@@ -133,6 +133,33 @@ The incoming path and query are appended to the gateway base URL: with
 `llmGateway.proxyUrl: https://gateway.example/prefix` (or `url`, when `proxyUrl`
 is unset), `/v1/messages` goes to `https://gateway.example/prefix/v1/messages`.
 Avoid repeating `/v1` in both URLs.
+
+**Without the proxy.** When the daemon runs without its loopback proxy
+(`daemon.llmProxy.listen` unset, or the address could not be bound),
+`llmGateway.whenProxyUnavailable` decides what happens to the files of the
+programs that use the proxy (`programs.copilot`, `programs.vscode`). With
+`failClosed`, the default, the daemon leaves their managed entries as they
+are: the Copilot CLI and VS Code stay pointed at the loopback port, and those
+requests fail instead of reaching GitHub past the gateway. If the address could
+not be bound because another process holds it, that process receives those
+requests, with VS Code's Copilot tokens and the pairing value: use the default
+on devices with a single user, as for the proxy in general. With
+`failOpen`, the daemon removes the entries until the proxy is back: VS Code on
+GitHub's models then talks to GitHub directly, and the Copilot CLI and VS Code
+on own models lose the gateway's models. Either way the programs report
+`inactive` with the reason, and the next apply with the proxy writes the
+current entries. A stopped daemon changes no file, so the tools fail until it
+runs again, whatever the policy. The policy covers only the files the daemon
+writes: whether developers can reach GitHub's models without the gateway is
+set by the organisation's Copilot policy and egress rules. Set the key only
+after the controller and the daemons run a version that knows it; older ones
+reject a configuration that carries it.
+
+```yaml
+llmGateway:
+  url: https://gateway.example.com
+  whenProxyUnavailable: failOpen   # default failClosed
+```
 The proxy does not discover models or rewrite model IDs; configure those in the
 client. VS Code's built-in **Custom Endpoint** provider can use this endpoint
 without the experimental extension in `vscode/`. The provider reads
@@ -269,6 +296,14 @@ device authorization again. Non-expiring App user tokens are also supported.
 Request bodies remain untouched. The existing Claude credential-helper flow is
 unchanged; the local proxy always uses the gateway identity in `Authorization`.
 
+### GitHub Copilot: a runnable example
+
+[`examples/copilot`](examples/copilot/README.md) runs Dex and Agentgateway
+locally and walks through the Copilot CLI, VS Code on the gateway's models and
+VS Code on GitHub's models, with what to check at each step (drift,
+conflicts, removal) and the settings the GitHub organisation owner controls
+([`examples/copilot/github-side.md`](examples/copilot/github-side.md)).
+
 ### Managed program: GitHub Copilot CLI
 
 `programs.copilot` makes the daemon write the Copilot CLI's BYOK provider
@@ -312,8 +347,9 @@ daemon's sidecar next to the file is gone, entries under the managed names
 that carry a pairing header are replaced on the next apply, and those that
 carry this daemon's own pairing value are removed when the program goes
 away; entries with another pairing value are left alone. The file is written owner-only. Removing
-`programs.copilot`, setting `useLlmGateway: false`, or running without the
-proxy takes the managed entries out again and restores the user's file with
+`programs.copilot` or setting `useLlmGateway: false` takes the managed
+entries out again (running without the proxy depends on
+`llmGateway.whenProxyUnavailable`, see **Without the proxy**) and restores the user's file with
 its previous mode (deleted only if the daemon created it and nothing else is
 left).
 
@@ -482,11 +518,14 @@ single-quoted string; the top level is not an object;
 leaves the file untouched and blocks every managed file on the device until it
 is resolved (and stops the daemon at startup); fix the file in VS Code and
 re-apply (with `daemon.reconcileInterval` set, the next tick applies it). Removal (program
-absent, `ownModels`, `useLlmGateway: false`, no gateway, no `proxyUrl`, or no
-proxy, with a warning) takes the key and the two entries out and deletes the
-file only if the daemon created it. Restart VS Code after an apply that changes
+absent, `ownModels`, `useLlmGateway: false`, no gateway, or no `proxyUrl`)
+takes the key and the two entries out and deletes the file only if the daemon
+created it. Without the proxy, `llmGateway.whenProxyUnavailable` decides (see
+**Without the proxy** above): the default keeps the override, so Copilot Chat
+fails instead of reaching GitHub directly. Restart VS Code after an apply that changes
 the file (first apply, re-pairing after a re-enrollment). There is no
-`--dry-run` preview: a dry run has no proxy and plans a removal; `--once`
+`--dry-run` preview: a dry run has no proxy, so it lists nothing for this file
+under `failClosed` and the removal under `failOpen`; `--once`
 refuses the program.
 
