Repo sync

content/admin/managing-accounts-and-repositories/managing-repositories-in-your-enterprise/managing-custom-properties-for-repositories-in-your-enterprise.md

@@ -31,14 +31,28 @@ People with read permissions to a repository can view the custom property values
 
 Additionally, organization owners can search for repositories in their organization by custom property values. See [AUTOTITLE](/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization#searching-and-filtering-repositories-by-custom-property-values).
 
+{% ifversion ghec %}
+## About custom property suggestions
+
+> [!NOTE]
+> {% data reusables.organizations.custom-property-suggestions-public-preview %}
+
+When you create a single-select or multi-select property, {% data variables.product.prodname_copilot_short %} can suggest allowed values for the property definition. Select a suggestion to add it to the list of allowed values.
+
+This feature is available with {% data variables.copilot.copilot_business_short %} or {% data variables.copilot.copilot_enterprise_short %}. By default, suggestions are enabled for enterprise-level properties and each organization can decide whether to enable suggestions. Enterprise owners can instead enable or disable suggestions everywhere with the **Repository custom property suggestions** policy. See [AUTOTITLE](/copilot/how-tos/administer-copilot/manage-for-enterprise/manage-enterprise-policies).
+{% endif %}
+
 ## Adding custom properties
 
 You can add custom properties to your enterprise to make those properties available in all of your organizations.
 
 {% data reusables.enterprise-accounts.access-enterprise %}
 1. In the left sidebar, under "Policies", click **Custom properties**.
 1. To add a new custom property, in the upper-right corner, click **New property**.
-1. Enter a name, description, and type for the custom property. The name must be unique across all of your organizations, can't contain spaces, and cannot exceed 75 characters in length.
+1. Enter a name, description, and type for the custom property. The name must be unique across all of your organizations, can't contain spaces, and cannot exceed 75 characters in length.{% ifversion ghec %}
+
+   If you selected a single select or multi select type, {% data variables.product.prodname_copilot_short %} can suggest allowed values for the property definition. Select **{% octicon "check" aria-label="Accept suggestion" %} Accept suggestion** to add it to the list of allowed values.{% endif %}
+
 1. Optionally, select **Allow repository actors to set this property**. When enabled, repository users and apps with the repository-level `custom properties` fine-grained permission will be able to set and update the property value for their repository. Additionally, any actor creating a repository can set the property on the repository.
 1. Optionally, select **Require this property for all repositories** and add a default value. This means that you require that all repositories in your enterprise have a value for this property. Repositories that don’t have an explicit value for this property will inherit the default value.
 {% data reusables.organizations.custom-properties-required-values %}

content/code-security/concepts/code-scanning/ai-powered-security-detections.md

@@ -75,6 +75,6 @@ You do not need to select a model to enable AI Scan.
 
 * **Enterprise**: The **AI Scan** policy under "Code Security" controls whether organizations can enable the feature. See [AUTOTITLE](/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise#enforcing-a-policy-to-manage-ai-scan-in-your-enterprises-repositories).
 * **Organization**: The **AI Scan** setting under "Code scanning" enables AI Scan for eligible repositories in the organization where {% data variables.product.prodname_code_scanning %} is enabled. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/configure-global-settings#enabling-ai-scan).
-* **Repository**: For an organization-owned repository, the **AI Scan** toggle under "Code scanning" lets repository administrators opt out when AI Scan is enabled for the organization. For an eligible public repository owned by a personal account, the toggle enables or disables AI Scan directly.
+* **Repository**: For an organization-owned repository, the **AI Scan for pull requests** toggle under "Code scanning" lets repository administrators opt out when AI Scan is enabled for the organization. For an eligible public repository owned by a personal account, the toggle enables or disables AI Scan directly.
 
