Restore the `sandbox.agent: false` opt-out by Copilot · Pull Request #58693 · github/gh-aw

Copilot · 2026-09-05T02:36:24Z

Restore sandbox-free agent execution as an explicit non-strict opt-out. Strict mode continues to reject it, while non-strict workflows must enable the dangerous feature flag.

Changes

Validation
- Require features.dangerously-disable-sandbox: true.
- Reject missing, false, or non-boolean values.
- Preserve the strict-mode error.
Deprecation reversal
- Remove the deprecation warning.
- Remove the codemod that deleted sandbox.agent: false.
Documentation
- Update workflow syntax, migration guidance, reference documentation, and release notes.

features:
  dangerously-disable-sandbox: true
sandbox:
  agent: false
strict: false

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 69.5 AIC · ⌖ 8.75 AIC · ⊞ 8.9K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-09-05T02:42:20Z

    - `cli-proxy: true` - Enable AWF CLI proxy sidecar for secure read-only `gh` CLI access without exposing `GITHUB_TOKEN` (requires AWF v0.26.0+). Prerequisite for `integrity-reactions`; the compiler enables it automatically when `integrity-reactions: true` is set.
    - `integrity-reactions: true` - Enable reaction-based integrity promotion/demotion. Maintainers can use 👍/❤️ reactions to promote content to `approved` and 👎/😕 to demote it to `none`. Compiler automatically enables `cli-proxy`. Requires `tools.github.min-integrity` to be set and MCPG >= v0.2.18. Defaults: endorsement reactions THUMBS_UP/HEART, disapproval reactions THUMBS_DOWN/CONFUSED, endorser-min-integrity: approved, disapproval-integrity: none.
-    - `dangerously-disable-sandbox-agent: "<justification>"` - Required when `sandbox.agent: false` is set. Must be a plain string justification (minimum 20 characters; expressions are not allowed) that explains why disabling the sandbox is safe for this workflow.
+    - `dangerously-disable-sandbox: true` - Required when `sandbox.agent: false` is set. This opt-out is rejected in strict mode.


@copilot match The old feature name

Updated the syntax, validation, tests, and related documentation to use the legacy dangerously-disable-sandbox-agent feature name in commit 0184ae3.

Copilot

🟡 Changes recommended

The public CompileWorkflowData path can bypass strict-mode sandbox rejection, and existing ADRs still contradict the restored policy.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Restores sandbox.agent: false for explicitly opted-out, non-strict workflows.

Changes:

Requires features.dangerously-disable-sandbox: true.
Removes the deprecation warning and removal codemod.
Updates tests, documentation, migration guidance, and release notes.

File summaries

File	Description
`pkg/workflow/workflow_run_validation_test.go`	Updates feature flags and warning expectations.
`pkg/workflow/sandbox.go`	Removes stored disable justification.
`pkg/workflow/sandbox_validation.go`	Validates the new boolean opt-out.
`pkg/workflow/sandbox_validation_test.go`	Removes justification-specific tests.
`pkg/workflow/sandbox_test.go`	Tests valid and invalid feature values.
`pkg/workflow/sandbox_agent_false_test.go`	Updates integration coverage for the opt-out.
`pkg/workflow/sandbox_agent_disabled_test.go`	Tests strict rejection and warning removal.
`pkg/workflow/pull_request_target_validation_test.go`	Updates warning expectations.
`pkg/workflow/prompts_test.go`	Uses the new feature syntax.
`pkg/workflow/importable_tools_test.go`	Uses the new feature syntax.
`pkg/workflow/compiler_validators.go`	Removes the deprecation warning.
`pkg/workflow/compiler_validators_test.go`	Verifies warning removal.
`pkg/workflow/aw_info_steps_test.go`	Uses the new feature syntax.
`pkg/constants/README.md`	Documents the renamed constant.
`pkg/constants/feature_constants.go`	Defines the new feature flag.
`pkg/cli/mcp_tools_management.go`	Removes the codemod from MCP help.
`pkg/cli/fix_codemods.go`	Unregisters the removal codemod.
`pkg/cli/fix_codemods_test.go`	Updates codemod registry expectations.
`pkg/cli/codemod_sandbox_agent_false_removal.go`	Deletes the obsolete codemod.
`pkg/cli/codemod_sandbox_agent_false_removal_test.go`	Deletes obsolete codemod tests.
`pkg/cli/codemod_network_firewall_test.go`	Updates migration expectations.
`docs/src/content/docs/reference/sandbox.md`	Documents the restored opt-out.
`docs/src/content/docs/reference/gh-aw-as-mcp-server.md`	Updates the codemod list.
`.github/aw/upgrade-agentic-workflows.md`	Updates migration guidance.
`.github/aw/syntax-agentic.md`	Updates syntax documentation.
`.changeset/restore-sandbox-agent-false.md`	Records the breaking change.

Review details

Files reviewed: 26/26 changed files
Comments generated: 2
Review effort level: Balanced

Copilot · 2026-09-05T03:25:23Z

 	if sandboxConfig.Agent != nil && sandboxConfig.Agent.Disabled {
-		justification, err := getSandboxDisableJustification(workflowData)
-		if err != nil {
-			flag := string(constants.DangerouslyDisableSandboxAgentFeatureFlag)
+		flag := string(constants.DangerouslyDisableSandboxFeatureFlag)
+		value, found := getFeatureValueCaseInsensitive(workflowData.Features, flag)
+		enabled, isBoolean := value.(bool)
+		if !found || !isBoolean || !enabled {


Fixed in the latest commit: CompileWorkflowData now applies effective strict-mode validation before generation, so sandbox.agent: false cannot bypass strict rejection. Added direct CompileWorkflowData coverage.

