Conversation
Adds Terminal, Files and Network permission sections to the Chat Customizations editor, behind the off-by-default `chat.customizations.permissions.enabled` setting, so users can see which rules govern an agent. The Copilot runtime is the source of truth for permissions: it owns the rule DSL, the matcher, and the precedence between managed policy, configured rules, location grants and session grants. Nothing here recomputes any of that -- the rule syntax helper only splits `Kind(argument)` for display, and domains exist only for the four rule families the runtime actually accepts. The runtime exposes no read API for its resolved rule set yet, so the snapshot reports only the managed scope and names the layers it could not read. An empty list would claim "nothing governs this agent", which is the opposite of the truth under `failClosed`. Tracked upstream in github/copilot-sdk-internal#244. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Upstream added `ManagedRuleFamily` for the rules VS Code sends. Note the relationship from the read-side parser, including why it accepts the `Bash`/`PowerShell`/`Edit` aliases the builder never emits, so the two family sets do not drift. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…nguage The permission sections were visibly foreign next to the customization sections: an inline icon+title+filter strip, no panel chrome, uppercase scope labels, and the description stranded in a bottom footer. Reuse the existing chrome instead of approximating it. The sections now join the shared selector lists for the content panel, the section title header (title, description, inline learn-more) and the search row, and render scope groups with the same collapsible `ai-customization-group-header` markup, so consistency holds by construction rather than by copied values. What stays different is what a row means: a permission rule is a read-only statement of what the runtime enforces, not something authored here, so there is no create button, uneditable rows carry a lock, and each row ends in an allow/ask/deny pill. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ssions sections
Addresses PR review findings:
- Disabling the agent host mid-probe left the in-flight generation valid,
so a late result could overwrite the disabled state. Bump the generation
on the transition.
- Provider failures arrive in-band as `{ error }` rather than thrown, and
were being skipped. A timeout then looked like "not supported", and a
mixed result could present one provider's rules as the whole policy.
Failures are now carried on the snapshot and shown as a warning, and an
all-failed probe reports an error instead of a capability gap.
- Selecting a permission section focused the hidden prompts search box.
Route contributed sections through their own `focus()` via one shared
helper used by both the selection path and the editor's `focus()`.
- An empty group while filtering said "No rules", implying no policy
exists. Say "No matching rules" when a filter is active.
- The snapshot only refreshed on construction or enablement change, so the
view could not recover from a stale read. Add a Refresh action in the
slot the customization sections use for their primary action, and
re-read when a section is opened unless a probe is already running.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Writing the fixture surfaced that the panel chrome was scoped to the
management editor, so the widget could not render standalone. Scope it to
`.chat-permissions-section` instead — the class belongs to the widget, so
it now carries its own chrome while staying in the shared rule.
Visual fixes found by looking at it:
- Drop the group-header icon. The shared header hides `.group-icon`, so it
was dead DOM; the scope icon now appears in the override badge instead,
where it explains which layer won.
- Dim the effect pill on an overridden rule. Its verdict does not apply, so
showing it at full strength misrepresented it.
- Replace the bare status line with the customization sections' centered
empty state, keeping the honest detail ("Rules may still be enforced").
Four fixtures cover managed-only, all scopes with a shadowed rule, partial
provider failure, and unavailable — each in Dark and Light.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Expands the fixtures from 4 to 13 (26 with themes) so every state the
widget can render has a screenshot baseline, and labels them
`kind: 'screenshot'` so CI treats them as such.
Adds coverage for: all three domains (Files exercises every path anchor,
Network its own argument shape), a family-wide rule, long arguments that
must ellipsize, a filtered view with no matches, fail-closed, loading,
error, and all three unavailable reasons. Fixtures build on the real
domain definitions rather than copies, so a label or docs-link change is
reflected instead of drifting.
Two problems the fixtures exposed, fixed here:
- A family-wide rule rendered as a bare kind and looked truncated. Domains
now supply an `allRequestsLabel` ("All commands"), shown in its place.
- `splitPermissionPathArgument` was unused while the UI showed the raw
anchors, so `//etc` versus `/src` was unexplained. Domains can now
contribute `describeArgument`, used for the row tooltip and — more
importantly — the accessible name, so a screen reader hears "in the
workspace" rather than a leading slash.