 Caveats. `github.copilot.advanced.debug.overrideCapiUrl` is an undocumented
@@ -614,7 +653,7 @@ device-wide state. The device page in the controller lists them under
 | `unchanged` | The program is configured and nothing needed to change. |
 | `removed` | The program is no longer configured and its managed content was removed. |
 | `conflict` | A managed file holds configuration the daemon will not overwrite; the detail names the file. |
-| `inactive` | The program uses the LLM gateway but the local LLM proxy is not running (see `llmProxy.error` in daemon-info), so its files point nowhere and were removed. |
+| `inactive` | The program uses the LLM gateway but the local LLM proxy is not running (see `llmProxy.error` in daemon-info): its entries were left pointing at the loopback port (`whenProxyUnavailable: failClosed`, the default) or removed (`failOpen`). |
 | `blocked` | The program had changes, but none were written because another program conflicted or failed; the detail names that program. |
 | `failed` | Planning or writing this program failed; the detail carries the error. |
 
 
@@ -103,14 +103,21 @@ pub(super) fn plan(
 ) -> anyhow::Result<()> {
     let state_path = json_merge::state_path(path);
     let pairing = proxy.map(|(_, pairing)| pairing);
-    let Some((config, Some(_gateway))) = configured else {
+    let Some((config, Some(gateway))) = configured else {
         remove(path, &state_path, pairing, plan)?;
         return Ok(());
     };
     let Some((listen, pairing)) = proxy else {
+        if crate::reconcile::fail_closed_without_proxy(gateway, plan) {
+            tracing::debug!(
+                path = %path.display(),
+                "programs.copilot is configured but the local LLM proxy is not available; whenProxyUnavailable: failClosed, so the managed Copilot CLI providers are left as they are"
+            );
+            return Ok(());
+        }
         tracing::debug!(
             path = %path.display(),
-            "programs.copilot is configured but the local LLM proxy is not available, so the Copilot CLI is not pointed at the gateway; the reason is llmProxy.error in daemon-info (or daemon.llmProxy.listen is unset); removing the managed Copilot CLI providers"
+            "programs.copilot is configured but the local LLM proxy is not available, so the Copilot CLI is not pointed at the gateway; the reason is llmProxy.error in daemon-info (or daemon.llmProxy.listen is unset); whenProxyUnavailable: failOpen, removing the managed Copilot CLI providers"
         );
         plan.inactive(crate::reconcile::PROXY_ABSENT_REASON);
         remove(path, &state_path, None, plan)?;
 
@@ -7,7 +7,9 @@ use std::{
     net::SocketAddr,
 };
 
-use agentdesktop_core::config::{CopilotConfig, CopilotModel, CopilotProvider, LlmGatewayConfig};
+use agentdesktop_core::config::{
+    CopilotConfig, CopilotModel, CopilotProvider, LlmGatewayConfig, ProxyUnavailable,
+};
 use serde_json::{Value, json};
 
 use super::discovery;
@@ -49,6 +51,7 @@ fn sample_gateway() -> LlmGatewayConfig {
         authentication: None,
         proxy_url: None,
         github_oauth: None,
+        when_proxy_unavailable: Default::default(),
     }
 }
 
@@ -575,11 +578,12 @@ fn removal_when_use_llm_gateway_is_effectively_false() {
 }
 
 #[test]
-fn removal_when_the_loopback_proxy_is_unavailable() {
+fn fail_open_removes_the_entries_when_the_loopback_proxy_is_unavailable() {
     let dir = tempfile::tempdir().unwrap();
     let path = dir.path().join("providers.json");
     let config = sample_config();
-    let gateway = sample_gateway();
+    let mut gateway = sample_gateway();
+    gateway.when_proxy_unavailable = ProxyUnavailable::FailOpen;
 
     let changes = ReconcilePlan::default();
     plan(
@@ -603,6 +607,50 @@ fn removal_when_the_loopback_proxy_is_unavailable() {
     );
 }
 
+#[test]
+fn fail_closed_keeps_the_entries_when_the_loopback_proxy_is_unavailable() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("providers.json");
+    let config = sample_config();
+    let gateway = sample_gateway();
+    assert_eq!(
+        gateway.when_proxy_unavailable,
+        ProxyUnavailable::FailClosed,
+        "the default"
+    );
+    let changes = ReconcilePlan::default();
+    plan(
+        &path,
+        Some((listen_addr(), PAIRING)),
+        Some((&config, Some(&gateway))),
+        &changes,
+    )
+    .unwrap();
+    changes.apply().unwrap();
+    let state = super::super::json_merge::state_path(&path);
+    let (before, state_before) = (fs::read(&path).unwrap(), fs::read(&state).unwrap());
+
+    let changes = ReconcilePlan::default();
+    plan(&path, None, Some((&config, Some(&gateway))), &changes).unwrap();
+    assert_eq!(
+        changes.inactive_reason().as_deref(),
+        Some(crate::reconcile::FAIL_CLOSED_REASON)
+    );
+    changes.apply().unwrap();
+    assert_eq!(
+        fs::read(&path).unwrap(),
+        before,
+        "the providers stay, pointed at the loopback port"
+    );
+    assert_eq!(fs::read(&state).unwrap(), state_before);
+
+    // Removing the program still removes, whatever the policy.
+    let changes = ReconcilePlan::default();
+    plan(&path, None, None, &changes).unwrap();
+    changes.apply().unwrap();
+    assert!(!path.exists());
+}
+
 // --- plan(): conflicts ------------------------------------------------------
 
