Sandbox defaults differ between Agent Host and the shared runtime

[digitarald]

Problem

The sandbox starts with different behavior in Copilot CLI and VS Code Agent Host even when the user and administrator have not configured those fields.

The shared runtime defaults to:

Setting	Runtime default	VS Code Agent Host value
Outbound network	Allowed	Blocked
Local network	Blocked	Allowed
Git credential injection	Enabled	Disabled
GitHub CLI credential injection	Enabled	Disabled

VS Code also fills several values before sending the sandbox configuration to the runtime. The runtime therefore cannot apply its own defaults.

This makes the same managed-settings document behave differently across clients. It also makes omissions ambiguous for administrators. An omitted field should not silently become a client-specific decision.

Expected behavior

Copilot CLI and VS Code Agent Host should resolve the same effective sandbox policy from the same user and managed settings.

Prefer leaving omitted fields unset so the shared runtime applies its defaults. If VS Code needs a different default, expose it as an explicit product setting and document the difference.

Acceptance criteria

• Align network and credential defaults with the shared runtime, or document an intentional product decision for each difference.
• Do not fill an omitted field unless VS Code owns that policy decision.
• Show the effective value and its source in Policy Diagnostics.
• Add parity tests that compare CLI and Agent Host resolution for an empty sandbox policy and representative managed policies.