Expose managed approval requirement on permission requests

dotnet/README.md

@@ -37,7 +37,7 @@ using GitHub.Copilot;
 await using var client = new CopilotClient();
 await client.StartAsync();
 
-// Create a session (OnPermissionRequest is optional; ApproveAll allows every tool)
+// ApproveAll is only valid when managed settings are disabled.
 await using var session = await client.CreateSessionAsync(new SessionConfig
 {
     Model = "gpt-5",
@@ -132,7 +132,7 @@ Create a new conversation session.
 - `Streaming` - Enable streaming of response chunks (default: false)
 - `InfiniteSessions` - Configure automatic context compaction (see below)
 - `EnableSessionStore` - Enables the cross-session store for search and retrieval across sessions. When unset in `CopilotClientMode.CopilotCli`, the runtime default applies (enabled). In `CopilotClientMode.Empty`, defaults to disabled.
-- `OnPermissionRequest` - Optional handler called before each tool execution to approve or deny it. When omitted, permission requests are emitted as events and left pending for manual resolution. Use `PermissionHandler.ApproveAll` to allow everything, or provide a custom function for fine-grained control. See [Permission Handling](#permission-handling) section.
+- `OnPermissionRequest` - Optional handler called before each tool execution to approve or deny it. When omitted, permission requests are emitted as events and left pending for manual resolution. `PermissionHandler.ApproveAll` approves requests when managed settings are disabled and throws when `EnableManagedSettings` is true. Custom handlers can inspect `ManagedApprovalRequired` for human-facing confirmation logic. See [Permission Handling](#permission-handling) section.
 - `OnUserInputRequest` - Handler for user input requests from the agent (enables ask_user tool). See [User Input Requests](#user-input-requests) section.
 - `Hooks` - Hook handlers for session lifecycle events. See [Session Hooks](#session-hooks) section.
 
@@ -782,7 +782,7 @@ An `OnPermissionRequest` handler is optional when you create or resume a session
 
 ### Approve All (simplest)
 
-Use the built-in `PermissionHandler.ApproveAll` helper to allow every tool call without any checks:
+Use the built-in `PermissionHandler.ApproveAll` helper to approve ordinary permission requests automatically:
 
 ```csharp
 using GitHub.Copilot;
@@ -794,16 +794,23 @@ var session = await client.CreateSessionAsync(new SessionConfig
 });
 ```
 
+When `EnableManagedSettings` is true for the session, `ApproveAll` throws on the first permission request. Use a custom handler for managed sessions; request-level `ManagedApprovalRequired` remains available for human-facing confirmation logic.
+
 ### Custom Permission Handler
 
