From ef627e1baad937d3c8da45f8a5541c6fc3c97b6a Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Mon, 10 Aug 2026 16:19:17 +0000 Subject: [PATCH 1/9] Update changelog.md for version 1.0.79 --- changelog.md | 47 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) diff --git a/changelog.md b/changelog.md index ce39e0f3..48f07df8 100644 --- a/changelog.md +++ b/changelog.md @@ -1,3 +1,50 @@ +## 1.0.79 - 2026-08-10 + +- The /sandbox configuration dialog shows where sandbox settings are stored in settings.json +- Add support for enterprise allow-auto-only policy so /allow-all auto works while full allow-all remains blocked. +- Allow enterprise-managed sandbox policy to enforce a proxy URL while credentials remain user-controlled +- A tool directory inside your workspace that is on PATH (.venv/bin, node_modules/.bin, an in-repo GOPATH) no longer turns that part of the workspace read-only in the sandbox +- The /sandbox configuration dialog groups the git, gh, and (on macOS) keychain settings under a new Auth tab, and the settings keys moved from `sandbox.gitAuth`/`sandbox.ghAuth` to `sandbox.auth.git`/`sandbox.auth.gh`. There is no migration: the old keys are ignored in settings files, and SDK requests that still send them are rejected as invalid rather than ignored +- Added a `worktreeBaseRef` setting that controls whether `/worktree`, `/worktree new`, and `--worktree` start from HEAD or the remote default branch. All three now default to HEAD; previously `--worktree` started from the remote default branch. +- Model picker groups models into Recent, Recommended, New, and other sections, and Shift+Tab switches grouping views. +- Large monorepos now use tgrep ([trigram-indexed grep for fast regex search in large codebases](https://github.com/microsoft/tgrep)) instead of ripgrep +- Agent Plugins spec plugins can now ship extensions under a com.github.copilot/extensions/ directory +- Add support for the kimi-k3 model +- Combine `--plan` with `--mode autopilot` to plan first and then implement without waiting for approval +- The `/app` command now opens the current session in the GitHub Copilot desktop app instead of landing on Home with the wrong folder (requires GitHub Copilot app 1.1.3 or later) +- On macOS, a sandbox read-only path nested inside a writable one now stays read-only instead of inheriting the write permission from the wider path +- On macOS, sandboxed commands can use UNIX-domain sockets again, so tools that talk over a local IPC pipe (tsx, vite, esbuild, jest workers) no longer fail with `listen EPERM` +- Sandboxed commands work when the working directory lives on a Windows Dev Drive +- `/theme` now only shows its deprecation notice for a valid color mode, so a mistyped mode no longer suggests an invalid command or hides the notice from your next valid `/theme`. +- Sandboxed git now authenticates to Azure DevOps, GitHub Enterprise Server, GitLab, and other non-GitHub remotes you have stored HTTPS credentials for +- Ask user multi-select prompts include an Other option for free-text answers +- Improve teleported subagent /tasks navigation with nested tree browsing, current/all and finished-task filters, and a live timeline you can steer +- A rare internal delay no longer prints a diagnostic warning on top of the interactive UI +- A failed session-history load no longer leaves the timeline permanently empty: the failure was silently discarded, so the transcript stayed blank for the rest of the session with nothing logged. It is now retried, and reported in the transcript and the log if it still fails +- Resuming a long session no longer collapses the timeline's scroll range while history renders in the background: entries that had not finished rendering were published as if they did not exist, so the scrollbar and scroll position jumped until the background render caught up +- Manage multiple concurrent sessions from the Sessions tab and sidebar +- Sandboxed wrapper builds (make and friends) get the dev tool caches their recipes need, based on the build manifests in the working directory +- Prompt pinning is off by default; set pinnedPrompts to true to enable it. +- Sandboxed commands can reach the network again on recent Windows builds, where every outbound connection was blocked even with outbound access enabled and no proxy configured +- Plugin custom agents honor deferred-tool-loading frontmatter +- Use `/worktree new` to start a new session in a new worktree +- A sandbox that cannot start an MCP server now fails in seconds instead of stalling the session, and sandbox startup failures for both MCP and language servers now say the sandbox was at fault and how to fix or opt out of it +- Login links are clickable during web and device-code sign-in +- Pin the current prompt one row higher, in the row the tab bar already reserves, so it keeps the shape of the prompt it copies while costing the timeline one row less +- Leave the pinned prompt off by default on terminals under 30 rows, where it would crowd the output; set pinnedPrompts explicitly to override at any size +- Compute /context attribution against the Auto-resolved model so token totals are accurate for Free/Student users +- Disabling an extension no longer breaks elicitation, canvases, or tool permission prompts for other extensions +- A prompt stashed with ctrl+s now stays with the session it was typed for, so switching away and back and pressing ctrl+s restores it instead of finding it gone +- On Linux, searches and most shell commands blocked by the sandbox now offer to re-run outside it +- BREAKING: the sandbox setting `allowDevToolCaches` is renamed `allowDevToolAccess`, since it grants dev-tool config and registries too, not just caches. The old key is no