From efb1c23cad3891429bd1447e4ba7cbdbe0ff9ee1 Mon Sep 17 00:00:00 2001 From: Michael Recachinas Date: Fri, 14 Aug 2026 16:39:54 -0400 Subject: [PATCH 1/3] Handle fork PR associations in invalid-label writer Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d --- .github/workflows/close-invalid-pr-writer.yml | 62 ++++++++++++++++--- 1 file changed, 55 insertions(+), 7 deletions(-) diff --git a/.github/workflows/close-invalid-pr-writer.yml b/.github/workflows/close-invalid-pr-writer.yml index 1094d6f4..a8f3f98f 100644 --- a/.github/workflows/close-invalid-pr-writer.yml +++ b/.github/workflows/close-invalid-pr-writer.yml @@ -44,19 +44,67 @@ jobs: exit 0 fi - if [ "$(jq '.pull_requests | length' <<<"$workflow_run")" -ne 1 ]; then - echo "Workflow run is not associated with exactly one PR; skipping." + run_head_sha="$(jq -r .head_sha <<<"$workflow_run")" + run_head_repo="$(jq -r '.head_repository.full_name // empty' <<<"$workflow_run")" + run_head_branch="$(jq -r '.head_branch // empty' <<<"$workflow_run")" + + if [ -z "$run_head_repo" ] || + [ -z "$run_head_branch" ] || + [[ ! "$run_head_sha" =~ ^[0-9a-f]{40}$ ]] || + [ "${run_head_repo#*/}" = "$run_head_repo" ] || + [ -z "${run_head_repo%%/*}" ] || + [ -z "${run_head_repo#*/}" ]; then + echo "Workflow run is missing valid head repository, branch, or SHA metadata; skipping." + exit 0 + fi + + pull_request_count="$(jq '.pull_requests | length' <<<"$workflow_run")" + if [ "$pull_request_count" -eq 1 ]; then + pr_number="$(jq -r .pull_requests[0].number <<<"$workflow_run")" + elif [ "$pull_request_count" -eq 0 ]; then + run_head_owner="${run_head_repo%%/*}" + matching_prs="$( + gh api --method GET --paginate "repos/$GH_REPO/pulls" \ + -f state=open \ + -f head="$run_head_owner:$run_head_branch" \ + -f per_page=100 | + jq -cs \ + --arg repo "$GH_REPO" \ + --arg head_repo "$run_head_repo" \ + --arg head_branch "$run_head_branch" \ + --arg head_sha "$run_head_sha" \ + 'add | [ + .[] | + select( + .state == "open" and + .base.repo.full_name == $repo and + .head.repo.full_name == $head_repo and + .head.ref == $head_branch and + .head.sha == $head_sha + ) + ]' + )" + + if [ "$(jq 'length' <<<"$matching_prs")" -ne 1 ]; then + echo "Workflow run could not be uniquely associated with an open PR; skipping." + exit 0 + fi + pr_number="$(jq -r '.[0].number' <<<"$matching_prs")" + else + echo "Workflow run is associated with multiple PRs; skipping." + exit 0 + fi + + if [[ ! "$pr_number" =~ ^[1-9][0-9]*$ ]]; then + echo "Workflow run produced an invalid PR number; skipping." exit 0 fi - pr_number="$(jq -r .pull_requests[0].number <<<"$workflow_run")" - run_head_sha="$(jq -r .head_sha <<<"$workflow_run")" - run_head_repo="$(jq -r '.head_repository.full_name // empty' <<<"$workflow_run")" pr="$(gh api "repos/$GH_REPO/pulls/$pr_number")" - if [ -z "$run_head_repo" ] || - [ "$(jq -r .base.repo.full_name <<<"$pr")" != "$GH_REPO" ] || + if [ "$(jq -r .base.repo.full_name <<<"$pr")" != "$GH_REPO" ] || [ "$(jq -r '.head.repo.full_name // empty' <<<"$pr")" != "$run_head_repo" ] || + [ "$(jq -r .head.ref <<<"$pr")" != "$run_head_branch" ] || [ "$(jq -r .head.sha <<<"$pr")" != "$run_head_sha" ]; then echo "PR #$pr_number no longer matches the workflow run head; skipping." exit 0 From be82101e70f0253b57519bebb9cc9d0f6dfb2ed2 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Sat, 29 Aug 2026 23:39:32 +0000 Subject: [PATCH 2/3] Update changelog.md for version 1.0.82 --- changelog.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/changelog.md b/changelog.md index 14f3c671..4a93ecd1 100644 --- a/changelog.md +++ b/changelog.md @@ -1,3 +1,9 @@ +## 1.0.82 - 2026-08-29 + +- A message typed while /worktree or /move is preparing the worktree no longer breaks the switch into it +- Ctrl+E expands the plan approval card to show the full plan again +- Show the specific authentication failure (such as 401 Bad credentials) instead of only the /login prompt + ## 1.0.81 - 2026-08-27 - The plugins dashboard is available to everyone: run `/plugin`, `/mcp`, or `/skills`. Set `PLUGINS_DASHBOARD=false` to opt out of it and the `copilot plugins` command. From d7ede79b9cbd4a76f64bb4b18a5731c4d008704b Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 4 Sep 2026 15:38:09 +0000 Subject: [PATCH 3/3] Update changelog.md for version 1.0.83 --- changelog.md | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/changelog.md b/changelog.md index 4a93ecd1..cb1d40ed 100644 --- a/changelog.md +++ b/changelog.md @@ -1,3 +1,43 @@ +## 1.0.83 - 2026-09-04 + +- Show running Copilot sessions in the Windows 11 taskbar with live hover status cards +- Add Client ID Metadata Document (CIMD) support for MCP OAuth