GitHub Copilot CLI changelog

2026-10-21

• Prompt mode now honors managed Auto model selection for -p and piped stdin runs
• Subagents honor custom and MCP tool approvals, avoiding duplicate permission prompts and allowing inherited workflows to run
• Plugin marketplaces accept git-subdir sources and long plugin descriptions
• Fish shell completion works when aliases include option aliases like --effort
• Chats no longer get blocked by organization plugin preparation while sending messages
• Long-running sandboxed commands continue running reliably past 10 seconds
• Replies cut off by a provider overload error retry with backoff and show the provider's message and request ID
• Sandboxed network traffic now honors NO_PROXY and ALL_PROXY when inheriting host proxy settings

2026-10-20

• Add native structured output for dynamic workflow subagents on supported models
• Add assistedApprovalInstructions setting to guide Assisted Permissions confirmation decisions
• Shell commands that create and then enter a directory now request path approval instead of being denied early.
• Headless and SDK sessions without an OAuth handler skip MCP connections when saved tokens require sign-in, while renewable grants still connect.
• macOS sandboxed commands can connect directly to localhost TCP services when local access is enabled and no host filters apply.
• Local models and loopback providers in providers.json no longer block Auto, your saved model or the default model when signed in to Copilot
• Explicit Entra MCP sign-in now recovers from rejected cached tokens by continuing to interactive sign-in.
• Switching only reasoning effort no longer forces compaction in over-budget sessions.
• Copy keys now reliably copy mouse selections even when pressed immediately after dragging.
• Cancel abandoned Microsoft sign-in flows so retries start cleanly
• Configured MCP inventory reads no longer fail when startup state is unchanged
• Google models now avoid repeated request rewrites when screenshot-heavy sessions exceed image limits, reducing extra token usage.
• Install Team-assigned plugins from Team-defined GitHub marketplaces
• Extension capability requests use explicit approval instead of the Assisted judge
• Shared MCP auth errors point to your client's sign-in settings; CLI authentication warnings still show /mcp auth.
• Switching from GPT models to Gemini no longer fails when earlier turns include custom tool calls
• Google model requests now respect registry image limits to avoid image-count request failures
• The first prompt no longer hangs silently when no model is selected at startup; the CLI now asks you to pick one with /model and keeps your prompt
• /usage now shows just the model name for BYOK and other rows without a provider label instead of "Unknown provider"
• Cancelling an admission-gated prompt now re-enables Enter without requiring extra typing while background work continues.
• Model picker marks your administrator-managed model as the default when it is available
• Preserve MCP PNG images that include ICC color profiles instead of omitting them
• Windows shell commands start reliably in restored sessions and clean up orphaned child processes
• Switching to HydraFusion compacts only when the routed model actually needs it
• CLI model lists refresh after endpoint updates instead of staying stale or empty
• Windows taskbar icon staging avoids concurrent temp-file collisions so icon presence remains stable across launches.
• Resuming a session shows the conversation sooner without waiting for placeholder environment setup
• Starting a session with sandboxed MCP servers now avoids unnecessary restarts and responds faster.
• Allow /config and /settings to set and unset showReasoning
• Permission approval prompts explain escalation causes and show a request-specific diagnosis command

