test(sdk): harden managed-settings empty-array wire tests

Add Go and Java tests proving explicit empty permission arrays
(allow/ask/deny) serialize as [] while nil/absent fields are omitted,
so a present empty allow list (admits nothing) stays distinguishable
from an absent one (no restriction) at both create and resume.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 326a5a5a-aa12-4d85-8b86-c7e392cf1b23

Author: joshspicer

go/client_test.go

@@ -3583,4 +3583,57 @@ func TestSessionRequests_ManagedSettings(t *testing.T) {
 			}
 		}
 	})
+
+	t.Run("distinguishes explicit empty allow from an absent allow", func(t *testing.T) {
+		// Security-critical: a present empty allow list admits nothing, while an
+		// absent allow list imposes no allow restriction. The wire output must
+		// tell these apart per-field, so an explicit empty slice serializes as
+		// `[]` while a nil slice is omitted entirely.
+		req := createSessionRequest{ManagedSettings: &ManagedSettings{
+			Permissions: &ManagedSettingsPermissions{
+				Allow: []string{}, // present but empty: admit nothing
+				// Deny and Ask left nil: no such restriction supplied.
+			},
+		}}
+		data, err := json.Marshal(req)
+		if err != nil {
+			t.Fatalf("Failed to marshal: %v", err)
+		}
+		var m map[string]any
+		json.Unmarshal(data, &m)
+		perms := m["managedSettings"].(map[string]any)["permissions"].(map[string]any)
+
+		allow, ok := perms["allow"].([]any)
+		if !ok || len(allow) != 0 {
+			t.Errorf("Expected allow to be an explicit empty array, got %v", perms["allow"])
+		}
+		if _, present := perms["deny"]; present {
+			t.Errorf("Expected deny to be omitted when nil, got %v", perms["deny"])
+		}
+		if _, present := perms["ask"]; present {
+			t.Errorf("Expected ask to be omitted when nil, got %v", perms["ask"])
+		}
+	})
+
+	t.Run("distinguishes explicit empty arrays on resume", func(t *testing.T) {
+		req := resumeSessionRequest{SessionID: "s1", ManagedSettings: &ManagedSettings{
+			Permissions: &ManagedSettingsPermissions{
+				Deny:  []string{},
+				Ask:   []string{},
+				Allow: []string{},
+			},
+		}}
+		data, err := json.Marshal(req)
+		if err != nil {
+			t.Fatalf("Failed to marshal: %v", err)
+		}
+		var m map[string]any
+		json.Unmarshal(data, &m)
+		perms := m["managedSettings"].(map[string]any)["permissions"].(map[string]any)
+		for _, key := range []string{"deny", "ask", "allow"} {
+			if value, ok := perms[key].([]any); !ok || len(value) != 0 {
+				t.Errorf("Expected %s to be an explicit empty array on resume, got %v", key, perms[key])
+			}
+		}
+	})
 }

java/src/test/java/com/github/copilot/ManagedSettingsTest.java

@@ -42,6 +42,37 @@ void rejectsUnsupportedBypassValue() {
         assertThrows(IllegalArgumentException.class, () -> permissions.setDisableBypassPermissionsMode("enable"));
     }
 
+    @Test
+    void preservesExplicitEmptyPermissionArrays() throws Exception {
+        // Security-critical: a present empty allow list admits nothing, while an
+        // absent (null) list imposes no such restriction. Jackson NON_NULL must
+        // emit an explicit empty array as `[]` and omit null fields, so the two
+        // remain distinguishable on the wire.
+        var permissions = new ManagedSettingsPermissions().setDeny(List.of()).setAsk(List.of()).setAllow(List.of());
+        var managedSettings = new ManagedSettings().setPermissions(permissions);
+        var create = SessionRequestBuilder.buildCreateRequest(new SessionConfig().setManagedSettings(managedSettings),
+                "managed-empty");
+
+        var json = new ObjectMapper().writeValueAsString(create);
+        assertEquals(true, json.contains("\"deny\":[]"), json);
+        assertEquals(true, json.contains("\"ask\":[]"), json);
+        assertEquals(true, json.contains("\"allow\":[]"), json);
+    }
+
+    @Test
+    void distinguishesExplicitEmptyAllowFromAbsentAllow() throws Exception {
+        // Present empty allow admits nothing; the null deny/ask must be omitted.
+        var permissions = new ManagedSettingsPermissions().setAllow(List.of());
+        var managedSettings = new ManagedSettings().setPermissions(permissions);
+        var create = SessionRequestBuilder.buildCreateRequest(new SessionConfig().setManagedSettings(managedSettings),
+                "managed-mixed");
+
+        var json = new ObjectMapper().writeValueAsString(create);
+        assertEquals(true, json.contains("\"allow\":[]"), json);
+        assertEquals(false, json.contains("\"deny\""), json);
+        assertEquals(false, json.contains("\"ask\""), json);
+    }
+
     @Test
     void directInjectionEnablesManagedSafeguards() throws Exception {
         var session = new CopilotSession("session-1", null);