[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M699B70GD3NCCWCF8YBEZMRK":3,"skill-same:01M699B70GD3NCCWCF8YBEZMRK":105},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":46,"linkOnly":47,"markdownContent":48,"markdownBody":49,"frontMatter":50,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":54,"repositoryHtmlUrl":55,"repositoryHomepageUrl":56,"ownerHtmlUrl":57,"ownerBlogUrl":58,"ownerDescription":59,"updatedAt":60,"install":61,"resources":74},"01M699B70GD3NCCWCF8YBEZMRK","policy-and-managed-settings",null,"Use whenever adding, modifying, or reviewing any Copilot, agent, LLM, AI, tool, permission, sandbox, MCP, model, telemetry, feature-gate, setting, configuration, or enterprise control—especially anything an organization or administrator may need to manage. Start here to decide whether it belongs in runtime managed settings, a typed SDK contract, VS Code configuration policy, extension policy, or a split implementation. Run on every new Copilot\u002Fagent\u002FLLM control and ANY change that adds a `policy:` field.","microsoft\u002Fvscode","microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","01M698VYDXZ6JW5WH3CRV650R8","Microsoft","01M6998NK2WED5M549DX06VBCH",195271,"MIT","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fvscode\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fpolicy-and-managed-settings\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45],"policy and managed settings","policy","managed","settings","split","organization","control","code","use","telemetry","contract","copilot","Enterprise","tool","decide","manage","runtime","model","feature","MCP","change","sandbox","2026-11-10 10:12:30",false,"---\nname: policy-and-managed-settings\ndescription: Use whenever adding, modifying, or reviewing any Copilot, agent, LLM, AI, tool, permission, sandbox, MCP, model, telemetry, feature-gate, setting, configuration, or enterprise control—especially anything an organization or administrator may need to manage. Start here to decide whether it belongs in runtime managed settings, a typed SDK contract, VS Code configuration policy, extension policy, or a split implementation. Run on every new Copilot\u002Fagent\u002FLLM control and ANY change that adds a `policy:` field.\n---\n\n# Enterprise Policy and Managed Settings\n\nRoute a control by **where the governed behavior is implemented**, not by who requested it. Most Copilot agent controls belong in the runtime, not VS Code.\n\n| Governed behavior | Destination | Guide |\n|---|---|---|\n| Copilot runtime: tools, shell, files, URLs, MCP, plugins, subagents, permissions, sandbox, runtime model\u002Ftelemetry | Runtime managed setting (SDK type only if the host owns the value) | [sdk-runtime-policy.md](.\u002Fsdk-runtime-policy.md) |\n| VS Code editor\u002Fworkbench | VS Code configuration `policy:` | [vscode-policy.md](.\u002Fvscode-policy.md) |\n| Extension-contributed setting | `extensionConfigurationPolicy` in vscode-distro | [extension-policy.md](.\u002Fextension-policy.md) |\n| Independent runtime **and** editor behavior | Split: runtime setting for agent behavior, VS Code policy for editor behavior only | both of the above |\n| Existing permission policy introduced before 1.133 | Bounded migration only | [legacy-permission-policy.md](.\u002Flegacy-permission-policy.md) |\n\nSupporting references:\n\n- [github-managed-settings.md](.\u002Fgithub-managed-settings.md): projecting managed settings into VS Code policy (channels, precedence, key declaration).\n- [policy-support-maintenance.md](.\u002Fpolicy-support-maintenance.md): Agent Host support inventory and Policy Diagnostics readiness.\n- [local-testing.md](.\u002Flocal-testing.md): mock policy server.\n\n## Rules\n\n- Runtime enforcement is authoritative. Do not duplicate runtime parsing, matching, or security decisions in VS Code, and never substitute editor UI suppression for runtime enforcement.\n- New Copilot controls go directly in the shared managed-settings schema\u002FSDK contract. Do not add a VS Code setting to mirror or bridge one.\n- Closed to new properties (existing entries stay for compatibility): GitHub token\u002Faccount `IPolicyData` fields consumed by `AccountPolicyService`, the legacy VS Code setting bridge, and pre-1.133 permission translation.\n- Split controls: add the runtime capability first and keep existing editor behavior until it ships. Keep both projections semantically aligned; keep permission authorization separate from sandbox containment; make create\u002Fresume\u002Fremoval\u002Fpeer\u002Fsubagent\u002Fcloud behavior explicit.\n- Every VS Code or extension policy change needs an `agentHostPolicySupport` entry and `pnpm run export-policy-data`. Never hand-edit `build\u002Flib\u002Fpolicies\u002FpolicyData.jsonc`.\n- Never log raw enterprise rules\u002Fvalues or add telemetry containing them.\n- Trust source and tests over these docs. Document decisions and invariants; link to source instead of copying it.\n\n## Policy-disabled UI\n\nPrefer an option that stays visible but disabled, with the briefcase managed-policy indicator, a localized reason, and an accessible next step, over silently hiding it ([design guidance](..\u002Fdesign-philosophy\u002FSKILL.md#make-unavailable-features-understandable)). Use policy provenance to distinguish prohibition from unsupported, feature-gated, or pending states. Presentation never changes authorization: a disabled option must not re-enter the runtime's allowed set or bypass create\u002Fresume\u002Fwrite validation. Test policy refresh\u002Fremoval, keyboard and pointer activation, and stale menus; preserve AI-hiding behavior.