2026-10-19

• Add --disable-client-telemetry flag to turn off client telemetry uploads from the CLI
• Add --trust-folder for one-off prompt-mode sessions started with -p or piped stdin
• Install verified Skills and plugins from GitHub install links via copilot plugin install "ghapp://air/install?..."
• Open /share without arguments to view a full-screen action menu for sharing the current session
• Sandbox host-rule traffic now honors HTTPS_PROXY and HTTP_PROXY when no sandbox proxy is configured
• Voice dictation no longer inserts language markers like into transcript text
• Managed plugins update activation in existing sessions when managed policy changes
• Sessions no longer stall for minutes when an MCP server hangs while loading tools.
• Gemini tool calls no longer fail when array parameters define enum values
• Gemini chats no longer fail after earlier tool results contain no readable content.
• Sandboxed shell commands now explain credential-proxy certificate trust failures and can offer an approved rerun outside the sandbox.
• Keep saved /diff review comments when reopening an unchanged diff in the same session, with an explicit discard action.
• Plugin enable, disable, update, and uninstall actions now route reliably after plugin inventory refreshes.
• Reasoning-only max-token responses no longer loop indefinitely and now end with a clear error when no progress is made
• Show a clear warning and keep the active model display in sync when a saved model is automatically replaced on resume.
• Sandboxed commands on Linux start more reliably without intermittent loopback setup failures
• Back from MCP resource details stays on the list during live metadata refreshes
• Native chats can start and finish while optional managed plugin downloads continue in the background.
• Double Ctrl+C exits immediately even when the CLI UI is busy
• Catalog search reports proxy authentication requirements for CONNECT proxy challenges
• HydraFusion keeps a pass expanded while its review runs, passes that were not kept stay expandable until you switch sessions or resume, and passes from an aborted turn say whether they were kept
• Managed account policy and bypass-mode warnings stay accurate after switching accounts, even when a policy cache miss happens.
• Avoid false context exhaustion and rollover refusal when tool definitions are deferred
• Custom agents that declare the documented search, web or todo tool aliases, or name github-mcp-server/web_search, now receive the matching tools
• CLI help and version flags exit reliably after printing their output
• Enterprise-managed ask permissions in Assisted mode now allow safe actions without unnecessary confirmation prompts.
• Keep your selected Microsoft Entra account pinned during sign-in and token renewal
• Up from sessions sidebar header actions wraps to the last visible session
• Plan, autopilot, and shell mode badges stay visible while startup components load and the agent works. The badge replaces the mode suffix that used to trail the activity text (Working - plan), and the startup Loading: row now truncates its diagnostics to keep the status row on one line
• Sandboxed commands can write package and build caches when developer tool access is enabled.
• Windows CLI Git commands now recover from thread-access-denied startup failures.
• A skill allowed-tools rule keeps commas inside its arguments instead of being split apart. Where a list's structure is ambiguous, its unscoped rules now prompt instead of being granted.
• MCP resource dashboard stays interactive while inventory adapters refresh
• Retry image-bearing Responses requests with smaller payload limits when providers reject oversized bodies
• Complete usage reporting no longer shows partial status or phantom unattributed spend after resume when billing data is complete.
• Assisted permissions send nested PowerShell and bash -c commands that only expand plain-data environment variables, single-quoted PowerShell, and PowerShell variable and alias statements to the permission judge instead of requiring unnecessary manual approval
• Path-specific instruction files in the repository root .github/instructions are now applied automatically when the agent reads or edits a matching file
• Start git, shell commands, and MCP servers on Windows when process snapshot thread enumeration fails
• Use the unified Sessions browser by default for /sessions, /session, and /resume.
• Session browsing now caps account discovery at 500 records and respects Retry-After hints for automatic refresh timing.
• Prompt to update the sandbox proxy certificate authority when masked hosts change
• Show a clear notice when administrator-managed settings override your selected model
• Enable semantic code search by default for online sessions.
• Improve /login for Microsoft Entra by letting you choose a cached account or explicitly sign in with a different account
• Sandboxed git on github.com can use your configured GITHUB_TOKEN from credentials.envVars
• /sandbox can keep sandboxing enabled for the current session without enabling it globally
• Trusted repository plugins install and update automatically before chat runs.
• Rename the built-in browser plugin to browser-use and keep existing browser plugin preferences working after upgrade
• Sandbox allows local network access by default so commands can reach localhost and private-network services.

2026-10-14

• Add support for Gemini 4 Argon
• Command hooks complete reliably even when child-exit signals are lost under Node
• MCP status and /mcp commands stay synced to the active session after split-view session switches
• Resuming a session now respects abandoned pending-permission work and continues only active permission requests.
• Keep ordinary characters typed while the input box is still coming up at startup, instead of dropping them
• Expand /ask answers with Ctrl+E, copy the entire answer with Ctrl+Y, and reopen the last usable completed answer in the session with /ask or /btw.

2026-10-13

• Add agent-scoped declarative hooks for custom agents
• Remote plugin marketplace and plugin fetches retry once with your signed-in GitHub token after HTTPS auth fails.
• Streamed responses behind TLS-intercepting proxies complete when close_notify is omitted
• Fix parsing of GitHub SCP remotes with absolute paths so repository owner and name resolve correctly
• Discover all custom agents even when repositories define more than 100 or nest agent files deeply.
• Autopilot denies a preToolUse hook's "ask" decision instead of stopping on a permission dialog nobody is watching
• Keep Windows taskbar agent icons grouped across CLI updates by using a stable icon path
• Keep saved settings such as dismissed prompts, trusted folders and sign-ins when one entry in config.json is invalid, instead of resetting them on every launch
• In /config, managed permission rules are read-only and hidden unless set by your organization.
• Show billed AI Credits in /usage for token-billed sessions, including after resume
• File reads using a view_range that is not exactly two elements, such as a lone start line, now show their line range and line count in the timeline, and session exports no longer contain the literal text undefined
• Dragging to select text in the transcript no longer occasionally highlights and copies the row below the pointer.
• Power BI and Bluebird MCP servers accept their published resource scopes during sign-in
• Redact secrets safely in --output-format json output while preserving valid variable references
• Resuming suspended sessions now reports interrupted tool calls and avoids replaying canceled writes.
• Synchronous /task JSON output now includes failed child error and lifecycle events before completion.
• Explicit GitHub MCP tool and toolset selections use the correct endpoint, so requested write tools stay available.
• Cached MCP tool calls recheck their definition when a concurrent tool-list refresh changes the catalog.
• Skills and custom agents from --plugin-dir plugins now reach autocomplete and invocation instead of going missing.
• Fixed resumed sessions rebuilding plugin hooks from the wrong plugin list, so hooks from repository-local marketplace plugins now keep running after --resume, and hooks from plugins your configuration disabled no longer come back
• Keep /user switch new-session choices visible after account checks in short terminals
• Unavailable permission recovery attempts are now tracked per request, so unrelated calls no longer consume each other's retry budget.
• Background-shell wait status no longer animates when no foreground work is running
• Emergency memory relief in long sessions can now bypass its cooldown before V8 aborts, so a session that would have been killed by a JavaScript heap out of memory crash may survive with compacted history instead
• Inline images render by default on supported terminals without enabling experimental mode. Use /settings inlineImages false to turn them off

