From 2392889bf7d2d3f3f9a7ad354c6017a21e4f9928 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Thu, 30 Jul 2026 23:36:02 +0000 Subject: [PATCH 1/6] Update changelog.md for version 1.0.77 --- changelog.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/changelog.md b/changelog.md index 0650749b..7e5e11af 100644 --- a/changelog.md +++ b/changelog.md @@ -1,3 +1,11 @@ +## 1.0.77 - 2026-07-30 + +- Unconditional autopilot approval now disables sandbox for the current session when bypass is allowed +- Ctrl+G opens your editor to edit ask_user freeform answers without closing the prompt +- Add a browser-based (web) OAuth login flow, now the default for `copilot login` on local interactive terminals (device code remains the default on remote/headless terminals). Use `--web-flow`/`--device-code` to force a mode, or pick one in the interactive `/login` command +- Support enforcing managed sandbox policy via macOS and Windows native MDM settings +- Allow reasoning effort to be omitted so the server can select the default + ## 1.0.76 - 2026-07-29 - Add enable/disable controls in /plugins for plugins, instructions, agents, LSP servers, and hooks From 9532bdacf5a343c3dcc444337f7b25e88fc7372c Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Mon, 3 Aug 2026 23:30:26 +0000 Subject: [PATCH 2/6] Update changelog.md for version 1.0.78 --- changelog.md | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/changelog.md b/changelog.md index 7e5e11af..ce39e0f3 100644 --- a/changelog.md +++ b/changelog.md @@ -1,3 +1,33 @@ +## 1.0.78 - 2026-08-03 + +- Timeline headers show how long each tool call took, right-aligned and ticking live while it runs (for calls of at least 5 seconds). On by default — disable with `/settings showToolDurations`. +- First-party plugins automatically update to the latest version at session start +- Add the experimental /new-worktree command to create a new worktree and start a new conversation in it +- Copilot login now defaults to the browser flow for local desktop subprocesses without a TTY, including IDE integrations, while remote and headless environments continue using device code +- Interactive shell shortcut now launches on Enter and shows an inline hint when "$" is armed +- Extension slash commands run their handler exactly once per invocation when several extensions are loaded +- Inline images no longer render with their first row repeated down the whole picture after the timeline scrolls +- A run whose prompt is piped over stdin now treats its `sessionEnd` hook the same way `-p` does: the hook fires once per completed agent turn with `reason` `complete` (or `error` if the turn failed), instead of once at shutdown with `user_exit`. As with `-p`, a piped run that exits before completing a turn fires no `sessionEnd` hook +- Split-view sidebar: the red close confirmation now reads `x again to close` (or `x again to exit CLI` on the last session) instead of `x close`, so a second press is clearly what closes +- Expose token usage in ACP prompt results and live usage_update notifications +- Added a forceRemoteSettingsRefresh managed setting that requires a fresh managed-settings fetch on startup +- Disabling the sandbox from a bypass prompt applies only to that session; new sessions start sandboxed again +- Managed settings now fall back to the persistent cache whenever a server-managed settings fetch fails for any reason (network error, a non-success HTTP status, or a malformed/unparseable response), and fail open — starting without the unconfirmed server restriction rather than the prior fail-closed behavior — when no usable cached policy is available +- When the sandbox blocks a shell command and bypass is allowed, CLI offers to re-run it outside the sandbox without asking the model +- /rewind no longer requires git and restores only the files Copilot changed, skipping any file whose contents no longer match what Copilot last wrote, with a conversation-only or conversation + files choice +- Add /permissions to switch between approval modes. +- ACP mode supports closing sessions with the closeSession request. +- Ctrl+Q now enqueues the highlighted mid-text skill completion instead of the partial token +- Switching sessions no longer restarts MCP servers or rebuilds hook state, so a turn running in another session is never halted with a stale-hook error +- Refresh deferred MCP tools after OAuth authentication +- New sandbox setting `allowDevToolCaches` (on by default): grants sandboxed builds access to toolchain caches, registries, and installs so builds work without extra setup. Set false to opt out. +- Honor explicit GitHub MCP toolset/tool config: keep gh-overlap tools and stop steering to the gh CLI when you opt in +- Warn on startup about unknown top-level keys in user