1.0.84-4

Added

• Add copilot instruction list and copilot lsp list, replacing copilot plugins list --kind instruction and --kind lsp
• Add --json to copilot plugin list, copilot plugin marketplace list and copilot plugin marketplace browse
• Add enable and disable to copilot plugin, copilot mcp and copilot skill, replacing copilot plugins enable/disable --plugin|--mcp|--skill

Fixed

• Show when sandboxing is only enabled for the current session in /sandbox status and settings.
• Interactive --yolo startup remains available before authentication when no managed policy evidence is present
• Indexed search shows when enabled, works on Windows ReFS volumes, supports explicit cloud-sync overrides, and keeps refreshing on Linux when native file watches are exhausted.

Removed

• Replace copilot plugins install --skill [--scope project] with copilot skill add [--project]; the --scope spelling is gone
• Remove the cross-kind --kind, --scope, --mcp and --skill flags from copilot plugins; use copilot mcp and copilot skill
• copilot plugins list --json now emits a flat array of plugins instead of the cross-kind { plugins, errors } object; scripts reading .plugins must be updated
• copilot plugins list is now an alias of copilot plugin list and reports only plugins, no longer MCP servers, skills, instructions or LSP servers

1.0.84-3

Fixed

• /copy includes task completion messages when available
• OAuth-authenticated MCP servers connect reliably during session startup

1.0.84-2

New

• Vim mode is now available to everyone. Turn it on with /vim or by setting editorMode to vim for modal editing in the composer, with the current mode shown while you type.

Improved

• On supported Windows sandbox policies, interactive shell commands now record blocked accesses. One approved escalation retries with file and process restrictions recording instead of blocking while network policy remains active, then falls back to the disclosed full bypass only if still blocked
• Speed up startup when resuming an existing local session by its exact UUID with --resume

Fixed

• ctrl+h no longer deletes a whole word in tmux, screen, and remote sessions that carry a Windows Terminal WT_SESSION from elsewhere. As an accepted tradeoff, ctrl+backspace now deletes a single character in those sessions — including a genuinely local Windows tmux or screen pane — where ctrl+w still deletes a word
• MCP servers now see the same copilot-cli client identity when you add a server and when a session connects, carrying the shipped CLI version instead of 0.0.0
• Interactive mode starts and submits the initial prompt when using --auth-token-env
• Use /settings taskbarPresence false to disable Windows taskbar session status. Loader-managed sessions restart immediately; standalone sessions require a manual restart.
• Pressing Escape once cancels MCP inference approval prompts once
• MCP reload summary shows servers still starting after timeout
• Initial prompts start immediately for Entra-authenticated sessions while token refresh runs in the background.
• Choosing approve-for-location now persists tool approval to avoid repeat prompts
• Large sessions resume without freezing the interface during context token counting
• Configured hooks keep running after an extension restarts instead of silently stopping and later denying every tool call; the extension's own callback hooks resume once it re-registers
• The allowManagedHooksOnly policy now also blocks extension-registered preToolUse, postToolUse and postToolUseFailure callbacks, which previously bypassed the managed-only lockdown that every other hook event already applied

1.0.84-1

Added

• Add support for GPT-6 Astra

1.0.84-0

Added

• Managed sandbox sessions can now be disabled for the rest of the session from an approved bypass prompt.

Fixed

• A PowerShell write the sandbox blocks offers to run the command outside the sandbox
• When you have more than one GitHub account in your credential store, a sandboxed gh command now acts as the account gh is logged in as instead of an arbitrary one.
• The /rubber-duck command is hidden after a model refresh removes its compatible critic
• Sandboxed runs now use relocated developer-tool caches from env vars and tool config files
• On Windows, a sandboxed command that runs git without naming it — a hook, a build tool, or an npm install that clones over HTTPS — no longer dies inside the credential helper's MSYS2 shell.

