Support a proxy PAC file URL (http.proxyPacUrl) and an enterprise policy for it #345402

Summary

Add a setting, http.proxyPacUrl, that points VS Code at a proxy auto-config (PAC) file, and an enterprise policy (ProxyPacUrl) so administrators can set it through ADMX and the other policy channels.

Problem

VS Code supports a manually configured proxy (http.proxy) and the system proxy, but there is no way to give it a PAC file. Many corporate proxy products (for example Zscaler and iboss) distribute a PAC over http(s); iboss serves it locally from 127.0.0.1. If the machine's OS proxy settings are not set up the same way, VS Code cannot follow the PAC, and an administrator has no supported way to configure one centrally.

There is also a policy-bypass concern. Browsers such as Edge and Chrome can be locked to a proxy through enterprise policy, but VS Code's built-in Integrated Browser is not covered by those policies or by http.proxy, so it can reach destinations that the organization's proxy rules are meant to control.

Related: #94148 (Investigate setting Electron's proxy from user setting).

Proposal

Two pull requests:

1. Native PAC support and policy.
   • New application-scoped setting http.proxyPacUrl accepting http and https URLs. Chromium does not load file:// PAC URLs in Electron, so those are out of scope.
   • New ProxyPacUrl policy in a new Network policy category, so it is available through the ADMX/ADML templates and the macOS and Linux policy channels. Policy values already win over user settings.
   • While a PAC URL is set, http.proxy and http.noProxy are ignored, so a user cannot route around the PAC with their own proxy. This avoids needing a separate http.proxy policy.
   • Applied to the window session (session.setProxy / app.setProxy with pacScript), and to the extension host and Agent Host proxy agents, which then defer to the Electron session for resolution.
   • Desktop only. The CLI and server request service have no PAC capability and stay unchanged.
2. Integrated Browser. Apply the same proxy configuration to the Integrated Browser's partitioned sessions so a configured PAC cannot be bypassed through it.

Status

I have PR 1 implemented and tested locally (unit tests plus a live run against fake proxies and a local PAC server, including the policy-over-user-setting case). Before opening it I would like to check that the approach is acceptable, in particular:

• the setting and policy names, and adding a Network policy category;
• ignoring http.proxy and http.noProxy while a PAC is set, rather than adding a separate http.proxy policy;
• limiting to http(s) URLs.

Known limitations I plan to document: HTTP_PROXY/HTTPS_PROXY environment variables still outrank host resolution in the extension host and Agent Host paths (as they do today for the system proxy), and the Copilot SDK child process receives a single proxy resolved for the Copilot API URL.