-details" hidden>
+									<span class="label-small">Schema source</span>
+									<code id="schema-source" class="block"></code>
+									<button id="hydrate-schema" type="button" class="btn-secondary">Generate Example</button>
+								</div>
+							</div>
+
+							<div class="form-group">
+								<div class="label-row">
+									<label for="editor">Response body (JSON)</label>
+									<span id="save-state" class="save-state" aria-live="polite"></span>
+								</div>
+								<textarea id="editor" spellcheck="false" autocomplete="off"
+									aria-describedby="editor-status"></textarea>
+								<p id="editor-status" class="status" aria-live="polite"></p>
+								<div id="validation-results" hidden></div>
 							</div>
-							<textarea id="editor" spellcheck="false" autocomplete="off"
-								aria-describedby="editor-status"></textarea>
-							<p id="editor-status" class="status" aria-live="polite"></p>
-							<div id="validation-results" hidden></div>
 						</div>
 					</div>
 				</section>

scripts/mock-policy-server/public/style.css

@@ -256,6 +256,17 @@ h2 {
 	min-width: 0;
 }
 
+.response-configuration {
+	display: flex;
+	flex-direction: column;
+	gap: 20px;
+	min-width: 0;
+}
+
+.response-configuration[hidden] {
+	display: none;
+}
+
 .section-block {
 	background: var(--surface);
 	border: 1px solid var(--border);