Repo sync

.github/CONTRIBUTING.md

@@ -76,7 +76,7 @@ For complete style guidance, see our [style guide](https://docs.github.com/en/co
 
 #### Repository-specific options:
 
-**Make changes in the UI:** Click **Make a contribution** at the bottom of any docs page for small changes like typos or broken links.
+**Make changes in the UI:** For small changes like typos or broken links, click **Make a contribution** at the bottom of any docs page. The button opens the article's source file in this repository. Click the pencil icon to edit the file. GitHub asks you to fork the repository, then lets you propose your change as a pull request. See "[Editing files in another user's repository](https://docs.github.com/en/repositories/working-with-files/managing-files/editing-files#editing-files-in-another-users-repository)."
 
 <img src="/contributing/images/contribution_cta.png" />
 

Dockerfile

@@ -4,7 +4,7 @@
 
 # Update the base image digest from the gh-base-noble package page:
 # https://github.com/github/gh-base-image/pkgs/container/gh-base-image%2Fgh-base-noble
-FROM ghcr.io/github/gh-base-image/gh-base-noble:20261020-225427-g5ec2175c5@sha256:931ce7d43f6f3dbe28113cb12f5fac2206a0b08dad395172f6d73ce4f95f77f3 AS base
+FROM ghcr.io/github/gh-base-image/gh-base-noble:20261022-141141-gfa3bc27f7@sha256:c1175f242e207eeaf679305e553b6f1a2f69d06fa7b3840b199c5c33da2de130 AS base
 # Install curl for NodeSource setup.
 # Install git for early-access and translation clones.
 # Ubuntu's nodejs package lags the Node LTS release line.

content/copilot/concepts/copilot-surfaces/github-copilot-app.md

@@ -54,9 +54,11 @@ The {% data variables.copilot.github_copilot_app %} supports the following opera
 
 ## The {% data variables.copilot.github_copilot_app %} workflow
 
+Connect a repository or local folder to the app, then start agent sessions to work on it. Sessions are grouped by repository in the sidebar.
+
 A typical workflow in the {% data variables.copilot.github_copilot_app %} looks like this:
 
-1. Browse issues in a repository and pick one up, or start from a blank workspace.
+1. Start a new agent session in a repository or local folder, or browse issues in a repository and start a session from an issue.
 1. Choose a session mode—Interactive, Plan, or Autopilot—and select a model.
 1. Describe the task and let the agent create a branch, write code, and run tests.
 1. Review the agent's changes, provide feedback, and iterate.

content/copilot/concepts/security-governance-and-network-settings/about-cloud-and-local-sandboxes.md

@@ -26,7 +26,7 @@ docsTeamMetrics:
 Sandboxing is available in both {% data variables.copilot.copilot_cli %} and the {% data variables.copilot.github_copilot_app %}, but the two surfaces expose it differently:
 
 * In {% data variables.copilot.copilot_cli_short %}, you control both local and cloud sandboxing with the commands and settings described in this article.
-* In the {% data variables.copilot.github_copilot_app %}, you can run a session in a cloud sandbox or use local sandboxing for local repository and working tree sessions. Project settings define the default for new local sessions, and you can change sandboxing for an active local session. For more information, see [AUTOTITLE](/copilot/how-tos/github-copilot-app/agent-sessions#using-cloud-and-local-sandboxes).
+* In the {% data variables.copilot.github_copilot_app %}, you can run a session in a cloud sandbox or use local sandboxing for local repository and working tree sessions. Repository settings define the default for new local sessions, and you can change sandboxing for an active local session. For more information, see [AUTOTITLE](/copilot/how-tos/github-copilot-app/agent-sessions#using-cloud-and-local-sandboxes).
 
 Local sandbox settings are configured separately in {% data variables.copilot.copilot_cli_short %} and the {% data variables.copilot.github_copilot_app %}. Enabling or configuring local sandboxing in one surface does not change it in the other.
 
@@ -63,7 +63,7 @@ If enterprise managed settings require sandboxing, ordinary settings and startup
 
 The CLI's built-in file tools—first-party commands that are part of the CLI, rather than shell commands like `sed`—run in-process in the CLI. Because the CLI itself is not sandboxed, the operating-system sandbox never sees the file operations these tools perform and cannot constrain them. Instead, the built-in tools are coded to check the sandbox policy themselves and honor your configured settings on a best-effort basis.
 