2026-10-12

• Interactive sandbox settings suggest possible environment secrets and let you add masking hosts before saving.
• Make model IDs in /model and /config model case-insensitive and save canonical IDs
• Keep /allow-all available during startup while enterprise policy is still resolving
• /add-dir grants sandbox access to added directories for the current session
• /user list shows the authentication source for each signed-in account
• Show retry progress messages before recovered responses after transient model failures
• Model completions no longer show an authentication warning when an account-owned catalog is unavailable while signed out
• Interactive sessions in git repositories reach the input prompt sooner
• Timeline now shows whether you, Assisted Permissions, policy, or unattended fallback made each permission decision.

2026-10-09

• Use native Microsoft Entra broker authentication on macOS when available, with browser fallback.
• copilot config supports sandbox credential injectHosts keys, with key completion in Bash, Zsh, and Fish.
• --context now applies to new and resumed ACP sessions instead of silently using the default or previously saved context tier
• Managed plugin setup retries hourly or after policy changes instead of on every message failure

2026-10-08

• Add Claude Haiku 5.5 to model selection and --model completions
• copilot mcp add recovers cleanly after interrupted MCP config initialization
• MCP enable/disable now works before server discovery without starting MCP servers
• Assisted permissions send visible shell code to the permission judge instead of requiring unnecessary manual approval
• Show a policy warning when startup bypass-permission flags are suppressed by managed settings
• Clicking a Sessions sidebar row now reliably switches sessions during split-view reconciliation
• Show update guidance when managed settings request a newer CLI version without blocking normal prompts
• Managed policy can disable Assisted Permissions and keep sessions in Manual Approval mode.

2026-10-07

• Add enterprise permissions.limitTo to enforce managed domain boundaries for network requests
• Run safe /user commands immediately during active turns, reject unsafe remote commands during active turns without opening dialogs, and queue commands advertised by relay hosts
• Plugin skill commands stay available after reloading enabled plugins
• Sandbox local-network allowlists now include localhost and loopback hosts.
• GitHub.com Connector users can expand GitHub CLI permissions in place and retry connections without switching sign-in methods.
• Honor --context long_context at startup and show accurate context allowance in /context
• Connecting a Connector without the required GitHub scope now prompts to update your authorization instead of failing with an authentication error
• Warmed language servers stay running across LSP requests when sandboxing is disabled
• Clicking a truncated compact shell command expands it
• Command sandboxing is available to all users via /sandbox and --sandbox.
• MCP server configuration changes apply between turns without restarting the session.
• Model picker updates the recommended list to prioritize GPT-6.1 Sol, GPT-6 Astra/Luna, and Claude 5.5 models.
• Read user settings only from ~/.copilot/settings.json; user-setting keys in ~/.copilot/config.json are ignored.