\n","# Enterprise Policy and Managed Settings\n\nRoute a control by **where the governed behavior is implemented**, not by who requested it. Most Copilot agent controls belong in the runtime, not VS Code.\n\n| Governed behavior | Destination | Guide |\n|---|---|---|\n| Copilot runtime: tools, shell, files, URLs, MCP, plugins, subagents, permissions, sandbox, runtime model\u002Ftelemetry | Runtime managed setting (SDK type only if the host owns the value) | [sdk-runtime-policy.md](.\u002Fsdk-runtime-policy.md) |\n| VS Code editor\u002Fworkbench | VS Code configuration `policy:` | [vscode-policy.md](.\u002Fvscode-policy.md) |\n| Extension-contributed setting | `extensionConfigurationPolicy` in vscode-distro | [extension-policy.md](.\u002Fextension-policy.md) |\n| Independent runtime **and** editor behavior | Split: runtime setting for agent behavior, VS Code policy for editor behavior only | both of the above |\n| Existing permission policy introduced before 1.133 | Bounded migration only | [legacy-permission-policy.md](.\u002Flegacy-permission-policy.md) |\n\nSupporting references:\n\n- [github-managed-settings.md](.\u002Fgithub-managed-settings.md): projecting managed settings into VS Code policy (channels, precedence, key declaration).\n- [policy-support-maintenance.md](.\u002Fpolicy-support-maintenance.md): Agent Host support inventory and Policy Diagnostics readiness.\n- [local-testing.md](.\u002Flocal-testing.md): mock policy server.\n\n## Rules\n\n- Runtime enforcement is authoritative. Do not duplicate runtime parsing, matching, or security decisions in VS Code, and never substitute editor UI suppression for runtime enforcement.\n- New Copilot controls go directly in the shared managed-settings schema\u002FSDK contract. Do not add a VS Code setting to mirror or bridge one.\n- Closed to new properties (existing entries stay for compatibility): GitHub token\u002Faccount `IPolicyData` fields consumed by `AccountPolicyService`, the legacy VS Code setting bridge, and pre-1.133 permission translation.\n- Split controls: add the runtime capability first and keep existing editor behavior until it ships. Keep both projections semantically aligned; keep permission authorization separate from sandbox containment; make create\u002Fresume\u002Fremoval\u002Fpeer\u002Fsubagent\u002Fcloud behavior explicit.\n- Every VS Code or extension policy change needs an `agentHostPolicySupport` entry and `pnpm run export-policy-data`. Never hand-edit `build\u002Flib\u002Fpolicies\u002FpolicyData.jsonc`.\n- Never log raw enterprise rules\u002Fvalues or add telemetry containing them.\n- Trust source and tests over these docs. Document decisions and invariants; link to source instead of copying it.\n\n## Policy-disabled UI\n\nPrefer an option that stays visible but disabled, with the briefcase managed-policy indicator, a localized reason, and an accessible next step, over silently hiding it ([design guidance](..\u002Fdesign-philosophy\u002FSKILL.md#make-unavailable-features-understandable)). Use policy provenance to distinguish prohibition from unsupported, feature-gated, or pending states. Presentation never changes authorization: a disabled option must not re-enter the runtime's allowed set or bypass create\u002Fresume\u002Fwrite validation. Test policy refresh\u002Fremoval, keyboard and pointer activation, and stale menus; preserve AI-hiding behavior.\n",{"name":5,"description":7},"main","d2b1bf2230b505648e972e81d854743de79b65af",".github\u002Fskills\u002Fpolicy-and-managed-settings",43773,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fvscode","https:\u002F\u002Fcode.visualstudio.com","https:\u002F\u002Fgithub.com\u002Fmicrosoft","https:\u002F\u002Fopensource.microsoft.com","Open source projects and samples from Microsoft","2026-11-11 08:47:49",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add microsoft\u002Fvscode --skill policy-and-managed-settings",{"tool":67,"command":68},"bunx","bunx skills add microsoft\u002Fvscode --skill policy-and-managed-settings",{"tool":70,"command":71},"pnpm","pnpm dlx skills add microsoft\u002Fvscode --skill policy-and-managed-settings","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fvscode\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fpolicy-and-managed-settings\u002FSKILL.md",true,[75,81,85,89,93,97,101],{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"extension-policy.md","REFERENCE","参考文档",1198,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fvscode\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fpolicy-and-managed-settings\u002Fextension-policy.md",{"path":82,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":83,"sourceHtmlUrl":84},"github-managed-settings.md",6219,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fvscode\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fpolicy-and-managed-settings\u002Fgithub-managed-settings.md",{"path":86,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":87,"sourceHtmlUrl":88},"legacy-permission-policy.md",2240,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fvscode\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fpolicy-and-managed-settings\u002Flegacy-permission-policy.md",{"path":90,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":91,"sourceHtmlUrl