longer read and is ignored silently, so an existing `false` opt-out reverts to the default (on). Rename it in settings.json and in any managed/MDM policy. +- Add /sandbox policy to show effective sandbox paths, denials, and network access +- Queue prompts, shell commands, and supported slash commands in local sessions to run in order after the current task finishes +- Set "autoUpdate": true on an extraKnownMarketplaces entry in your user settings to auto-update its plugins at session start +- /sandbox tags inactive settings as (disabled) and explains why they are locked, and documents dev tool caches in copilot help sandbox +- Show "pending · ctrl+c to cancel" for in-flight steering prompts +- Make /model session-scoped by default, and use /config model to set defaults for future sessions. +- Pin the current prompt as a single line instead of a three-row framed block, so it reads as chrome and returns rows to the timeline; with the tab bar on it sits directly below the tabs and costs the timeline nothing + ## 1.0.78 - 2026-08-03 - Timeline headers show how long each tool call took, right-aligned and ticking live while it runs (for calls of at least 5 seconds). On by default — disable with `/settings showToolDurations`. From 476581ccde7d596ded05d2b77b36edb57762a2c4 Mon Sep 17 00:00:00 2001 From: Michael Recachinas Date: Tue, 11 Aug 2026 10:58:35 -0400 Subject: [PATCH 2/9] Migrate close-on-PR workflow off pull_request_target Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/close-invalid-pr-writer.yml | 51 +++++++++++++++++++ .github/workflows/close-invalid.yml | 46 +++++++++-------- 2 files changed, 76 insertions(+), 21 deletions(-) create mode 100644 .github/workflows/close-invalid-pr-writer.yml diff --git a/.github/workflows/close-invalid-pr-writer.yml b/.github/workflows/close-invalid-pr-writer.yml new file mode 100644 index 00000000..7cfc6a70 --- /dev/null +++ b/.github/workflows/close-invalid-pr-writer.yml @@ -0,0 +1,51 @@ +name: Close invalid PR writer + +on: + workflow_run: + workflows: [Close issue/PR on adding invalid label] + types: [completed] + +permissions: + issues: read + pull-requests: write + +jobs: + close-invalid-pr: + if: > + github.repository == 'github/copilot-cli' && + github.event.workflow_run.event == 'pull_request' && + github.event.workflow_run.conclusion == 'success' && + github.event.workflow_run.repository.full_name == github.repository + runs-on: ubuntu-latest + steps: + - name: Close invalid PR + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_REPO: ${{ github.repository }} + HEAD_OWNER: ${{ github.event.workflow_run.head_repository.owner.login }} + HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }} + PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }} + run: | + set -euo pipefail + + if [ -z "${PR_NUMBER:-}" ] || [ "$PR_NUMBER" = "null" ]; then + PR_NUMBER="$(gh api --method GET "repos/$GH_REPO/pulls" -f state=open -f head="$HEAD_OWNER:$HEAD_BRANCH" --jq 'if length == 1 then .[0].number else empty end')" + fi + + if [ -z "${PR_NUMBER:-}" ]; then + echo "Unable to identify a single open PR for workflow run; skipping." + exit 0 + fi + + pr_state="$(gh api "repos/$GH_REPO/pulls/$PR_NUMBER" --jq .state)" + if [ "$pr_state" != "open" ]; then + echo "PR #$PR_NUMBER is $pr_state; skipping." + exit 0 + fi + + if ! gh api "repos/$GH_REPO/issues/$PR_NUMBER/labels" --jq '.[].name' | grep -Fxq invalid; then + echo "PR #$PR_NUMBER does not currently have the invalid label; skipping." + exit 0 + fi + + gh api -X PATCH "repos/$GH_REPO/pulls/$PR_NUMBER" -f state=closed diff --git a/.github/workflows/close-invalid.yml b/.github/workflows/close-invalid.yml index 4078bd87..b1fa4801 100644 --- a/.github/workflows/close-invalid.yml +++ b/.github/workflows/close-invalid.yml @@ -1,36 +1,40 @@ name: Close issue/PR on adding invalid label -# **What it does**: This action closes issues that are labeled as invalid in the repo. +# **What it does**: This action closes issues and PRs that are labeled as invalid in the repo. on: issues: types: [labeled] - pull_request_target: + pull_request: types: [labeled] -permissions: - contents: read - issues: write - pull-requests: write +permissions: {} jobs: - close-on-adding-invalid-label: - if: - github.repository == 'github/copilot-cli' && github.event.label.name == - 'invalid' + close-issue-on-adding-invalid-label: + if: > + github.repository == 'github/copilot-cli' && + github.event_name == 'issues' && + github.event.label.name == 'invalid' runs-on: ubuntu-latest - + permissions: + issues: write steps: - name: Close issue - if: ${{ github.event_name == 'issues' }} env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - URL: ${{ github.event.issue.html_url }} - run: gh issue close $URL + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_REPOSITORY: ${{ github.repository }} + ISSUE_NUMBER: ${{ github.event.issue.number }} + run: gh api -X PATCH "repos/$GH_REPOSITORY/issues/$ISSUE_NUMBER" -f state=closed - - name: Close PR - if: ${{ github.event_name == 'pull_request_target' }} - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - URL: ${{ github.event.pull_request.html_url }} - run: gh pr close $URL + signal-invalid-pr-label: + if: > + github.repository == 'github/copilot-cli' && + github.event_name == 'pull_request' && + github.event.label.name == 'invalid' + runs-on: ubuntu-latest + permissions: + pull-requests: read + steps: + - name: Record invalid PR label signal + run: echo "Invalid label signal for PR #${{ github.event.pull_request.number }}" From 132979e761a234a7061126488c1d4f7e2960c076 Mon Sep 17 00:00:00 2001 From: Michael Recachinas Date: Wed, 12 Aug 2026 09:51:29 -0400 Subject: [PATCH 3/9] Harden invalid PR close dispatcher Bind privileged closure to the trusted workflow identity and exact PR head, and reconcile invalid conflicted PRs from the default branch. