Enhance Copilot CLI session management and permissions handling (#310495)

DonJayamanne · Copilot · web-flow · commit 8b883105cafa · 2026-04-16T09:31:33.000Z
* Enhance Copilot CLI session management and permissions handling

* Update src/vs/workbench/contrib/chat/browser/chatSessions/chatSessions.contribution.ts

Co-authored-by: Copilot &lt;175728472+Copilot@users.noreply.github.com&gt;

* Update extensions/copilot/src/extension/chatSessions/copilotcli/node/copilotcliSession.ts

Co-authored-by: Copilot &lt;175728472+Copilot@users.noreply.github.com&gt;

* updates

* Fixes

---------

Co-authored-by: Copilot &lt;175728472+Copilot@users.noreply.github.com&gt;
diff --git a/extensions/copilot/src/extension/chatSessions/copilotcli/node/copilotcliSession.ts b/extensions/copilot/src/extension/chatSessions/copilotcli/node/copilotcliSession.ts
@@ -7,6 +7,7 @@ import type { Attachment, SendOptions, Session, SessionOptions } from '@github/c
 import * as l10n from '@vscode/l10n';
 import type * as vscode from 'vscode';
 import type { ChatParticipantToolToken } from 'vscode';
+import { IRunCommandExecutionService } from '../../../../platform/commands/common/runCommandExecutionService';
 import { ConfigKey, IConfigurationService } from '../../../../platform/configuration/common/configurationService';
 import { ILogService } from '../../../../platform/log/common/logService';
 import { GenAiMetrics } from '../../../../platform/otel/common/genAiMetrics';
@@ -29,6 +30,7 @@ import { IChatSessionMetadataStore } from '../../common/chatSessionMetadataStore
 import { ExternalEditTracker } from '../../common/externalEditTracker';
 import { getWorkingDirectory, isIsolationEnabled, IWorkspaceInfo } from '../../common/workspaceInfo';
 import { enrichToolInvocationWithSubagentMetadata, isCopilotCliEditToolCall, isCopilotCLIToolThatCouldRequirePermissions, processToolExecutionComplete, processToolExecutionStart, ToolCall, updateTodoList } from '../common/copilotCLITools';
+import { SessionIdForCLI } from '../common/utils';
 import type { CopilotCliBridgeSpanProcessor } from './copilotCliBridgeSpanProcessor';
 import { ICopilotCLIImageSupport } from './copilotCLIImageSupport';
 import { handleExitPlanMode } from './exitPlanModeHandler';
@@ -93,6 +95,12 @@ export interface ICopilotCLISession extends IDisposable {
 	addUserMessage(content: string): void;
 	addUserAssistantMessage(content: string): void;
 	getSelectedModelId(): Promise<string | undefined>;
+	/**
+	 * Temporarily sets the session resource.
+	 * Only for non-controller code paths.
+	 * @deprecated
+	 */
+	setSessionResource(resource: vscode.Uri): IDisposable;
 }
 
 export class CopilotCLISession extends DisposableStore implements ICopilotCLISession {
@@ -147,6 +155,8 @@ export class CopilotCLISession extends DisposableStore implements ICopilotCLISes
 	setSdkTraceContextUpdater(updater: ((traceparent?: string, tracestate?: string) => void) | undefined): void {
 		this._updateSdkTraceContext = updater;
 	}
+	private _sessionResource: Uri;
+
 	constructor(
 		private readonly _workspaceInfo: IWorkspaceInfo,
 		private readonly _agentName: string | undefined,
@@ -162,11 +172,19 @@ export class CopilotCLISession extends DisposableStore implements ICopilotCLISes
 		@IUserQuestionHandler private readonly _userQuestionHandler: IUserQuestionHandler,
 		@IConfigurationService private readonly configurationService: IConfigurationService,
 		@IOTelService private readonly _otelService: IOTelService,
+		@IRunCommandExecutionService private readonly _commandExecutionService: IRunCommandExecutionService,
 	) {
 		super();
 		this.sessionId = _sdkSession.sessionId;
+		this._sessionResource = SessionIdForCLI.getResource(this.sessionId);
 	}
 