sign-in +- Custom agents can list several models in `model`, tried in order until one is available to you, and `model-policy: required` keeps model changes on that list +- Adding support for claude-fable-5.1 +- Add Recent, Created, Name, and classic None sorting to the split Sessions sidebar, with the selected order saved across restarts +- Enterprise admins can pin sign-in to approved GitHub organizations with the forceLoginOrgs managed setting +- Add automatic HTTPS proxy mTLS client certificate support for model and web requests +- Detect the herdr terminal multiplexer instead of mistaking it for tmux, so the Kitty keyboard protocol, color scheme following, terminal progress, `/copy` and notifications work in herdr panes +- A session lock that is re-entered on the same thread now fails with a reported error instead of freezing the CLI. +- Kerberos proxy authentication reconnects when the initial challenge answers with `Connection: close` +- Sandboxed `gh` commands now authenticate as the account configured for the repository instead of the Copilot CLI login +- MCP tools remain callable after MCP server restarts +- Sandboxed file tools now read the same developer-tool paths as sandboxed shell commands, including token-bearing registry config such as ~/.npmrc; set sandbox.allowDevToolAccess to false to turn these grants off +- Stopping a timed-out shell command now lets queued messages run and sessions return to idle +- A follow-up prompt typed while autopilot is running no longer disappears from the timeline +- Restart provides clearer update guidance when automatic restart cannot be completed +- MCP servers configured by your agent stay available after built-in sub-agent turns. +- Anthropic sessions continue after temporary fallback instead of failing on invalid thinking signatures +- Long-running sessions on Linux return freed memory to the system instead of holding gigabytes of it +- Enterprise-denied MCP servers can no longer start before the managed allow/deny policy resolves; server startup now waits for the managed-settings fetch instead of racing it +- Host-provided plugin customizations can be read without redundant path permission prompts +- A relative `--add-dir` or `--plugin-dir` path now resolves against the session's working directory under `--resume=` and `--worktree`, instead of the directory the CLI was launched from. Relative values are also resolved after `-C` is applied, so `-C` no longer has to precede either option on the command line +- MCP servers contributed by a plugin are no longer labelled "User" in the MCP dashboard, and a server from a bundled plugin is now shown as built-in and names the plugin it came from. +- The newest line of output stays visible above the input box instead of hiding behind it, except while a prompt is pinned to the top of the transcript +- Exporting a resumed session with --share or --share-gist writes the whole transcript instead of only the latest run +- On macOS and Linux, sandboxed commands can no longer reach services running on your machine. On macOS this also blocks a server the command itself starts on 127.0.0.1, so test suites that bind a local port will fail; turn on Allow local network in /sandbox to reach localhost again. +- Linux sandboxing now needs slirp4netns, nsenter, iptables, ip6tables, iptables-restore and ip6tables-restore on PATH. Install them if sandboxed commands start failing to launch. +- CLI starts without the interrupted-session restore prompt by default. +- Resuming large sessions keeps the input prompt responsive sooner. +- Linux sandboxes now restrict network egress to the configured proxy; proxy mode requires slirp4netns, util-linux 2.35+, iptables, and /dev/net/tun access +- `/mcp config` and the MCP add/edit/authenticate forms now open in the plugins dashboard instead of a separate MCP manager, so closing a form returns to the server list. +- File path autocomplete stays fast in large repositories +- Plugin list commands and /plugin now show bundled built-in plugins. +- Improve sandboxed Bazel and Bazelisk runs by granting required cache and output paths; macOS requires a future Bazel release or additional sandbox capabilities +- The collapsed autopilot goal panel now reads as a single-line pinned prompt, keeping the frame it shares with a pinned prompt instead of compressing into a bare band wedged against the chrome above it +- Improve /sandbox policy by grouping path grants by source and showing detected developer tools +- Remove retired Claude and Gemini models from /model picker results + ## 1.0.82 - 2026-08-29 - A message typed while /worktree or /move is preparing the worktree no longer breaks the switch into it