Describe the bug
Copilot CLI continues to encounter filesystem access denials after I updated sandbox settings to allow access, including C:\Users\vineset . The effective policy has not been verified, so this may be a sandbox policy-application or process working-directory issue.
Environment: Windows; Copilot CLI 1.0.81-1 .
Steps to reproduce:
- Open a CLI session in a Git repository on the D: drive.
- Configure sandbox read/write permissions to allow the required paths.
- Ask the agent to run git -C "D:<repo>" status --short --branch .
- Update the sandbox permissions and retry in the same session.
Expected: Git reads the allowed repository and returns its status.
Actual: Every attempt fails with exit code 128:
fatal: Unable to read current working directory: Permission denied
Supporting observations:
- PowerShell successfully listed the repository and confirmed that .git exists.
- An earlier process-launch error reported C:\ as its working directory, although the session was configured for the repository on D:.
- Plugin management also failed to initialize logging because access to a file under %LOCALAPPDATA%\agency\logs was denied.
- The Git error does not identify the blocked path, making it difficult to determine which permission is missing.
Impact: Unable to run even read-only Git status operations; repository updates and plugin management are also blocked.
Please investigate: Whether tool processes inherit the correct working directory, whether sandbox setting changes reach subsequent processes in the current session, and whether an additional restriction overrides the configured allowed paths. If a restart is required, please make that explicit in the settings UI. Denial messages should identify the affected path and policy rule.
Uncertainty: The exact root cause is not established, and reproduction after a full CLI restart has not been confirmed.
Affected version
No response
Steps to reproduce the behavior
No response
Expected behavior
No response
Additional context
No response
Describe the bug
Copilot CLI continues to encounter filesystem access denials after I updated sandbox settings to allow access, including C:\Users\vineset . The effective policy has not been verified, so this may be a sandbox policy-application or process working-directory issue.
Environment: Windows; Copilot CLI 1.0.81-1 .
Steps to reproduce:
Expected: Git reads the allowed repository and returns its status.
Actual: Every attempt fails with exit code 128:
fatal: Unable to read current working directory: Permission denied
Supporting observations:
Impact: Unable to run even read-only Git status operations; repository updates and plugin management are also blocked.
Please investigate: Whether tool processes inherit the correct working directory, whether sandbox setting changes reach subsequent processes in the current session, and whether an additional restriction overrides the configured allowed paths. If a restart is required, please make that explicit in the settings UI. Denial messages should identify the affected path and policy rule.
Uncertainty: The exact root cause is not established, and reproduction after a full CLI restart has not been confirmed.
Affected version
No response
Steps to reproduce the behavior
No response
Expected behavior
No response
Additional context
No response