2026-10-05

• Add copilot config subcommands to list, read, set, and remove settings.
• Add a pre-conversation Ctrl+E environment picker to switch between local and cloud runs
• Entra-protected MCP servers can silently renew access-token-only credentials.
• Legacy HTTP+SSE MCP connections no longer hang indefinitely when a message POST is never acknowledged; the acknowledgement is bounded by the server's configured timeout
• Voice runtime install errors name why the download from nuget.org failed, not only the fallback feed's 401
• Compaction keeps your latest prompt when requests exceed context limits
• Large Anthropic requests rejected by provider size limits now retry after downscaling images or removing attachments
• Custom agent model entries keep model-bound reasoning effort only when that model is selected
• Shell tool calls now stream live stdout and stderr output reliably in the timeline
• Usage reporting preserves provider-reported reasoning token totals when available
• Sessions no longer slow to a crawl for minutes after the agent writes a very large file in one step
• Sandboxed shells now withhold ambient GITHUB_TOKEN unless explicitly configured.
• Plan usage reflects the current billing period after quota resets
• Custom agents launched through ACP task calls now resolve and run correctly
• Remote session resume now uses your configured GitHub auth for --resume and --connect
• Entra sign-in falls back to browser auth when no broker is available and shows a manual URL when auto-open fails
• copilot sandbox ca commands now respect --config-dir (including with -C).
• Search commands avoid sandbox bypass prompts when access is already granted
• Sandboxed uv commands can write to the uv cache by default when dev tool access is enabled
• pnpm commands run in sandboxed sessions without lock-file permission errors
• Pressing n repeatedly in the Sessions tab reliably creates each new session
• Reverse search updates results when command history finishes loading at startup
• MCP tools recover within the same turn when server instructions change
• Changing experimental mode with /experimental or /settings takes effect after restart even when launched with an opposing experimental flag
• Keyboard, paste, and mouse input now stay ordered and responsive during rapid interaction.
• Sandboxed shell commands offer a network bypass prompt whenever the proxy blocks a destination
• Sandboxed scripts that run Git now authenticate with masked credentials and SSH remote rewrites
• Sub-agents keep working after you replace your GitHub authentication credentials
• Sandboxed commands on Windows write temporary files to the granted temp directory, so tools that rename a temp file into place work
• Prompt-mode sessions fire a single sessionEnd hook after Stop-hook continuations complete
• Reconnect to remote MCP servers after idle Streamable HTTP sessions expire
• Messaging a running background agent now steers its active turn at the next processing opportunity.
• Context rollovers keep your latest requests in the recovery context.
• Hide the automatic sandbox CA setup prompt on Windows accounts that cannot self-elevate
• Copilot no longer describes a subagent as configured when the current session cannot run it. Previously a session that could not use rubber-duck still reported it as set up in /subagents, and asking for it failed instead of being skipped cleanly.
• MCP tools continue working after OAuth reauthentication when tool definitions are unchanged
• Select which account to use after Microsoft Entra sign-in, and let /logout sign out those OAuth sessions.
• Improve first-run startup by extracting the bundled CLI package in a child process
• Improve startup responsiveness when connecting many MCP servers at once
• Canvas actions can now return images to the model in invoke_canvas_action.
• Remove retired models from the model picker and supported CLI selections

2026-10-01

• Add copilot sandbox ca commands to check, create, trust, rotate, and remove proxy CA trust, including unattended Windows setup; /sandbox ca install becomes create and trust
• Session timelines now clear busy status after interrupted turns finish.
• Sandboxed commands run on Windows versions without filesystem enumeration support, with a warning that PowerShell's current location may be wrong
• Footer text selection stays on the same visible line when the footer grows or shrinks.
• Offer sandbox network bypass for Node/npm EACCES socket denials on Windows
• CLI shutdown flushes pending telemetry before exit, with a bounded delay when telemetry is still initializing.
• Complete, statically analyzable read-only shell pipelines can now enter execution-evidence review, while incomplete or unbound pipelines require explicit approval.

2026-09-30

• Add support for GPT-6.1 Sol in model selection
• Add --mcp-github-auth to scope GitHub account auth to approved MCP server origins
• Add session-scoped read-only directory approvals to path access prompts
• Permission prompts remain answerable after resuming interrupted sessions.
• Auto-approval now takes into account messages you type while the agent is working, as it already did for prompts sent while it was idle
• Compaction now returns a summary even when instructions ask for tool use.
• Copying selected text on Wayland now finishes as soon as wl-copy accepts it, instead of timing out and falling back to the in-process clipboard that can print "Somebody else owns the clipboard now" over the UI
• A narrow Sessions sidebar drops keyboard hints that do not fit instead of cutting one off mid-word
• MCP tools recover after transient discovery failures without restarting the session; unchanged catalogs remain available during recovery.
• "No supported model available" is no longer shown on launch or in the model picker when a configured provider already supplies a model
• MCP tool calls complete even when servers keep sending progress updates after responding
• A fresh launch no longer prints "Failed to read model provider attribution" errors while it signs in
• MCP OAuth sign-in to servers such as Datadog reuses a still-valid cached token
• Withdrawn running prompts stay removed after session resume
• Click anywhere on expanded tool calls in compact timeline to collapse them
• Holding Space and Ctrl+X V explain when voice mode is off or still getting ready