 #[test]
 
@@ -98,14 +98,21 @@ pub(super) fn plan(
 ) -> anyhow::Result<()> {
     let state_path = json_merge::state_path(path);
     let pairing = proxy.map(|(_, pairing)| pairing);
-    let Some((config, Some(_gateway))) = configured else {
+    let Some((config, Some(gateway))) = configured else {
         remove(path, &state_path, pairing, plan)?;
         return Ok(());
     };
     let Some((listen, pairing)) = proxy else {
+        if crate::reconcile::fail_closed_without_proxy(gateway, plan) {
+            tracing::debug!(
+                path = %path.display(),
+                "programs.vscode is configured but the local LLM proxy is not available; whenProxyUnavailable: failClosed, so the managed chat language models are left as they are"
+            );
+            return Ok(());
+        }
         tracing::debug!(
             path = %path.display(),
-            "programs.vscode is configured but the local LLM proxy is not available, so VS Code is not pointed at the gateway; the reason is llmProxy.error in daemon-info (or daemon.llmProxy.listen is unset); removing the managed chat language models"
+            "programs.vscode is configured but the local LLM proxy is not available, so VS Code is not pointed at the gateway; the reason is llmProxy.error in daemon-info (or daemon.llmProxy.listen is unset); whenProxyUnavailable: failOpen, removing the managed chat language models"
         );
         plan.inactive(crate::reconcile::PROXY_ABSENT_REASON);
         remove(path, &state_path, None, plan)?;
 
@@ -489,8 +489,11 @@ pub(super) fn read_state(bytes: &[u8]) -> Option<SettingsState> {
 ///
 /// Edits only when the program is set with `copilotChat: githubModels`,
 /// uses the gateway, the gateway has `proxyUrl` and the loopback proxy is
-/// available; removes the managed keys otherwise (with a warning when the
-/// proxy is the missing part), the same decision shape as `reconcile::plan`.
+/// available; removes the managed keys otherwise, the same decision shape as
+/// `reconcile::plan`. The one exception is the proxy being the missing part:
+/// then `llmGateway.whenProxyUnavailable` decides, and `failClosed` (the default) leaves
+/// the file as it is, so VS Code stays pointed at the loopback port
+/// instead of reaching GitHub past the gateway.
 pub(super) fn plan(
     path: &Path,
     proxy: Option<(SocketAddr, &str)>,
@@ -507,9 +510,18 @@ pub(super) fn plan(
         return remove(path, &state_path, proxy, plan);
     }
     let Some((listen, pairing)) = proxy else {
+        if let Some((_, Some(gateway))) = configured
+            && crate::reconcile::fail_closed_without_proxy(gateway, plan)
+        {
+            debug!(
+                path = %path.display(),
+                "programs.vscode uses copilotChat: githubModels but the local LLM proxy is not available; whenProxyUnavailable: failClosed, so the settings are left as they are"
+            );
+            return Ok(());
+        }
         tracing::debug!(
             path = %path.display(),
-            "programs.vscode uses copilotChat: githubModels but the local LLM proxy is not available, so VS Code is not pointed at the gateway; the reason is llmProxy.error in daemon-info (or daemon.llmProxy.listen is unset); removing the managed settings"
+            "programs.vscode uses copilotChat: githubModels but the local LLM proxy is not available, so VS Code is not pointed at the gateway; the reason is llmProxy.error in daemon-info (or daemon.llmProxy.listen is unset); whenProxyUnavailable: failOpen, removing the managed settings"
         );
         plan.inactive(crate::reconcile::PROXY_ABSENT_REASON);
         return remove(path, &state_path, None, plan);
 
@@ -7,14 +7,17 @@
 
 use std::{collections::BTreeMap, fs, net::SocketAddr, path::PathBuf};
 
-use agentdesktop_core::config::{LlmGatewayConfig, VsCodeConfig, VsCodeCopilotChat, VsCodeModel};
+use agentdesktop_core::config::{
+    LlmGatewayConfig, ProxyUnavailable, VsCodeConfig, VsCodeCopilotChat, VsCodeModel,
+};
 use jsonc_parser::{ParseOptions, cst::CstRootNode};
 use serde_json::{Value, json};
 
 use super::settings::{
     Removal, SETTINGS_STATE_VERSION, SettingsConflict, SettingsState, edit_settings, plan,
     read_state, remove_settings, settings_path,
 };
+use crate::provider::json_merge;
 use crate::reconcile::ReconcilePlan;
 