-In the {% data variables.copilot.github_copilot_app %}, project settings define the local sandboxing default for new local repository and working tree sessions. You can also change sandboxing for an active local session without changing the project default.
+In the {% data variables.copilot.github_copilot_app %}, repository settings define the local sandboxing default for new local repository and working tree sessions. You can also change sandboxing for an active local session without changing the repository default.
 
 For more information about enabling local sandboxing in {% data variables.copilot.copilot_cli_short %} and the {% data variables.copilot.github_copilot_app_short %}, see [AUTOTITLE](/copilot/how-tos/cloud-and-local-sandboxes/using-local-sandboxing).
 
@@ -80,13 +80,13 @@ In {% data variables.copilot.copilot_cli_short %}, you can control several dimen
 * **Keychain (macOS)**: Choose whether the system keychain is reachable from inside the sandbox.
 * **Per-command exceptions**: Allow or prevent individual commands from running outside the sandbox when they need broader access.
 
-In the {% data variables.copilot.github_copilot_app %}, project settings expose a subset of these controls:
+In the {% data variables.copilot.github_copilot_app %}, repository settings expose a subset of these controls:
 
 * **Filesystem**: Grant additional read-only or read/write access to specific paths, or deny paths.
 * **Network**: Allow or block outbound internet and local network access.
 * **Credentials**: Choose whether your Git and {% data variables.product.prodname_cli %} credentials are available inside the sandbox.
 
-The app can also ask you to approve an individual command to run outside the sandbox. You cannot configure whether bypass requests are allowed in the project settings. For more information about configuring local sandboxing in the app or CLI, see [AUTOTITLE](/copilot/how-tos/cloud-and-local-sandboxes/configuring-local-sandbox-settings).
+The app can also ask you to approve an individual command to run outside the sandbox. You cannot configure whether bypass requests are allowed in the repository settings. For more information about configuring local sandboxing in the app or CLI, see [AUTOTITLE](/copilot/how-tos/cloud-and-local-sandboxes/configuring-local-sandbox-settings).
 
 ### Cross-platform support
 
@@ -107,7 +107,7 @@ In {% data variables.copilot.copilot_cli_short %}, host rules and HTTP proxy set
 * **macOS and Linux**: The sandbox restricts outbound connections to the local proxy. Programs that ignore proxy settings cannot connect directly instead. The Linux requirements for outbound traffic listed in [Cross-platform support](#cross-platform-support) also apply when you configure a proxy.
 * **Windows**: Proxying and host rules require a supported Windows version and **Allow local network** to be turned on. On Windows, the sandbox relies on programs honoring the proxy settings. As a result, these controls do not provide the same protection against direct connections as on macOS and Linux.
 
-In the {% data variables.copilot.github_copilot_app %}, you can save denied paths in the project settings. If the active BaseContainer capabilities cannot enforce a denied path, the sandboxed command fails instead of running with a weaker policy or without a sandbox.
+In the {% data variables.copilot.github_copilot_app %}, you can save denied paths in the repository settings. If the active BaseContainer capabilities cannot enforce a denied path, the sandboxed command fails instead of running with a weaker policy or without a sandbox.
 
 On Linux, bubblewrap cannot control local network access independently for spawned processes, including shell commands and local MCP or LSP servers. The local network setting still applies to in-process operations, such as web requests and remote MCP connections, in both the CLI and the app.
 

content/copilot/get-started/quickstart-copilot-app.md

@@ -47,22 +47,22 @@ Download and install the {% data variables.copilot.github_copilot_app %} for you
    If you use {% data variables.product.prodname_ghe_cloud %} with data residency, choose **Use GitHub Enterprise** and enter your `*.ghe.com` hostname when prompted. {% data variables.product.prodname_ghe_server %} is not supported by the {% data variables.copilot.github_copilot_app %}.
 1. If you do not have a {% data variables.product.prodname_copilot_short %} plan, choose whether to sign up for a plan or continue with your own model provider.
     * If you choose to use your own model provider, select a provider, enter any required credentials, then click **Save and continue**.
-1. When prompted, select one or more repositories based on your recent {% data variables.product.github %} activity. You can also add a local folder or repository, or skip this step and add projects later.
+1. When prompted, select one or more repositories based on your recent {% data variables.product.github %} activity. You can also add a local folder or repository, or skip this step and add repositories later.
 1. Choose a theme, then complete onboarding to open the app.
 
