Regression: Manual Approval no longer prompts for repository-mutating Git commands after Copilot harness migration #5177

Describe the bug

Critical Facts

1. Regression introduced with the October 2026 Copilot agent harness migration.

   • Before the migration, VS Code Copilot Chat consistently requested explicit approval before executing repository-mutating Git commands.
   • This included git add, git commit, git push, git checkout -b, git branch -D, merges, rebases, and similar operations.
   • After the migration to the new Copilot agent harness, some of these commands execute without approval.
   • The developer did not request or authorize a change to this approval behavior.

2. Reproduced in both Copilot CLI and VS Code Copilot Chat.

   • Both environments exhibit inconsistent approval behavior.
   • This suggests the problem may originate in the shared Copilot CLI agent harness or its permission-handling implementation.

3. Manual Approval mode is explicitly enabled.

   • Both Copilot CLI and VS Code Copilot Chat are running in Manual Approval mode.
   • Neither environment was intentionally configured to allow unrestricted tool execution.
   • The observed behavior is inconsistent with the developer's expectation that repository-mutating Git commands require approval.

4. Controlled reproduction demonstrates inconsistent authorization.

   • Executed git branch -D nope through Copilot CLI.
   • The command executed without requesting approval.
   • Git reported error: branch 'nope' not found, confirming the command was actually executed.
   • In the same Copilot CLI session, deleting PR_DESCRIPTION.md through PowerShell triggered an explicit approval request.
   • Therefore, the approval mechanism is operational but is not consistently applied to potentially destructive Git commands.

5. VS Code terminal auto-approval is explicitly disabled.

   • chat.tools.terminal.enableAutoApprove is set to false.
   • chat.agent.sandbox.allowAutoApprove is set to false.
   • chat.agent.sandbox.network.allowNetwork is set to false.
   • File-edit auto-approval is also explicitly disabled.
   • Investigation suggests that the new harness may execute commands through a powershell tool rather than VS Code's traditional terminal tool, potentially bypassing the VS Code terminal approval configuration.
   • This execution-path explanation remains a hypothesis, not a confirmed root cause.

6. No evidence of a persisted blanket approval.

   • %USERPROFILE%\.copilot\permissions-config.json does not exist in the inspected configuration directory.
   • Extensive configuration analysis has not identified an intentional authorization for automatic execution of destructive Git commands.
   • The absence of this file does not conclusively exclude other permission sources.

7. Related existing issue.

   • GitHub Copilot CLI issue DESTRUCTIVE (forced) git branch deletion is MISCLASSIFIED and requires NO PERMISSION #4156 describes git branch -D executing without approval.
   • DESTRUCTIVE (forced) git branch deletion is MISCLASSIFIED and requires NO PERMISSION #4156
   • However, this report concerns the broader regression in Git operation approvals observed after the October 2026 harness migration.

Expected Behavior

In Manual Approval mode, repository-mutating Git operations should require explicit authorization before execution, consistent with the behavior of VS Code Copilot Chat before the October 2026 agent harness migration.

This includes commands such as git add, git commit, git push, branch creation/deletion, merges, and rebases.

Actual Behavior

Some repository-mutating Git commands execute without requesting authorization, despite Manual Approval mode being active.

Other destructive operations, such as deleting files through PowerShell, correctly request approval.

The resulting permission behavior is inconsistent and difficult for developers to predict.

Impact

This regression undermines human-supervised, non-autonomous coding workflows.

Previously, developers could depend on the IDE to mediate repository-mutating Git operations. After the harness migration, that authorization boundary is no longer consistently enforced.

This is particularly concerning for operations such as git push, forced branch deletion, resets, merges, and rebases, where an unintended operation can have significant consequences.

This is not a request for a new feature. It is a report of an established authorization behavior that regressed during the Copilot agent harness migration.

Environment

• OS: Windows 11
• VS Code: 1.140.0
• Copilot CLI: Manual Approval mode
• Copilot CLI version: 1.0.98
• VS Code Copilot Chat: New Copilot agent harness (October 2026 migration)
• Chat : Agent: Sandbox Enabled: off

Requested Resolution

Restore reliable, explicit approval for repository-mutating Git operations in Manual Approval mode.

Ideally, approval enforcement should be deterministic and independent of the agent model's judgment about whether a command is safe.

At minimum, developers need a supported configuration that guarantees approval before executing Git commands that modify repository state.

Affected version

GitHub Copilot CLI 1.0.98

Steps to reproduce the behavior

1. Manual Permissions mode is on.
2. No auto approval settings for repo-mutating git commands
3. ask GH CLI or VS Code copilot chat to execute git branch -D nope and it executes it without prompting for approval.
4. git push commands and many other repo-mutating commands also execute without first requesting approval via the built-in terminal approval mechanism.

Expected behavior

Repo-mutating git commands should prompt for approval via the built-in terminal approval mechanism as it did before the October 2026 update.

Additional context

Environment

• OS: Windows 11
• VS Code: 1.140.0
• Copilot CLI: Manual Approval mode
• Copilot CLI version: 1.0.98
• VS Code Copilot Chat: New Copilot agent harness (October 2026 migration)
• Chat : Agent: Sandbox Enabled: off