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d --- .github/workflows/close-invalid-pr-writer.yml | 85 +++++++++++++++---- .github/workflows/close-invalid.yml | 10 ++- 2 files changed, 73 insertions(+), 22 deletions(-) diff --git a/.github/workflows/close-invalid-pr-writer.yml b/.github/workflows/close-invalid-pr-writer.yml index 7cfc6a70..1094d6f4 100644 --- a/.github/workflows/close-invalid-pr-writer.yml +++ b/.github/workflows/close-invalid-pr-writer.yml @@ -4,48 +4,97 @@ on: workflow_run: workflows: [Close issue/PR on adding invalid label] types: [completed] + # pull_request does not run for conflicted PRs, so reconcile from the trusted default branch. + schedule: + - cron: '*/5 * * * *' + workflow_dispatch: -permissions: - issues: read - pull-requests: write +permissions: {} jobs: - close-invalid-pr: + close-invalid-pr-from-workflow-run: if: > github.repository == 'github/copilot-cli' && + github.event_name == 'workflow_run' && github.event.workflow_run.event == 'pull_request' && - github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.repository.full_name == github.repository runs-on: ubuntu-latest + permissions: + actions: read + pull-requests: write + concurrency: + group: close-invalid-pr-${{ github.event.workflow_run.pull_requests[0].number || github.run_id }} + cancel-in-progress: false steps: - name: Close invalid PR env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} GH_REPO: ${{ github.repository }} - HEAD_OWNER: ${{ github.event.workflow_run.head_repository.owner.login }} - HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }} - PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }} + WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }} run: | set -euo pipefail - if [ -z "${PR_NUMBER:-}" ] || [ "$PR_NUMBER" = "null" ]; then - PR_NUMBER="$(gh api --method GET "repos/$GH_REPO/pulls" -f state=open -f head="$HEAD_OWNER:$HEAD_BRANCH" --jq 'if length == 1 then .[0].number else empty end')" + trusted_workflow_id="$(gh api "repos/$GH_REPO/actions/workflows/close-invalid.yml" --jq .id)" + workflow_run="$(gh api "repos/$GH_REPO/actions/runs/$WORKFLOW_RUN_ID")" + + if [ "$(jq -r .workflow_id <<<"$workflow_run")" != "$trusted_workflow_id" ] || + [ "$(jq -r .event <<<"$workflow_run")" != "pull_request" ] || + [ "$(jq -r .repository.full_name <<<"$workflow_run")" != "$GH_REPO" ]; then + echo "Workflow run is not a trusted pull_request run from $GH_REPO; skipping." + exit 0 fi - if [ -z "${PR_NUMBER:-}" ]; then - echo "Unable to identify a single open PR for workflow run; skipping." + if [ "$(jq '.pull_requests | length' <<<"$workflow_run")" -ne 1 ]; then + echo "Workflow run is not associated with exactly one PR; skipping." exit 0 fi - pr_state="$(gh api "repos/$GH_REPO/pulls/$PR_NUMBER" --jq .state)" - if [ "$pr_state" != "open" ]; then - echo "PR #$PR_NUMBER is $pr_state; skipping." + pr_number="$(jq -r .pull_requests[0].number <<<"$workflow_run")" + run_head_sha="$(jq -r .head_sha <<<"$workflow_run")" + run_head_repo="$(jq -r '.head_repository.full_name // empty' <<<"$workflow_run")" + pr="$(gh api "repos/$GH_REPO/pulls/$pr_number")" + + if [ -z "$run_head_repo" ] || + [ "$(jq -r .base.repo.full_name <<<"$pr")" != "$GH_REPO" ] || + [ "$(jq -r '.head.repo.full_name // empty' <<<"$pr")" != "$run_head_repo" ] || + [ "$(jq -r .head.sha <<<"$pr")" != "$run_head_sha" ]; then + echo "PR #$pr_number no longer matches the workflow run head; skipping." exit 0 fi - if ! gh api "repos/$GH_REPO/issues/$PR_NUMBER/labels" --jq '.[].name' | grep -Fxq invalid; then - echo "PR #$PR_NUMBER does not currently have the invalid label; skipping." + if [ "$(jq -r .state <<<"$pr")" != "open" ] || + ! jq -e 'any(.labels[]?; .name == "invalid")' >/dev/null <<<"$pr"; then + echo "PR #$pr_number is not open with the invalid label; skipping." exit 0 fi - gh api -X PATCH "repos/$GH_REPO/pulls/$PR_NUMBER" -f state=closed + gh api -X PATCH "repos/$GH_REPO/pulls/$pr_number" -f state=closed + + reconcile-invalid-prs: + if: > + github.repository == 'github/copilot-cli' && + (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') + runs-on: ubuntu-latest + permissions: + pull-requests: write + concurrency: + group: close-invalid-pr-reconciliation + cancel-in-progress: false + steps: + - name: Close open PRs with the invalid label + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_REPO: ${{ github.repository }} + run: | + set -euo pipefail + + gh api --paginate "repos/$GH_REPO/pulls?state=open&per_page=100" \ + --jq '.[] | select(any(.labels[]?; .name == "invalid")) | .number' | + while read -r pr_number; do + pr="$(gh api "repos/$GH_REPO/pulls/$pr_number")" + + if [ "$(jq -r .state <<<"$pr")" = "open" ] && + jq -e 'any(.labels[]?; .name == "invalid")' >/dev/null <<<"$pr"; then + gh api -X PATCH "repos/$GH_REPO/pulls/$pr_number" -f state=closed + fi + done diff --git a/.github/workflows/close-invalid.yml b/.github/workflows/close-invalid.yml index b1fa4801..18288ff0 100644 --- a/.github/workflows/close-invalid.yml +++ b/.github/workflows/close-invalid.yml @@ -1,6 +1,6 @@ name: Close issue/PR on adding invalid label -# **What it does**: This action closes issues and PRs that are labeled as invalid in the repo. +# **What it does**: This action closes invalid issues and signals invalid PRs to a trusted writer. on: issues: @@ -33,8 +33,10 @@ jobs: github.event_name == 'pull_request' && github.event.label.name == 'invalid' runs-on: ubuntu-latest - permissions: - pull-requests: read + permissions: {} steps: - name: Record invalid PR label signal - run: echo "Invalid label signal for PR #${{ github.event.pull_request.number }}" + env: + PR_NUMBER: ${{ github.event.pull_request.number }} + run: | + echo "Invalid label signal for PR #$PR_NUMBER" From da6329cc64f78f2ea9643e5d4b121f3b2bcfe8a4 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 14 Aug 2026 02:28:40 +0000 Subject: [PATCH 4/9] Update changelog.md for version 1.0.80 --- changelog.