Copilot Repeatedly Asks For Too Much GitHub Access, Grant Does Nothing

[ConnerArdman]

Type: Bug

1. Use GitHub Copilot chat in Agent mode, it occasionally asks for access to GitHub "To get more relevant Copilot Chat results, we need permission to read the contents of your repository on GitHub."
2. Click "Grant"
3. GitHub.com opens, requesting access to all organizations I am a part of. I cannot give this, as I am using Copilot for personal projects and cannot give it access to all of these other organizations. All it should ask for is access to the repo it is working in. Click "cancel".
4. Return to VS Code using Copilot as normal.
5. Probably 10% of requests in Agent mode will again ask for GitHub access.
6. Click "Grant" again. Now it doesn't even open GitHub and Copilot just moves on. Did it give it access to something? Did it just give up? I'm not sure as the UI doesn't tell me, but it asks the same thing repeatedly with no clear path to give access only to the repo it is currently working in.

Prompt to grant access:

GitHub asking for access to more than the repo:

After cancelling, this is what happens on all future "grants" without ever opening GitHub:

CC: @hawkticehurst

VS Code version: Code 1.100.3 (Universal) (258e40f, 2025-06-02T13:30:54.273Z)
OS version: Darwin arm64 23.6.0
Modes:

System Info

Item	Value
CPUs	Apple M1 Max (10 x 2400)
GPU Status	2d_canvas: enabled canvas_oop_rasterization: enabled_on direct_rendering_display_compositor: disabled_off_ok gpu_compositing: enabled multiple_raster_threads: enabled_on opengl: enabled_on rasterization: enabled raw_draw: disabled_off_ok skia_graphite: disabled_off video_decode: enabled video_encode: enabled webgl: enabled webgl2: enabled webgpu: enabled webnn: disabled_off
Load (avg)	2, 2, 2
Memory (System)	64.00GB (13.14GB free)
Process Argv	--crash-reporter-id e1a55aaf-42ca-48bf-89e0-41c3eb648932
Screen Reader	no
VM	0%

Extensions (29)

Extension	Author (truncated)	Version
vscode-eslint	dba	3.0.10
prettier-vscode	esb	11.0.0
code-runner	for	0.12.2
copilot	Git	1.330.0
copilot-chat	Git	0.27.3
Kotlin	mat	1.7.1
csdevkit	ms-	1.20.35
csharp	ms-	2.80.16
vscode-dotnet-runtime	ms-	2.3.5
debugpy	ms-	2025.8.0
isort	ms-	2025.0.0
python	ms-	2025.6.1
vscode-pylance	ms-	2025.5.1
remote-ssh	ms-	0.120.0
remote-ssh-edit	ms-	0.87.0
remote-explorer	ms-	0.5.0
vscode-typescript-next	ms-	5.9.20250605
java	red	1.42.0
LiveServer	rit	5.7.9
code-spell-checker	str	4.0.47
intellicode-api-usage-examples	Vis	0.2.9
vscodeintellicode	Vis	1.3.2
vstuc	vis	1.1.2
vscode-gradle	vsc	3.16.4
vscode-java-debug	vsc	0.58.2
vscode-java-dependency	vsc	0.24.1
vscode-java-pack	vsc	0.29.2
vscode-java-test	vsc	0.43.1
vscode-maven	vsc	0.44.0

A/B Experiments

vsliv368cf:30146710
vspor879:30202332
vspor708:30202333
vspor363:30204092
pythonvspyt551cf:31249601
vscod805:30301674
binariesv615:30325510
14424-chatv2:31321273
c4g48928:30535728
azure-dev_surveyone:30548225
962ge761:30959799
h48ei257:31000450
pythontbext0:30879054
cppperfnew:31000557
dwnewjupyter:31046869
pythonrstrctxt:31112756
nativeloc2:31192216
5fd0e150:31155592
dwcopilot:31170013
6074i472:31201624
dwoutputs:31242946
customenabled:31248079
hdaa2157:31222309
copilot_t_ci:31222730
e5gg6876:31282496
pythoneinst12:31285622
bgtreat:31268568
4gafe986:31271826
c7cif404:31314491
996jf627:31283433
pythonrdcb7cf:31303019
usemplatestapi:31297334
0aa6g176:31307128
7bj51361:31289155
747dc170:31275177
pylancecolor:31314202
aj953862:31281341
generatesymbolt:31295002
convertfstringf:31295003
gendocf:31295004
pylancequickfixt:31319676

[TylerLeonhardt]

The permission request should only be showing up once per session... feels like a bug.

do you have any clear repro steps where you would see this permission request a second time in the same window?

[ConnerArdman]

I tend to click "new chat" a lot, so if that resets the ability for Copilot to ask for access, that might be why I am seeing it so often. I'm not closing the window, but not sure what y'all consider to be a single session.

That said, the bigger bugs to me are:

1. Copilot says it needs access to read the repo, but the permissions it asks for are far more than that.
2. After clicking cancel on the GitHub website, all future instances of "grant" do nothing.

[TylerLeonhardt]

I tend to click "new chat" a lot, so if that resets the ability for Copilot to ask for access, that might be why I am seeing it so often

"Per session" is per window. So new chat shouldn't change anything.

Copilot says it needs access to read the repo, but the permissions it asks for are far more than that.

GitHub OAuth apps don't have any finer granularity so we can't do anything about this. It's repo all or nothing.

After clicking cancel on the GitHub website, all future instances of "grant" do nothing

This is because you shouldn't have seen the option to "grant" at all. Regardless of your choice at this prompt, you made the choice to "not grant" already and that decision is persisted for the session (window). That's why those subsequent questions do nothing. It is a UI bug that you see them at all.

So knowing concrete steps of when you see this is critical to making sure this UI is not shown.

[ConnerArdman]

So knowing concrete steps of when you see this is critical to making sure this UI is not shown.

I think this is as concrete as I can get, hope that's helpful to repro it:

1. Use copilot in a repo you have never used it in, in a vscode instance where you have never granted copilot GitHub access
2. At some point in normal usage, copilot will ask for GitHub permissions (I'm not entirely sure what triggers this to begin with?)
3. Click Grant
4. When the GitHub website auth page opens, click cancel on the website
5. Return to VSCode, continuing without the GitHub access
6. Continue to use copilot, eventually it will ask for access again (and this is the point where grant has no effect)

The only other context I can think of that might be relevant is I am using Agent mode with Claude 3.7 Sonnet.