[cherry-pick] [cherry-pick] Changes to include workspaceStorage directory for allowRead

build/lib/policies/policyData.jsonc

@@ -245,7 +245,7 @@
             "localization": {
                 "description": {
                     "key": "chat.agent.allowedNetworkDomains",
-                    "value": "Allowed domains for network access by agent tools (fetch tool, integrated browser). Applies when `#chat.agent.networkFilter#` or `#chat.agent.sandbox.enabled#` is enabled. When `#chat.agent.sandbox.enabled#` is enabled, this also configures terminal sandbox networking. Supports wildcards like `*.example.com`. When both allowed and denied lists are empty, all domains are blocked. Denied domains (see `#chat.agent.deniedNetworkDomains#`) take precedence."
+                    "value": "Allowed domains for network access by agent tools (fetch tool, integrated browser). Applies when `#chat.agent.networkFilter#` or `#chat.agent.sandbox.enabled#` is enabled. When `#chat.agent.sandbox.enabled#` is set to `allowNetwork`, all domains are allowed. Supports wildcards like `*.example.com`. When both allowed and denied lists are empty, all domains are blocked. Denied domains (see `#chat.agent.deniedNetworkDomains#`) take precedence."
                 }
             },
             "type": "array",
@@ -260,7 +260,7 @@
             "localization": {
                 "description": {
                     "key": "chat.agent.deniedNetworkDomains",
-                    "value": "Denied domains for network access by agent tools (fetch tool, integrated browser). Applies when `#chat.agent.networkFilter#` or `#chat.agent.sandbox.enabled#` is enabled. When `#chat.agent.sandbox.enabled#` is enabled, this also configures terminal sandbox networking. Takes precedence over `#chat.agent.allowedNetworkDomains#`. Supports wildcards like `*.example.com`."
+                    "value": "Denied domains for network access by agent tools (fetch tool, integrated browser). Applies when `#chat.agent.networkFilter#` or `#chat.agent.sandbox.enabled#` is enabled. This does not apply when `#chat.agent.sandbox.enabled#` is set to `allowNetwork`. Takes precedence over `#chat.agent.allowedNetworkDomains#`. Supports wildcards like `*.example.com`."
                 }
             },
             "type": "array",
@@ -333,7 +333,7 @@
                     },
                     {
                         "key": "agentSandbox.enabledSetting.allowNetworkDescription",
-                        "value": "Enable sandboxing for agent mode tools, but do not block commands based on configured network domains."
+                        "value": "Enable sandboxing for agent mode tools and allow all network domains."
                     }
                 ]
             },

build/lib/stylelint/vscode-known-variables.json

@@ -621,6 +621,7 @@
 		"--vscode-quickInput-list-focusBackground",
 		"--vscode-quickInputList-focusBackground",
 		"--vscode-quickInputList-focusForeground",
+		"--vscode-quickInputList-focusHighlightForeground",
 		"--vscode-quickInputList-focusIconForeground",
 		"--vscode-quickInputTitle-background",
 		"--vscode-radio-activeBackground",

extensions/copilot/package.json

@@ -3862,6 +3862,15 @@
 							"onExp"
 						]
 					},
+					"github.copilot.chat.claude47OpusPrompt.enabled": {
+						"type": "boolean",
+						"default": false,
+						"markdownDescription": "%github.copilot.config.claude47OpusPrompt.enabled%",
+						"tags": [
+							"experimental",
+							"onExp"
+						]
+					},
 					"github.copilot.chat.gpt54ConcisePrompt.enabled": {
 						"type": "boolean",
 						"default": false,
@@ -4668,7 +4677,7 @@
 					},
 					"github.copilot.chat.cli.autoModel.enabled": {
 						"type": "boolean",
-						"default": true,
+						"default": false,
 						"markdownDescription": "%github.copilot.config.cli.autoModel.enabled%",
 						"tags": [
 							"advanced"
@@ -4708,7 +4717,7 @@
 					},
 					"github.copilot.chat.cli.forkSessions.enabled": {
 						"type": "boolean",
-						"default": true,
+						"default": false,
 						"markdownDescription": "%github.copilot.config.cli.forkSessions.enabled%",
 						"tags": [
 							"advanced"
@@ -4733,7 +4742,7 @@
 					},
 					"github.copilot.chat.cli.sessionController.enabled": {
 						"type": "boolean",
-						"default": true,
+						"default": false,
 						"markdownDescription": "%github.copilot.config.cli.sessionController.enabled%",
 						"tags": [
 							"advanced"

extensions/copilot/package.nls.json

@@ -353,6 +353,7 @@
 	"github.copilot.config.responsesApi.promptCacheKey.enabled": "Enables prompt cache key being set for the Responses API.",
 	"github.copilot.config.responsesApi.toolSearchTool.enabled": "Enable tool search for OpenAI Responses API models. When enabled, tools are dynamically discovered and loaded on-demand using embeddings-based search, reducing context window usage when many tools are available.",
 	"github.copilot.config.updated53CodexPrompt.enabled": "Enables the updated prompt for gpt-5.3-codex model.",
+	"github.copilot.config.claude47OpusPrompt.enabled": "Enables the updated system prompt tuned for the Claude Opus 4.7 model.",
 	"github.copilot.config.gpt54ConcisePrompt.enabled": "Enables the concise prompt experiment for gpt-5.4 model.",
 	"github.copilot.config.gpt54LargePrompt.enabled": "Enables the large prompt experiment for gpt-5.4 model.",
 	"github.copilot.config.anthropic.tools.websearch.enabled": "Enable Anthropic's native web search tool for BYOK Claude models. When enabled, allows Claude to search the web for current information. \n\n**Note**: This is an experimental feature only available for BYOK Anthropic Claude models.",