+	setSessionResource(resource: vscode.Uri): IDisposable {
+		this._sessionResource = resource;
+		return this.add(toDisposable(() => {
+			this._sessionResource = SessionIdForCLI.getResource(this.sessionId);
+		}));
+	}
 	attachStream(stream: vscode.ChatResponseStream): IDisposable {
 		this._stream = stream;
 		return toDisposable(() => {
@@ -517,6 +535,16 @@ export class CopilotCLISession extends DisposableStore implements ICopilotCLISes
 							token,
 						);
 						flushPendingInvocationMessages();
+
+						// Update the permission picker dropdown based on the selected action
+						if (response.approved && response.selectedAction !== 'exit_only') {
+							const autopilotSelected = response.selectedAction === 'autopilot' || response.selectedAction === 'autopilot_fleet';
+							const commandId = 'workbench.action.chat.copilotcli.approval';
+							this._commandExecutionService.executeCommand(commandId, this._sessionResource, autopilotSelected).catch(error => {
+								this.logService.error(error, '[CopilotCLISession] Failed to update permission picker');
+							});
+						}
+
 						this._sdkSession.respondToExitPlanMode(event.data.requestId, response);
 					} catch (error) {
 						this.logService.error(error, '[CopilotCLISession] Error handling exit plan mode');
diff --git a/extensions/copilot/src/extension/chatSessions/copilotcli/node/test/copilotCliSessionService.spec.ts b/extensions/copilot/src/extension/chatSessions/copilotcli/node/test/copilotCliSessionService.spec.ts
@@ -42,6 +42,7 @@ import { CopilotCLIMCPHandler } from '../mcpHandler';
 import { IQuestion, IQuestionAnswer, IUserQuestionHandler } from '../userInputHelpers';
 import { MockCliSdkSession, MockCliSdkSessionManager, MockSkillLocations, NullCopilotCLIAgents, NullICopilotCLIImageSupport } from './testHelpers';
 import { MockPromptsService } from '../../../../../platform/promptFiles/test/common/mockPromptsService';
+import { MockRunCommandExecutionService } from '../../../../../platform/commands/common/mockRunCommandExecutionService';
 
 // Re-export for backward compatibility with other spec files
 export { MockCliSdkSession, MockCliSdkSessionManager, MockSkillLocations, NullCopilotCLIAgents, NullICopilotCLIImageSupport } from './testHelpers';
@@ -56,7 +57,7 @@ class MockLocalSession {
 	}
 }
 
-class NullAgentSessionsWorkspace implements IAgentSessionsWorkspace {
+export class NullAgentSessionsWorkspace implements IAgentSessionsWorkspace {
 	_serviceBrand: undefined;
 	readonly isAgentSessionsWorkspace = false;
 }
@@ -147,7 +148,7 @@ describe('CopilotCLISessionService', () => {
 						}
 					}();
 				}
-				return disposables.add(new CopilotCLISession(workspaceInfo, agentName, sdkSession, [], logService, workspaceService, new MockChatSessionMetadataStore(), instantiationService, new NullRequestLogger(), new NullICopilotCLIImageSupport(), new FakeToolsService(), new FakeUserQuestionHandler(), accessor.get(IConfigurationService), new NoopOTelService(resolveOTelConfig({ env: {}, extensionVersion: '0.0.0', sessionId: 'test' }))));
+				return disposables.add(new CopilotCLISession(workspaceInfo, agentName, sdkSession, [], logService, workspaceService, new MockChatSessionMetadataStore(), instantiationService, new NullRequestLogger(), new NullICopilotCLIImageSupport(), new FakeToolsService(), new FakeUserQuestionHandler(), accessor.get(IConfigurationService), new NoopOTelService(resolveOTelConfig({ env: {}, extensionVersion: '0.0.0', sessionId: 'test' })), new MockRunCommandExecutionService()));
 			}
 		} as unknown as IInstantiationService;
 		const configurationService = accessor.get(IConfigurationService);
diff --git a/extensions/copilot/src/extension/chatSessions/copilotcli/node/test/copilotcliSession.spec.ts b/extensions/copilot/src/extension/chatSessions/copilotcli/node/test/copilotcliSession.spec.ts
@@ -29,6 +29,7 @@ import { CopilotCLISession } from '../copilotcliSession';
 import { PermissionRequest } from '../permissionHelpers';
 import { IQuestion, IQuestionAnswer, IUserQuestionHandler } from '../userInputHelpers';
 import { NullICopilotCLIImageSupport } from './testHelpers';
+import { MockRunCommandExecutionService } from '../../../../../platform/commands/common/mockRunCommandExecutionService';
 
