Add sandbox policy reports to Copilot agent sessions - #335918
Open
Dileep Yavanmandha (dileepyavan) wants to merge 1 commit into
Open
Add sandbox policy reports to Copilot agent sessions#335918Dileep Yavanmandha (dileepyavan) wants to merge 1 commit into
Dileep Yavanmandha (dileepyavan) wants to merge 1 commit into
Conversation
Copilot started reviewing on behalf of
Dileep Yavanmandha (dileepyavan)
September 12, 2026 01:02
View session
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Output hooks can skip cache invalidation or discard custom output, and accessibility help omits Space activation.
Get a fresh assessment by requesting another Copilot review.
Review tier: Balanced
Findings: 2
Open findings (3)
What changed in this PR
Adds persisted, previewable sandbox-policy reports to Copilot Agent Host sessions.
Changes:
- Adds
/sandbox-policycommand handling, formatting, and persistence. - Adds Markdown-preview link rendering with URI rewriting and keyboard support.
- Adds extensive completion, lifecycle, rendering, accessibility, and persistence tests.
| File | Description |
|---|---|
chatWidget.fixture.ts |
Adds sandbox-policy link fixture. |
chatMarkdownContentPart.test.ts |
Tests preview links and anchor scanning. |
chatInlineAnchorWidget.test.ts |
Tests rendering and activation. |
stateToProgressAdapter.test.ts |
Tests preview metadata preservation. |
chatAccessibilityHelp.test.ts |
Tests accessibility guidance. |
chatInlineAnchorWidget.css |
Adds theme-aware preview-link colors. |
chatMarkdownDecorationsRenderer.ts |
Renders preview anchors during decoration. |
chatInlineAnchorWidget.ts |
Adds filtered rendering and preview activation. |
stateToProgressAdapter.ts |
Preserves metadata across URI rewriting. |
chatAccessibilityHelp.ts |
Documents sandbox-policy usage. |
copilotSlashCommandCompletionProvider.test.ts |
Tests command discovery and collisions. |
copilotSlashCommand.test.ts |
Tests hooks and output rendering. |
copilotAgentSession.test.ts |
Tests policy command lifecycle and persistence. |
copilotSlashCommandProvider.ts |
Adds host command and handler resolution. |
copilotSlashCommandCompletionProvider.ts |
Reuses shared command metadata type. |
copilotSlashCommand.ts |
Defines command hooks and structured output. |
copilotSandboxPolicyDisplay.ts |
Formats and persists policy reports. |
copilotAgentSession.ts |
Integrates invocation and output hooks. |
copilotAgent.ts |
Updates provider construction. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| this._logService.error(err, `[Copilot:${this.sessionId}] rpc.commands.invoke(${slashCommand.command}) failed`); | ||
| throw err; | ||
| } | ||
| const output = await runtimeSlashCommand.getOutput?.(slashCommand.rest, result); |
| throw err; | ||
| } | ||
| const output = await runtimeSlashCommand.getOutput?.(slashCommand.rest, result); | ||
| const renderedOutput = output ? renderCopilotSlashCommandOutput(output) : undefined; |
| content.push(localize('workbench.action.openAgentsWindow', 'To open the Agents Window, invoke the Open Agents Window command{0}. In screen reader mode, this keybinding includes Alt to avoid conflicts with screen reader shortcuts.', '<keybinding:workbench.action.openAgentsWindow>')); | ||
| content.push(localize('workbench.action.chat.openAgentHostFolderPicker', 'When starting an agent session in a multi-root workspace, you can choose which root folder it runs in by invoking the Folder command{0}, then selecting a folder from the list.', '<keybinding:workbench.action.chat.openAgentHostFolderPicker>')); | ||
| content.push(localize('chat.agentHostApprovalsPicker', 'When an agent session exposes approval presets, use Tab to reach the Approvals picker and choose how it handles workspace access, commands, and the internet.')); | ||
| content.push(localize('chat.agentHostSandboxPolicy', "In Copilot agent-host sessions, use /sandbox-policy to view the effective sandbox policy. In the response, use Tab to focus Open Sandbox Policy and Enter to open the formatted report.")); |
Contributor
Screenshot ChangesBase: 3 insignificant change(s) omitted (≤20 px, Δ≤2). See CI logs for details. Added (2)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
20260912-0056-47.9836396.mp4
Add
/sandbox-policyto Copilot agent-host sessions. The VS Code command invokes the SDK's existing/sandbox policycommand and presents its effective policy as a persisted Markdown report, without starting a model turn or changing sandbox enforcement.User experience
/sandbox-policyin slash-command completion while keeping native/sandboxsubcommands hidden.Implementation
getInvocationandgetOutputhooks on resolved slash commands, separate from SDK catalog metadata. Omitted hooks or hooks returningundefinedpreserve the existing SDK invocation and output behavior.CopilotSandboxPolicyDisplay.Compatibility
Validation
git diff --checkpassed.