 ## Connecting a repository or folder
 
-To work on code, you need at least one project connected to the app. A project can be a folder already on your machine, including a repository you've already cloned locally, or a repository you clone from {% data variables.product.github %} or another remote Git host such as Azure DevOps. Connecting a project unlocks the core app workflow: reading code, making edits, and opening pull requests from agent sessions. If you skipped project setup during onboarding, or want to add more projects later:
+To work on code, you need at least one repository or local folder connected to the app. You can connect a folder already on your machine, including a repository you've already cloned locally, or a repository you clone from {% data variables.product.github %} or another remote Git host such as Azure DevOps. Connecting a repository or folder unlocks the core app workflow: reading code, making edits, and opening pull requests from agent sessions. If you skipped repository setup during onboarding, or want to add more repositories or folders later:
 
-1. In the sidebar, next to **Projects**, click {% octicon "plus" aria-label="Add project" %}.
-1. Under **Add project from**, choose one of the following:
-  * **Local folder or repository** — Select a folder already on your machine, including one that contains a repository you've already cloned locally.
-  * **{% data variables.product.github %} repository** — Browse and clone a repository from {% data variables.product.github %}.
-  * **Repository URL** — Clone from a Git URL for repositories hosted outside {% data variables.product.github %} (for example, on Azure DevOps) or for private repositories without app access.
+1. In the sidebar, next to **Sessions**, click {% octicon "plus" aria-label="New" %}.
+1. Choose where to add the repository or folder from:
+  * **Open local folder** — Select a folder already on your machine, including one that contains a repository you've already cloned locally.
+  * **Add {% data variables.product.github %} repository** — Browse and clone a repository from {% data variables.product.github %}.
+  * **Clone repository** — Clone from a Git URL for repositories hosted outside {% data variables.product.github %} (for example, on Azure DevOps) or for private repositories without app access.
 
 ## Making your first code changes
 
-1. Under **Projects** in the sidebar, find the connected folder or repository you want to use, then click {% octicon "plus" aria-label="Start a new session" %} next to it.
+1. In the sidebar, next to **Sessions**, click {% octicon "plus" aria-label="New" %}, then select the connected repository or folder under "Start session in."
 1. Select a session mode from the dropdown below the prompt field—for example, **Interactive** to work collaboratively with the agent.
 1. In the prompt box, paste this prompt:
 
@@ -87,7 +87,7 @@ The sidebar gives you access to the main areas of the app:
 * **[Automations](https://github.com/copilot/app/launch?open=ghapp%3A%2F%2Fautomations)** — Saved agent tasks that run on a schedule or on demand.
 * **Customize** — Discover and manage plugins, skills, MCP servers, and canvases.
 * **Search** — Search across your repositories directly from the app.
-* **Projects** — View connected projects and their active agent sessions, or start a new session for a project.
+* **Sessions** — View connected repositories, local folders, and their active agent sessions, or start a new session for a repository or folder.
 * **Chats** — General conversations that do not require a dedicated branch or workspace.
 
 ## Next steps

content/copilot/how-tos/cloud-and-local-sandboxes/configuring-local-sandbox-settings.md

@@ -31,29 +31,35 @@ For a conceptual overview of cloud and local sandboxes for {% data variables.pro
 
 ## Configuring the {% data variables.copilot.github_copilot_app_short %}
 
-You configure local sandboxing separately for each project in the {% data variables.copilot.github_copilot_app %}. The configuration applies to local repository and working tree sessions. It does not apply to cloud sandbox sessions or sessions that run on a remote host.
+You configure local sandboxing separately for each repository or local folder in the {% data variables.copilot.github_copilot_app %}. The configuration applies to local repository and working tree sessions. It does not apply to cloud sandbox sessions or sessions that run on a remote host.
 
 A working tree keeps the branches and files for concurrent sessions separate, but it does not restrict what a command can access elsewhere on your machine. Local sandboxing provides that additional protection.
 
