Agent Host: Require confirmation for managed permission asks

[joshspicer]

Why

Enterprise-managed permission ask rules require an explicit human response through the client's standard approval UI. Agent Host must not apply its normal auto-approval shortcuts when the Copilot runtime marks a request with managedApprovalRequired.

Depends on https://github.com/github/copilot-agent-runtime/pull/13312, whose initial managed-selector scope is Shell, Read, Edit, and Domain. Tool and MCP selectors are deferred.

Public SDK type: github/copilot-sdk#2080

What

• forwards managedApprovalRequired through the SDK request projection and host-only pending_confirmation signal
• bypasses Approve When Safe recommendations and request-local shortcuts inside CopilotAgentSession
• bypasses Agent Host session/global auto-approval in AgentSideEffects
• presents only Allow Once and Skip for managed asks; Allow in this Session is intentionally omitted
• defensively ignores a client-supplied allow-session response for managed calls so it cannot seed Agent Host session permissions
• dispatches the normal ChatToolCallReady confirmation flow so the connected client renders its approval UI
• prevents managed approvals from seeding duplicate read/write auto-approval state
• adds focused coverage at both the SDK callback and Agent Host side-effects layers

The client does not evaluate managed rules. The runtime decides the verdict and enforces one-time semantics; VS Code only presents its existing confirmation UI and returns the user's one-time decision.

Validation

• npm run typecheck-client
• targeted ESLint on changed files
• agentSideEffects.test.ts — 136 passed
• focused copilotAgentSession managed-approval coverage
• local linked runtime + SDK + Code OSS manual validation for Shell, Read, Edit, and Domain managed asks

[Copilot]

Pull request overview

Adds managed permission markers so Agent Host can require human confirmation.

Changes:

• Projects managedApprovalRequired into permission requests.
• Guards local auto-approval paths.
• Adds focused confirmation coverage.

Show a summary per file

File	Description
copilotAgentSession.ts	Guards permission auto-approval paths.
copilotToolDisplay.ts	Extends the permission request projection.
copilotAgentSession.test.ts	Tests managed approval recommendations.

Review details

Comments suppressed due to low confidence (1)

src/vs/platform/agentHost/node/copilot/copilotAgentSession.ts:2245

• This guards only the client-tool result that was buffered before the permission request. If completion arrives after the managed request has entered _pendingPermissions, handleClientToolCallComplete still unconditionally calls respondToPermissionRequest(toolCallId, true) at line 1269, resolving the managed ask without human input. Preserve whether a pending request is managed and suppress that late-completion auto-approval as well.

			if (!managedApprovalRequired && request.kind === 'custom-tool'
				&& typeof request.toolName === 'string'
				&& this._clientToolNames.has(this._clientToolName(request.toolName))
				&& this._pendingClientToolCalls.hasBufferedResult(toolCallId)
			) {
				this._logService.info(`[Copilot:${this.sessionId}] Auto-approving client tool ${request.toolName} because its result arrived before the permission request`);
				return { kind: 'approve-once' };

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Medium

[justschen]

woah!!