VS Code 1.142 forces Copilot Agent Host when policies apply

Visual Studio Code 1.142 Stable, released October 14, 2026, requires the Copilot harness in Agent Host for full chat sessions when an organization needs those sessions to honor managed runtime rules. A nonempty permissions object, or sandbox.enabled set to true, is enough. The release notes say VS Code requires Copilot in Agent Host so those policies can be enforced.

The trigger is narrower than a blanket Copilot policy. An empty permissions object does not require Agent Host. Legacy policy alone does not start the migration. The ChatToolsAutoApprove device policy does not trigger this routing by itself. The enterprise AI settings documentation lists the same two conditions. It also notes that the current enterprise-managed settings reference does not list the shared sandbox key as supported for VS Code, and points Agent Host sessions to session sandbox controls plus a check of the effective sandbox policy on the machine where commands run.

Opening an existing, unarchived Local chat moves it to Copilot. The transcript and unsent draft move with it, including attachments. The enterprise docs also say selections are preserved, and that the input is not submitted. Nothing is sent automatically. The new chat uses its normal model and permission defaults under current organization policy.

The original chat is archived only after the new chat opens successfully. If you switch away while the move is in progress, the original stays unchanged and the unopened destination is removed. After a successful open, the enterprise docs describe the original Local session as archived and read-only. Opening another unarchived Local session starts the same process.

While those policies apply, Claude, Codex, and terminal chat are unavailable. Claude and Codex sessions do not appear in the sessions list. They are not migrated, archived, or deleted. Local-backed terminal chat is unavailable. Editor inline chat remains available for limited read and edit tasks, and next edit suggestions remain available.

Administrators who need more time can keep Local. Starting with VS Code 1.142, set vscode.temporaryDefaultToLocalHarness to true:

{
  "vscode": {
    "temporaryDefaultToLocalHarness": true
  }
}

That keeps the Local harness available, stops automatic switching to Copilot, and does not change explicit, remembered, or current harness choices. Set the managed value to false, or remove the key, to restore normal routing.

The opt-out does not enforce the rules it postpones. It overrides routing required by managed sandbox and permission settings. Local does not enforce those runtime-only rules. Enforcement in Copilot Agent Host sessions is unchanged. The enterprise documentation warns administrators to review the security impact before using the temporary control.

The release also separates permission modes. Administrators can permit Assisted while blocking Allow All. Set permissions.disableBypassPermissionsMode to "disable" to remove Allow All from the picker. Leave permissions.disableAssistedPermissionsMode at false to keep Assisted, or set it to true to remove Assisted. permissions.defaultMode only supplies a starting default — manual, assisted, or allow-all — and does not restrict other modes the organization still allows. If that default is unavailable, new sessions use Manual permissions.

The legacy ChatToolsAutoApprove: false policy still blocks both Allow All and Assisted unless you configure explicit managed mode restrictions. Setting only permissions.defaultMode does not replace that legacy restriction. Assisted is not currently compatible with permissions.allow, permissions.ask, or permissions.deny. If any of those keys are in use, the release notes say to set disableAssistedPermissionsMode to true. They also say the next release will support both alongside one another.

Windows sandboxing for terminal commands in Local agent sessions is deprecated. For sandboxed command execution on Windows, the release notes say to use an Agent Host session. Local sandbox device policies, including ChatAgentSandboxEnabled, are deprecated, apply to Local sessions, and do not enforce sandboxing for Copilot harness sessions.

Teams running Claude or Codex for full chats can find those sessions missing from the list as soon as a nonempty permissions policy, or sandbox.enabled set to true, takes effect. The temporary Local default can stop the automatic move. It also skips the runtime checks those settings were meant to enforce.

Read the 1.142 enterprise notes and the manage-AI-settings page, then run Developer: Policy Diagnostics and confirm whether a nonempty permissions object or sandbox.enabled is already effective before you depend on Claude, Codex, or Local terminal chat.

Sources

• Visual Studio Code 1.142
• Manage AI settings in enterprise environments