Sandbox bypass confirmation should offer disabling sandbox for the session

[digitarald]

When the Copilot SDK requests a sandbox bypass, VS Code currently presents its standard tool-confirmation options. The existing Allow in this Session choice remembers tool approval; it does not disable sandboxing for the session. As a result, users must confirm each command that legitimately cannot run inside the sandbox.

The Copilot App offers a clearer set of choices:

• Cancel
• Run once outside sandbox
• Disable sandbox and run

VS Code should offer the equivalent session-scoped choice when all of the following are true:

• The Copilot Runtime marks the request as a sandbox bypass.
• Sandboxing is enabled for the current session.
• Enterprise policy allows sandbox bypass.

Suggested wording: Disable sandbox for this session and run.

Selecting it should:

1. Approve the current command outside the sandbox.
2. Disable sandboxing only for the current session.
3. Keep the user's saved sandbox setting unchanged.
4. Make the session's unsandboxed state visible in the permissions UI.
5. Avoid offering the choice when managed policy sets sandbox.allowBypass to false.

This should be a sandbox-specific option rather than reusing Allow in this Session. The latter changes tool approval for future calls; it does not communicate or implement the broader security posture change of disabling containment for the rest of the session.

🤖 Posted by GitHub Copilot on Harald's behalf.

[dileepyavan]

Harald Kirschner (@digitarald) in vscode , running outside sandbox confirmation shows up as below:

Allow in the session: disables sandboxing for that session.
Allow once:: to disable for the command execution only.
skip : for cancelling the request.

I think these options are similar to options that are shown for other confirmation windows in chat.

To fix: When selecting allow for the session, it should not change the setting at workspace level that applies to all the sessions.