1.0.83

2026-09-04

• Show running Copilot sessions in the Windows 11 taskbar with live hover status cards
• Add Client ID Metadata Document (CIMD) support for MCP OAuth sign-in
• Custom agents can list several models in model, tried in order until one is available to you, and model-policy: required keeps model changes on that list
• Adding support for claude-fable-5.1
• Add Recent, Created, Name, and classic None sorting to the split Sessions sidebar, with the selected order saved across restarts
• Enterprise admins can pin sign-in to approved GitHub organizations with the forceLoginOrgs managed setting
• Add automatic HTTPS proxy mTLS client certificate support for model and web requests
• Detect the herdr terminal multiplexer instead of mistaking it for tmux, so the Kitty keyboard protocol, color scheme following, terminal progress, /copy and notifications work in herdr panes
• A session lock that is re-entered on the same thread now fails with a reported error instead of freezing the CLI.
• Kerberos proxy authentication reconnects when the initial challenge answers with Connection: close
• Sandboxed gh commands now authenticate as the account configured for the repository instead of the Copilot CLI login
• MCP tools remain callable after MCP server restarts
• Sandboxed file tools now read the same developer-tool paths as sandboxed shell commands, including token-bearing registry config such as ~/.npmrc; set sandbox.allowDevToolAccess to false to turn these grants off
• Stopping a timed-out shell command now lets queued messages run and sessions return to idle
• A follow-up prompt typed while autopilot is running no longer disappears from the timeline
• Restart provides clearer update guidance when automatic restart cannot be completed
• MCP servers configured by your agent stay available after built-in sub-agent turns.
• Anthropic sessions continue after temporary fallback instead of failing on invalid thinking signatures
• Long-running sessions on Linux return freed memory to the system instead of holding gigabytes of it
• Enterprise-denied MCP servers can no longer start before the managed allow/deny policy resolves; server startup now waits for the managed-settings fetch instead of racing it
• Host-provided plugin customizations can be read without redundant path permission prompts
• A relative --add-dir or --plugin-dir path now resolves against the session's working directory under --resume=<id> and --worktree, instead of the directory the CLI was launched from. Relative values are also resolved after -C is applied, so -C no longer has to precede either option on the command line
• MCP servers contributed by a plugin are no longer labelled "User" in the MCP dashboard, and a server from a bundled plugin is now shown as built-in and names the plugin it came from.
• The newest line of output stays visible above the input box instead of hiding behind it, except while a prompt is pinned to the top of the transcript
• Exporting a resumed session with --share or --share-gist writes the whole transcript instead of only the latest run
• On macOS and Linux, sandboxed commands can no longer reach services running on your machine. On macOS this also blocks a server the command itself starts on 127.0.0.1, so test suites that bind a local port will fail; turn on Allow local network in /sandbox to reach localhost again.
• Linux sandboxing now needs slirp4netns, nsenter, iptables, ip6tables, iptables-restore and ip6tables-restore on PATH. Install them if sandboxed commands start failing to launch.
• CLI starts without the interrupted-session restore prompt by default.
• Resuming large sessions keeps the input prompt responsive sooner.
• Linux sandboxes now restrict network egress to the configured proxy; proxy mode requires slirp4netns, util-linux 2.35+, iptables, and /dev/net/tun access
• /mcp config and the MCP add/edit/authenticate forms now open in the plugins dashboard instead of a separate MCP manager, so closing a form returns to the server list.
• File path autocomplete stays fast in large repositories
• Plugin list commands and /plugin now show bundled built-in plugins.
• Improve sandboxed Bazel and Bazelisk runs by granting required cache and output paths; macOS requires a future Bazel release or additional sandbox capabilities
• The collapsed autopilot goal panel now reads as a single-line pinned prompt, keeping the frame it shares with a pinned prompt instead of compressing into a bare band wedged against the chrome above it
• Improve /sandbox policy by grouping path grants by source and showing detected developer tools
• Remove retired Claude and Gemini models from /model picker results

1.0.83-5

Added

• Show running Copilot sessions in the Windows 11 taskbar with live hover status cards

Improved

• On macOS and Linux, sandboxed commands can no longer reach services running on your machine. On macOS this also blocks a server the command itself starts on 127.0.0.1, so test suites that bind a local port will fail; turn on Allow local network in /sandbox to reach localhost again.
• Linux sandboxing now needs slirp4netns, nsenter, iptables, ip6tables, iptables-restore and ip6tables-restore on PATH. Install them if sandboxed commands start failing to launch.

Fixed

• A session lock that is re-entered on the same thread now fails with a reported error instead of freezing the CLI.
• Kerberos proxy authentication reconnects when the initial challenge answers with Connection: close
• Sandboxed gh commands now authenticate as the account configured for the repository instead of the Copilot CLI login
• MCP tools remain callable after MCP server restarts

1.0.83-4

Added

• Add Client ID Metadata Document (CIMD) support for MCP OAuth sign-in

Improved

• CLI starts without the interrupted-session restore prompt by default.
• Resuming large sessions keeps the input prompt responsive sooner.

Fixed

• Sandboxed file tools now read the same developer-tool paths as sandboxed shell commands, including token-bearing registry config such as ~/.npmrc; set sandbox.allowDevToolAccess to false to turn these grants off
• Stopping a timed-out shell command now lets queued messages run and sessions return to idle
• A follow-up prompt typed while autopilot is running no longer disappears from the timeline
• Restart provides clearer update guidance when automatic restart cannot be completed
• MCP servers configured by your agent stay available after built-in sub-agent turns.
• Anthropic sessions continue after temporary fallback instead of failing on invalid thinking signatures
• Long-running sessions on Linux return freed memory to the system instead of holding gigabytes of it
• Enterprise-denied MCP servers can no longer start before the managed allow/deny policy resolves; server startup now waits for the managed-settings fetch instead of racing it
• Host-provided plugin customizations can be read without redundant path permission prompts

Removed

• Remove retired Claude and Gemini models from /model picker results

1.0.83-3

Fixes and changes

1.0.83-2

Added

• Custom agents can list several models in model, tried in order until one is available to you, and model-policy: required keeps model changes on that list
• Adding support for claude-fable-5.1

Improved

• Linux sandboxes now restrict network egress to the configured proxy; proxy mode requires slirp4netns, util-linux 2.35+, iptables, and /dev/net/tun access