":92},"local-testing.md",1882,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fvscode\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fpolicy-and-managed-settings\u002Flocal-testing.md",{"path":94,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":95,"sourceHtmlUrl":96},"policy-support-maintenance.md",3411,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fvscode\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fpolicy-and-managed-settings\u002Fpolicy-support-maintenance.md",{"path":98,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":99,"sourceHtmlUrl":100},"sdk-runtime-policy.md",8251,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fvscode\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fpolicy-and-managed-settings\u002Fsdk-runtime-policy.md",{"path":102,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":103,"sourceHtmlUrl":104},"vscode-policy.md",2688,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fvscode\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fpolicy-and-managed-settings\u002Fvscode-policy.md",[106,132,154,168,183,199],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":46},"01M70H0ANBKZAVEP1NVV4K28M3","sweeper-query","Answer natural-language questions about the VS Code Sweeper's published issue index (index-\u003Cname>.json for microsoft\u002Fvscode and the enrolled family repos) — which issues are agent-ready to implement or plan, what the sweeper proposed for an assignee or area, whether the sweeper knows a report as a duplicate, the highest-value open bugs in a lane — and, for one issue, the review's full record (evidence with file citations, fix brief, proposed comment). Use ONLY when the request explicitly names the sweeper — \"sweeper\", \"vscodesweeper\", \"sweeper-query\", a sweeper verdict, record, brief or index, an agent-ready issue — or asks what \"the sweeper\" found, proposed or knows. Do NOT use for general questions about issues, duplicates, priorities or ranking that do not mention the sweeper. Read-only; discovery only.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fvscode\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fsweeper-query\u002FSKILL.md",[],[113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,31],"sweeper query","query","sweeper","review","fix","when","request","which","natural-language","ranking","duplicates","ready","only","read","plan","open","Citations","brief","issues",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":46},"01M699DRJS4YJCV600Q72SVVWE","update-skills","Create or update repository skills and instructions when major learnings are discovered during a session. Use when the user says \"learn!\", when a significant pattern or pitfall is identified, or when reusable domain knowledge should be captured for future sessions.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fvscode\u002Fblob\u002Fmain\u002Fsrc\u002Fvs\u002Fsessions\u002Fskills\u002Fupdate-skills\u002FSKILL.md",[],[139,140,141,142,143,144,145,32,146,147,148,149,150,151,152,153,118],"update","update skills","for","pattern","domain","learnings","reusable","session","user","instructions","knowledge","repository","learn","create","sessions",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":46},"01M699DPWHZ72B66P82EW31RNE","update-pr","Update the pull request for the current session. Use when the user wants to push new changes to an existing PR.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fvscode\u002Fblob\u002Fmain\u002Fsrc\u002Fvs\u002Fsessions\u002Fskills\u002Fupdate-pr\u002FSKILL.md",[],[139,161,162,118,119,163,141,32,146,147,164,165,166,167],"pr","update pr","Existing","push","pull","pull request","changes",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":174,"publishedAt":46},"01M699DJMR6CE1MH5XCJZ0GFQ0","sync","Sync the current session branch with its upstream branch, or publish the current session branch to a remote. Use when the user asks to sync a branch, pull latest changes, rebase onto upstream, push current branch, publish branch, or set upstream.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fvscode\u002Fblob\u002Fmain\u002Fsrc\u002Fvs\u002Fsessions\u002Fskills\u002Fsync\u002FSKILL.md",[],[170,175,176,164,165,177,118,167,178,179,180,181,32,146,147,182],"SET","publish","rebase","latest","with","remote","upstream","branch",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":189,"publishedAt":46},"01M699DGXHX6A2A72X57R6GGHJ","sync-upstream","Update a stale session branch by rebasing onto the latest origin. Use when the upstream has moved significantly and the session needs to catch up, resolving conflicts by preserving upstream changes and adapting session work to fit.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fvscode\u002Fblob\u002Fmain\u002Fsrc\u002Fvs\u002Fsessions\u002Fskills\u002Fsync-upstream\u002FSKILL.md",[],[181,170,190,191,118,192,193,167,178,194,195,196,197,32,146,182,198,139],"sync upstream","fit","catch","catch up","origin","conflicts","stale","up","work",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":205,"publishedAt":46},"01M699DEXYFWDGW0BAXJ5QQ377","merge","Merge changes from the topic branch to the merge base branch. Use when the user wants to merge their session's work back to the base branch.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fvscode\u002Fblob\u002Fmain\u002Fsrc\u002Fvs\u002Fsessions\u002Fskills\u002Fmerge\u002FSKILL.md",[],[201,146,32,198,182,147,118,206,207,167],"back","base"]