fix(sdk): enforce safeguards for injected policy

joshspicer · joshspicer · commit 5411c8857628 · 2026-08-03T08:08:44.000-07:00
Treat direct managedSettings injection as a managed session in every language SDK and document the compatible-runtime requirement.

Co-authored-by: Copilot App &lt;223556219+Copilot@users.noreply.github.com&gt;

Copilot-Session: d5d4d699-33e2-4a55-9d48-57d2e483dd3d
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,7 +11,7 @@ See [GitHub Releases](https://github.com/github/copilot-sdk/releases) for the fu
 
 Session create and resume accept a new optional `managedSettings` option that injects an enterprise permissions policy at session startup, alongside the existing `enableManagedSettings` self-fetch flag. The current contract is permissions-only: `disableBypassPermissionsMode` (the literal `"disable"`), plus `deny`, `ask`, and `allow` rule lists. The layer composes restrictively with any server- or device-level managed settings (deny/ask are unioned, every present allow list must admit a tool, and `disableBypassPermissionsMode` is deny-wins).
 
-This layer is startup-only and is not persisted with the session, so it must be re-supplied on resume to remain in effect; omitting it on resume clears the previously injected layer. It can be combined with `enableManagedSettings`. Older runtimes that do not recognize the field reject session creation (fail-closed) rather than silently ignoring it, so it requires a Copilot CLI runtime whose schema includes managed settings.
+This layer is startup-only and is not persisted with the session, so it must be re-supplied on resume to remain in effect; omitting it on resume clears the previously injected layer. It can be combined with `enableManagedSettings`. Older runtimes may ignore the additive field, so hosts must not rely on injected policy until they ship a Copilot CLI runtime whose schema includes managed settings.
 
 ```ts
 const session = await client.createSession({
diff --git a/dotnet/src/Client.cs b/dotnet/src/Client.cs
@@ -785,7 +785,7 @@ private CopilotSession InitializeSession(
         session.RegisterTools(config.Tools ?? []);
         session.RegisterPermissionHandler(
             config.OnPermissionRequest,
-            config.EnableManagedSettings is true);
+            config.EnableManagedSettings is true || config.ManagedSettings is not null);
         session.RegisterMcpAuthHandler(config.OnMcpAuthRequest);
         session.RegisterCommands(config.Commands);
         session.RegisterElicitationHandler(config.OnElicitationRequest);
diff --git a/dotnet/src/Types.cs b/dotnet/src/Types.cs
@@ -3033,8 +3033,8 @@ public sealed class ManagedSettingsPermissions
 /// re-supplied on <see cref="CopilotClient.ResumeSessionAsync"/> to remain in
 /// effect; omitting it on resume clears the previously injected layer. It can be
 /// combined with <see cref="SessionConfigBase.EnableManagedSettings"/>. Older
-/// runtimes that do not recognize the <c>managedSettings</c> field reject session
-/// creation (fail-closed).
+/// runtimes may ignore this additive field, so hosts must not rely on injected
+/// policy until they ship a compatible runtime.