2026-09-28

• Left-clicking supported ask_user and elicitation form inputs focuses them and places the cursor at the clicked position
• Add support for Claude Code rule files in .claude/rules as custom instructions
• Sessions in the sidebar show a blue dot when they finished a turn you have not opened yet
• Auto suggests a routing tier and lets you switch with a shortcut or click
• Auto shows a quick feedback prompt after switching away to a manually selected model
• MCP pre-registered OAuth clients honor configured oauthScopes.
• In local sessions, Esc Esc in an empty chat input takes back a prompt whose turn the model has not started answering and removes it from the conversation
• Add GPT-6 Sol and GPT-6 Luna to the model picker when available
• Adding support for claude-opus-5.5
• Shell output no longer shows trailing command completion metadata.
• Timeline output stops auto-following while text selection is active
• server/tool and server/* tool filters now match MCP tool names that contain a slash
• Queue exit commands while an agent response is still running
• Extensions no longer fail to load under enterprise managed settings while managed MCP policy is still being applied
• Fixed Git failures in applications launched from CLI shells when empty environment variables are dropped, on Git 2.36 or newer.
• Sessions sidebar saves opened and closed tabs as they change, rather than only on exit
• Agent shell commands in sandbox can access session files and logs
• Fix Auto tier selection to cycle correctly in /model and remove the unsupported Fast profile; a previously stored, exported, or resumed Fast preference now falls back to Balance instead of routing on it
• Run wrapped gh and git commands, such as timeout 60 gh ..., correctly in sandboxed sessions
• ACP sessions stay connected when clients pause reading large responses
• Gemini models no longer fail every request with 400 invalid request body when an MCP server exposes a tool whose schema puts a type or properties beside anyOf, such as a nullable discriminated union
• GitHub MCP tools connect correctly on first CLI startup after sign-in
• Ask-user forms keep custom Other answers separate across questions
• MCP config loading keeps valid workspace servers when sibling entries are invalid
• Delete old sessions succeeds when run directly in the CLI
• Claude requests above attachment size limits now recover automatically before sending.
• Listing shells shows running shells first, so a shell still running in the background is no longer hidden behind a long list of finished ones
• View tool honors line ranges when providers send flattened view_range arguments
• In local sessions, Up in an empty chat input recalls the pending message and leaves queued prompts in the queue
• PR creation now follows repository pull request templates, preserving required sections and checklist structure.
• Configure automatic indexed search activation with TGREP_FILE_COUNT_THRESHOLD
• Direct plugin installs can now be enabled and disabled. One already recorded as disabled now stops loading; re-enable it with copilot plugin enable
• Sandboxed commands on supported Windows versions can access localhost when Local network access is on
• Autocomplete model IDs in /model and /model plan argument pickers
• Show managed Connector consent progress with a copyable authorization URL during connect and reconnect.

2026-09-22

• Add optional OSC 777 terminal notifications for direct Ghostty and WezTerm sessions.
• Text selection now works in bottom-anchored dialogs, including login device codes
• Preserve /allow-all during managed-settings refresh failures, and remember exact session approvals for missing paths without granting their parent directory; exact grants are visible in /list-dirs and cleared by /reset-allowed-tools
• Sandboxed network denials from proxy tunnel failures now show bypass guidance
• Custom-agent startup now distinguishes model-list load failures from an empty catalog, preventing false unavailable warnings and silent required-agent deselection
• Pressing Enter in freeform ask_user prompts adds a new line; submit with Ctrl+Enter or Ctrl+S as a fallback
• A custom agent's reasoning-effort now applies when the agent is selected, instead of only its model. An explicit --reasoning-effort still wins, and a level the selected model does not offer is reported and left unapplied
• Deferred MCP tools whose registered name needed sanitizing or shortening are now listed under that name, so tool search can find them, and deferred MCP tools with no resolvable server name are now listed with the other tools instead of being left out of the reminder
• Prompt mode now warns when it stops waiting for background tasks and explains how to change the timeout limit.
• Resuming sessions no longer stalls when MCP permission prompts are pending
• MCP tools recover more reliably from transient listing, connection, and OAuth failures
• Hook commands without an explicit cwd again run in the project root instead of the session's current directory, so repo-relative hook scripts still resolve from a subdirectory.
• Enterprise managed settings now apply to sessions opened in ACP mode (copilot --acp), by AHP hosts (copilot --ahp-host), and by the published --server session, which previously ran with no managed MCP, permission, or plugin policy.
• GitHub MCP scope escalation now uses the CLI OAuth app's registered /callback redirect URI
• Agents from a plugin mounted with --plugin-dir now appear in server-mode sessions
• Session and subagent start hooks combine successful additional-context contributions within the hook-output limit
• Cached MCP tools stay scoped to environment-resolved server addresses and headers
• Session resume preserves pending conversation events when saving fails and explains that retrying is safe
• Support namespaced custom skills and ignored skill directories during skill discovery
• MCP and plugin views show server display names and plugin descriptions for clearer status.
• Resuming large local sessions keeps transcript memory bounded for smoother CLI performance.
• Prompt to update GitHub authorization when Connectors need reauthorization
• Indexed search supports glob filtering and --files listings with accurate ripgrep fallback behavior.
• Run /fork during active turns to branch work without waiting.
• In the Sessions tab, rows you can dismiss now take x then x again to confirm: a local session is permanently deleted, while a session backed by a server is only closed and its conversation is left on the server. The footer says which of the two the highlighted row will do, and shows no x hint for rows that cannot be dismissed.