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/changelog.md b/changelog.md index 48f07df8..381986dd 100644 --- a/changelog.md +++ b/changelog.md @@ -1,3 +1,7 @@ +## 1.0.80 - 2026-08-14 + +- Update model configurations + ## 1.0.79 - 2026-08-10 - The /sandbox configuration dialog shows where sandbox settings are stored in settings.json From efb1c23cad3891429bd1447e4ba7cbdbe0ff9ee1 Mon Sep 17 00:00:00 2001 From: Michael Recachinas Date: Fri, 14 Aug 2026 16:39:54 -0400 Subject: [PATCH 5/9] Handle fork PR associations in invalid-label writer Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d --- .github/workflows/close-invalid-pr-writer.yml | 62 ++++++++++++++++--- 1 file changed, 55 insertions(+), 7 deletions(-) diff --git a/.github/workflows/close-invalid-pr-writer.yml b/.github/workflows/close-invalid-pr-writer.yml index 1094d6f4..a8f3f98f 100644 --- a/.github/workflows/close-invalid-pr-writer.yml +++ b/.github/workflows/close-invalid-pr-writer.yml @@ -44,19 +44,67 @@ jobs: exit 0 fi - if [ "$(jq '.pull_requests | length' <<<"$workflow_run")" -ne 1 ]; then - echo "Workflow run is not associated with exactly one PR; skipping." + run_head_sha="$(jq -r .head_sha <<<"$workflow_run")" + run_head_repo="$(jq -r '.head_repository.full_name // empty' <<<"$workflow_run")" + run_head_branch="$(jq -r '.head_branch // empty' <<<"$workflow_run")" + + if [ -z "$run_head_repo" ] || + [ -z "$run_head_branch" ] || + [[ ! "$run_head_sha" =~ ^[0-9a-f]{40}$ ]] || + [ "${run_head_repo#*/}" = "$run_head_repo" ] || + [ -z "${run_head_repo%%/*}" ] || + [ -z "${run_head_repo#*/}" ]; then + echo "Workflow run is missing valid head repository, branch, or SHA metadata; skipping." + exit 0 + fi + + pull_request_count="$(jq '.pull_requests | length' <<<"$workflow_run")" + if [ "$pull_request_count" -eq 1 ]; then + pr_number="$(jq -r .pull_requests[0].number <<<"$workflow_run")" + elif [ "$pull_request_count" -eq 0 ]; then + run_head_owner="${run_head_repo%%/*}" + matching_prs="$( + gh api --method GET --paginate "repos/$GH_REPO/pulls" \ + -f state=open \ + -f head="$run_head_owner:$run_head_branch" \ + -f per_page=100 | + jq -cs \ + --arg repo "$GH_REPO" \ + --arg head_repo "$run_head_repo" \ + --arg head_branch "$run_head_branch" \ + --arg head_sha "$run_head_sha" \ + 'add | [ + .[] | + select( + .state == "open" and + .base.repo.full_name == $repo and + .head.repo.full_name == $head_repo and + .head.ref == $head_branch and + .head.sha == $head_sha + ) + ]' + )" + + if [ "$(jq 'length' <<<"$matching_prs")" -ne 1 ]; then + echo "Workflow run could not be uniquely associated with an open PR; skipping." + exit 0 + fi + pr_number="$(jq -r '.[0].number' <<<"$matching_prs")" + else + echo "Workflow run is associated with multiple PRs; skipping." + exit 0 + fi + + if [[ ! "$pr_number" =~ ^[1-9][0-9]*$ ]]; then + echo "Workflow run produced an invalid PR number; skipping." exit 0 fi - pr_number="$(jq -r .pull_requests[0].number <<<"$workflow_run")" - run_head_sha="$(jq -r .head_sha <<<"$workflow_run")" - run_head_repo="$(jq -r '.head_repository.full_name // empty' <<<"$workflow_run")" pr="$(gh api "repos/$GH_REPO/pulls/$pr_number")" - if [ -z "$run_head_repo" ] || - [ "$(jq -r .base.repo.full_name <<<"$pr")" != "$GH_REPO" ] || + if [ "$(jq -r .base.repo.full_name <<<"$pr")" != "$GH_REPO" ] || [ "$(jq -r '.head.repo.full_name // empty' <<<"$pr")" != "$run_head_repo" ] || + [ "$(jq -r .head.ref <<<"$pr")" != "$run_head_branch" ] || [ "$(jq -r .head.sha <<<"$pr")" != "$run_head_sha" ]; then echo "PR #$pr_number no longer matches the workflow run head; skipping." exit 0 From ab097e5b3e75c2da1658385c5d8c970ebabb38c0 Mon Sep 17 00:00:00 2001 From: Derek Legenzoff Date: Tue, 25 Aug 2026 17:19:31 -0700 Subject: [PATCH 6/9] Prepare public prerelease v1.0.81-11 From 4ab8707dbf12f8fc15e8bac2cb5c38d18341b494 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Thu, 27 Aug 2026 17:10:10 +0000 Subject: [PATCH 7/9] Update changelog.md for version 1.0.81 --- changelog.md | 92 ++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 75 insertions(+), 17 deletions(-) diff --git a/changelog.md b/changelog.md index 381986dd..14f3c671 100644 --- a/changelog.md +++ b/changelog.md @@ -1,49 +1,107 @@ +## 1.0.81 - 2026-08-27 + +- The plugins dashboard is available to everyone: run `/plugin`, `/mcp`, or `/skills`. Set `PLUGINS_DASHBOARD=false` to opt out of it and the `copilot plugins` command. +- Ship MCP 2026-07-28 support to CLI, SDK, IDE, and in-memory clients +- Hooks can now receive the current OpenTelemetry trace context and emit correlated spans: inputs gain `traceparent` (plus `tracestate` when the span has vendor state); command hooks also get env vars. +- Windows: remote MCP servers protected by Microsoft Entra ID can now sign in through the OS authentication broker (WAM), usually with no prompt at all. Other platforms, `--device-code`, and machines without the broker library keep the existing browser flow. +- Add xhigh reasoning effort support for Grok 4.6 +- Startup now offers to restore sessions that were still open when their CLI went away, so a crash or a machine restart no longer means reopening each terminal by hand +- models.list now includes service-published infoMessages and warningMessages per model +- Add `copilot app` to open the GitHub Copilot app in the current directory +- Add defaultMode and defaultPermissionMode settings to choose startup