extensions/copilot/src/extension/chatSessions/copilotcli/AGENTS.md

@@ -342,7 +342,7 @@ The integration respects these VS Code settings (all under `github.copilot.chat.
 | `planExitMode.enabled` | `true` | Show plan exit mode choices (Autopilot/Interactive/Exit) |
 | `planCommand.enabled` | `true` | Enable the `/plan` command |
 | `aiGenerateBranchNames.enabled` | `true` | AI-generated branch names for worktrees |
-| `forkSessions.enabled` | `true` | Allow forking sessions into new conversations |
+| `forkSessions.enabled` | `false` | Allow forking sessions into new conversations |
 | `isolationOption.enabled` | `true` | Show worktree isolation option in session UI |
 | `autoCommit.enabled` | `true` | Auto-commit worktree changes at end of each turn |
 | `sessionController.enabled` | `false` | Use session controller API (V2) |

extensions/copilot/src/extension/chatSessions/copilotcli/node/test/copilotCliModels.spec.ts

@@ -191,7 +191,9 @@ describe('CopilotCLIModels', () => {
 		});
 
 		it('resolves "auto" without querying SDK models', async () => {
-			const { models } = createModels({ hasSession: false });
+			const configService = new MockConfigurationService();
+			await configService.setConfig(ConfigKey.Advanced.CLIAutoModelEnabled, true);
+			const { models } = createModels({ hasSession: false, configService });
 
 			// Even without a session, 'auto' resolves to itself
 			expect(await models.resolveModel('auto')).toBe('auto');
@@ -366,7 +368,9 @@ describe('CopilotCLIModels', () => {
 		}
 
 		it('always includes auto model in results', async () => {
-			const { models } = createModels({ hasSession: true });
+			const configService = new MockConfigurationService();
+			await configService.setConfig(ConfigKey.Advanced.CLIAutoModelEnabled, true);
+			const { models } = createModels({ hasSession: true, configService });
 			const lm = createLmMock();
 			models.registerLanguageModelChatProvider(lm.mock as any);
 
@@ -380,7 +384,9 @@ describe('CopilotCLIModels', () => {
 		});
 
 		it('returns only auto when not authenticated', async () => {
-			const { models } = createModels({ hasSession: false });
+			const configService = new MockConfigurationService();
+			await configService.setConfig(ConfigKey.Advanced.CLIAutoModelEnabled, true);
+			const { models } = createModels({ hasSession: false, configService });
 			const lm = createLmMock();
 			models.registerLanguageModelChatProvider(lm.mock as any);
 
@@ -403,7 +409,9 @@ describe('CopilotCLIModels', () => {
 				getRequestId: vi.fn(() => undefined),
 			} as unknown as ICopilotCLISDK;
 
-			const { models } = createModels({ hasSession: true, sdk });
+			const configService = new MockConfigurationService();
+			await configService.setConfig(ConfigKey.Advanced.CLIAutoModelEnabled, true);
+			const { models } = createModels({ hasSession: true, sdk, configService });
 			const lm = createLmMock();
 			models.registerLanguageModelChatProvider(lm.mock as any);
 
@@ -430,7 +438,9 @@ describe('CopilotCLIModels', () => {
 		});
 
 		it('returns full model list with auto prepended after fetch completes', async () => {
-			const { models } = createModels({ hasSession: true });
+			const configService = new MockConfigurationService();
+			await configService.setConfig(ConfigKey.Advanced.CLIAutoModelEnabled, true);
+			const { models } = createModels({ hasSession: true, configService });
 			const lm = createLmMock();
 			models.registerLanguageModelChatProvider(lm.mock as any);
 
@@ -444,7 +454,9 @@ describe('CopilotCLIModels', () => {
 		});
 
 		it('resets to auto-only after auth change, then recovers', async () => {
-			const { models, auth } = createModels({ hasSession: true });
+			const configService = new MockConfigurationService();
+			await configService.setConfig(ConfigKey.Advanced.CLIAutoModelEnabled, true);
+			const { models, auth } = createModels({ hasSession: true, configService });
 			const lm = createLmMock();
 			models.registerLanguageModelChatProvider(lm.mock as any);
 
@@ -559,8 +571,10 @@ describe('CopilotCLIModels', () => {
 			expect(await models.resolveModel('auto')).toBeUndefined();
 		});
 
-		it('includes auto model when setting is enabled (default)', async () => {
-			const { models } = createModels({ hasSession: true });
+		it('includes auto model when setting is enabled', async () => {
+			const configService = new MockConfigurationService();
+			await configService.setConfig(ConfigKey.Advanced.CLIAutoModelEnabled, true);
+			const { models } = createModels({ hasSession: true, configService });
 			const lm = createLmMock();
 			models.registerLanguageModelChatProvider(lm.mock as any);