2026-09-21

• Add user and managed startup defaults for the Auto routing tier, including strict and user-overridable organization policy
• Consecutive steering prompts in the same mode combine into one pending message. Press Up in an empty chat input to take it back for editing, including pasted text and attachments. The recall hint appears in the pending message. Ctrl+C stops the running turn instead of removing pending prompts one at a time. Ctrl+Q queued prompts remain separate. Use Ctrl+P to browse history without withdrawing prompts. Available for local sessions; commands and prompts already being processed cannot be recalled.
• A worktreePathTemplate setting decides where /worktree, /move, /new and --worktree create worktrees. Set for example ~/src/worktrees/{repo}/{branch}; {repoPath}, {repo}, {branch} and {branchSlug} are supported. Unset keeps the current layout, <repo>.worktrees/ with slashes in the branch name flattened to dashes.
• Number-key selection in the question dialog works for choices 10 and beyond
• Sandbox proxies work on Windows, and a proxy with a username and password works on every platform
• /keep-alive (and /caffeinate) no longer reports that sleep is prevented when the sleep inhibitor exits immediately on startup instead of acquiring the lock (e.g. no session bus on WSL/containers/headless); it now reports the failure.
• Prompt mode exits successfully when a child task fails but the parent recovers.
• Resume very large local sessions and continue with new prompts reliably.
• Keep --yolo enabled after startup policy checks for authenticated unmanaged sessions
• Empty strictKnownMarketplaces allowlists now hide and block built-in plugin marketplaces.
• Mouse-selected text is visibly highlighted in /help and /mcp show screens
• Tear down the processes an internal git command started when it times out, so a slow repository status check no longer leaves them running and consuming memory.
• MCP auth status warnings stay accurate during reconnects and startup refreshes
• Pull request badge and GitHub status tabs remain available after auth or branch refreshes
• A failing MCP server no longer removes other servers' tools
• copilot mcp list and copilot mcp get now report the built-in github-mcp-server when you are signed in, instead of showing it only in the interactive /mcp view
• MCP servers that advertise list-change capabilities but do not implement subscriptions now connect instead of failing
• Extension permission handlers approve subagent tool requests without leaving duplicate CLI prompts
• Secrets exported in the launching shell are no longer written to debug logs when a session is created or resumed
• Managed plugin commands load organization marketplace policy with environment, GitHub CLI, broker, and persisted authentication
• Session resume no longer hangs while reconnecting MCP servers
• Configure per-server MCP slow-connection warning thresholds with slowConnectionThresholdMs
• Show live elapsed time for execution subagents in timeline entries
• Enable the rubber-duck agent for every model family and for low-cost-tier session models
• Reduce allocation overhead when repainting blank terminal areas.

2026-09-17

• Custom agents can opt into repository instruction files (AGENTS.md, copilot-instructions.md, CLAUDE.md) by setting include-custom-instructions: true in their frontmatter.
• Resuming an active session without plugin-directory, discovery, or working-directory overrides preserves marketplace plugins and skills after reload. Configuration read or validation failures no longer discard active plugins; missing-file and intentional-removal behavior is unchanged.
• /sandbox policy now reports local-network access using your configured setting
• The status row now says it is waiting for background shells, instead of "Working", when a turn ends while an attached background shell such as a dev server is still running.
• Resume sessions even when transcript files contain recoverable corruption
• Expanded reasoning text in the compact timeline is no longer dimmed, so it is as readable as the rest of the timeline.
• Autopilot stops after accepted task completion instead of continuing unexpectedly

