[cherry-pick] accounts: avoid more redundant managed settings requests

[vs-code-engineering]

Cherry-pick of #333823 from main.

Summary

• keep forceRefresh as a simple boolean that bypasses every default-account cache
• keep ordinary account refreshes cache-aware with no force flag
• preserve fresh quota/upgrade checks with an explicit entitlement-only refresh
• deduplicate authentication sessions that match multiple accepted scope alternatives
• treat a managed-settings 404 as the final cacheable no-policy result instead of retrying other sessions
• retain bounded 401 authentication fallback and fail-closed forced-freshness behavior

Why

A workbench reload could turn one managed-settings lookup into four sequential GETs. A chat entitlement update was forcing all account data to refresh, one GitHub session was selected once per matching scope alternative, and the shared request helper retried 404 responses as though they indicated a bad token.

The refresh contract remains simple: normal operation honors fresh caches; forceRefresh: true refreshes everything and is reserved for explicit policy sync/retry actions. Quota dashboards, quota reset checks, and upgrade flows explicitly refresh only entitlement data so they do not remain stale for up to one hour or invalidate unrelated caches.

Launch validation

Using an isolated authenticated Code OSS Dev profile:

• initial uncached account resolution made one request for each required account resource
• explicit entitlement refresh requested only /copilot_internal/user; token, MCP, and managed-settings caches were reused
• reload made zero managed-settings requests
• Developer: Sync Account Policy refreshed entitlement, token, managed-settings, and MCP data exactly once each
• the managed-settings 404 stopped after the first distinct session and was cached as “no policy”

Council review

GPT-5.5, Claude Opus 4.6, and GPT-5.3-Codex unanimously found that making forceResolveEntitlement fully cache-aware would regress quota-reset, dashboard, and post-upgrade freshness for up to one hour. The current implementation fixes that with a single entitlement-only refresh option and focused regression coverage.

Validation

• npm run hygiene
• npm run compile (zero errors)
• npm run valid-layers-check
• ./scripts/test.sh --run src/vs/workbench/services/accounts/test/browser/defaultAccount.test.ts --run src/vs/workbench/services/chat/test/common/chatEntitlementService.test.ts --run src/vs/workbench/services/policies/test/browser/accountPolicyGateContribution.test.ts (59 passing)

[Copilot]

🟢 Approval recommended

The cache and retry changes are coherent, narrowly scoped, and supported by focused regression coverage.

Pull request overview

Reduces redundant default-account and managed-settings requests while preserving targeted entitlement freshness.

Changes:

• Adds entitlement-only refreshes and keeps normal refreshes cache-aware.
• Deduplicates matching sessions and stops managed-settings retries after 404.
• Adds focused regression tests.

File summaries

File	Description
src/vs/workbench/services/chat/common/chatEntitlementService.ts	Uses entitlement-only refreshes.
src/vs/workbench/services/accounts/test/browser/defaultAccount.test.ts	Covers caching, session deduplication, and 404 handling.
src/vs/workbench/services/accounts/browser/defaultAccount.ts	Refines cache bypass and authenticated request behavior.
src/vs/platform/defaultAccount/common/defaultAccount.ts	Adds the entitlement refresh option.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[joshspicer]

Fixed the release-branch cherry-pick adaptation in bb2c6916e0d.

The failure was not hygiene formatting: the combined Compile & Hygiene job's core-ci step rejected a five-argument createProvider(...) call because the release/1.136 test helper still accepted only four arguments. Runtime Browser/Electron jobs ignored the extra JavaScript argument, so the authentication override was never applied and the new overlapping-scope test received no sessions.

Minimal fix: add the optional authenticationServiceOverrides parameter and spread it last into the test authentication-service stub. No production files changed.

Validation on the cherry-pick branch:

• full repository hygiene: passed
• full compile: zero errors
• release default-account suite: 44 passing
• pre-commit hygiene: passed

[joshspicer]

Verified endpoint load against the exact pre-change baseline using compiled Code OSS launches and mock-policy-server. The release cherry-pick's production diff has the same stable patch ID as #333823 (6755743a8478e5af6462620dbefa1121a8375791).

Across cold start, hot start, hot reload, explicit force sync, governed success, governed 500, and force 401 scenarios:

• /copilot_internal/user was unchanged in every A/B comparison
• token, managed-settings, and MCP request counts were equal or lower
• no endpoint had a positive request delta

Hot reload fell from 7 default-account endpoint requests to 2: /user remained 2 while token fell 1→0, managed settings 3→0, and MCP 1→0.

Full evidence is recorded in the session A/B report.