 vi.mock('../cliHelpers', async (importOriginal) => ({
 	...(await importOriginal<typeof import('../cliHelpers')>()),
@@ -246,6 +247,7 @@ describe('CopilotCLISession', () => {
 			new FakeUserQuestionHandler(),
 			configurationService,
 			new NoopOTelService(resolveOTelConfig({ env: {}, extensionVersion: '0.0.0', sessionId: 'test' })),
+			new MockRunCommandExecutionService()
 		));
 	}
 
diff --git a/extensions/copilot/src/extension/chatSessions/vscode-node/copilotCLIChatSessionsContribution.ts b/extensions/copilot/src/extension/chatSessions/vscode-node/copilotCLIChatSessionsContribution.ts
@@ -1389,6 +1389,7 @@ export class CopilotCLIChatSessionParticipant extends Disposable {
 			// Previously we just updated it with details of the folder.
 			// If user has selected a repo, then update with repo information (right icons, etc).
 			if (isUntitled) {
+				disposables.add(session.object.setSessionResource(resource));
 				void this.lockRepoOptionForSession(context, token);
 				this.customSessionTitleService.generateSessionTitle(session.object.sessionId, request, token).catch(ex => this.logService.error(ex, 'Failed to generate custom session title'));
 			}
diff --git a/extensions/copilot/src/extension/chatSessions/vscode-node/test/copilotCLIChatSessionParticipant.spec.ts b/extensions/copilot/src/extension/chatSessions/vscode-node/test/copilotCLIChatSessionParticipant.spec.ts
@@ -57,6 +57,7 @@ import { CopilotCLIChatSessionContentProvider, CopilotCLIChatSessionItemProvider
 import { CopilotCloudSessionsProvider } from '../copilotCloudSessionsProvider';
 import { CopilotCLIFolderRepositoryManager } from '../folderRepositoryManagerImpl';
 import { MockPromptsService } from '../../../../platform/promptFiles/test/common/mockPromptsService';
+import { MockRunCommandExecutionService } from '../../../../platform/commands/common/mockRunCommandExecutionService';
 
 // Mock terminal integration to avoid importing PowerShell asset (.ps1) which Vite cannot parse during tests
 vi.mock('../copilotCLITerminalIntegration', () => {
@@ -392,7 +393,7 @@ describe('CopilotCLIChatSessionParticipant.handleRequest', () => {
 						}
 					}();
 				}
-				const session = new TestCopilotCLISession(workspaceInfo, agentName, sdkSession, [], logService, workspaceService, new MockChatSessionMetadataStore(), instantiationService, new NullRequestLogger(), new NullICopilotCLIImageSupport(), new FakeToolsService(), new FakeUserQuestionHandler(), accessor.get(IConfigurationService), new NoopOTelService(resolveOTelConfig({ env: {}, extensionVersion: '0.0.0', sessionId: 'test' })));
+				const session = new TestCopilotCLISession(workspaceInfo, agentName, sdkSession, [], logService, workspaceService, new MockChatSessionMetadataStore(), instantiationService, new NullRequestLogger(), new NullICopilotCLIImageSupport(), new FakeToolsService(), new FakeUserQuestionHandler(), accessor.get(IConfigurationService), new NoopOTelService(resolveOTelConfig({ env: {}, extensionVersion: '0.0.0', sessionId: 'test' })), new MockRunCommandExecutionService());
 				cliSessions.push(session);
 				return disposables.add(session);
 			}
diff --git a/src/vs/workbench/contrib/chat/browser/chatSessions/chatSessions.contribution.ts b/src/vs/workbench/contrib/chat/browser/chatSessions/chatSessions.contribution.ts
@@ -32,21 +32,21 @@ import { ChatEditorInput } from '../widgetHosts/editor/chatEditorInput.js';
 import { IChatAgentAttachmentCapabilities, IChatAgentData, IChatAgentService } from '../../common/participants/chatAgents.js';
 import { ChatContextKeys } from '../../common/actions/chatContextKeys.js';
 import { ChatSessionOptionsMap, ChatSessionStatus, IChatNewSessionRequest, IChatSession, IChatSessionCommitEvent, IChatSessionContentProvider, IChatSessionCustomizationItemGroup, IChatSessionCustomizationsProvider, IChatSessionItem, IChatSessionItemController, IChatSessionItemsDelta, IChatSessionOptionsChangeEvent, IChatSessionProviderOptionGroup, IChatSessionProviderOptionItem, IChatSessionRequestHistoryItem, IChatSessionsExtensionPoint, IChatSessionsService, isSessionInProgressStatus, ReadonlyChatSessionOptionsMap, ResolvedChatSessionsExtensionPoint } from '../../common/chatSessionsService.js';
-import { ChatAgentLocation, ChatModeKind } from '../../common/constants.js';
+import { ChatAgentLocation, ChatModeKind, ChatPermissionLevel } from '../../common/constants.js';
 import { CHAT_CATEGORY } from '../actions/chatActions.js';
 import { IChatEditorOptions } from '../widgetHosts/editor/chatEditor.js';
 import { IChatService, ResponseModelState } from '../../common/chatService/chatService.js';
 import { autorun, observableFromEvent } from '../../../../../base/common/observable.js';
 import { IChatRequestVariableEntry, PromptFileVariableKind, toPromptFileVariableEntry } from '../../common/attachments/chatVariableEntries.js';
 import { IViewsService } from '../../../../services/views/common/viewsService.js';
-import { ChatViewId } from '../chat.js';
+import { ChatViewId, IChatWidgetService } from '../chat.js';
 import { ChatViewPane } from '../widgetHosts/viewPane/chatViewPane.js';
 import { AgentSessionProviders, getAgentSessionProvider, getAgentSessionProviderName } from '../agentSessions/agentSessions.js';
 import { BugIndicatingError, isCancellationError } from '../../../../../base/common/errors.js';
 import { IEditorGroupsService } from '../../../../services/editor/common/editorGroupsService.js';
 import { isUntitledChatSession, LocalChatSessionUri } from '../../common/model/chatUri.js';
 import { assertNever } from '../../../../../base/common/assert.js';
-import { ICommandService } from '../../../../../platform/commands/common/commands.js';
+import { CommandsRegistry, ICommandService } from '../../../../../platform/commands/common/commands.js';
 import { Target } from '../../common/promptSyntax/promptTypes.js';
 import { slashReg } from '../../common/requestParser/chatRequestParser.js';
 import { IPromptsService } from '../../common/promptSyntax/service/promptsService.js';
@@ -1238,6 +1238,21 @@ export class ChatSessionsService extends Disposable implements IChatSessionsServ
 
