[Jose Alvarez (jpalvarezl)]

Motivation & Context

A bare PermissionDecisionApproveForSession() does not specify a URL permission scope. Deriving that scope from only the requested hostname can discard meaningful URL boundaries such as the scheme and explicit port, allowing the resulting session approval to cover more than the triggering request.

This change keeps the existing crash avoidance for under-specified decisions while ensuring URL permissions fail closed to a single request unless the caller provides an explicit domain= scope.

Description & Review Guide

• What are the major changes? Bare session approvals for URL permission requests now become PermissionDecisionApproveOnce() instead of a framework-derived hostname approval. Explicit caller-supplied domain= values remain unchanged. The regression matrix covers protocol, default and non-default ports, IPv4, IPv6, IDNA, trailing dots, userinfo, parser ambiguity, malformed URLs, and explicit domains. The package README documents the behavior.
• What is the impact of these changes? Callers returning a bare session decision for a URL prompt receive one-time approval for that request. Callers that intentionally want session-scoped URL access must provide an explicit domain=. Structured tool session approvals and public API signatures are unchanged.
• What do you want reviewers to focus on? Confirm that the fail-closed URL behavior preserves explicit-domain pass-through and the original under-specified-decision crash avoidance.

Related Issue

N/A - maintainer-directed correction to URL permission scope normalization; no public issue or competing pull request.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: Implementation, regression tests, documentation, and PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after a language prefix such as "Python:" or ".NET:") — a workflow keeps the label and the title prefix in sync automatically.

[Copilot]

🟢 Approval recommended

No active review issues block the change that limits unscoped URL approvals to a single request.

No open issues 🎉

What changed in this PR

This PR narrows unscoped URL permission approvals in the Python GitHub Copilot integration, preventing inferred hostname scopes from granting broader session access than intended.

Changes:

• Converts bare URL session approvals to one-time approvals while preserving explicit domain= scopes and structured tool approvals.
• Expands regression coverage for URL variants and explicit-domain pass-through.
• Documents the fallback behavior and removes URL-domain inference code.

File	Description
python/​packages/​github_copilot/​tests/​test_github_copilot_agent.py	Tests one-time URL approvals and preservation of explicit domains.
python/​packages/​github_copilot/​README.md	Explains URL approval fallback and explicit session scopes.
python/​packages/​github_copilot/​agent_framework_github_copilot/​_agent.py	Removes hostname inference and narrows unscoped URL approvals to one request.

_{Review effort: Balanced}

[github-code-quality]

Code coverage overview

Languages: Python

Python / code-coverage/python

main 9db7efb	fix-copilot-url-sess... 9ff75e1	+/-
92%	92%	0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): 9ff75e163c93
Model: gpt-5.6-sol

Overview

The change fails closed by converting bare URL session approvals to one-time approvals while preserving explicit domains and structured non-URL session scopes. The wrapper remains applied across new and resumed sessions, and the regression matrix covers URL parsing boundaries, malformed input, explicit scopes, and decision pass-through. No publishable Critical, High, or Medium issue was established.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.