CM-64462: add GitHub Copilot (VS Code) support to AI guardrails#498
Merged
Conversation
New copilot IDE integration: hooks install to ~/.copilot/hooks/cycode.json
(Copilot-native format, also read by Copilot CLI and the cloud coding agent),
scan parsing for the VS Code payload dialect (prompt / read_file / MCP tools),
session context with MCP config and plugin inventory from all three plugin
sources (CLI registry, VS Code registry, chat.pluginLocations).
Copilot hooks have no matchers, so the no-handler fast path in scan_command
now resolves before any policy/client work, and unmatched tools return a
neutral {} that leaves VS Code's own permission flow intact.
MCP tool names arrive as mcp_<prefix>_<tool> where the prefix derives from
the server's self-reported handshake name; known config names (incl. plugin
servers) match via normalized variants, anything else reports the unsplit
remainder rather than a guessed split.
Also: claude-code payload matching now requires transcript_path (VS Code
Copilot sends near-identical payloads without it), and cursor/codex report
mode no longer appends the shell '&' on Windows where nothing detaches
safely (cmd no-op, PowerShell parse error).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.
Tip: disable this comment in your organization's Code Review settings.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A module-level Path.home() constant binds its filesystem accessor at import on py<=3.10, bypassing fake filesystems in tests and ignoring home changes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
url2pathname handles drive-letter file URIs (file:///C:/...) that a bare urlparse().path mangles with a leading slash; also build the pluginLocations test fixture with json.dumps so Windows path separators are escaped. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Copilot's bash hook field runs under bash, which reattaches a backgrounded command's stdin to /dev/null (POSIX behavior with job control off) - the scan read an empty payload and silently no-oped without reaching the backend. An explicit <&0 disables that default and keeps the payload flowing. Cursor/Codex keep the bare '&' - their runners were verified to deliver stdin to backgrounded scans (zsh keeps it; bash/sh do not). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
omer-roth
approved these changes
Jul 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
New copilot IDE integration: hooks install to ~/.copilot/hooks/cycode.json (Copilot-native format, also read by Copilot CLI and the cloud coding agent), scan parsing for the VS Code payload dialect (prompt / read_file / MCP tools), session context with MCP config and plugin inventory from all three plugin sources (CLI registry, VS Code registry, chat.pluginLocations).
Copilot hooks have no matchers, so the no-handler fast path in scan_command now resolves before any policy/client work, and unmatched tools return a neutral {} that leaves VS Code's own permission flow intact.
MCP tool names arrive as mcp__ where the prefix derives from the server's self-reported handshake name; known config names (incl. plugin servers) match via normalized variants, anything else reports the unsplit remainder rather than a guessed split.
Also: claude-code payload matching now requires transcript_path (VS Code Copilot sends near-identical payloads without it), and cursor/codex report mode no longer appends the shell '&' on Windows where nothing detaches safely (cmd no-op, PowerShell parse error).