Clarify sandbox limitations for cross-repo PR creation

[Copilot]

The agent was asked to open a PR from Vettabase/tidesql:copilot/separate-tidesdb-config to the upstream tidesdb/tidesql:master, but initially targeted the wrong repository (Vettabase/tidesql instead of tidesdb/tidesql).

Findings

• The Copilot agent token is scoped to Vettabase/tidesql only — gh pr create --repo tidesdb/tidesql returns HTTP 403.
• Browser and direct curl GitHub API access are blocked by the sandbox DNS proxy.
• Available GitHub MCP tools are read-only; no create_pull_request endpoint is exposed.
• report_progress only targets the current fork's PR.

Required manual step

The branch is ready at Vettabase/tidesql:copilot/separate-tidesdb-config (SHA 8785d08). A maintainer with write access to tidesdb/tidesql can open the PR directly at:

https://github.com/tidesdb/tidesql/compare/master...Vettabase:tidesql:copilot/separate-tidesdb-config

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh gh auth status (http block)
  • Triggering command: /usr/bin/gh gh auth status -h github.com (http block)
  • Triggering command: /usr/bin/gh gh pr create --repo tidesdb/tidesql --base master --head Vettabase:copilot/separate-tidesdb-config --title Separate TidesDB config --body This pull request proposes separating the TidesDB configuration into its own file. (http block)
• https://api.github.com/repos/tidesdb/tidesql
  • Triggering command: /usr/bin/gh gh api /repos/tidesdb/tidesql (http block)
• https://api.github.com/repos/tidesdb/tidesql/pulls
  • Triggering command: /usr/bin/curl curl -s -X POST -H Authorization: ****** -H Accept: application/vnd.github+json -H X-GitHub-Api-Version: 2022-11-28 REDACTED -d { "title": "Separate TidesDB config", "body": "This pull request proposes separating the TidesDB configuration into its own file.", "head": "Vettabase:copilot/separate-tidesdb-config", "base": "master" } (http block)
• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api /user --disable-default-apps --disable-dev-shm-usage --disable-features=AcceptCHFrame,AvoidUnnecessaryBeforeUnloadCheckSync,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,PaintHolding,ThirdPartyStoragePartitioning,Translate,AutoDeElevate,Automat (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.