Policy moved the chat. It did not move the machine.

The migration is a security feature.

VS Code 1.142 routes a Local chat into Copilot Agent Host when enterprise settings require a nonempty permissions policy or enable sandboxing. The Local harness cannot enforce those runtime rules. The product therefore changes the runtime instead of pretending the old runtime became governed.

The move keeps the transcript, unsent draft, and attachments. It sends nothing by itself. VS Code archives the old Local chat only after the destination opens. If the move fails or the user switches away during transfer, the original stays unchanged.

Conversation continuity is useful. It is not execution continuity.

The destination owns the next command.

Agent Host is a dedicated process that owns supported sessions. It runs beside the workspace. That can be the local machine, a remote host, or a Dev Container. File edits and commands use the environment that contains the host.

The browser or editor window is a client. It can display and steer the session without being the machine that runs the commands. A connected client can also contribute tools. Those tools disappear when that client disconnects.

This creates four separate transfer questions:

• Did the conversation arrive?
• Which folder or worktree now receives edits?
• Which host runs commands and resolves paths?
• Which tools and policy rules are active for this session?

Sandbox is a property of the execution host.

VS Code resolves sandbox settings on the machine where commands run. Remote paths refer to the remote file system. Linux and WSL2 need bubblewrap and socat. The sandbox does not silently fall back when a required dependency is missing.

Sandboxing and approvals answer different questions. An approval decides whether an operation needs confirmation. The sandbox limits file and network access for supported processes. Selecting Allow all does not remove the sandbox.

Two defaults deserve a bright label. Sandboxing defaults to off. When sandboxing is on, outbound network access defaults to allowed. The operator must inspect both values instead of reading the word sandbox as a complete network policy.

Use the report, not the remembered setting.

Copilot harness sessions expose /sandbox policy. It generates a report with the execution host, implementation, and effective file and network rules. The command does not start a model turn or change settings.

Run it after a transfer. Record the workspace path, host identity, harness, connected client tools, and effective sandbox report. Then use a harmless read and a denied-path or denied-network check that matches your policy.

The temporary enterprise opt-out deserves equal care. VS Code documents that vscode.temporaryDefaultToLocalHarness can stop automatic migration. It also states that Local does not enforce the runtime-only rules that required Copilot Agent Host. That switch is a compatibility exception, not a protected equivalent.

A five-minute transfer drill

• Save the old session title and the intended workspace.
• Let the destination open. Confirm the original became read only only after success.
• Read the destination harness and execution host.
• Check the exact folder, branch, worktree status, and pending changes.
• List tools that come from a connected editor client.
• Run /sandbox policy and save the effective report.
• Exercise one allowed action and one action the policy should block.
• Resume work only after the receipt names the destination.

A chat can carry intent across the gap. The destination still has to prove that it can carry the work.