 registerSingleton(IChatSessionsService, ChatSessionsService, InstantiationType.Delayed);
 
+CommandsRegistry.registerCommand('workbench.action.chat.copilotcli.approval', (accessor: ServicesAccessor, sessionResource: UriComponents, setAutopilot: boolean) => {
+	const chatWidgetService = accessor.get(IChatWidgetService);
+	const widget = chatWidgetService.getWidgetBySessionResource(URI.revive(sessionResource));
+	if (!widget) {
+		return;
+	}
+	if (setAutopilot) {
+		widget.inputPart.setPermissionLevel(ChatPermissionLevel.Autopilot);
+	} else {
+		if (widget.inputPart.currentPermissionLevelObs.get() === ChatPermissionLevel.Autopilot) {
+			widget.inputPart.setPermissionLevel(ChatPermissionLevel.Default);
+		}
+	}
+});
+
 
 
 function registerNewSessionInPlaceAction(type: string, displayName: string): IDisposable {

Original file line number	Diff line number	Diff line change
`@@ -42,6 +42,7 @@ import { CopilotCLIMCPHandler } from '../mcpHandler';`
`42`	`42`	`import { IQuestion, IQuestionAnswer, IUserQuestionHandler } from '../userInputHelpers';`
`43`	`43`	`import { MockCliSdkSession, MockCliSdkSessionManager, MockSkillLocations, NullCopilotCLIAgents, NullICopilotCLIImageSupport } from './testHelpers';`
`44`	`44`	`import { MockPromptsService } from '../../../../../platform/promptFiles/test/common/mockPromptsService';`
	`45`	`+import { MockRunCommandExecutionService } from '../../../../../platform/commands/common/mockRunCommandExecutionService';`
`45`	`46`
`46`	`47`	`// Re-export for backward compatibility with other spec files`
`47`	`48`	`export { MockCliSdkSession, MockCliSdkSessionManager, MockSkillLocations, NullCopilotCLIAgents, NullICopilotCLIImageSupport } from './testHelpers';`
`@@ -56,7 +57,7 @@ class MockLocalSession {`
`56`	`57`	`}`
`57`	`58`	`}`
`58`	`59`
`59`		`-class NullAgentSessionsWorkspace implements IAgentSessionsWorkspace {`
	`60`	`+export class NullAgentSessionsWorkspace implements IAgentSessionsWorkspace {`
`60`	`61`	`_serviceBrand: undefined;`
`61`	`62`	`readonly isAgentSessionsWorkspace = false;`
`62`	`63`	`}`
`@@ -147,7 +148,7 @@ describe('CopilotCLISessionService', () => {`
`147`	`148`	`}`
`148`	`149`	`}();`
`149`	`150`	`}`
`150`		`- return disposables.add(new CopilotCLISession(workspaceInfo, agentName, sdkSession, [], logService, workspaceService, new MockChatSessionMetadataStore(), instantiationService, new NullRequestLogger(), new NullICopilotCLIImageSupport(), new FakeToolsService(), new FakeUserQuestionHandler(), accessor.get(IConfigurationService), new NoopOTelService(resolveOTelConfig({ env: {}, extensionVersion: '0.0.0', sessionId: 'test' }))));`
	`151`	`+ return disposables.add(new CopilotCLISession(workspaceInfo, agentName, sdkSession, [], logService, workspaceService, new MockChatSessionMetadataStore(), instantiationService, new NullRequestLogger(), new NullICopilotCLIImageSupport(), new FakeToolsService(), new FakeUserQuestionHandler(), accessor.get(IConfigurationService), new NoopOTelService(resolveOTelConfig({ env: {}, extensionVersion: '0.0.0', sessionId: 'test' })), new MockRunCommandExecutionService()));`