 /// </remarks>
 public sealed class ManagedSettings
 {
diff --git a/dotnet/test/Unit/ClientSessionLifetimeTests.cs b/dotnet/test/Unit/ClientSessionLifetimeTests.cs
@@ -459,7 +459,6 @@ public async Task CreateSessionAsync_Serializes_ManagedSettings_Permissions()
 
         await using var session = await client.CreateSessionAsync(new SessionConfig
         {
-            EnableManagedSettings = true,
             ManagedSettings = new ManagedSettings
             {
                 Permissions = new ManagedSettingsPermissions
@@ -474,7 +473,10 @@ public async Task CreateSessionAsync_Serializes_ManagedSettings_Permissions()
         });
 
         var request = Assert.Single(server.Requests, request => request.Method == "session.create");
-        Assert.True(request.Params.GetProperty("enableManagedSettings").GetBoolean());
+        Assert.False(request.Params.TryGetProperty("enableManagedSettings", out _));
+        var managedField = typeof(CopilotSession).GetField("_managedSettingsEnabled", BindingFlags.Instance | BindingFlags.NonPublic)
+            ?? throw new InvalidOperationException("Managed settings field was not found.");
+        Assert.True((bool)managedField.GetValue(session)!);
         var permissions = request.Params.GetProperty("managedSettings").GetProperty("permissions");
         Assert.Equal("disable", permissions.GetProperty("disableBypassPermissionsMode").GetString());
         Assert.Equal("shell(rm*)", Assert.Single(permissions.GetProperty("deny").EnumerateArray()).GetString());
diff --git a/go/client.go b/go/client.go
@@ -750,6 +750,10 @@ func extractTransformCallbacks(config *SystemMessageConfig) (*SystemMessageConfi
 	return wireConfig, callbacks
 }
 
+func hasManagedSettings(enableManagedSettings *bool, managedSettings *ManagedSettings) bool {
+	return (enableManagedSettings != nil && *enableManagedSettings) || managedSettings != nil
+}
+
 func (c *Client) CreateSession(ctx context.Context, config *SessionConfig) (*Session, error) {
 	if config == nil {
 		config = &SessionConfig{}
@@ -913,7 +917,7 @@ func (c *Client) CreateSession(ctx context.Context, config *SessionConfig) (*Ses
 			sessionID,
 			c.client,
 			"",
-			config.EnableManagedSettings != nil && *config.EnableManagedSettings,
+			hasManagedSettings(config.EnableManagedSettings, config.ManagedSettings),
 		)
 
 		s.registerTools(config.Tools)
@@ -1242,7 +1246,7 @@ func (c *Client) ResumeSessionWithOptions(ctx context.Context, sessionID string,
 		sessionID,
 		c.client,
 		"",
-		config.EnableManagedSettings != nil && *config.EnableManagedSettings,
+		hasManagedSettings(config.EnableManagedSettings, config.ManagedSettings),
 	)
 
 	session.registerTools(config.Tools)
diff --git a/go/client_test.go b/go/client_test.go
@@ -3442,6 +3442,15 @@ func TestSessionRequests_ManagedSettings(t *testing.T) {
 		"allow":                        []any{"Read(**)"},
 	}
 
+	t.Run("direct injection enables managed safeguards", func(t *testing.T) {
+		if !hasManagedSettings(nil, settings) {
+			t.Fatal("expected injected managed settings to enable managed safeguards")
+		}
+		if hasManagedSettings(nil, nil) {
+			t.Fatal("expected an ordinary session to remain unmanaged")
+		}
+	})
+
 	t.Run("includes managedSettings on create when set", func(t *testing.T) {
 		req := createSessionRequest{EnableManagedSettings: Bool(true), ManagedSettings: settings}
 		data, err := json.Marshal(req)
diff --git a/java/src/main/java/com/github/copilot/SessionRequestBuilder.java b/java/src/main/java/com/github/copilot/SessionRequestBuilder.java
@@ -372,7 +372,8 @@ static void configureSession(CopilotSession session, SessionConfig config) {