mode and approval behavior for new interactive sessions +- Add --with-token to copilot login to read an auth token from stdin +- Add support for Gemini 3.7 Flash +- Add Ctrl+E in /sandbox to open settings.json in your editor +- Add per-agent usage metrics to --usage-output-file JSON output +- Repeated read_agent calls now consistently return the full turn history unless since_turn is provided +- Hook lifecycle events (`hook.start`/`hook.end`) from hooks inside a subagent are now recorded on that subagent's session and re-emitted on its parent, instead of being dropped on an internal session. +- Repeatedly resuming the same session no longer crashes while telemetry is being replaced +- An MCP server blocked by an enterprise policy now shows as blocked in /mcp instead of spinning as pending forever +- Fixed an indefinite "Loading…/Resuming…" hang at startup when a repository plugin activates a contributed extension (or another extension reload races the initial load), which previously left the environment stuck on "still waiting on extensions" +- Vim mode badge stays visible beside the activity indicator during turns +- The startup status finishes after extension configuration during plugin reconciliation +- Signing out of an account now clears its cached enterprise managed settings, so signing back in generally re-fetches the policy rather than re-applying the one cached before sign-out +- An enterprise managed-settings policy is no longer rejected when `permissions.disableBypassPermissionsMode` carries an unrecognized value; it is now logged and enforced as `disable`. +- Sandboxed builds on Windows create their scratch caches on first run, so cargo, go, Gradle, and ccache work without a warm cache +- On macOS and Linux, shell commands resolve the same tools a bash login shell does, including project environments activated from a profile +- Canvas windows open and refresh in the background instead of stealing focus from your terminal +- A prompt sent while the agent is working no longer leaves a second copy of itself stuck as `(pending)` at the bottom of the transcript after it has been answered +- Turning allow-all off from an ACP client now reaches the permission engine whenever there is a runtime override or auto-approval to revoke, so the setting can no longer report success while permissions stay enabled (a baseline granted by --allow-all-\* launch flags is still deliberately left intact) +- A failed tool call no longer stacks its `(MCP: server)` label one character per line down the timeline — the label and the error now share the row, with the longer side truncating +- Agents, skills and MCP servers contributed by installed plugins are no longer dropped in non-interactive (-p) runs, so --agent : works headlessly without --plugin-dir +- Typing `$` and pressing Enter opens the interactive shell again, instead of clearing the prompt and doing nothing +- The prompt frame now renders in terminals it previously skipped, such as foot and alacritty, instead of a fixed list +- A prompt queued while the agent is working stays visible instead of vanishing when you send another one +- The sessions sidebar's keyboard cursor is visible again, and selected rows in the Select family, the diff viewer and custom picker rows now pair the selection fill with the text color derived for it. +- Keys sent to an unfocused terminal pane are no longer dropped: Enter and other keystrokes are handled even after a terminal focus-out report, so tmux and agent multiplexers can drive a background pane +- Compact the autopilot goal panel to its identity row on a short terminal (a paused goal keeps its resume note), with ctrl+x → g to expand or collapse it by hand +- Render the autopilot goal panel as a pinned prompt frame, drop its progress bar for the exact todo count, fold the subagent hint into the row it toggles, and keep its metrics on a narrow pane +- Resume large sessions faster by showing recent history first while older messages load. +- `x` is now the delete key everywhere: /sandbox config, /settings, /mcp, the sessions dialog and the diff comments summary move off `d` +- Auto mode now adapts model selection as your task evolves during a conversation +- /plugin now flags installed plugins and marketplaces that have a newer version upstream, and offers an Update action to pull it +- Show your last prompt as the inferred objective in the Autopilot status panel +- When --no-sandbox is ignored because enterprise policy could not be determined, the notice now says so, and no longer points at an administrator, instead of claiming a policy requires the sandbox. The unsupported-host warning says the same rather than contradicting it. +- Show model data retention warnings with links in the /model picker +- Path-sourced plugins in a local (directory-source) marketplace now load live from their real directory, so editing one takes effect on `/restart` or a new session — no `/plugin update` +- Skills and custom agents are discovered from directories added with --add-dir +- Use Ctrl+Space to toggle voice dictation. +- A session sandboxed by an enterprise managed policy now says so on the timeline, including when the policy arrives mid-session, instead of leaving the footer's sandbox chip as the only hint that commands are being restricted +- forceRemoteSettingsRefresh now fails closed: when set, the cached managed-settings policy is never served or used as a fetch-failure fallback (skipping both the 1h fast path and the 24h stale fallback), so a failed startup fetch blocks on the unconfirmed policy instead of reverting to a possibly-stale cached one. Concretely, until a fresh policy is fetched the session applies the restrictive undetermined-policy posture: