Fix Critical Privilege / Permission Bypass in Rust

[DrHazemAli]

I discovered and fixed a critical privilege/permission bypass bug in the Rust SDK’s empty-mode session startup flow. Before this fix, ClientMode::Empty left config discovery unset during session creation, so the CLI could fall back to its default behavior and discover workspace MCP config before any permission decision was made.

Flow

1. The app creates a session with ClientMode::Empty.
2. Session creation builds the wire payload.
3. enable_config_discovery was previously omitted.
4. The CLI applied its default and discovered workspace MCP config.
5. That happened before any tool permission request or approval flow.

flowchart TD
  A[User app / Rust SDK] --> B[Client::create_session]
  B --> C[SessionConfig]
  C --> D[wire payload for session.create]
  D --> E[Copilot CLI runtime]
  E --> F[MCP config discovery]
  F --> G[Workspace MCP servers / tools]

  H[Permission handler] --> I[permission.requested]
  I --> J[App approves / denies tool use]

  E -. before fix .-> F
  H -. normal tool flow .-> I

Loading

Threat

This created an unsafe-defaults startup bypass. A caller expecting empty mode to be conservative could still end up with workspace MCP config discovery happening implicitly, which could expose configured tools or trigger config-driven behavior without the intended approval gate. This is a security issue because starting a malicious workspace-controlled MCP command is itself code execution during initialization.

What Fixed

• Empty mode now explicitly disables config discovery during session creation.
• Added a regression test to lock in the behavior.
• Kept the fix scoped to the session startup path that controlled the bypass.