2026-09-16

• Vim mode is now available to everyone. Turn it on with /vim or by setting editorMode to vim for modal editing in the composer, with the current mode shown while you type.
• Add /settings options to opt in to context management tools for agents and subagents
• Set transcriptView to "concise" to group tool activity into expandable work summaries.
• Add /config to open a sidebar configuration screen in the CLI
• Add /sandbox Network host allow/deny rules without replacing your configured upstream proxy
• Add session and memory import commands for the semantic JSONL interchange format
• Add copilot instruction list and copilot lsp list, replacing copilot plugins list --kind instruction and --kind lsp
• Add --json to copilot plugin list, copilot plugin marketplace list and copilot plugin marketplace browse
• Add enable and disable to copilot plugin, copilot mcp and copilot skill, replacing copilot plugins enable/disable --plugin|--mcp|--skill
• Add support for GPT-6 Astra
• Managed sandbox sessions can now be disabled for the rest of the session from an approved bypass prompt.
• --add-dir rejects non-directory and inaccessible paths uniformly and aborts startup before session initialization
• Streamer mode masks internal model names in /model, the footer, and startup diagnostics without restarting model initialization on toggles
• Fixed the one-command sandbox bypass on Windows: when the sandbox container refuses a policy-blocked write for want of a privilege, approving the bypass now runs the command instead of stopping after the permissive retry, so it no longer takes disabling the sandbox for the whole session
• Respect terminal color themes even when palettes are incomplete
• Failed new-session handoffs stop unused clients from polling and preserve the current session, schedules, and unsent prompt.
• Earlier messages remain visible when switching back to a background session with frequent hooks.
• End and Ctrl+E move the cursor to the true end of a wrapped line, so typing or Ctrl+K no longer edits one character early inside a long word or URL. On such a line the landing spot is the wrap boundary, so pressing End or Ctrl+E again advances to the end of the next visual row
• --share=~/notes.md now writes the exported session to your home directory instead of creating a folder named ~ in the current directory
• Modified chords such as Ctrl+X, Alt+X or capital X no longer trigger the /tasks letter shortcuts; only unmodified a, f, x, r, b, j and k respond. Enter, Escape, the arrow keys and Ctrl+G / Ctrl+P / Ctrl+N are unaffected
• Scheduled prompts show an error when they fail at runtime
• CLI retries image prompts without images when providers reject image-limit requests
• Authenticated model lists refresh after startup auth hydration
• MCP servers no longer fail to load when the CLI is connected to a running IDE. The in-process IDE bridge was rejected by config validation, which failed the plugin reload and restricted the session
• copilot init now removes the .github directory it created when the run exits without writing an instructions file.
• MCP turns continue even if tool list refresh fails after a tool change
• MCP servers keep correct workspace source labels after trusting a folder
• An editor or shell that leaves mouse tracking on no longer leaves your terminal reporting clicks, during the session or after the CLI exits
• The /permissions picker marks Allow all when --allow-all-tools, --allow-all-paths and --allow-all-urls are all set
• Resumed sessions show completed reasoning as Thought instead of Thinking…
• copilot --help describes the --no-* options again, and --no-auto-update says it runs the version bundled in the binary. --no-auto-login and --no-sandbox stay supported but remain hidden from help, as they were before the clap port
• Restore keyboard input and screen output on macOS and Linux when you return from an external editor that reset the terminal
• Model lists refresh after signing in, switching accounts, or signing out
• Fixed the thinking shape sent to Claude models classified as adaptive-only: they now stay adaptive instead of failing (turning thinking off lowers reasoning effort instead), and reasoning effort is capped at high whenever thinking is disabled
• Run sessionEnd hooks when /clear closes an interactive session
• Plugin agents expand ${PLUGIN_ROOT} placeholders in mcp-servers frontmatter
• Skills from directories added with --add-dir are no longer missing when a skills load races the directory registration
• A relative --additional-mcp-config @<file> path now resolves against the session working directory under --resume=<id> and --worktree instead of the launch directory, and ~/ expands.
• Windows sandbox denials of loopback and local network access prompt to re-run the command outside the sandbox
• Approved sandbox retries are labeled sandbox relaxed while network policy stays enforced, or sandbox bypassed when fully unsandboxed; failed bypasses explain that host permissions still apply
• Cancelling an MCP tool call now notifies the MCP server and cleanly ends the turn.
• Scrolling the wheel with mouse capture off no longer walks backwards through prompt history in terminals that report DEC private mode 1007 (alternate scroll), such as Ghostty
• MCP OAuth requests additional scopes when needed and retries the tool call
• Changing reasoning effort now takes effect before the next logical request in an active turn, while retries keep their original effort
• Automatic compaction now saves a checkpoint that appears in /session checkpoints
• Windows CLI artifacts run without requiring the Visual C++ Redistributable
• Keep terminal theme colors consistent at startup and during live appearance changes
• Interactive mode submits startup prompts even when model discovery is still loading.
• MCP tools with boolean property or array-item schemas work with Gemini instead of causing a 400 error
• An enterprise-managed sandbox policy delivered by MDM or a managed settings file no longer discards sandbox.allowBypass, so bypass prompts and /sandbox disable work as the policy intends
• The managed sandbox startup notice no longer says sandboxing can't be turned off when your organization's policy allows a session opt-out; it names /sandbox disable instead
• Viewing or attaching an image in a format the model cannot read, such as BMP or TIFF, no longer leaves the session unable to send any further message; the image is now reported as an unsupported format that you can convert to PNG, JPEG, WebP or GIF
• The YOLO status indicator reflects the active session after switching sessions
• Computer Use now stays in sync across /computer and whole-plugin /plugin toggles.
• Pressing Enter in the Sessions tab now foregrounds the highlighted session, even when a background refresh rebuilds the list at that moment, instead of sometimes opening a different session
• Indexed search on Windows prevents new disk-space leaks when updating indexes
• Keep long /ask responses visible after generation completes
• When session history is truncated or compacted just as a turn finishes, the "Working" indicator now clears instead of staying up for the rest of the session
• COPILOT_ALLOW_ALL no longer refuses to start the CLI on values such as 1, 0, yes or an empty string, and falsey values now disable automatic tool approval instead of enabling it
• Subagent launches honor explicit model, reasoning effort, and context tier preferences from applicable global and custom instructions
• A failed command whose EPERM or EACCES diagnostic names a sandbox-blocked path now offers to run outside the sandbox, even when the command line never named that path
• A write blocked by a read-only sandbox path, and a Node or Go network failure blocked by the sandbox, are now recognized as sandbox denials instead of surfacing as raw errors
• Report in-memory MCP servers as memory instead of local in copilot mcp list
• /compact no longer reports an empty model response when a valid summary was returned
• Streaming responses preserve message chunk ordering before final output.