-Provide your own permission handler (`Func<PermissionRequest, PermissionInvocation, Task<PermissionDecision>>`) to inspect each request and apply custom logic:
+Provide your own permission handler (`Func<PermissionRequest, PermissionInvocation, Task<PermissionDecision>>`) to inspect each request and apply custom logic. Check `ManagedApprovalRequired` before any automatic approval:
 
 ```csharp
 var session = await client.CreateSessionAsync(new SessionConfig
 {
     Model = "gpt-5",
     OnPermissionRequest = async (request, invocation) =>
     {
+        if (request.ManagedApprovalRequired is true)
+        {
+            return PermissionDecision.NoResult();
+        }
+
         // Pattern-match on the discriminated PermissionRequest union to access
         // per-kind fields (FullCommandText, Path, ToolName, …).
         return request switch

dotnet/src/Client.cs

@@ -783,7 +783,9 @@ private CopilotSession InitializeSession(
             _logger,
             this);
         session.RegisterTools(config.Tools ?? []);
-        session.RegisterPermissionHandler(config.OnPermissionRequest);
+        session.RegisterPermissionHandler(
+            config.OnPermissionRequest,
+            config.EnableManagedSettings is true);
         session.RegisterMcpAuthHandler(config.OnMcpAuthRequest);
         session.RegisterCommands(config.Commands);
         session.RegisterElicitationHandler(config.OnElicitationRequest);

dotnet/src/PermissionHandlers.cs

@@ -9,7 +9,34 @@ namespace GitHub.Copilot;
 /// <summary>Provides pre-built permission request handlers.</summary>
 public static class PermissionHandler
 {
-    /// <summary>A permission handler that approves all permission requests.</summary>
+    /// <summary>
+    /// A permission handler that approves requests when managed settings are disabled.
+    /// </summary>
     public static Func<PermissionRequest, PermissionInvocation, Task<PermissionDecision>> ApproveAll { get; } =
-        (_, _) => Task.FromResult<PermissionDecision>(PermissionDecision.ApproveOnce());
+        (request, invocation) => invocation.ManagedSettingsEnabled
+            ? Task.FromException<PermissionDecision>(
+                new InvalidOperationException("ApproveAll cannot be used when managed settings are enabled"))
+            : RequiresManagedApproval(request)
+                ? Task.FromResult(PermissionDecision.NoResult())
+                : Task.FromResult(PermissionDecision.ApproveOnce());
+
+    private static bool RequiresManagedApproval(PermissionRequest request)
+    {
+        if (request.ManagedApprovalRequired is true)
+        {
+            return true;
+        }
+
+        return request.GetType() == typeof(PermissionRequest)
+            && request.Kind is not ("shell"
+                or "write"
+                or "read"
+                or "mcp"
+                or "url"
+                or "memory"
+                or "custom-tool"
+                or "hook"
+                or "extension-management"
+                or "extension-permission-access");
+    }
 }

dotnet/src/Session.cs

@@ -63,6 +63,7 @@
     private readonly CopilotClient _parentClient;
 
     private volatile Func<PermissionRequest, PermissionInvocation, Task<PermissionDecision>>? _permissionHandler;
+    private bool _managedSettingsEnabled;
     private volatile Func<McpAuthContext, Task<McpAuthResult?>>? _mcpAuthHandler;
     private volatile Func<UserInputRequest, UserInputInvocation, Task<UserInputResponse>>? _userInputHandler;
     private volatile Func<ElicitationContext, Task<ElicitationResult>>? _elicitationHandler;
@@ -557,13 +558,17 @@
     /// Registers a handler for permission requests.
     /// </summary>
     /// <param name="handler">The permission handler function.</param>
+    /// <param name="managedSettingsEnabled">Whether managed settings are enabled for the session.</param>
     /// <remarks>
     /// When the assistant needs permission to perform certain actions (e.g., file operations),
     /// this handler is called to approve or deny the request.
     /// </remarks>
-    internal void RegisterPermissionHandler(Func<PermissionRequest, PermissionInvocation, Task<PermissionDecision>>? handler)
+    internal void RegisterPermissionHandler(
+        Func<PermissionRequest, PermissionInvocation, Task<PermissionDecision>>? handler,
+        bool managedSettingsEnabled)
     {
         _permissionHandler = handler;
+        _managedSettingsEnabled = managedSettingsEnabled;
     }
 
     internal void RegisterMcpAuthHandler(Func<McpAuthContext, Task<McpAuthResult?>>? handler)
@@ -590,7 +595,8 @@
 
         var invocation = new PermissionInvocation
         {
-            SessionId = SessionId
+            SessionId = SessionId,
+            ManagedSettingsEnabled = _managedSettingsEnabled
         };
 
         var permissionTimestamp = Stopwatch.GetTimestamp();
@@ -932,7 +938,8 @@
         {
             var invocation = new PermissionInvocation
             {
-                SessionId = SessionId
+                SessionId = SessionId,
+                ManagedSettingsEnabled = _managedSettingsEnabled
             };
 
             var permissionTimestamp = Stopwatch.GetTimestamp();
