A fresh Microsoft Agent Framework commit fixed a session-approval reply that carried neither a tool scope nor a domain and could crash the Copilot CLI while it was interpreted. “Approve for this session” sounds like a simple convenience; it is actually a promise to remember an authority decision after the current prompt disappears.
The repair does not turn an empty reply into a broad pass. The adapter reconstructs the scope from the prompt that caused it: a shell request becomes approval for those command identifiers; an MCP request names its server and tool; a URL request can name its domain. If a prompt cannot safely offer a session scope, the response is narrowed to one use. Existing explicit scopes pass through unchanged.
The dangerous part is not the button
The most instructive detail is the URL path. Python and the CLI do not parse every crafted URL authority the same way. The change treats a backslash, tab, newline, carriage return, or missing host as a reason not to mint a domain-wide approval; it drops back to a one-shot decision instead. That is a useful rule for any agent integration: uncertainty about the object of authority should reduce its lifetime, not silently stretch it.
A separate Hermes change shows why this matters once the approval UI leaves the terminal. It adds plugin transports so a human can answer an approval request elsewhere, but the host creates an immutable request, gives it an ID and digest, offers only permitted choices, and rejects a reply that is late, altered, or attached to another request. A timeout or transport failure denies by default. The public guide is unusually clear: the plugin changes where the prompt is presented; it is not the authorization-policy engine.
Give every remembered yes an address
For builders, the practical audit is compact. Follow one approval from display to execution and ask what identifies its target, what response fields are signed or correlated, which scopes are actually offered, and what happens when the UI is slow, wrong, or offline. “Approved” should never be the only answer in the log.
These repositories have not announced a common protocol, and main-branch code cannot prove a deployed or independently audited security property. They have, however, made the next public test precise: look for releases and adversarial tests in which stale replies, changed tool identities, and parser-ambiguous URLs all fail closed rather than inheriting yesterday’s permission.