Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Security and enterprise docs overstate policy enforcement for Copilot harness sessions (ChatAgentMode, ChatMCP, network filter, tool approval)

オープン
  • 何か問題がありますか？
#10,489 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@alok-108 がすでに取り組んでいます。

2026年10月15日 から。

  • #10491 @alok-108 による — オープン

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
18/100
issue の種類
ドキュメント
明瞭さ
おおむね明確
活発さ
停滞
技術スタック
markdown, typescript
領域
documentation, security

調査の方向性

Start with the "Enterprise policies" section of docs/agents/run/security.md (around lines 213-218) and the policy notes in docs/enterprise/manage-ai-settings.md (around lines 175, 228, 298, 302, 332), then compare them with the partial-support entries in agentHostPolicySupport.ts. Done means the absolute wording is qualified per harness, and each affected policy has a note like the existing ChatHooks one. Linked PR #10491 is already open against this issue, so check it before starting.

索引モデルが issue の本文から書いたものです。

説明

Summary

The security and enterprise docs present several VS Code device policies as complete controls. Copilot harness (Agent Host) sessions enforce these policies only partially. Two VS Code sources say so: its own policy coverage inventory, agentHostPolicySupport.ts, at 1.142.0, and open microsoft/vscode issues. The docs don't mention these gaps, so an admin who follows them can believe a control is in place when Copilot harness sessions bypass it.

The published pages (security, manage AI settings) and vnext contain the same text.

Docs claim vs. Copilot harness behavior in 1.142
Docs say Copilot harness status in agentHostPolicySupport.ts Tracking
security.md#L213: "Prevent the use of agent mode entirely with the ChatAgentMode policy." See also manage-ai-settings.md#L175-L177. partial: "Blocks the Agents window. In the editor it only switches the chat mode; Agent Host session targets remain available." "Not yet tracked" (source comment)
security.md#L215: "…or disable MCP support completely (off) with the ChatMCP policy." partial: "independent runtime discovery does not consult VS Code MCP access." microsoft/vscode#328241 (open since July)
security.md#L217 and manage-ai-settings.md#L298: ChatToolsEligibleForAutoApproval forces manual approval for individual tools. partial: "does not force per-tool confirmation in other approval modes." microsoft/vscode#337540: "assisted approval and saved session approvals can still auto-approve them"
security.md#L218 and manage-ai-settings.md#L302: ChatToolsTerminalEnableAutoApprove set to false requires approval for terminal commands. partial: custom terminal tools' approval paths "still need a parity audit." None found
manage-ai-settings.md#L332-L336: "Network filtering applies to the fetch tool and Integrated Browser." partial for ChatAgentNetworkFilter, ChatAgentAllowedNetworkDomains, and ChatAgentDeniedNetworkDomains: "native SDK sandboxing ignores them, and the permissions bridge does not translate allowlists." microsoft/vscode#337539: "the runtime's web_fetch bypasses it: unlisted domains prompt, and under Allow All they are fetched silently." Also microsoft/vscode#337538
Why this matters
  • The same file describes the Copilot harness as "the candidate default replacement for Local". It is already a Session Target that users can pick in the editor. VS Code also moves Local sessions to it automatically when managed sandbox or permission settings apply (manage-ai-settings.md#L94-L97).
  • Network allowlist: An organization might set ChatAgentNetworkFilter: true with ChatAgentAllowedNetworkDomains: ["github.com"] to prevent data exfiltration. In a Copilot harness session with Allow all, web_fetch to an unlisted domain succeeds without a prompt (microsoft/vscode#337539).
  • Agents off: An organization might set ChatAgentMode to false to turn off agents. The policy blocks the Agents window (OPEN_AGENTS_WINDOW_PRECONDITION). But the editor's Session Target picker (sessionTargetPickerActionItem.ts) and its availability check (sessionTypeAvailability.ts) don't check chat.agent.enabled. Agent Host sessions remain available there.
  • The docs already handle a similar gap well for hooks. manage-ai-settings.md#L228 says ChatHooks "does not apply to Copilot harness sessions". The policies above don't have an equivalent note.
Suggested fix
  1. In the "Enterprise policies" section of security.md, drop the absolute wording ("entirely", "completely", "Force") or qualify it per harness.
  2. In manage-ai-settings.md, add harness notes like the existing ChatHooks note for ChatAgentMode, ChatToolsEligibleForAutoApproval, ChatToolsTerminalEnableAutoApprove, and network filtering. Where the source names a Copilot managed setting for Agent Host enforcement, point to it.
  3. Consider a "Policy coverage by harness" table. agentHostPolicySupport.ts lists a status for every policy in policyData.jsonc, and the build fails when one is missing, so the table could be generated from it the same way the policy reference is.
How this was checked
  • microsoft/vscode at e9eaf94 (1.142.0): agentHostPolicySupport.ts, the Session Target picker and availability code, and OPEN_AGENTS_WINDOW_PRECONDITION.
  • Linked microsoft/vscode issues #328241, #337538, #337539, and #337540, all open.
  • Docs at main@54f9a67, the live code.visualstudio.com pages, and vnext all have the same text.
  • No existing vscode-docs issue or open PR covers this.
主要言語
Markdown
スター
6.7k
フォーク
5.8k
平均マージ
9時間 7分
マージ済み PR（30日）
117

環境構築

Codespaces で開く

このプロジェクトの開発コンテナを、あなたの GitHub アカウントでブラウザ上に起動します。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

microsoft/vscode-docs のほかの issue

microsoft/vscode-docs の issue をすべて見る

似ている issue

Documentation の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。