 You can use the REST API to manage the organization or repository `ai-scan` setting. See [AUTOTITLE](/rest/code-scanning/code-scanning#get-the-ai-scan-setting-for-an-organization).

content/copilot/concepts/agents/copilot-cli/understanding-local-sandboxing.md

@@ -111,7 +111,7 @@ You can grant extra read/write or read-only paths, deny paths, and change other
 
 ## Enterprise-managed policies
 
-If you get {% data variables.product.prodname_copilot_short %} through an enterprise-owned organization, an administrator can enforce a filesystem policy through managed settings. Managed settings act as a restrictive baseline: they can require sandboxing, add denied paths, and limit which paths you are allowed to grant. Where a managed setting applies, the `/sandbox config` dialog shows it as a locked **(managed)** value, and `/sandbox policy` reflects it in the resolved policy. If the effective policy permits sandbox bypass, a user can explicitly disable sandboxing for the rest of the current session from an active bypass permission prompt. This session opt-out does not loosen the saved policy.
+If you get {% data variables.product.prodname_copilot_short %} through an enterprise-owned organization, an administrator can enforce a filesystem policy through managed settings. Managed settings act as a restrictive baseline: they can require sandboxing, add denied paths, and limit which paths you are allowed to grant. Where a managed setting applies, the `/sandbox config` dialog shows it as a locked **(managed)** value, and `/sandbox policy` reflects it in the resolved policy. If the effective policy permits sandbox bypass, a user can explicitly disable sandboxing for the rest of the current session, either from an active bypass permission prompt or by running `/sandbox disable`. This session opt-out does not loosen the saved policy.
 
 Unlike most settings, where a single source wins, the sandbox policy is composed from every source in force at once. Managed settings can arrive through more than one channel simultaneously—server-managed, MDM, and file-based—and these combine with each other, and with your own settings, in the **most restrictive** direction rather than one source overriding another: a required toggle stays on, denied paths from all sources add up, and the paths you are allowed to grant can only be narrowed. For more information, see [AUTOTITLE](/copilot/reference/enterprise-administrators/enterprise-managed-settings#sandbox).
 

content/copilot/how-tos/cloud-and-local-sandboxes/configuring-local-sandbox-settings.md

@@ -50,7 +50,7 @@ The **Allow sandbox bypass** setting controls what happens when {% data variable
 * **On (default)**: If a command fails inside the sandbox, you are prompted to allow {% data variables.product.prodname_copilot_short %} to run the command outside the sandbox. Your response to this prompt applies to this specific attempt to run the command. Optionally, you can choose to disable the sandbox for the rest of the session (if permitted by your enterprise), or you can enter an instruction for {% data variables.product.prodname_copilot_short %} to work on instead.
 * **Off**: If {% data variables.product.prodname_copilot_short %} can't run a command successfully in the sandbox, it stops working on the task and reports the failure.
 
-If enterprise managed settings set `sandbox.allowBypass` to `false`, you cannot approve individual commands to run outside the sandbox or disable sandboxing for the rest of the session. If managed settings require sandboxing but the effective policy permits bypass, you can disable sandboxing only from an active bypass permission prompt, not through ordinary settings or `/sandbox disable`.
+If enterprise managed settings set `sandbox.allowBypass` to `false`, you cannot approve individual commands to run outside the sandbox or disable sandboxing for the rest of the session. If managed settings require sandboxing but the effective policy permits bypass, you cannot turn sandboxing off through ordinary settings, but you can disable it for the rest of the current session—either from an active bypass permission prompt or by running `/sandbox disable`—without loosening the saved policy.
 
 ## Configuring authentication settings
 

content/copilot/how-tos/cloud-and-local-sandboxes/using-local-sandboxing.md

@@ -20,7 +20,7 @@ docsTeamMetrics:
 
 Sandboxing is currently an experimental feature. To use it, start {% data variables.copilot.copilot_cli_short %} with the `‑‑experimental` command line option, or enter `/experimental on` during a session.
 