Rendering a filtered view needed the filter to be set at construction, so
the widget takes an optional `initialFilter`.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…e agent is asked VS Code receives the same admin-authored managed-settings documents the agent does, through the server and file channels, and retains them raw — `IDefaultAccountService.managedSettingsRawResponse` and `IFileManagedSettingsService.rawManagedSettings`. The Permissions sections therefore no longer have to sit blank for seconds waiting on the diagnostics probe. The agent stays authoritative: it runs its own resolution, composes layers this client cannot see, and applies fail-closed. The local read is a labelled stand-in that is always superseded, and if the probe fails the stand-in is kept but marked unconfirmed rather than collapsing to a bare error — the admin-authored policy is still the best available description of what governs the user. Two things this must not become: - It never merges channels. VS Code resolves managed settings by per-key precedence, but the agent composes `deny`/`ask` as a union and `allow` as an intersection; applying VS Code's precedence would show only the winning channel and under-report the restrictions in force. Channels are read independently and concatenated, and two declared allow lists set `allowIntersected` rather than being flattened. - It omits native MDM. That watcher only reports keys a configuration policy declares, and `permissions.*` is runtime-owned with no VS Code setting behind it; declaring one purely to read it is what the managed-settings guidance warns against. The agent's answer covers it. Extraction is shared with the probe path, so both produce identical rows. Also registers `NullFileManagedSettingsService` in web so the service is injectable everywhere, mirroring the existing native MDM registration. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* sessions: clarify remote chat target Show the selected remote host for workspace-less chats and align workspace picker submenu affordances with the row edge.\n\nFixes microsoft#336544\nFixes microsoft#336582\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * sessions: align workspace picker submenu indicator Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * git: ignore deleted cached repository paths Validate the repository path when callers request it from git.clone so a surviving workspace cache entry cannot resurrect a deleted clone.\n\nFixes microsoft#335672\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* automations: add Ben to CodeNotify Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * signing commit --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Clear ambient proxy variables for every CopilotAgent test and restore the original environment after each test so 1ES Network Isolation cannot bypass the mocked proxy resolver. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…r-neutral (microsoft#337111) Co-authored-by: vs-code-engineering[bot] <vs-code-engineering[bot]@users.noreply.github.com>
Make each segmented Voice Mode control configure the command it currently invokes, including start/disconnect, listen, and mute actions. Add regression coverage for the state-aware mappings.\n\nFixes microsoft#337067\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* network: normalize Unicode wildcard domain patterns Normalize wildcard suffixes with the URL-aware authority helper before validating the pattern. Add matching, policy, and fetch-tool regression coverage while preserving existing domain handling. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * network: normalize sandbox domains and IDN URL approvals Canonicalize sandbox domain policies and preflight URL hosts, rejecting patterns that cannot be normalized. Match equivalent Unicode and Punycode literal host labels in URL trust and approval rules while preserving existing glob semantics. Partial Unicode wildcard labels remain outside this change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * url: align trust checks with effective HTTP destinations Normalize authority separators and resolved paths consistently across trusted domains, URL approval rules, and web-page fetching. Preserve hostname case semantics, escaped path data, and actual request destinations, with regression coverage for approvals, exclusions, and declined tool calls. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * sandbox: warn and deny network for invalid domain patterns Keep shell-tool registration and offline sandboxed commands available when domain patterns cannot be normalized. Log a warning and use a deny-all policy instead of throwing, with regression coverage for both lists and recovery after settings are corrected. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * url: bound glob matching and preserve effective URL semantics Replace the eager recursive matcher with iterative deduplicated states to avoid Unicode path allocation spikes and stack growth. Normalize configured patterns consistently, preserve effective authority and path semantics, and retain HTTP path case without changing non-HTTP drive normalization. Add regression coverage for the PR feedback and verify real Code OSS trust, approval, fetch, and sandbox workflows. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* agentHost: stabilize concurrent subagent replay Match opted-in concurrent parent and child model requests by their normalized projections, and canonicalize only cross-channel completion interleaving in the affected AHP snapshot. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: preserve per-chat snapshot order Canonicalize the complete action sequence for each participating chat so cross-channel normalization cannot move a completion ahead of an earlier response. Extend the regression test with interleaved response actions. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Make subagent model guidance the default Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Update Copilot system message expectation Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…icrosoft#336828) Agent Host changes for agents/customization-migration-revert-fix
* Agents - remember isolation per workspace * Pull request feedback
