Describe the bug

Copilot CLI sandbox enforcement preflight fails with CreateProcessW error 2 on supported Windows host

Describe the bug

On a managed Windows 11 device whose enterprise policy requires local sandboxing (sandbox.enabled: true, failIfUnavailable: true, allowBypass: false), every session is blocked at the sandbox enforcement preflight:

This session is blocked because your organization's sandbox policy requires enforcement, but the sandbox is unavailable: backend_error: CreateProcessW failed with error code 2 (0x00000002). (CreateProcessW(PROC_THREAD_ATTRIBUTE_SECURITY_ENVIRONMENT) failed: WIN32_ERROR(2) (working directory: C:\Users\<user>\sandboxes\test (from process.cwd))). Start a new session after resolving the sandbox problem.

The host supports the sandbox. Outside Copilot, @microsoft/mxc-sdk 1.0.0 (the version bundled in Copilot 1.0.105) and 1.0.1 both successfully launch cmd.exe, Windows PowerShell 5.1, and PowerShell 7.6.9 on the same machine.

The standalone MXC tests use the same working directory and the same filesystem/network policy reported by /sandbox policy.

The failure has only been reproduced through Copilot's sandbox enforcement preflight. Because Copilot does not log the preflight image path or command line, I cannot determine which path is producing ERROR_FILE_NOT_FOUND.

Important: Local sandboxing works successfully on the same device when the enterprise-managed sandbox settings are not applied. The failure occurs when the enterprise-managed sandbox configuration is present and Copilot performs its managed sandbox enforcement/revalidation preflight.

Affected version

GitHub Copilot CLI 1.0.105, installed via WinGet (GitHub.Copilot).

WinGet reports:

Name: GitHub Copilot CLI
Id: GitHub.Copilot
Version: 1.0.105
Installer Type: wix
Dependency: Microsoft.PowerShell >= 7.0.0

The standalone installation is located under:

%LOCALAPPDATA%\GitHubCopilotCLI

and contains:

copilot.exe
copilot-taskbar-activator.exe
GitHubCopilotCLI.sparse.msix

The same failure occurs through the VS Code Copilot shim and when invoking the standalone copilot.exe directly.

The 1.0.105-1 prerelease bundles the same mxc-sdk 1.0.0.

Affected version

No response

Steps to reproduce the behavior

Steps to reproduce

1. Use Windows 11 Enterprise 25H2, OS build 26200.9711.
2. Apply these managed settings from a GHE.com tenant:
   • sandbox.enabled=true
   • sandbox.failIfUnavailable=true
   • sandbox.allowBypass=false
3. Change to an empty local folder.
4. Run Copilot CLI and send any message.
5. Observe that the session is blocked by the sandbox enforcement preflight.

This occurs:

• on every new session;
• after restarting Windows;
• from different working directories;
• through the VS Code Copilot shim; and
• when invoking the standalone executable directly:

& "$env:LOCALAPPDATA\GitHubCopilotCLI\copilot.exe"

Expected behavior

The sandboxed session starts.

If the enforcement preflight cannot launch its process, the error or debug log should identify the image path and command line passed to the process creation operation.

Additional diagnostics

MXC platform support

Using @microsoft/mxc-sdk/v1:

getPlatformSupport():
  isSupported: true
  isolationTier: "base-container"

probe() returns base-container with no warnings.

The following capabilities are reported as available:

baseContainerApiPresent
baseContainerSupportsDenyPaths
baseContainerSupportsEnumeratePaths
baseContainerSupportsIngressHostLoopbackAllow
baseContainerSupportsIdentitylessLoopbackProxy

Standalone MXC using Copilot's sandbox policy

A standalone MXC test uses:

• all 21 paths reported by /sandbox policy;
• egress allow;
• host loopback allow; and
• the same working directory that fails from Copilot.

Results:

This is significant because mxc-sdk 1.0.0 is also the version bundled with the affected Copilot CLI release.

PowerShell resolution checked

PowerShell 7.6.9 is installed per-user without relying on the WindowsApps alias:

C:\Users\<user>\AppData\Local\Programs\PowerShell\7\pwsh.exe

Get-Command pwsh.exe -All returns this executable before:

C:\Users\<user>\AppData\Local\Microsoft\WindowsApps\pwsh.exe

and:

pwsh.exe --version

returns:

PowerShell 7.6.9

The executable reports product/file version 7.6.9.500.

The standalone MXC test successfully launches this unpackaged PowerShell executable.

VS Code shim eliminated as cause

Both Copilot installations are visible on PATH:

C:\Program Files\Microsoft VS Code\bin\copilot-shim\copilot.exe
C:\Users\<user>\AppData\Local\GitHubCopilotCLI\copilot.exe

The VS Code shim is normally resolved first.

However, explicitly bypassing the shim and running:

& "$env:LOCALAPPDATA\GitHubCopilotCLI\copilot.exe"

produces the same sandbox enforcement failure.

Therefore, the failure is not specific to invoking Copilot through the VS Code shim.

Other troubleshooting already performed

None of the following changed the error:

• Installed PowerShell 7.6.9.
• Put an unpackaged PowerShell 7 executable ahead of the WindowsApps alias on PATH.
• Verified that the real pwsh.exe is selected by Get-Command and where.exe.
• Added C:\ and the PowerShell directory to sandbox.userPolicy.filesystem.readonlyPaths.
• Set sandbox.auth.git=false.
• Set sandbox.auth.gh=false.
• Set allowLocalNetwork=false.
• Confirmed those settings through /sandbox policy.
• Used different working directories.
• Restarted Windows and started fresh sessions.
• Bypassed the VS Code shim and invoked the standalone CLI directly.
• Reproduced equivalent MXC launches successfully using both mxc-sdk 1.0.0 and 1.0.1.

Logs

With --log-level all, the relevant output is:

[WARNING] [rust:copilot_runtime::session::services::sandbox_service] managed sandbox enforcement revalidation refused the session {"error":"...CreateProcessW failed with error code 2..."}

[ERROR] [sandbox] enforcement preflight failed: Error: ...same message...

[WARNING] Failed to process event type 'session.sandbox_enforcement_blocked' for timeline reconstruction: Error: Unhandled event type in timeline: session.sandbox_enforcement_blocked

No image path or command line for the failed preflight process appears in the log.

Current findings

The tests appear to rule out a general lack of MXC/base-container support on the host:

• MXC reports the platform as supported.
• MXC probe() succeeds.
• mxc-sdk 1.0.0 successfully creates sandboxed processes.
• mxc-sdk 1.0.1 successfully creates sandboxed processes.
• The Copilot-reported sandbox policy works in the standalone MXC test.
• The working directory works in the standalone MXC test.
• cmd.exe, Windows PowerShell, and PowerShell 7.6.9 all launch successfully through MXC.
• PowerShell 7 resolves to the real executable rather than the WindowsApps alias.
• Bypassing the VS Code shim does not change the result.

The remaining difference I have been unable to inspect is the exact image, command line, and process creation configuration used by Copilot's managed sandbox enforcement preflight.

Expected behavior

Sandbox works without error

Additional context

No response