SDKs: Add sandbox config

[jcoc611-microsoft]

Summary

Add sandbox configuration support to session creation and resume APIs across all six SDK languages.

• Expose the generated SandboxConfig and related policy types through each SDK's public session configuration API.
• Forward the optional configuration as sandboxConfig for create and resume requests, while preserving omission when unset.
• Apply configured sandbox options through session.options.update before returning a created or resumed session, ensuring current CLI versions activate the requested policy.
• Add create/resume serialization coverage across Rust, Node.js, .NET, Python, Go, and Java.
• Add behavior-based E2E coverage for Node.js, .NET, Python, Go, and Java using the shared replay fixture.
• Verify actual policy effects: enabled create blocks a write outside automatic grants, disabled create permits it, and enabled resume blocks it again.

Testing

• Linux bubblewrap E2Es passed for Node.js, .NET, Python, Go, and Java against Copilot CLI 1.0.81-6.
• Node.js focused client test passed.
• Python focused client test, Ruff format, and Ruff lint passed.
• Go focused client test and gofmt passed.
• .NET compiled on net8.0; the exact sandbox E2E passed in Linux.
• Java options-update unit tests, the exact sandbox E2E, Spotless, and Checkstyle passed.
• Rust compiled with Rust 1.94 on Linux; sandbox serialization test and formatting check passed.

[Copilot]

Pull request overview

Adds Rust SDK sandbox configuration support for session creation and resume.

Changes:

• Exposes sandbox policy types publicly.
• Forwards optional sandbox configuration in create/resume requests.
• Adds nested serialization and omission coverage.

Show a summary per file

File	Description
rust/src/wire.rs	Adds optional sandbox configuration to wire payloads.
rust/src/types.rs	Extends public configs, conversions, exports, redacted debug output, and tests.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced

[SteveSandersonMS]

Thanks for adding the Rust support. Would you be willing to apply the same improvement across the other five SDK languages (Node, C#, Python, Go, and Java), with at least one end-to-end test for each language?

We aim to keep all six SDKs in sync in capabilities and usage patterns, so landing this only for Rust would leave an avoidable cross-language gap. Please move the PR back out of draft status once the other implementations and E2E coverage are ready for review.

[github-actions]

Generated by SDK Consistency Review Agent for #2371 · sonnet46 99.5 AIC · ⌖ 5.84 AIC · ⊞ 6.6K

[github-actions]

Generated by SDK Consistency Review Agent for #2371 · sonnet46 55.6 AIC · ⌖ 5.56 AIC · ⊞ 6.6K

[jcoc611-microsoft]

@SteveSandersonMS added other SDKs plus e2e testing on all languages. The e2e tests do require bubblewrap on Linux, so added that to CI envs. If you prefer not adding that then I could remove/disable the e2e tests.

[github-actions]

Cross-SDK Consistency Review ✅

This PR adds sandbox_config support to session creation and resume APIs across all six SDK implementations. After reviewing the authoritative PR diff, the changes are consistent across all languages.

Coverage Summary

SDK	SessionConfig.sandboxConfig	ResumeSessionConfig.sandboxConfig	Forwarded in create/resume request	Applied via session.options.update	E2E test
Node.js/TypeScript	✅	✅	✅	✅	✅
Python	✅	✅	✅	✅	✅
Go	✅	✅	✅	✅	✅
.NET	✅	✅	✅	✅	✅
Java	✅	✅	✅	✅	✅
Rust	✅	✅	✅	✅	✅

Public API Shape

All SDKs expose SandboxConfig and its sub-types (SandboxConfigUserPolicy, SandboxConfigUserPolicyFilesystem, SandboxConfigUserPolicyNetwork, etc.) as part of the public API. The naming follows each language's conventions correctly:

• TypeScript/Java: sandboxConfig (camelCase)
• Python/Rust: sandbox_config (snake_case)
• Go/.NET: SandboxConfig (PascalCase)

Language-Idiomatic Patterns

The Rust SDK adds with_sandbox_config() fluent builder methods (idiomatic for Rust), while other SDKs use direct property/field assignment — this is expected and appropriate.

No cross-SDK consistency issues were found.

Generated by SDK Consistency Review Agent for #2371 · sonnet46 56.4 AIC · ⌖ 5.48 AIC · ⊞ 6.6K · ◷