Keep Remote actions visible by limiting the unified workspace picker to ten recent workspaces. Add regression coverage for the cap.\n\nFixes microsoft#337129\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ft#337080) * test: clean up Windows agent-host descendants after shutdown Record the test server's descendants before graceful shutdown and await cleanup of survivors before removing temporary directories. Keep product provider shutdown and timeout budgets unchanged. Add a Windows regression proving that a clean parent exit does not imply descendant exit. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: bound descendant snapshots by the shutdown deadline Share the existing shutdown budget between descendant enumeration and graceful exit. Preserve EOF and forced cleanup when enumeration stalls, report the timeout afterward, and cover that path with a real-process regression. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
homecoc
added this pull request to stack #5
September 21, 2026 20:51
* sessions: clarify remote chat target Show the selected remote host for workspace-less chats and align workspace picker submenu affordances with the row edge.\n\nFixes microsoft#336544\nFixes microsoft#336582\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * sessions: align workspace picker submenu indicator Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * git: ignore deleted cached repository paths Validate the repository path when callers request it from git.clone so a surviving workspace cache entry cannot resurrect a deleted clone.\n\nFixes microsoft#335672\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* automations: add Ben to CodeNotify Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * signing commit --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Clear ambient proxy variables for every CopilotAgent test and restore the original environment after each test so 1ES Network Isolation cannot bypass the mocked proxy resolver. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…r-neutral (microsoft#337111) Co-authored-by: vs-code-engineering[bot] <vs-code-engineering[bot]@users.noreply.github.com>
Make each segmented Voice Mode control configure the command it currently invokes, including start/disconnect, listen, and mute actions. Add regression coverage for the state-aware mappings.\n\nFixes microsoft#337067\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* network: normalize Unicode wildcard domain patterns Normalize wildcard suffixes with the URL-aware authority helper before validating the pattern. Add matching, policy, and fetch-tool regression coverage while preserving existing domain handling. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * network: normalize sandbox domains and IDN URL approvals Canonicalize sandbox domain policies and preflight URL hosts, rejecting patterns that cannot be normalized. Match equivalent Unicode and Punycode literal host labels in URL trust and approval rules while preserving existing glob semantics. Partial Unicode wildcard labels remain outside this change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * url: align trust checks with effective HTTP destinations Normalize authority separators and resolved paths consistently across trusted domains, URL approval rules, and web-page fetching. Preserve hostname case semantics, escaped path data, and actual request destinations, with regression coverage for approvals, exclusions, and declined tool calls. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * sandbox: warn and deny network for invalid domain patterns Keep shell-tool registration and offline sandboxed commands available when domain patterns cannot be normalized. Log a warning and use a deny-all policy instead of throwing, with regression coverage for both lists and recovery after settings are corrected. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * url: bound glob matching and preserve effective URL semantics Replace the eager recursive matcher with iterative deduplicated states to avoid Unicode path allocation spikes and stack growth. Normalize configured patterns consistently, preserve effective authority and path semantics, and retain HTTP path case without changing non-HTTP drive normalization. Add regression coverage for the PR feedback and verify real Code OSS trust, approval, fetch, and sandbox workflows. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* agentHost: stabilize concurrent subagent replay Match opted-in concurrent parent and child model requests by their normalized projections, and canonicalize only cross-channel completion interleaving in the affected AHP snapshot. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * agentHost: preserve per-chat snapshot order Canonicalize the complete action sequence for each participating chat so cross-channel normalization cannot move a completion ahead of an earlier response. Extend the regression test with interleaved response actions. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Make subagent model guidance the default Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Update Copilot system message expectation Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…icrosoft#336828) Agent Host changes for agents/customization-migration-revert-fix
* Agents - remember isolation per workspace * Pull request feedback
Keep Remote actions visible by limiting the unified workspace picker to ten recent workspaces. Add regression coverage for the cap.\n\nFixes microsoft#337129\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ft#337080) * test: clean up Windows agent-host descendants after shutdown Record the test server's descendants before graceful shutdown and await cleanup of survivors before removing temporary directories. Keep product provider shutdown and timeout budgets unchanged. Add a Windows regression proving that a clean parent exit does not imply descendant exit. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: bound descendant snapshots by the shutdown deadline Share the existing shutdown budget between descendant enumeration and graceful exit. Preserve EOF and forced cleanup when enumeration stalls, report the timeout afterward, and cover that path with a real-process regression. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
11 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.