 /// The two keys the daemon owns in `settings.json`.
@@ -57,6 +60,7 @@ fn gateway_with_proxy() -> LlmGatewayConfig {
         authentication: None,
         proxy_url: Some("https://gateway.example.com/copilot-proxy".parse().unwrap()),
         github_oauth: None,
+        when_proxy_unavailable: Default::default(),
     }
 }
 
@@ -365,12 +369,13 @@ fn removal_no_proxy_url_keeps_user_keys() {
 }
 
 #[test]
-fn removal_no_proxy_available_keeps_user_keys_with_a_warning() {
+fn fail_open_removal_no_proxy_available_keeps_user_keys() {
     let dir = tempfile::tempdir().unwrap();
     let path = dir.path().join("settings.json");
     write_user_settings(&path, &json!({"editor.fontSize": 14}));
     let config = github_models_config();
-    let gateway = gateway_with_proxy();
+    let mut gateway = gateway_with_proxy();
+    gateway.when_proxy_unavailable = ProxyUnavailable::FailOpen;
     apply_managed(&path, listen_addr(), PAIRING, &config, &gateway);
 
     // `ctx.llm_proxy` is `None` (bind failed, proxy off) even though the
@@ -384,6 +389,82 @@ fn removal_no_proxy_available_keeps_user_keys_with_a_warning() {
     assert!(after.get(OVERRIDE_KEY).is_none(), "{after}");
 }
 
+#[test]
+fn fail_closed_leaves_the_file_and_sidecar_until_the_proxy_is_back() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("settings.json");
+    write_user_settings(&path, &json!({"editor.fontSize": 14}));
+    let config = github_models_config();
+    let gateway = gateway_with_proxy();
+    apply_managed(&path, listen_addr(), PAIRING, &config, &gateway);
+    let state = json_merge::state_path(&path);
+    let (before, state_before) = (fs::read(&path).unwrap(), fs::read(&state).unwrap());
+
+    let changes = apply_removal(&path, None, Some((&config, Some(&gateway))));
+    assert_eq!(
+        changes.inactive_reason().as_deref(),
+        Some(crate::reconcile::FAIL_CLOSED_REASON)
+    );
+    changes.apply().unwrap();
+    assert_eq!(
+        fs::read(&path).unwrap(),
+        before,
+        "the override stays, pointed at the loopback port"
+    );
+    assert_eq!(fs::read(&state).unwrap(), state_before);
+
+    // The proxy back, on another port: the current URL is written.
+    let other: SocketAddr = "127.0.0.1:18199".parse().unwrap();
+    apply_managed(&path, other, PAIRING, &config, &gateway);
+    assert_eq!(read(&path)[OVERRIDE_KEY], override_url(other, PAIRING));
+
+    // Removing the program still removes, whatever the policy.
+    apply_removal(&path, None, None).apply().unwrap();
+    let after = read(&path);
+    assert!(after.get(OVERRIDE_KEY).is_none(), "{after}");
+    assert_eq!(after["editor.fontSize"], 14);
+}
+
+#[test]
+fn fail_closed_does_not_create_a_file_without_the_proxy() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("settings.json");
+    let changes = apply_removal(
+        &path,
+        None,
+        Some((&github_models_config(), Some(&gateway_with_proxy()))),
+    );
+    changes.apply().unwrap();
+    assert!(!path.exists());
+}
+
+#[test]
+fn when_proxy_unavailable_defaults_to_fail_closed_and_parses_fail_open() {
+    let parse = |extra: Value| {
+        let mut document = json!({"url": "https://gateway.example.com"});
+        document
+            .as_object_mut()
+            .unwrap()
+            .extend(extra.as_object().unwrap().clone());
+        serde_json::from_value::<LlmGatewayConfig>(document)
+    };
+    let default = parse(json!({})).unwrap();
+    assert_eq!(default.when_proxy_unavailable, ProxyUnavailable::FailClosed);
+    assert!(
+        serde_json::to_value(&default)
+            .unwrap()
+            .get("whenProxyUnavailable")
+            .is_none()
+    );
+    assert_eq!(
+        parse(json!({"whenProxyUnavailable": "failOpen"}))
+            .unwrap()
+            .when_proxy_unavailable,
+        ProxyUnavailable::FailOpen
+    );
+    assert!(parse(json!({"whenProxyUnavailable": "failSoft"})).is_err());
+}
+
 #[test]
 fn removal_of_a_created_and_emptied_file_deletes_it() {
     let dir = tempfile::tempdir().unwrap();