-When you enable local sandboxing, {% data variables.copilot.copilot_cli_short %} runs most of the commands and tools it invokes on your behalf inside an operating-system sandbox. After you enable local sandboxing, it is used for all your {% data variables.copilot.copilot_cli_short %} sessions until you disable it, or turn it off for a specific session. If enterprise managed settings require sandboxing, ordinary configuration, the `--no-sandbox` command line option, and the `/sandbox disable` command cannot disable it. However, if the effective policy permits sandbox bypass, you can explicitly disable sandboxing for the rest of the current session from an active bypass permission prompt.
+When you enable local sandboxing, {% data variables.copilot.copilot_cli_short %} runs most of the commands and tools it invokes on your behalf inside an operating-system sandbox. After you enable local sandboxing, it is used for all your {% data variables.copilot.copilot_cli_short %} sessions until you disable it, or turn it off for a specific session. If enterprise managed settings require sandboxing, ordinary configuration and the `--no-sandbox` command line option cannot disable it. However, if the effective policy permits sandbox bypass, you can explicitly disable sandboxing for the rest of the current session, either from an active bypass permission prompt or by running `/sandbox disable`. This session opt-out does not loosen the saved policy.
 
 By default, sandboxed commands and tools can write within your current working directory and temporary folders. Your user profile (home) directory, along with system and tool locations are read-only. Other disk locations are blocked. In a Git repository, the rest of the repository above your current working directory is readable but not writable. Access to your local and private network is permitted, as is outbound internet access.
 
@@ -38,7 +38,7 @@ You manage local sandboxing from within a {% data variables.copilot.copilot_cli_
 | `/sandbox policy` | Show the effective filesystem policy for the current directory—the paths that are readable, writable, or blocked, and the network access in force. For more information, see [AUTOTITLE](/copilot/concepts/agents/copilot-cli/understanding-local-sandboxing). |
 | `/sandbox config` | Open the interactive settings interface. Entering `/sandbox` on its own does the same thing. For more information, see [AUTOTITLE](/copilot/how-tos/cloud-and-local-sandboxes/configuring-local-sandbox-settings). |
 | `/sandbox enable` | Turn local sandboxing on. See [Enabling local sandboxing](#enabling-local-sandboxing). |
-| `/sandbox disable` | Turn local sandboxing off. If enterprise managed settings require sandboxing, this is refused. See [Disabling local sandboxing](#disabling-local-sandboxing). |
+| `/sandbox disable` | Turn local sandboxing off. If enterprise managed settings require sandboxing, this is refused unless the effective policy permits sandbox bypass, in which case it disables sandboxing for the rest of the current session only. See [Disabling local sandboxing](#disabling-local-sandboxing). |
 
 ## Enabling local sandboxing
 
@@ -60,7 +60,7 @@ After you enable local sandboxing, it continues to be used for the current and f
 
 ## Disabling local sandboxing
 
-If enterprise managed settings require sandboxing, `/sandbox disable` is refused. If the effective policy permits sandbox bypass, you can instead explicitly disable sandboxing for the rest of the current session from an active bypass permission prompt.
+If enterprise managed settings require sandboxing, `/sandbox disable` is refused unless the effective policy permits sandbox bypass. When bypass is permitted, running `/sandbox disable`—or responding to an active bypass permission prompt—disables sandboxing for the rest of the current session only, without loosening the saved policy.
 
 To stop using local sandboxing, enter the following command in an interactive {% data variables.copilot.copilot_cli_short %} session:
 
@@ -84,7 +84,7 @@ copilot --sandbox -p "PROMPT"
 
 ## Running a single command outside the sandbox
 
-When a command needs broader access than the sandbox allows, {% data variables.product.prodname_copilot_short %} can request to run that single command outside the sandbox. You are shown a confirmation prompt describing the command. You can approve that single command, keep it inside the sandbox, or disable sandboxing for the rest of the current session. The session opt-out is available only while responding to an active bypass prompt and only if the effective policy permits sandbox bypass.
+When a command needs broader access than the sandbox allows, {% data variables.product.prodname_copilot_short %} can request to run that single command outside the sandbox. You are shown a confirmation prompt describing the command. You can approve that single command, keep it inside the sandbox, or disable sandboxing for the rest of the current session. Disabling sandboxing for the session is available only if the effective policy permits sandbox bypass. When it is permitted, you can also do this at any time by running `/sandbox disable`.
 
 This behavior is enabled by default and can be turned off in your sandbox settings.