`151`	`152`	`}`
`152`	`153`	`} as unknown as IInstantiationService;`
`153`	`154`	`const configurationService = accessor.get(IConfigurationService);`
Original file line number	Diff line number	Diff line change
`@@ -1389,6 +1389,7 @@ export class CopilotCLIChatSessionParticipant extends Disposable {`
`1389`	`1389`	`// Previously we just updated it with details of the folder.`
`1390`	`1390`	`// If user has selected a repo, then update with repo information (right icons, etc).`
`1391`	`1391`	`if (isUntitled) {`
	`1392`	`+ disposables.add(session.object.setSessionResource(resource));`
`1392`	`1393`	`void this.lockRepoOptionForSession(context, token);`
`1393`	`1394`	`this.customSessionTitleService.generateSessionTitle(session.object.sessionId, request, token).catch(ex => this.logService.error(ex, 'Failed to generate custom session title'));`
`1394`	`1395`	`}`
Original file line number	Diff line number	Diff line change
`@@ -57,6 +57,7 @@ import { CopilotCLIChatSessionContentProvider, CopilotCLIChatSessionItemProvider`
`57`	`57`	`import { CopilotCloudSessionsProvider } from '../copilotCloudSessionsProvider';`
`58`	`58`	`import { CopilotCLIFolderRepositoryManager } from '../folderRepositoryManagerImpl';`
`59`	`59`	`import { MockPromptsService } from '../../../../platform/promptFiles/test/common/mockPromptsService';`
	`60`	`+import { MockRunCommandExecutionService } from '../../../../platform/commands/common/mockRunCommandExecutionService';`
`60`	`61`
`61`	`62`	`// Mock terminal integration to avoid importing PowerShell asset (.ps1) which Vite cannot parse during tests`
`62`	`63`	`vi.mock('../copilotCLITerminalIntegration', () => {`
`@@ -392,7 +393,7 @@ describe('CopilotCLIChatSessionParticipant.handleRequest', () => {`
`392`	`393`	`}`
`393`	`394`	`}();`
`394`	`395`	`}`
`395`		`- const session = new TestCopilotCLISession(workspaceInfo, agentName, sdkSession, [], logService, workspaceService, new MockChatSessionMetadataStore(), instantiationService, new NullRequestLogger(), new NullICopilotCLIImageSupport(), new FakeToolsService(), new FakeUserQuestionHandler(), accessor.get(IConfigurationService), new NoopOTelService(resolveOTelConfig({ env: {}, extensionVersion: '0.0.0', sessionId: 'test' })));`
	`396`	`+ const session = new TestCopilotCLISession(workspaceInfo, agentName, sdkSession, [], logService, workspaceService, new MockChatSessionMetadataStore(), instantiationService, new NullRequestLogger(), new NullICopilotCLIImageSupport(), new FakeToolsService(), new FakeUserQuestionHandler(), accessor.get(IConfigurationService), new NoopOTelService(resolveOTelConfig({ env: {}, extensionVersion: '0.0.0', sessionId: 'test' })), new MockRunCommandExecutionService());`
`396`	`397`	`cliSessions.push(session);`
`397`	`398`	`return disposables.add(session);`
`398`	`399`	`}`