Copilot · 2026-09-05T03:25:23Z

+Setting `sandbox.agent: false` disables the agent firewall while keeping the MCP gateway enabled. This removes a trust boundary and is only supported when `strict: false`.

-To disable the agent sandbox, you **must** add `features.dangerously-disable-sandbox-agent` with a literal justification string of at least 20 characters. The justification must explain why the trust boundary is being removed and is stored for diagnostics and audit. The following values are rejected by the compiler:
-
- Boolean `true` — no longer accepted as a legacy shorthand
- Expressions such as `${{ inputs.reason }}` — must be a static literal
- Strings shorter than 20 characters after trimming whitespace
+To disable the agent sandbox, you **must** set `features.dangerously-disable-sandbox: true`. Missing, false, and non-boolean values are rejected by the compiler.


Fixed in the latest commit: ADR-38325 and ADR-29483 are now marked superseded and explicitly point to the restored non-strict boolean opt-out policy and removed codemod.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

gh-aw-bot · 2026-09-05T03:04:20Z

pr-sous-chef

@copilot Please take the next forward-progress pass on this PR.

A fresh review on the current head still calls out two follow-ups: ensure the public CompileWorkflowData path cannot bypass strict-mode sandbox rejection, and reconcile the restored policy with the existing ADR/docs set.
Please address that review feedback on HEAD, refresh the branch state if needed, and run the pr-finisher skill before handing back to maintainers.
In your handoff, summarize exactly which strict-mode path and ADR/doc updates were fixed, and whether any remaining blocker is only routine CI or maintainer approval.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/33940432105

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 69.5 AIC · ⌖ 8.75 AIC · ⊞ 8.9K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-09-05T03:25:23Z

pr-sous-chef
```...

Implemented the strict-mode and ADR follow-ups in commit ?: CompileWorkflowData now applies effective strict-mode sandbox rejection with direct coverage, and ADR-38325/ADR-29483 are marked superseded with the restored policy. Local fmt, lint, unit, full test, and recompile validation pass; remaining CI checks require a maintainer re-trigger.

pr-sous-chef
```...

Correction: the implementation commit is 5357dff.

github-actions · 2026-09-07T04:13:51Z

🎉 This pull request is included in a new release.

Release: v0.88.5

Restore supported sandbox agent opt-out

bdb01de

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan Sep 5, 2026

Copilot AI changed the title ~~Restore sandbox.agent false opt-out~~ Restore the sandbox.agent: false opt-out Sep 5, 2026

Copilot finished work on behalf of pelikhan September 5, 2026 02:36

Copilot AI requested a review from pelikhan September 5, 2026 02:36

Copilot created this pull request from a session on behalf of pelikhan September 5, 2026 02:36 View session

pelikhan marked this pull request as ready for review September 5, 2026 02:41

Copilot AI balanced review requested due to automatic review settings September 5, 2026 02:41

Copilot started reviewing on behalf of pelikhan September 5, 2026 02:42 View session

pelikhan reviewed Sep 5, 2026

View reviewed changes

Copilot AI reviewed Sep 5, 2026

View reviewed changes

Copilot started work on behalf of pelikhan September 5, 2026 02:49 View session

Restore legacy sandbox feature name

1321835

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Merge branch 'main' into copilot/reverse-deprecation-sandbox-agent

e3b8cbe

github-actions Bot mentioned this pull request Sep 5, 2026

[pr-sous-chef] PR Sous Chef run report #58638

Closed

Clarify sandbox flag rename

0184ae3

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan September 5, 2026 03:05

Copilot AI requested a review from pelikhan September 5, 2026 03:05

Copilot started work on behalf of gh-aw-bot September 5, 2026 03:06 View session

Enforce strict sandbox opt-out validation

5357dff

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot September 5, 2026 03:26

Copilot AI requested a review from gh-aw-bot September 5, 2026 03:26

pelikhan merged commit 5de8068 into main Sep 5, 2026
34 checks passed

pelikhan deleted the copilot/reverse-deprecation-sandbox-agent branch September 5, 2026 03:50

github-actions Bot mentioned this pull request Sep 8, 2026

[instructions] Sync instruction files with release v0.88.2 #59404

Merged

Navigation Menu

Uh oh!

Restore the `sandbox.agent: false` opt-out - #58693

Restore the `sandbox.agent: false` opt-out#58693
pelikhan merged 5 commits into
mainfrom
copilot/reverse-deprecation-sandbox-agent

Copilot AI commented Sep 5, 2026 •

edited by github-actions Bot

Loading

Uh oh!

pelikhan Sep 5, 2026

Uh oh!

Copilot AI Sep 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Sep 5, 2026

Uh oh!

Copilot AI Sep 5, 2026

Uh oh!

gh-aw-bot commented Sep 5, 2026

Uh oh!

Copilot AI commented Sep 5, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

Copilot AI commented Sep 5, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

pelikhan Sep 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Copilot AI Sep 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 5, 2026

Choose a reason for hiding this comment

Uh oh!

gh-aw-bot commented Sep 5, 2026

Uh oh!

Copilot AI commented Sep 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Sep 5, 2026 •

edited by github-actions Bot

Loading

Copilot AI commented Sep 5, 2026 •

edited

Loading