Skip to content

Bug/Feat: Sandbox config to selectively enable tools #4298

Description

@dylbarne

Describe the feature or problem you'd like to solve

Feature Request: Sandbox config in settings.json to selectively enable tools, and/or whitelist bundled copilot package tools

Proposed solution

potentially have some tools { ... } within sandbox section in settings.json to enable allowed tools/apps/executables
(or provide documentation on how best to accomplish this if fits somehow in current schema)

more specifically, encountered this around copilot bundled rg ripgrep, while in sandbox enabled:

Search "xunit\.V3" (sandboxed)  sh: 1:~/.copilot/pkg/linux-x64/1.0.75/ripgrep/bin/linux-x64/rg: not found

Search is blocked because the bundled  rg  executable is unavailable under the current sandbox policy.
Please review  /sandbox  and retry.

ideally specifically around this, executable packages that are bundled within distributed copilot are just marked "safe" by default and end user does not need to do anything additional to whitelist to allow these in sandbox mode

Example prompts or workflows

No response

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    area:configurationConfig files, instruction files, settings, and environment variablesarea:permissionsTool approval, security boundaries, sandbox mode, and directory restrictionsarea:toolsBuilt-in tools: file editing, shell, search, LSP, git, and tool call behavior

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions