The Pulse
GitHub Adds Project-Level Sandboxing to Its Copilot App
GitHub announced local sandboxing for the GitHub Copilot app on September 23. Users can configure it per project for local repository and working-tree sessions.
AI.info Team ·
GitHub announced local sandboxing for the GitHub Copilot app on September 23. Users can configure it per project for local repository and working-tree sessions. Sandboxing helps reduce the potential impact of unintended commands by limiting access to files, network resources and credentials on the user’s machine. The feature is in public preview, off by default and subject to change.
Project settings define the requested limits
Users can configure filesystem access with lists of additional read/write folders, additional read-only folders and denied folders. The settings distinguish folders the session can read and write from those it can read but not write, as well as folders it should be denied access to.
Network settings cover outbound internet and local network access. Credential settings specify whether a session can use Git credentials for authenticated HTTPS Git operations and GitHub CLI credentials for GitHub CLI authentication. These are separate categories of settings: filesystem access, network access and credentials.
The project settings describe the policy the app requests when a sandboxed session starts. They do not guarantee that the effective policy will be identical: enterprise-managed settings can make it more restrictive. If the operating system cannot enforce the requested policy, the sandboxed shell returns an error rather than running without a sandbox.
The sandbox applies to tools an agent invokes on the user’s behalf; it does not move a local session off the machine. A working tree keeps concurrent sessions’ branches and files separate, but by itself does not restrict what commands can access elsewhere on the computer. Local sandboxing adds that access boundary.
New sessions use the project default
To enable the default, a user opens the app’s settings, selects a project and turns on “Sandbox new sessions” under “Sandbox.” The setting applies to new sessions in that project, not to sessions already running. Changes to filesystem, network or credential settings also apply to new sessions, or when an existing session restarts.
For an active local session, users can enter /sandbox on to enable sandboxing for that session. This does not change the project default. The project-level setting and the active-session command therefore serve different purposes: one sets the default for new sessions, while the other changes the current local session.
App settings are separate from CLI settings
The app’s local sandboxing does not apply to cloud sandbox sessions or sessions running on a remote host. GitHub Copilot app and Copilot CLI sandbox settings are configured separately, so configuring one does not change the other.
The announcement describes the app feature as a way to configure local sandboxing per project, with the policy requested when a sandboxed session starts. It also specifies how users enable the project default, how they can enable sandboxing for an active session, and what happens if the operating system cannot enforce the requested policy. GitHub says the feature is in public preview and may change. Read GitHub’s announcement.