non-default MCP servers are blocked, bypass-permissions mode cannot be enabled, and policy-gated plugin install/update mutations are blocked +- ACP clients receive subagent IDs, raw event subscriptions, and live title, mode, command, and plan updates +- Show each user instruction file separately in /instructions +- Managed settings now win per entry for enabledPlugins and extraKnownMarketplaces, so a plugin or marketplace your organization pins can't be overridden locally +- Use x to remove scheduled /every and /after prompts in Schedule Manager +- Update model configurations +- Removed the `PLUGINS_DASHBOARD` opt-out and the legacy skills picker it kept alive. `/skills`, bare `/mcp`, and `/mcp show` (with no server name) always open the dashboard; `/mcp config` still opens the dedicated MCP wizard. +- Removed `/plugins`; its resources moved to `/plugin`, `/mcp` and `/skills`, with `/subagents` and `/instructions` for agents and instructions. +- Enabling and disabling hooks and LSP servers is temporarily unavailable: those toggles existed only in the `/plugins` dashboard that this release removes. + ## 1.0.80 - 2026-08-14 - Update model configurations ## 1.0.79 - 2026-08-10 -- The /sandbox configuration dialog shows where sandbox settings are stored in settings.json - Add support for enterprise allow-auto-only policy so /allow-all auto works while full allow-all remains blocked. - Allow enterprise-managed sandbox policy to enforce a proxy URL while credentials remain user-controlled -- A tool directory inside your workspace that is on PATH (.venv/bin, node_modules/.bin, an in-repo GOPATH) no longer turns that part of the workspace read-only in the sandbox -- The /sandbox configuration dialog groups the git, gh, and (on macOS) keychain settings under a new Auth tab, and the settings keys moved from `sandbox.gitAuth`/`sandbox.ghAuth` to `sandbox.auth.git`/`sandbox.auth.gh`. There is no migration: the old keys are ignored in settings files, and SDK requests that still send them are rejected as invalid rather than ignored -- Added a `worktreeBaseRef` setting that controls whether `/worktree`, `/worktree new`, and `--worktree` start from HEAD or the remote default branch. All three now default to HEAD; previously `--worktree` started from the remote default branch. -- Model picker groups models into Recent, Recommended, New, and other sections, and Shift+Tab switches grouping views. -- Large monorepos now use tgrep ([trigram-indexed grep for fast regex search in large codebases](https://github.com/microsoft/tgrep)) instead of ripgrep - Agent Plugins spec plugins can now ship extensions under a com.github.copilot/extensions/ directory - Add support for the kimi-k3 model - Combine `--plan` with `--mode autopilot` to plan first and then implement without waiting for approval +- Manage multiple concurrent sessions from the Sessions tab and sidebar +- Add /sandbox policy to show effective sandbox paths, denials, and network access +- Queue prompts, shell commands, and supported slash commands in local sessions to run in order after the current task finishes +- Set "autoUpdate": true on an extraKnownMarketplaces entry in your user settings to auto-update its plugins at session start +- A tool directory inside your workspace that is on PATH (.venv/bin, node_modules/.bin, an in-repo GOPATH) no longer turns that part of the workspace read-only in the sandbox - The `/app` command now opens the current session in the GitHub Copilot desktop app instead of landing on Home with the wrong folder (requires GitHub Copilot app 1.1.3 or later) - On macOS, a sandbox read-only path nested inside a writable one now stays read-only instead of inheriting the write permission from the wider path - On macOS, sandboxed commands can use UNIX-domain sockets again, so tools that talk over a local IPC pipe (tsx, vite, esbuild, jest workers) no longer fail with `listen EPERM` - Sandboxed commands work when the working directory lives on a Windows Dev Drive - `/theme` now only shows its deprecation notice for a valid color mode, so a mistyped mode no longer suggests an invalid command or hides the notice from your next valid `/theme`. - Sandboxed git now authenticates to Azure DevOps, GitHub Enterprise Server, GitLab, and other non-GitHub remotes you have stored HTTPS credentials for -- Ask user multi-select prompts include an Other option for free-text answers -- Improve teleported subagent /tasks navigation with nested tree browsing, current/all and finished-task filters, and a live timeline you can steer - A rare internal delay no longer prints a diagnostic warning on top of the interactive UI - A failed session-history load no longer leaves the timeline permanently empty: the failure was silently discarded, so the transcript stayed blank for the rest of the session with nothing logged. It is now retried, and reported in the transcript and the log if it still fails - Resuming a long session no longer collapses the timeline's scroll range while history renders in the background: entries that had not finished rendering were published as if they did not exist, so the scrollbar and scroll position jumped until the background render caught up -- Manage multiple concurrent sessions from the Sessions tab and sidebar - Sandboxed wrapper builds (make and friends) get the dev tool caches their recipes need, based on the build manifests in the working directory -- Prompt pinning is off by default; set pinnedPrompts to true to enable it. - Sandboxed commands can reach the network again on recent Windows builds, where every outbound connection was blocked even with outbound access enabled and no proxy configured - Plugin custom agents honor deferred-tool-loading frontmatter -- Use `/worktree new` to start a new session in a new worktree - A sandbox that cannot start an MCP server now fails in seconds instead of stalling the session, and sandbox startup failures for both MCP and language servers now say the sandbox was at fault and how to fix or opt out of it - Login links are clickable during web and device-code sign-in -- Pin the current prompt one row higher, in the row the tab bar already reserves, so it keeps the shape of the prompt it copies while costing the timeline one row less -- Leave the pinned prompt off by default on terminals under 30 rows, where it would crowd the output; set pinnedPrompts explicitly to override at any size - Compute /context attribution against the Auto-resolved model so token totals are accurate for Free/Student users - Disabling an extension no longer breaks elicitation, canvases, or tool permission prompts for other extensions - A prompt stashed with ctrl+s now stays with the session it was typed for, so switching away and back and pressing ctrl+s restores it instead of finding it gone - On Linux, searches and most shell commands blocked by the sandbox now offer to re-run outside it +- The /sandbox configuration dialog shows where sandbox settings are stored in settings.json +- The /sandbox configuration dialog groups the git, gh, and (on macOS) keychain settings under a new Auth tab, and the settings keys moved from `sandbox.gitAuth`/`sandbox.ghAuth` to `sandbox.auth.git`/`sandbox.auth.gh`. There is no migration: the old keys are ignored in settings files, and SDK requests that still send them are rejected as invalid rather than ignored +- Added a `worktreeBaseRef` setting that controls whether `/worktree`, `/worktree new`, and `--worktree` start from HEAD or the remote default branch. All three now default to HEAD; previously `--worktree` started from the remote default branch. +- Model picker groups models into Recent, Recommended, New, and other sections, and Shift+Tab switches grouping views. +- Large monorepos now use tgrep ([trigram-indexed grep for fast regex search in large codebases](https://github.com/microsoft/tgrep)) instead of ripgrep +- Ask user multi-select prompts include an Other option for free-text answers +- Improve teleported subagent /tasks navigation with nested tree browsing, current/all and finished-task filters, and a live timeline you can steer +- Prompt pinning is off by default; set pinnedPrompts to true to enable it. +- Use `/worktree new` to start a new session in a new worktree +- Pin the current prompt one row higher, in the row the tab bar already reserves, so it keeps the shape of the prompt it copies while costing the timeline one row less - BREAKING: the sandbox setting `allowDevToolCaches` is renamed `allowDevToolAccess`, since it grants dev-tool config and registries too, not just caches. The old key is no longer read and is ignored silently, so an existing `false` opt-out reverts to the default (on). Rename it in settings.json and in any managed/MDM policy. -- Add /sandbox policy to show effective sandbox paths, denials, and network access -- Queue prompts, shell commands, and supported slash commands in local sessions to run in order after the current task finishes -- Set "autoUpdate": true on an extraKnownMarketplaces entry in your user settings to auto-update its plugins at session start - /sandbox tags inactive settings as (disabled) and explains why they are locked, and documents dev tool caches in copilot help sandbox - Show "pending · ctrl+c to cancel" for in-flight steering prompts - Make /model session-scoped by default, and use /config model to set defaults for future sessions. @@ -61,7 +119,7 @@ - A run whose prompt is piped over stdin now treats its `sessionEnd` hook the same way `-p` does: the hook fires once per completed agent turn with `reason` `complete` (or `error` if the turn failed), instead of once at shutdown with `user_exit`. As with `-p`, a piped run that exits before completing a turn fires no `sessionEnd` hook - Split-view sidebar: the red close confirmation now reads `x again to close` (or `x again to exit CLI` on the last session) instead of `x close`, so a second press is clearly what closes - Expose token usage in ACP prompt results and live usage_update notifications -- Added a forceRemoteSettingsRefresh managed setting that requires a fresh managed-settings fetch on startup +- Added a forceRemoteSettingsRefresh managed setting that requires a fresh managed-settings fetch on startup; when the setting is in effect and that refresh cannot be confirmed, plugin mutations and read-only marketplace operations alike (including `plugins marketplace` list, browse, and refresh) fail closed rather than proceeding without the server-managed policy - Disabling the sandbox from a bypass prompt applies only to that session; new sessions start sandboxed again - Managed settings now fall back to the persistent cache whenever a server-managed settings fetch fails for any reason (network error, a non-success HTTP status, or a malformed/unparseable response), and fail open — starting without the unconfirmed server restriction rather than the prior fail-closed behavior — when no usable cached policy is available - When the sandbox blocks a shell command and bypass is allowed, CLI offers to re-run it outside the sandbox without asking the model From be82101e70f0253b57519bebb9cc9d0f6dfb2ed2 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Sat, 29 Aug 2026 23:39:32 +0000 Subject: [PATCH 8/9] Update changelog.md for version 1.0.82 --- changelog.