Auto-approve in Copilot multi-chat is session-scoped and applies across chats

- Copilot Chat Extension Version:
- VS Code Version:
- OS Version:
- Feature: multi-chat / auto-approve behavior
- Selected model:

Description

When using Copilot's multi-chat feature, setting Auto-approve for one chat appears to enable Auto-approve for every other chat in the same session. Auto-approve seems to be scoped to the session (effectively the CWD) rather than to an individual chat.

Actual Behavior

1. Open a multi-chat session.
2. In Chat A, enable Auto-approve.
3. Switch to Chat B in the same session.
4. Notice Chat B has that same auto-approve value

Expected Behavior

Auto-approve should be scoped per chat. Enabling Auto-approve in Chat A should not grant bypass approvals to other chats in the same session unless the user explicitly enables it for those chats.

Steps to Reproduce

1. Start a Copilot multi-chat session.
2. In one chat, enable Auto-approve.
3. Start a different chat in the same session and attempt an action that would normally require approval (e.g., install or run a command that needs permission).
4. Observe whether the action is auto-approved.

Impact

This behavior can cause unintended privilege escalation: a side-chat where a user is experimenting or asking to install software could inherit bypass approvals from another chat, allowing actions without the user's explicit consent.

Notes / Additional Context

This was observed in internal discussion and appears to be a design/bug where configuration like Auto-approve and permission mode are session-scoped instead of chat-scoped. The session concept appears tied to the CWD while chat-related settings (model/agent selection) are chat-scoped. This mismatch is surprising and likely a bug.

Please investigate scoping of Auto-approve and permission mode for multi-chat — they should be chat-scoped.

[View original Slack conversation](https://vscodeteam.slack.com/archives/C0AKR94N3CK/p1784007558228099?thread_ts=1784007558.228099&cid=C0AKR94N3CK)