feat: deny-by-default permissions, add PermissionHandler::approveAll()

[Copilot]

Sync with official SDK PR github/copilot-sdk#509. requestPermission is now always true — tool operations (file writes, shell commands, URL fetches, MCP calls) are denied by default unless an onPermissionRequest handler is provided.

Changes

• src/Client.php: requestPermission hardcoded to true in both createSession() and resumeSession() (was conditional on handler presence)
• src/Support/PermissionHandler.php: New class with approveAll() static method, matching the official SDK's PermissionHandler.ApproveAll / approveAll pattern
• docs/jp/permission-request.md: Rewritten to lead with deny-by-default explanation and PermissionHandler::approveAll() usage
• tests/Unit/Support/PermissionHandlerTest.php: Coverage for the new handler

Migration

use Revolution\Copilot\Support\PermissionHandler;
use Revolution\Copilot\Types\SessionConfig;

// Auto-approve all (equivalent to previous default behavior)
$config = new SessionConfig(
    onPermissionRequest: PermissionHandler::approveAll(),
);

// Or granular control by kind
$config = new SessionConfig(
    onPermissionRequest: function (array $request, array $invocation) {
        return match ($request['kind']) {
            'read' => ['kind' => 'approved'],
            default => ['kind' => 'denied-interactively-by-user'],
        };
    },
);

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/copilot_internal/user
  • Triggering command: /home/REDACTED/.local/bin/copilot copilot --headless --stdio --log-level info (http block)
  • Triggering command: /home/REDACTED/.local/bin/copilot copilot --headless --stdio --log-level info /sadc stty n/stty (http block)
  • Triggering command: /home/REDACTED/.local/bin/copilot copilot --headless --stdio --log-level info pilot-sdk/vendor/bin/stty stty ndor/bin/stty (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.