…

2026-09-04

• Show running Copilot sessions in the Windows 11 taskbar with live hover status cards
• Add Client ID Metadata Document (CIMD) support for MCP OAuth sign-in
• Custom agents can list several models in model, tried in order until one is available to you, and model-policy: required keeps model changes on that list
• Adding support for claude-fable-5.1
• Add Recent, Created, Name, and classic None sorting to the split Sessions sidebar, with the selected order saved across restarts
• Enterprise admins can pin sign-in to approved GitHub organizations with the forceLoginOrgs managed setting
• Add automatic HTTPS proxy mTLS client certificate support for model and web requests
• Detect the herdr terminal multiplexer instead of mistaking it for tmux, so the Kitty keyboard protocol, color scheme following, terminal progress, /copy and notifications work in herdr panes
• A session lock that is re-entered on the same thread now fails with a reported error instead of freezing the CLI.
• Kerberos proxy authentication reconnects when the initial challenge answers with Connection: close
• Sandboxed gh commands now authenticate as the account configured for the repository instead of the Copilot CLI login
• MCP tools remain callable after MCP server restarts
• Sandboxed file tools now read the same developer-tool paths as sandboxed shell commands, including token-bearing registry config such as ~/.npmrc; set sandbox.allowDevToolAccess to false to turn these grants off
• Stopping a timed-out shell command now lets queued messages run and sessions return to idle
• A follow-up prompt typed while autopilot is running no longer disappears from the timeline
• Restart provides clearer update guidance when automatic restart cannot be completed
• MCP servers configured by your agent stay available after built-in sub-agent turns.
• Anthropic sessions continue after temporary fallback instead of failing on invalid thinking signatures
• Long-running sessions on Linux return freed memory to the system instead of holding gigabytes of it
• Enterprise-denied MCP servers can no longer start before the managed allow/deny policy resolves; server startup now waits for the managed-settings fetch instead of racing it
• Host-provided plugin customizations can be read without redundant path permission prompts
• A relative --add-dir or --plugin-dir path now resolves against the session's working directory under --resume=<id> and --worktree, instead of the directory the CLI was launched from. Relative values are also resolved after -C is applied, so -C no longer has to precede either option on the command line
• MCP servers contributed by a plugin are no longer labelled "User" in the MCP dashboard, and a server from a bundled plugin is now shown as built-in and names the plugin it came from.
• The newest line of output stays visible above the input box instead of hiding behind it, except while a prompt is pinned to the top of the transcript
• Exporting a resumed session with --share or --share-gist writes the whole transcript instead of only the latest run
• On macOS and Linux, sandboxed commands can no longer reach services running on your machine. On macOS this also blocks a server the command itself starts on 127.0.0.1, so test suites that bind a local port will fail; turn on Allow local network in /sandbox to reach localhost again.
• Linux sandboxing now needs slirp4netns, nsenter, iptables, ip6tables, iptables-restore and ip6tables-restore on PATH. Install them if sandboxed commands start failing to launch.
• CLI starts without the interrupted-session restore prompt by default.
• Resuming large sessions keeps the input prompt responsive sooner.
• Linux sandboxes now restrict network egress to the configured proxy; proxy mode requires slirp4netns, util-linux 2.35+, iptables, and /dev/net/tun access
• /mcp config and the MCP add/edit/authenticate forms now open in the plugins dashboard instead of a separate MCP manager, so closing a form returns to the server list.
• File path autocomplete stays fast in large repositories
• Plugin list commands and /plugin now show bundled built-in plugins.
• Improve sandboxed Bazel and Bazelisk runs by granting required cache and output paths; macOS requires a future Bazel release or additional sandbox capabilities
• The collapsed autopilot goal panel now reads as a single-line pinned prompt, keeping the frame it shares with a pinned prompt instead of compressing into a bare band wedged against the chrome above it
• Improve /sandbox policy by grouping path grants by source and showing detected developer tools
• Remove retired Claude and Gemini models from /model picker results