Allow sandboxed sessions to write their own plan.md without granting access to other sessions

[jsilhan]

Describe the feature or problem you'd like to solve

Copilot CLI stores  plan.md  under  ~/.copilot/session-state/<SESSION_ID>/ and in sandboxed yolo env it requests permissions. Pls provide a secure mean to allow editing plan.md by an agent

Proposed solution

Copilot CLI stores planning state at:

~/.copilot/session-state/<SESSION_ID>/plan.md

With local sandboxing enabled on macOS, writing this file requires permission outside the working directory.

The session ID is generated dynamically, so the exact path cannot be configured beforehand. Allowing the parent directory:

~/.copilot/session-state

removes repeated prompts, but also lets session A read or modify session B’s state. This weakens session isolation.

Sandbox filesystem path rules currently appear to require literal paths and do not support a session-specific variable or placeholder.

Expected behavior

A sandboxed session should be able to write its own internal planning files without gaining access to another session’s state.

Ideally, this should work automatically without permission prompts while preserving isolation between:

session-state/<SESSION_A>/
session-state/<SESSION_B>/

Potential solutions

1. Automatically allow the current session directory
   Add the active directory below to that session’s sandbox policy:
   ~/.copilot/session-state/<CURRENT_SESSION_ID>
   This should be scoped exclusively to the current session.
2. Introduce a  $SESSION_ID  sandbox variable
   Support variables in filesystem path rules:
   ~/.copilot/session-state/$SESSION_ID
   The variable should be expanded by Copilot CLI when constructing the sandbox policy, not inherited from an untrusted shell environment.
3. Make the plan path configurable
   Add a setting such as:
   {
   "planPath": "${workspaceFolder}/.copilot/plan.md"
   }
   This would allow users to keep planning state inside the repository or another already-authorized directory.
4. Support an external task backend
   Allow the internal TODO/plan mechanism to use an MCP tool or configurable task provider instead of requiring  session-state//plan.md .

Security considerations

The solution should not require allowing the complete  ~/.copilot/session-state  directory. Session-derived variables should be resolved internally and must not allow arbitrary environment-variable or path traversal expansion.

Environment

Copilot CLI: 1.0.71
Operating system: macOS
Sandbox: Local sandbox enabled

Example prompts or workflows

• copilot --sandbox --experimental --allow-all-paths --allow-all-tools
• plan more complex task where agent has to write plan.md
• harness asks for permission to modify ~/.copilot/session-state/32609295-b541-40d0-97fd-e9bdcb68b20 each time
• agent can't work autonomously without having a user accept these requests -> slows down a developer

Additional context

No response