settings.json (e.g. a misspelled setting) instead of silently ignoring them +- Shell completion for --model now suggests auto and supported model names +- Render long session transcripts progressively to keep scrolling responsive +- Resuming a long session is dramatically faster and far lighter on memory, because its history is now read once at startup (in parallel, across CPU cores) instead of being re-read in full for every check the CLI runs before it can paint. In our benchmark a 230MB, 74k-event transcript came back in well under a second instead of about ten, at roughly a quarter of the peak memory; the exact gain depends on your machine's core count and disk +- The /allow-all auto safety-judge model is no longer user-configurable; the judge model is now selected automatically. + ## 1.0.77 - 2026-07-30 - Unconditional autopilot approval now disables sandbox for the current session when bypass is allowed From ef627e1baad937d3c8da45f8a5541c6fc3c97b6a Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Mon, 10 Aug 2026 16:19:17 +0000 Subject: [PATCH 3/6] Update changelog.md for version 1.0.79 --- changelog.md | 47 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) diff --git a/changelog.md b/changelog.md index ce39e0f3..48f07df8 100644 --- a/changelog.md +++ b/changelog.md @@ -1,3 +1,50 @@ +## 1.0.79 - 2026-08-10 + +- The /sandbox configuration dialog shows where sandbox settings are stored in settings.json +- Add support for enterprise allow-auto-only policy so /allow-all auto works while full allow-all remains blocked. +- Allow enterprise-managed sandbox policy to enforce a proxy URL while credentials remain user-controlled +- A tool directory inside your workspace that is on PATH (.venv/bin, node_modules/.bin, an in-repo GOPATH) no longer turns that part of the workspace read-only in the sandbox +- The /sandbox configuration dialog groups the git, gh, and (on macOS) keychain settings under a new Auth tab, and the settings keys moved from `sandbox.gitAuth`/`sandbox.ghAuth` to `sandbox.auth.git`/`sandbox.auth.gh`. There is no migration: the old keys are ignored in settings files, and SDK requests that still send them are rejected as invalid rather than ignored +- Added a `worktreeBaseRef` setting that controls whether `/worktree`, `/worktree new`, and `--worktree` start from HEAD or the remote default branch. All three now default to HEAD; previously `--worktree` started from the remote default branch. +- Model picker groups models into Recent, Recommended, New, and other sections, and Shift+Tab switches grouping views. +- Large monorepos now use tgrep ([trigram-indexed grep for fast regex search in large codebases](https://github.com/microsoft/tgrep)) instead of ripgrep +- Agent Plugins spec plugins can now ship extensions under a com.github.copilot/extensions/ directory +- Add support for the kimi-k3 model +- Combine `--plan` with `--mode autopilot` to plan first and then implement without waiting for approval +- The `/app` command now opens the current session in the GitHub Copilot desktop app instead of landing on Home with the wrong folder (requires GitHub Copilot app 1.1.3 or later) +- On macOS, a sandbox read-only path nested inside a writable one now stays read-only instead of inheriting the write permission from the wider path +- On macOS, sandboxed commands can use UNIX-domain sockets again, so tools that talk over a local IPC pipe (tsx, vite, esbuild, jest workers) no longer fail with `listen EPERM` +- Sandboxed commands work when the working directory lives on a Windows Dev Drive +- `/theme` now only shows its deprecation notice for a valid color mode, so a mistyped mode no longer suggests an invalid command or hides the notice from your next valid `/theme`. +- Sandboxed git now authenticates to Azure DevOps, GitHub Enterprise Server, GitLab, and other non-GitHub remotes you have stored HTTPS credentials for +- Ask user multi-select prompts include an Other option for free-text answers +- Improve teleported subagent /tasks navigation with nested tree browsing, current/all and finished-task filters, and a live timeline you can steer +- A rare internal delay no longer prints a diagnostic warning on top of the interactive UI +- A failed session-history load no longer leaves the timeline permanently empty: the failure was silently discarded, so the transcript stayed blank for the rest of the session with nothing logged. It is now retried, and reported in the transcript and the log if it still fails +- Resuming a long session no longer collapses the timeline's scroll range while history renders in the background: entries that had not finished rendering were published as if they did not exist, so the scrollbar and scroll position jumped until the background render caught up +- Manage multiple concurrent sessions from the Sessions tab and sidebar +- Sandboxed wrapper builds (make and friends) get the dev tool caches their recipes need, based on the build manifests in the working directory +- Prompt pinning is off by default; set pinnedPrompts to true to enable it. +- Sandboxed commands can reach the network again on recent Windows builds, where every outbound connection was blocked even with outbound access enabled and no proxy configured +- Plugin custom agents honor deferred-tool-loading frontmatter +- Use `/worktree new` to start a new session in a new worktree +- A sandbox that cannot start an MCP server now fails in seconds instead of stalling the session, and sandbox startup failures for both MCP and language servers now say the sandbox was at fault and how to fix or opt out of it +- Login links are clickable during web and device-code sign-in +- Pin the current prompt one row higher, in the row the tab bar already reserves, so it keeps the shape of the prompt it copies while costing the timeline one row less +- Leave the pinned prompt off by default on terminals under 30 rows, where it would crowd the output; set pinnedPrompts explicitly to override at any size +- Compute /context attribution against the Auto-resolved model so token totals are accurate for Free/Student users +- Disabling an extension no longer breaks elicitation, canvases, or tool permission prompts for other extensions +- A prompt stashed with ctrl+s now stays with the session it was typed for, so switching away and back and pressing ctrl+s restores it instead of finding it gone +- On Linux, searches and most shell commands blocked by the sandbox now offer to re-run outside it +- BREAKING: the sandbox setting `allowDevToolCaches` is renamed `allowDevToolAccess`, since it grants dev-tool config and registries too, not just caches. The old key is no longer read and is ignored silently, so an existing `false` opt-out reverts to the default (on). Rename it in settings.json and in any managed/MDM policy. +- Add /sandbox policy to show effective sandbox paths, denials, and network access +- Queue prompts, shell commands, and supported slash commands in local sessions to run in order after the current task finishes +- Set "autoUpdate": true on an extraKnownMarketplaces entry in your user settings to auto-update its plugins at session start +- /sandbox tags inactive settings as (disabled) and explains why they are locked, and documents dev tool caches in copilot help sandbox +- Show "pending · ctrl+c to cancel" for in-flight steering prompts +- Make /model session-scoped by default, and use /config model to set defaults for future sessions. +- Pin the current prompt as a single line instead of a three-row framed block, so it reads as chrome and returns rows to the timeline; with the tab bar on it sits directly below the tabs and costs the timeline nothing + ## 1.0.78 - 2026-08-03 - Timeline headers show how long each tool call took, right-aligned and ticking live while it runs (for calls of at least 5 seconds). On by default — disable with `/settings showToolDurations`. From 476581ccde7d596ded05d2b77b36edb57762a2c4 Mon Sep 17 00:00:00 2001 From: Michael Recachinas Date: Tue, 11 Aug 2026 10:58:35 -0400 Subject: [PATCH 4/6] Migrate close-on-PR workflow off pull_request_target Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/close-invalid-pr-writer.yml | 51 +++++++++++++++++++ .github/workflows/close-invalid.yml | 46 +++++++++-------- 2 files changed, 76 insertions(+), 21 deletions(-) create mode 100644 .github/workflows/close-invalid-pr-writer.yml diff --git a/.github/workflows/close-invalid-pr-writer.yml b/.github/workflows/close-invalid-pr-writer.yml new file mode 100644 index 00000000..7cfc6a70 --- /dev/null +++ b/.github/workflows/close-invalid-pr-writer.yml @@ -0,0 +1,51 @@ +name: Close invalid PR writer + +on: + workflow_run: + workflows: [Close issue/PR on adding invalid label] + types: [completed] + +permissions: + issues: read + pull-requests: write + +jobs: + close-invalid-pr: + if: > + github.repository == 'github/copilot-cli' && + github.event.workflow_run.event == 'pull_request' && + github.event.workflow_run.conclusion == 'success' && + github.event.workflow_run.repository.full_name == github.repository + runs-on: ubuntu-latest + steps: + - name: Close invalid PR + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_REPO: ${{ github.repository }} + HEAD_OWNER: ${{ github.event.workflow_run.head_repository.owner.login }} + HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }} + PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }} + run: | + set -euo pipefail + + if [ -z "${PR_NUMBER:-}" ] || [ "$PR_NUMBER" = "null" ]; then + PR_NUMBER="$(gh api --method GET "repos/$GH_REPO/pulls" -f state=open -f head="$HEAD_OWNER:$HEAD_BRANCH" --jq 'if length == 1 then .