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/changelog.md b/changelog.md index 14f3c671..4a93ecd1 100644 --- a/changelog.md +++ b/changelog.md @@ -1,3 +1,9 @@ +## 1.0.82 - 2026-08-29 + +- A message typed while /worktree or /move is preparing the worktree no longer breaks the switch into it +- Ctrl+E expands the plan approval card to show the full plan again +- Show the specific authentication failure (such as 401 Bad credentials) instead of only the /login prompt + ## 1.0.81 - 2026-08-27 - The plugins dashboard is available to everyone: run `/plugin`, `/mcp`, or `/skills`. Set `PLUGINS_DASHBOARD=false` to opt out of it and the `copilot plugins` command. From d7ede79b9cbd4a76f64bb4b18a5731c4d008704b Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 4 Sep 2026 15:38:09 +0000 Subject: [PATCH 9/9] Update changelog.md for version 1.0.83 --- changelog.md | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/changelog.md b/changelog.md index 4a93ecd1..cb1d40ed 100644 --- a/changelog.md +++ b/changelog.md @@ -1,3 +1,43 @@ +## 1.0.83 - 2026-09-04 + +- Show running Copilot sessions in the Windows 11 taskbar with live hover status cards +- Add Client ID Metadata Document (CIMD) support for MCP OAuth sign-in +- Custom agents can list several models in `model`, tried in order until one is available to you, and `model-policy: required` keeps model changes on that list +- Adding support for claude-fable-5.1 +- Add Recent, Created, Name, and classic None sorting to the split Sessions sidebar, with the selected order saved across restarts +- Enterprise admins can pin sign-in to approved GitHub organizations with the forceLoginOrgs managed setting +- Add automatic HTTPS proxy mTLS client certificate support for model and web requests +- Detect the herdr terminal multiplexer instead of mistaking it for tmux, so the Kitty keyboard protocol, color scheme following, terminal progress, `/copy` and notifications work in herdr panes +- A session lock that is re-entered on the same thread now fails with a reported error instead of freezing the CLI. +- Kerberos proxy authentication reconnects when the initial challenge answers with `Connection: close` +- Sandboxed `gh` commands now authenticate as the account configured for the repository instead of the Copilot CLI login +- MCP tools remain callable after MCP server restarts +- Sandboxed file tools now read the same developer-tool paths as sandboxed shell commands, including token-bearing registry config such as ~/.npmrc; set sandbox.allowDevToolAccess to false to turn these grants off +- Stopping a timed-out shell command now lets queued messages run and sessions return to idle +- A follow-up prompt typed while autopilot is running no longer disappears from the timeline +- Restart provides clearer update guidance when automatic restart cannot be completed +- MCP servers configured by your agent stay available after built-in sub-agent turns. +- Anthropic sessions continue after temporary fallback instead of failing on invalid thinking signatures +- Long-running sessions on Linux return freed memory to the system instead of holding gigabytes of it +- Enterprise-denied MCP servers can no longer start before the managed allow/deny policy resolves; server startup now waits for the managed-settings fetch instead of racing it +- Host-provided plugin customizations can be read without redundant path permission prompts +- A relative `--add-dir` or `--plugin-dir` path now resolves against the session's working directory under `--resume=` and `--worktree`, instead of the directory the CLI was launched from. Relative values are also resolved after `-C` is applied, so `-C` no longer has to precede either option on the command line +- MCP servers contributed by a plugin are no longer labelled "User" in the MCP dashboard, and a server from a bundled plugin is now shown as built-in and names the plugin it came from. +- The newest line of output stays visible above the input box instead of hiding behind it, except while a prompt is pinned to the top of the transcript +- Exporting a resumed session with --share or --share-gist writes the whole transcript instead of only the latest run +- On macOS and Linux, sandboxed commands can no longer reach services running on your machine. On macOS this also blocks a server the command itself starts on 127.0.0.1, so test suites that bind a local port will fail; turn on Allow local network in /sandbox to reach localhost again. +- Linux sandboxing now needs slirp4netns, nsenter, iptables, ip6tables, iptables-restore and ip6tables-restore on PATH. Install them if sandboxed commands start failing to launch. +- CLI starts without the interrupted-session restore prompt by default. +- Resuming large sessions keeps the input prompt responsive sooner. +- Linux sandboxes now restrict network egress to the configured proxy; proxy mode requires slirp4netns, util-linux 2.35+, iptables, and /dev/net/tun access +- `/mcp config` and the MCP add/edit/authenticate forms now open in the plugins dashboard instead of a separate MCP manager, so closing a form returns to the server list. +- File path autocomplete stays fast in large repositories +- Plugin list commands and /plugin now show bundled built-in plugins. +- Improve sandboxed Bazel and Bazelisk runs by granting required cache and output paths; macOS requires a future Bazel release or additional sandbox capabilities +- The collapsed autopilot goal panel now reads as a single-line pinned prompt, keeping the frame it shares with a pinned prompt instead of compressing into a bare band wedged against the chrome above it +- Improve /sandbox policy by grouping path grants by source and showing detected developer tools +- Remove retired Claude and Gemini models from /model picker results + ## 1.0.82 - 2026-08-29 - A message typed while /worktree or /move is preparing the worktree no longer breaks the switch into it