         if (config.getOnPermissionRequest() != null) {
             session.registerPermissionHandler(config.getOnPermissionRequest());
         }
-        session.setManagedSettingsEnabled(config.getEnableManagedSettings().orElse(false));
+        session.setManagedSettingsEnabled(
+                config.getEnableManagedSettings().orElse(false) || config.getManagedSettings() != null);
         if (config.getOnMcpAuthRequest() != null) {
             session.registerMcpAuthHandler(config.getOnMcpAuthRequest());
         }
@@ -423,7 +424,8 @@ static void configureSession(CopilotSession session, ResumeSessionConfig config)
         if (config.getOnPermissionRequest() != null) {
             session.registerPermissionHandler(config.getOnPermissionRequest());
         }
-        session.setManagedSettingsEnabled(config.getEnableManagedSettings().orElse(false));
+        session.setManagedSettingsEnabled(
+                config.getEnableManagedSettings().orElse(false) || config.getManagedSettings() != null);
         if (config.getOnMcpAuthRequest() != null) {
             session.registerMcpAuthHandler(config.getOnMcpAuthRequest());
         }
diff --git a/java/src/test/java/com/github/copilot/ManagedSettingsTest.java b/java/src/test/java/com/github/copilot/ManagedSettingsTest.java
@@ -41,4 +41,16 @@ void rejectsUnsupportedBypassValue() {
         var permissions = new ManagedSettingsPermissions();
         assertThrows(IllegalArgumentException.class, () -> permissions.setDisableBypassPermissionsMode("enable"));
     }
+
+    @Test
+    void directInjectionEnablesManagedSafeguards() throws Exception {
+        var session = new CopilotSession("session-1", null);
+        var settings = new ManagedSettings().setPermissions(new ManagedSettingsPermissions());
+
+        SessionRequestBuilder.configureSession(session, new SessionConfig().setManagedSettings(settings));
+
+        var field = CopilotSession.class.getDeclaredField("managedSettingsEnabled");
+        field.setAccessible(true);
+        assertEquals(true, field.getBoolean(session));
+    }
 }
diff --git a/nodejs/src/client.ts b/nodejs/src/client.ts
@@ -1467,7 +1467,9 @@ export class CopilotClient {
                 this.onGetTraceContext,
                 {
                     mcpAuthHandler: config.onMcpAuthRequest,
-                    managedSettingsEnabled: config.enableManagedSettings,
+                    managedSettingsEnabled:
+                        config.enableManagedSettings === true ||
+                        config.managedSettings !== undefined,
                 }
             );
             s.registerTools(config.tools);
@@ -1706,7 +1708,8 @@ export class CopilotClient {
             this.onGetTraceContext,
             {
                 mcpAuthHandler: config.onMcpAuthRequest,
-                managedSettingsEnabled: config.enableManagedSettings,
+                managedSettingsEnabled:
+                    config.enableManagedSettings === true || config.managedSettings !== undefined,
             }
         );
         session.registerTools(config.tools);
diff --git a/nodejs/src/types.ts b/nodejs/src/types.ts
@@ -2586,8 +2586,9 @@ export interface SessionConfigBase {
      * when both are supplied the injected, server, and device restrictions all
      * apply.
      *
-     * Requires a Copilot runtime whose RPC schema includes `managedSettings`;
-     * older runtimes reject the unknown field rather than silently ignoring it.
+     * Requires a Copilot runtime whose RPC schema includes `managedSettings`.
+     * Older runtimes may ignore this additive field, so hosts must not rely on
+     * injected policy until they ship a compatible runtime.
