Auto-approve in Copilot multi-chat is session-scoped and applies across chats

[TylerLeonhardt]

• Copilot Chat Extension Version:
• VS Code Version:
• OS Version:
• Feature: multi-chat / auto-approve behavior
• Selected model:

Description

When using Copilot's multi-chat feature, setting Auto-approve for one chat appears to enable Auto-approve for every other chat in the same session. Auto-approve seems to be scoped to the session (effectively the CWD) rather than to an individual chat.

Actual Behavior

1. Open a multi-chat session.
2. In Chat A, enable Auto-approve.
3. Switch to Chat B in the same session.
4. Notice Chat B has that same auto-approve value

Expected Behavior

Auto-approve should be scoped per chat. Enabling Auto-approve in Chat A should not grant bypass approvals to other chats in the same session unless the user explicitly enables it for those chats.

Steps to Reproduce

1. Start a Copilot multi-chat session.
2. In one chat, enable Auto-approve.
3. Start a different chat in the same session and attempt an action that would normally require approval (e.g., install or run a command that needs permission).
4. Observe whether the action is auto-approved.

Impact

This behavior can cause unintended privilege escalation: a side-chat where a user is experimenting or asking to install software could inherit bypass approvals from another chat, allowing actions without the user's explicit consent.

Notes / Additional Context

This was observed in internal discussion and appears to be a design/bug where configuration like Auto-approve and permission mode are session-scoped instead of chat-scoped. The session concept appears tied to the CWD while chat-related settings (model/agent selection) are chat-scoped. This mismatch is surprising and likely a bug.

Please investigate scoping of Auto-approve and permission mode for multi-chat — they should be chat-scoped.

View original Slack conversation

[TylerLeonhardt]

The root fix here is a protocol-level gap: AHP only models config at the session level (SessionState.config / session/configChanged), with no per-chat equivalent — so approval config (permission mode / auto-approve) can't be scoped per chat the way model/agent already are.

Filed the protocol addition (a generic ChatConfig: ChatState.config, a chat/configChanged action, and a chatScoped schema flag) here: microsoft/agent-host-protocol#335. That needs to land first; the VS Code side then flags permissionMode/autoApprove as chatScoped and routes the picker to the active chat channel.

(Groundwork for mid-turn forwarding already went in via #321691 / #325726.)