1.0.76-4

Fixed

• Sandbox denied paths are enforced for relative and symlinked entries on macOS and Linux (Windows cannot deny per path)

1.0.76-3

Improved

• When an update is auto-downloaded, the notification suggests /restart and drops the warning color
• /diff scrolls and syntax-highlights large multi-file diffs faster
• Split-view sidebar: hover-to-focus is now off by default (opt in with sidebar.hoverFocus), the active session card is accented by default (opt out with sidebar.accentActiveSession), and the closed-state open sidebar hint always renders in the neutral hint color
• web_fetch now follows HTTP redirects instead of failing, asking permission for the redirect target when it is on a different origin and showing where the redirect came from

Fixed

• Unsent prompt text now stays with the session it was typed for (for the rest of the CLI session) instead of following you to the session you switch to
• Resuming a session now restores its autopilot or plan mode instead of reverting to interactive, so the autopilot-only task_complete tool stays available and the mode matches the session you left
• URL permission prompts now keep their sandbox-bypass warning and the model's reason when a host integration rebuilds the prompt, so an elevated fetch is no longer shown as an ordinary one

1.0.76-2

Added

• Add a directable queue manager (staff) to reorder, edit, remove, repeat, and immediately send queued messages
• New Sessions sidebar for managing multiple concurrent sessions: switch between them, spawn new ones, and see their status at a glance. Turn it on with experimental mode (/experimental on).
• Enterprise administrators can enforce a restrictive sandbox floor: managed settings tighten (but never loosen) the user's sandbox policy, and the /sandbox dialog surfaces the org-configured managed values with locked fields and managed filesystem paths so admins can confirm what is enforced.

Improved

• Sandboxed searches now offer an immediate bypass prompt and avoid duplicate bypass prompts.

Fixed

• Sessions no longer fail every turn with "Holder terminated during creation" after a subagent finishes
• Startup tips only suggest /init in repositories that don't already have Copilot instructions
• A userPromptSubmitted hook returning a non-string value for modifiedPrompt, modifiedTransformedPrompt, or a handled responseContent no longer corrupts the session; the value is ignored, a type-only warning naming the field is logged, an empty-string replacement is rejected instead of blanking the model-facing content, a hook that sets handled without a usable responseContent is now diagnosed instead of silently falling through to the model, and a null additionalContext is treated as absent instead of being injected as the literal text null; hook output is also bounded at 10 MiB per invocation, so an HTTP or command hook returning an unbounded response can no longer exhaust memory or leave an oversized session behind
• Show recent shell output for large commands that write to a file
• The /instructions picker now respects --no-custom-instructions.
• Render inline images in Rio terminals that support Kitty graphics

1.0.76-1

Added

• Voice mode pauses playing media before recording and resumes it afterward, where supported (macOS and Windows)
• Show the number of active scheduled prompts in the footer
• Add /limits predict to suggest a session AI-credit limit from similar sessions.
• Add configurable timed refreshes for custom status-line commands

Improved

• web_fetch routes through the configured sandbox proxy when outbound is allowed, and denies egress when network.allowOutbound is false (a proxy no longer overrides the user's outbound policy); when a proxied fetch fails it warns that curl/wget share the same proxy, and suggests requestSandboxBypass only when the sandbox proxy itself is unreachable
• Improve subagent delegation for small tasks and parallel work
• Queue mid-turn /model changes and apply them after the current response finishes

Fixed

• Queued messages list no longer shows a blank row or inflated count, and Ctrl+C removes your own newest queued message
• Changing the mouse setting mid-session now takes effect immediately, from both /settings mouse on|off and the /settings dialog, instead of being saved but ignored until the CLI restarted

1.0.76-0

Improved

• MCP tools load faster from definition-scoped snapshots, with process-wide and per-server cache opt-outs.
• Autopilot stays selected after task_complete by default; set stayInAutopilot to false to return to interactive mode after each task

Fixed

• Restore the early warning when unreclaimable system and tool context nears the limit, before automatic compaction is blocked
• Session working directory no longer reverts to the original checkout shortly after /worktree switches into a new worktree

1.0.75

2026-07-24

• Add support for Claude Opus 5

1.0.74

2026-07-23

• Typing ? while the /search bar is open enters it as text instead of opening quick help
• Add support for Open Plugin Spec v1 plugin manifests and mcp.json configuration
• IDE integration reconnects reliably when the CLI reloads MCP servers or changes directory
• Multi-turn subagent timelines show every prompt and response in the correct order after reopening /tasks
• Subagent timelines identify whether prompts came from the main agent or another subagent
• Show a first-run splash to opt into the default sandbox
• Adding support for gemini-3.6-flash
• The /mcp add and /mcp edit wizard now preserves = characters in environment variable values (such as base64 padding), so secrets and tokens are stored correctly.
• Remote session uploads stop retrying permanent Mission Control 400/404 responses
• Show Tab in /settings footer to switch scope tabs
• Downscale oversized tool-result images so CAPI Responses requests continue
• When multiplexing sessions, a session's open dialog no longer leaks into another session; eligible pickers reopen when you switch back
• The $ interactive shell shortcut now opens a shell even while the agent is working
• Fully honor the skill disable-model-invocation flag
• Warn when a participating language server reports a different symbol than the one requested
• Steering interrupts shell output waits without stopping the running command
• Increase the Responses request size limit
• Plan mode now allows session-folder planning artifacts while still blocking clear file mutations outside the session folder.
• Add /model plan (or /model --plan) to pick a model used while in plan mode; pass a model id, off to clear, or no id to open the picker. Reverts to the session model when you leave plan mode.
• Resume search matches session titles even when whitespace differs

1.0.74-4

Added

• Add support for Open Plugin Spec v1 plugin manifests and mcp.json configuration

Improved

• Subagent timelines identify whether prompts came from the main agent or another subagent

Fixed

• IDE integration reconnects reliably when the CLI reloads MCP servers or changes directory
• Multi-turn subagent timelines show every prompt and response in the correct order after reopening /tasks

1.0.74-3

Fixes and changes

1.0.74-2

Fixes and changes