@@ -954,21 +961,22 @@
                 SessionId,
                 requestId);
         }
-        catch (Exception)
+        catch (Exception ex)
         {
+            _logger.LogError(ex, "Permission handler or response delivery failed. SessionId={SessionId}, RequestId={RequestId}", SessionId, requestId);
             try
             {
                 await Rpc.Permissions.HandlePendingPermissionRequestAsync(requestId, PermissionDecision.UserNotAvailable());
             }
             catch (IOException)
             {
                 // Connection lost or RPC error — nothing we can do
             }
             catch (ObjectDisposedException)
             {
                 // Connection already disposed — nothing we can do
             }
         }
     }
 
     /// <summary>

dotnet/src/Types.cs

@@ -833,6 +833,9 @@ public sealed class PermissionInvocation
     /// Identifier of the session that triggered the permission request.
     /// </summary>
     public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Whether managed settings are enabled for this session.</summary>
+    public bool ManagedSettingsEnabled { get; set; }
 }
 
 // ============================================================================

dotnet/test/Unit/PermissionHandlerTests.cs

@@ -0,0 +1,127 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+using System.Text.Json;
+using System.Text.Json.Serialization.Metadata;
+using GitHub.Copilot.Rpc;
+using Xunit;
+
+namespace GitHub.Copilot.Test.Unit;
+
+public class PermissionHandlerTests
+{
+    private static readonly JsonSerializerOptions SerializerOptions = new()
+    {
+        TypeInfoResolver = new DefaultJsonTypeInfoResolver(),
+    };
+
+    [Fact]
+    public void PermissionEventExposesManagedApprovalRequired()
+    {
+        const string json = """
+            {
+              "permissionRequest": {
+                "kind": "read",
+                "intention": "Read managed content",
+                "path": "/workspace/file.txt",
+                "managedApprovalRequired": true
+              },
+              "requestId": "permission-1"
+            }
+            """;
+
+        var data = JsonSerializer.Deserialize<PermissionRequestedData>(
+            json,
+            SerializerOptions);
+
+        Assert.NotNull(data);
+        var request = Assert.IsType<PermissionRequestRead>(data.PermissionRequest);
+        Assert.True(request.ManagedApprovalRequired);
+        PermissionRequest genericRequest = request;
+        Assert.True(genericRequest.ManagedApprovalRequired);
+    }
+
+    [Fact]
+    public async Task ApproveAllThrowsWhenManagedSettingsEnabled()
+    {
+        var request = new PermissionRequest
+        {
+            Kind = "read",
+            ManagedApprovalRequired = true,
+        };
+
+        await Assert.ThrowsAsync<InvalidOperationException>(() =>
+            PermissionHandler.ApproveAll(request, new PermissionInvocation
+            {
+                ManagedSettingsEnabled = true,
+            }));
+    }
+
+    [Fact]
+    public async Task ApproveAllApprovesOrdinaryRequest()
+    {
+        var request = new PermissionRequest { Kind = "read" };
+
+        var decision = await PermissionHandler.ApproveAll(request, new PermissionInvocation());
+
+        Assert.IsType<PermissionDecisionApproveOnce>(decision);
+    }
+
+    [Fact]
+    public async Task ApproveAllLeavesManagedRequestPendingWhenSessionFlagIsAbsent()
+    {
+        var request = new PermissionRequestRead
+        {
+            Intention = "Read managed content",
+            ManagedApprovalRequired = true,
+            Path = "/workspace/file.txt",
+        };
+
+        var decision = await PermissionHandler.ApproveAll(request, new PermissionInvocation());
+
+        Assert.IsType<PermissionDecisionNoResult>(decision);
+    }
+
+    [Fact]
+    public async Task ApproveAllLeavesManagedKnownVariantPendingThroughBaseType()
+    {
+        PermissionRequest request = new PermissionRequestRead
+        {
+            Intention = "Read managed content",
+            ManagedApprovalRequired = true,
+            Path = "/workspace/file.txt",
+        };
+
+        var decision = await PermissionHandler.ApproveAll(request, new PermissionInvocation());
+
+        Assert.IsType<PermissionDecisionNoResult>(decision);
+    }
+
+    [Fact]
+    public void DerivedManagedApprovalAccessorForwardsToBaseStorage()
+    {
+        var request = new PermissionRequestRead
+        {
+            Intention = "Read managed content",
+            ManagedApprovalRequired = true,
+            Path = "/workspace/file.txt",
+        };
+
+        PermissionRequest genericRequest = request;
+        Assert.True(genericRequest.ManagedApprovalRequired);
+
+        genericRequest.ManagedApprovalRequired = false;
+        Assert.False(request.ManagedApprovalRequired);
+    }
+
+    [Fact]
+    public async Task ApproveAllLeavesUnknownRequestPending()
+    {
+        var request = new PermissionRequest { Kind = "future-managed-kind" };
+
+        var decision = await PermissionHandler.ApproveAll(request, new PermissionInvocation());
+
+        Assert.IsType<PermissionDecisionNoResult>(decision);
+    }
+}