      */
     managedSettings?: ManagedSettings;
 
diff --git a/nodejs/test/client.test.ts b/nodejs/test/client.test.ts
@@ -3594,6 +3594,25 @@ describe("managedSettings serialization", () => {
         });
     });
 
+    it("marks directly injected sessions as managed", async () => {
+        const client = new CopilotClient();
+        await client.start();
+        onTestFinished(() => stopClient(client));
+        vi.spyOn((client as any).connection!, "sendRequest").mockImplementation(
+            async (method: string, params: any) => {
+                if (method === "session.create") return { sessionId: params.sessionId };
+                throw new Error(`Unexpected method: ${method}`);
+            }
+        );
+
+        const session = await client.createSession({
+            onPermissionRequest: approveAll,
+            managedSettings: { permissions: { deny: ["Edit(/secrets/**)"] } },
+        });
+
+        expect((session as any).managedSettingsEnabled).toBe(true);
+    });
+
     it("omits managedSettings when not supplied", async () => {
         const params = await captureCreateParams({});
         expect(params.managedSettings).toBeUndefined();
diff --git a/python/copilot/client.py b/python/copilot/client.py
@@ -2634,7 +2634,8 @@ def _initialize_session(sid: str) -> CopilotSession:
                 sid,
                 self._client,
                 workspace_path=None,
-                managed_settings_enabled=enable_managed_settings is True,
+                managed_settings_enabled=enable_managed_settings is True
+                or managed_settings is not None,
             )
             if self._session_fs_config:
                 if create_session_fs_handler is None:
@@ -3291,7 +3292,8 @@ async def resume_session(
             session_id,
             self._client,
             workspace_path=None,
-            managed_settings_enabled=enable_managed_settings is True,
+            managed_settings_enabled=enable_managed_settings is True
+            or managed_settings is not None,
         )
         if self._session_fs_config:
             if create_session_fs_handler is None:
diff --git a/python/test_client.py b/python/test_client.py
@@ -643,14 +643,16 @@ async def mock_request(method, params, **kwargs):
                     )
                 ),
             )
-            await client.resume_session(
+            resumed_session = await client.resume_session(
                 session.session_id,
                 on_permission_request=PermissionHandler.approve_all,
                 managed_settings=ManagedSettings(
                     permissions=ManagedSettingsPermissions(ask=["Domain(publish.example)"])
                 ),
             )
 
+            assert session._managed_settings_enabled is True
+            assert resumed_session._managed_settings_enabled is True
             assert captured["session.create"]["enableManagedSettings"] is True
             assert captured["session.create"]["managedSettings"] == {
                 "permissions": {
diff --git a/rust/src/session.rs b/rust/src/session.rs
@@ -66,6 +66,13 @@ pub(crate) struct SessionHandlers {
     pub tools: Arc<HashMap<String, Arc<dyn crate::tool::ToolHandler>>>,
 }
 
+fn has_managed_settings(
+    enable_managed_settings: Option<bool>,
+    managed_settings: Option<&crate::types::ManagedSettings>,
+) -> bool {
+    enable_managed_settings == Some(true) || managed_settings.is_some()
+}
+
 /// Shared state between a [`Session`] and its event loop, used by [`Session::send_and_wait`].
 struct IdleWaiter {
     tx: oneshot::Sender<Result<Option<SessionEvent>, Error>>,
@@ -899,7 +906,10 @@ impl Client {
         );
         let handlers = SessionHandlers {
             permission: permission_handler,
-            managed_settings_enabled: wire.enable_managed_settings == Some(true),
+            managed_settings_enabled: has_managed_settings(
+                wire.enable_managed_settings,
+                wire.managed_settings.as_ref(),
+            ),
             elicitation: runtime.elicitation_handler.take(),
             mcp_auth: runtime.mcp_auth_handler.take(),
             user_input: runtime.user_input_handler.take(),
@@ -1169,7 +1179,10 @@ impl Client {
         );
         let handlers = SessionHandlers {
             permission: permission_handler,
-            managed_settings_enabled: wire.enable_managed_settings == Some(true),
+            managed_settings_enabled: has_managed_settings(
+                wire.enable_managed_settings,
+                wire.managed_settings.as_ref(),
+            ),
             elicitation: runtime.elicitation_handler.take(),
             mcp_auth: runtime.mcp_auth_handler.take(),
             user_input: runtime.user_input_handler.take(),
@@ -2550,9 +2563,16 @@ fn inject_transform_sections_resume(
 mod tests {
     use serde_json::json;
 
-    use super::{notification_permission_payload, permission_request_data};
+    use super::{has_managed_settings, notification_permission_payload, permission_request_data};
     use crate::handler::PermissionResult;
 
+    #[test]
+    fn direct_injection_enables_managed_safeguards() {
+        let settings = crate::types::ManagedSettings::default();
+        assert!(has_managed_settings(None, Some(&settings)));
+        assert!(!has_managed_settings(None, None));
+    }
+
     #[test]
     fn notification_payload_suppresses_no_result() {
         assert!(notification_permission_payload(&PermissionResult::NoResult).is_none());
diff --git a/rust/src/types.rs b/rust/src/types.rs
@@ -1778,8 +1778,9 @@ pub struct ManagedSettingsPermissions {
 /// This layer is startup-only and is not persisted with the session. It must be
 /// re-supplied on resume to remain in effect; omitting it on resume clears the
 /// previously injected layer. It can be combined with
-/// [`SessionConfig::enable_managed_settings`]. Older runtimes that do not
-/// recognize the `managedSettings` field reject session creation (fail-closed).
