Map managed permission policies into Agent Host sessions - #328082
Draft
Josh Spicer (joshspicer) wants to merge 3 commits into
Draft
Map managed permission policies into Agent Host sessions#328082Josh Spicer (joshspicer) wants to merge 3 commits into
Josh Spicer (joshspicer) wants to merge 3 commits into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Maps enterprise permission policies into Copilot Agent Host session startup settings and restart detection.
Changes:
- Derives managed runtime permissions exclusively from policy values.
- Forwards permissions during session creation/resumption.
- Restarts sessions when managed permissions change and adds coverage.
Show a summary per file
| File | Description |
|---|---|
agentHostSchema.ts |
Defines managed permission schema and derivation. |
remoteAgentHostProtocolClient.ts |
Forwards policy-derived permissions. |
copilotAgent.ts |
Adds permissions to restart snapshots. |
copilotSessionLauncher.ts |
Passes permissions to the Copilot SDK. |
agentHostSchema.test.ts |
Tests derivation and validation. |
remoteAgentHostProtocolClient.test.ts |
Tests policy forwarding. |
copilotAgent.test.ts |
Tests restart detection. |
copilotSessionLauncher.test.ts |
Tests SDK configuration forwarding. |
Review details
- Files reviewed: 8/8 changed files
- Comments generated: 1
- Review effort level: Medium
| }); | ||
| this.dispatchAction(ROOT_STATE_URI, { | ||
| type: ActionType.RootConfigChanged, | ||
| config: { [AgentHostManagedPermissionsConfigKey]: permissions }, |
Josh Spicer (joshspicer)
force-pushed
the
joshspicer-managed-permissions-agent-host
branch
from
July 31, 2026 22:41
0eab96e to
df202b5
Compare
Contributor
|
Base:
|
Josh Spicer (joshspicer)
force-pushed
the
joshspicer-managed-permissions-agent-host
branch
2 times, most recently
from
August 4, 2026 16:24
c4c405b to
b8af535
Compare
Synthesize a client-agnostic managedSettings.permissions object from VS Code's legacy enterprise Copilot/agent policies and forward it through the Agent Host root config to the Copilot SDK at session create/resume. Derive exclusively from IConfigurationService.inspect(...).policyValue, using only rule boundaries the runtime supports: - managed chat.tools.global.autoApprove === false -> disableBypassPermissionsMode: 'disable' - managed chat.tools.terminal.enableAutoApprove === false -> ask: ['Shell(*)'] Per-tool eligibility (chat.tools.eligibleForAutoApproval) is intentionally not mapped: the runtime rejects generic Tool(...) rules, so there is no supported boundary to express it, and malformed/unknown rules reject session startup. Network/sandbox policies are out of scope. The derived snapshot participates in restart detection so a policy change refreshes the session before the next turn. The published @github/copilot-sdk (^1.0.8) does not yet expose managedSettings, so a precise additive local type mirrors the existing local-type precedent (ICopilotRuntimeManagedSettingsSdk) until the SDK publishes the field. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: c111c62a-eff3-4ff6-bb8a-8436a1b4babe
The `managedPermissions` root config key follows omit semantics: it is absent
when no restrictive enterprise policy applies. Its schema property carried a
`default: {}`, which is seeded into stored root config values by
`registerProviderConfiguration` and would let the launcher forward an empty
(and misleading) `managedSettings` even with no policy. Remove the default so
the key stays `undefined` and `managedSettings` is omitted entirely.
Also remove the stale `chat.tools.eligibleForAutoApproval` reference from the
`AgentHostManagedPermissionsConfigKey` doc comment (eligibility is no longer
synthesized after the runtime-contract correction).
Add a launcher test asserting neither create nor resume config carries
`managedSettings` when the root value is unset.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c111c62a-eff3-4ff6-bb8a-8436a1b4babe
Clear removed policy through the merge-based root config, restart peer chats on policy changes, and update rebased launcher tests. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d5d4d699-33e2-4a55-9d48-57d2e483dd3d
Josh Spicer (joshspicer)
force-pushed
the
joshspicer-managed-permissions-agent-host
branch
from
August 4, 2026 16:29
b8af535 to
71e9d23
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
VS Code has legacy enterprise policy values that arrive through its configuration policy system rather than the runtime's newer managed-settings delivery mechanisms. This maps the restrictive subset that has exact equivalents in the runtime's managed-permission grammar into the SDK startup contract.
Exact policy mapping
Only
IConfigurationService.inspect(...).policyValueis read. User, workspace, profile, and default values are never promoted to enterprise policy.chat.tools.global.autoApprovepolicy valuefalse→
disableBypassPermissionsMode: "disable"chat.tools.terminal.enableAutoApprovepolicy valuefalse→
ask: ["Shell(*)"]chat.tools.eligibleForAutoApprovalis intentionally not mapped because the runtime rejects genericTool(...)selectors. Network and sandbox policies are also out of scope because their semantics are not equivalent to generic permission rules.How it works
undefined; Agent Host normalizes the sentinel back to no policy.managedSettings: { permissions }on both create and resume, alongsideenableManagedSettings: trueso runtime self-fetch/device policy still composes.managedSettingsis omitted from the SDK configuration.Rollout blocker
The currently published
@github/copilot-sdk(1.0.9-preview.1) types and runtime do not transport/enforcemanagedSettings; the narrow local type only keeps this integration compileable. Keep this PR draft until:github/copilot-agent-runtime#14000is released;github/copilot-sdk#2139publishes a version bundling that runtime;@github/copilot-sdkin both package trees and removes the temporary type shim.Until that dependency bump, this PR must not merge because the published SDK would drop the field before RPC.
Testing
Full
typecheck-clientcurrently also reports unrelated errors from currentmainin native auth/component-fixture files; the Agent Host files changed here compile through the focused suites.