-### Enabling local sandboxing for a project
+<!-- Anchor to preserve links from before the Projects to Repositories rename. -->
+<a name="enabling-local-sandboxing-for-a-project"></a>
 
-Local sandboxing is turned off by default unless enterprise managed settings require it. The sandbox settings are not available for remote-only projects. To enable sandboxing for new local sessions in a project:
+### Enabling local sandboxing for a repository
+
+Local sandboxing is turned off by default unless enterprise managed settings require it. The sandbox settings are not available for remote-only repositories. To enable sandboxing for new local sessions in a repository or local folder:
 
 1. In the app sidebar, open **Settings**.
-1. Under "Projects," select the project that you want to configure.
+1. Under "Repositories," select the repository or folder that you want to configure.
 1. Under "Sandbox," turn on **Sandbox new sessions**.
 
-The setting applies to new sessions in the project. It does not change a session that is already running. For details of how to turn on local sandboxing for the current session, see [AUTOTITLE](/copilot/how-tos/cloud-and-local-sandboxes/using-local-sandboxing#enabling-and-disabling-sandboxing-for-your-session).
+The setting applies to new sessions in the repository or folder. It does not change a session that is already running. For details of how to turn on local sandboxing for the current session, see [AUTOTITLE](/copilot/how-tos/cloud-and-local-sandboxes/using-local-sandboxing#enabling-and-disabling-sandboxing-for-your-session).
+
+For most repositories, you can start with the default sandboxing policy. This allows access needed for common development tasks such as installing dependencies, connecting to a local development server, pushing a branch, and creating a pull request. Add restrictions when the repository is next to sensitive folders, does not need network access, or should not use your credentials.
 
-For most projects, you can start with the default sandboxing policy. This allows access needed for common development tasks such as installing dependencies, connecting to a local development server, pushing a branch, and creating a pull request. Add restrictions when the project is next to sensitive folders, does not need network access, or should not use your credentials.
+<!-- Anchor to preserve links from before the Projects to Repositories rename. -->
+<a name="configuring-the-sandbox-policy-for-a-project"></a>
 
-### Configuring the sandbox policy for a project
+### Configuring the sandbox policy for a repository
 
-A sandbox policy is a set of rules that controls which files, networks, and credentials agent-run tools can access. The project settings describe the policy that the app requests when a sandboxed session starts. The effective policy can be more restrictive, for example, when enterprise managed settings apply.
+A sandbox policy is a set of rules that controls which files, networks, and credentials agent-run tools can access. The repository settings describe the policy that the app requests when a sandboxed session starts. The effective policy can be more restrictive, for example, when enterprise managed settings apply.
 
 The "Configured policy summary" shows your selected folder, network, and credential settings. It does not confirm that the sandbox is running or show every restriction that applies. Changes are saved automatically.
 
-In the project settings, you can configure:
+In the repository settings, you can configure:
 
 * [**Filesystem access**](#configuring-filesystem-access): Grant additional read-only or read/write access to specific paths, or deny paths.
 * [**Network access**](#configuring-network-access): Allow or block outbound internet and local network access.
@@ -63,7 +69,7 @@ In the project settings, you can configure:
 
 By default, a sandboxed session has read/write access to its workspace and current working directory. You can grant access to additional folders or prevent access to specific folders.
 
-In the "Sandbox" section of the project settings, configure any of the following lists:
+In the "Sandbox" section of the repository settings, configure any of the following lists:
 
 * **Additional read/write**: Folders that agent-run tools can read and modify.
 * **Additional read-only**: Folders that agent-run tools can read but not modify.
@@ -73,11 +79,11 @@ To add a folder, click **Add folder** for the appropriate list, then choose the
 
 A more-specific denied folder remains denied when a broader parent folder has read or write access.
 
-On Windows, you can save a denied path in the project settings. If the active Windows sandbox capabilities cannot guarantee the denial, a sandboxed command fails with an unsupported-policy message. The command does not run with the denied path accessible or without a sandbox.
+On Windows, you can save a denied path in the repository settings. If the active Windows sandbox capabilities cannot guarantee the denial, a sandboxed command fails with an unsupported-policy message. The command does not run with the denied path accessible or without a sandbox.
 
 #### Configuring network access
 
-By default, both network settings are turned on in the app. In the "Sandbox" section of the project settings, you can change the following settings:
+By default, both network settings are turned on in the app. In the "Sandbox" section of the repository settings, you can change the following settings:
 
 * **Outbound internet**: Allow connections to internet services, such as {% data variables.product.github %} and package registries.
 * **Local network**: Allow loopback and local-network connections, including connections to local development servers.