+/// [`SessionConfig::enable_managed_settings`]. Older runtimes may ignore this
+/// additive field, so hosts must not rely on injected policy until they ship a
+/// compatible runtime.
 #[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct ManagedSettings {

Original file line number	Diff line number	Diff line change
`@@ -372,7 +372,8 @@ static void configureSession(CopilotSession session, SessionConfig config) {`
`372`	`372`	`if (config.getOnPermissionRequest() != null) {`
`373`	`373`	`session.registerPermissionHandler(config.getOnPermissionRequest());`
`374`	`374`	`}`
`375`		`- session.setManagedSettingsEnabled(config.getEnableManagedSettings().orElse(false));`
	`375`	`+ session.setManagedSettingsEnabled(`
	`376`	`+ config.getEnableManagedSettings().orElse(false) \|\| config.getManagedSettings() != null);`
`376`	`377`	`if (config.getOnMcpAuthRequest() != null) {`
`377`	`378`	`session.registerMcpAuthHandler(config.getOnMcpAuthRequest());`
`378`	`379`	`}`
`@@ -423,7 +424,8 @@ static void configureSession(CopilotSession session, ResumeSessionConfig config)`
`423`	`424`	`if (config.getOnPermissionRequest() != null) {`
`424`	`425`	`session.registerPermissionHandler(config.getOnPermissionRequest());`
`425`	`426`	`}`
`426`		`- session.setManagedSettingsEnabled(config.getEnableManagedSettings().orElse(false));`
	`427`	`+ session.setManagedSettingsEnabled(`
	`428`	`+ config.getEnableManagedSettings().orElse(false) \|\| config.getManagedSettings() != null);`
`427`	`429`	`if (config.getOnMcpAuthRequest() != null) {`
`428`	`430`	`session.registerMcpAuthHandler(config.getOnMcpAuthRequest());`
`429`	`431`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1467,7 +1467,9 @@ export class CopilotClient {`
`1467`	`1467`	`this.onGetTraceContext,`
`1468`	`1468`	`{`
`1469`	`1469`	`mcpAuthHandler: config.onMcpAuthRequest,`
`1470`		`- managedSettingsEnabled: config.enableManagedSettings,`
	`1470`	`+ managedSettingsEnabled:`
	`1471`	`+ config.enableManagedSettings === true \|\|`
	`1472`	`+ config.managedSettings !== undefined,`
`1471`	`1473`	`}`
`1472`	`1474`	`);`
`1473`	`1475`	`s.registerTools(config.tools);`
`@@ -1706,7 +1708,8 @@ export class CopilotClient {`
`1706`	`1708`	`this.onGetTraceContext,`
`1707`	`1709`	`{`
`1708`	`1710`	`mcpAuthHandler: config.onMcpAuthRequest,`
`1709`		`- managedSettingsEnabled: config.enableManagedSettings,`
	`1711`	`+ managedSettingsEnabled:`
	`1712`	`+ config.enableManagedSettings === true \|\| config.managedSettings !== undefined,`
`1710`	`1713`	`}`
`1711`	`1714`	`);`
`1712`	`1715`	`session.registerTools(config.tools);`