[0].number else empty end')" + fi + + if [ -z "${PR_NUMBER:-}" ]; then + echo "Unable to identify a single open PR for workflow run; skipping." + exit 0 + fi + + pr_state="$(gh api "repos/$GH_REPO/pulls/$PR_NUMBER" --jq .state)" + if [ "$pr_state" != "open" ]; then + echo "PR #$PR_NUMBER is $pr_state; skipping." + exit 0 + fi + + if ! gh api "repos/$GH_REPO/issues/$PR_NUMBER/labels" --jq '.[].name' | grep -Fxq invalid; then + echo "PR #$PR_NUMBER does not currently have the invalid label; skipping." + exit 0 + fi + + gh api -X PATCH "repos/$GH_REPO/pulls/$PR_NUMBER" -f state=closed diff --git a/.github/workflows/close-invalid.yml b/.github/workflows/close-invalid.yml index 4078bd87..b1fa4801 100644 --- a/.github/workflows/close-invalid.yml +++ b/.github/workflows/close-invalid.yml @@ -1,36 +1,40 @@ name: Close issue/PR on adding invalid label -# **What it does**: This action closes issues that are labeled as invalid in the repo. +# **What it does**: This action closes issues and PRs that are labeled as invalid in the repo. on: issues: types: [labeled] - pull_request_target: + pull_request: types: [labeled] -permissions: - contents: read - issues: write - pull-requests: write +permissions: {} jobs: - close-on-adding-invalid-label: - if: - github.repository == 'github/copilot-cli' && github.event.label.name == - 'invalid' + close-issue-on-adding-invalid-label: + if: > + github.repository == 'github/copilot-cli' && + github.event_name == 'issues' && + github.event.label.name == 'invalid' runs-on: ubuntu-latest - + permissions: + issues: write steps: - name: Close issue - if: ${{ github.event_name == 'issues' }} env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - URL: ${{ github.event.issue.html_url }} - run: gh issue close $URL + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_REPOSITORY: ${{ github.repository }} + ISSUE_NUMBER: ${{ github.event.issue.number }} + run: gh api -X PATCH "repos/$GH_REPOSITORY/issues/$ISSUE_NUMBER" -f state=closed - - name: Close PR - if: ${{ github.event_name == 'pull_request_target' }} - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - URL: ${{ github.event.pull_request.html_url }} - run: gh pr close $URL + signal-invalid-pr-label: + if: > + github.repository == 'github/copilot-cli' && + github.event_name == 'pull_request' && + github.event.label.name == 'invalid' + runs-on: ubuntu-latest + permissions: + pull-requests: read + steps: + - name: Record invalid PR label signal + run: echo "Invalid label signal for PR #${{ github.event.pull_request.number }}" From 132979e761a234a7061126488c1d4f7e2960c076 Mon Sep 17 00:00:00 2001 From: Michael Recachinas Date: Wed, 12 Aug 2026 09:51:29 -0400 Subject: [PATCH 5/6] Harden invalid PR close dispatcher Bind privileged closure to the trusted workflow identity and exact PR head, and reconcile invalid conflicted PRs from the default branch. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d --- .github/workflows/close-invalid-pr-writer.yml | 85 +++++++++++++++---- .github/workflows/close-invalid.yml | 10 ++- 2 files changed, 73 insertions(+), 22 deletions(-) diff --git a/.github/workflows/close-invalid-pr-writer.yml b/.github/workflows/close-invalid-pr-writer.yml index 7cfc6a70..1094d6f4 100644 --- a/.github/workflows/close-invalid-pr-writer.yml +++ b/.github/workflows/close-invalid-pr-writer.yml @@ -4,48 +4,97 @@ on: workflow_run: workflows: [Close issue/PR on adding invalid label] types: [completed] + # pull_request does not run for conflicted PRs, so reconcile from the trusted default branch. + schedule: + - cron: '*/5 * * * *' + workflow_dispatch: -permissions: - issues: read - pull-requests: write +permissions: {} jobs: - close-invalid-pr: + close-invalid-pr-from-workflow-run: if: > github.repository == 'github/copilot-cli' && + github.event_name == 'workflow_run' && github.event.workflow_run.event == 'pull_request' && - github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.repository.full_name == github.repository runs-on: ubuntu-latest + permissions: + actions: read + pull-requests: write + concurrency: + group: close-invalid-pr-${{ github.event.workflow_run.pull_requests[0].number || github.run_id }} + cancel-in-progress: false steps: - name: Close invalid PR env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} GH_REPO: ${{ github.repository }} - HEAD_OWNER: ${{ github.event.workflow_run.head_repository.owner.login }} - HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }} - PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }} + WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }} run: | set -euo pipefail - if [ -z "${PR_NUMBER:-}" ] || [ "$PR_NUMBER" = "null" ]; then - PR_NUMBER="$(gh api --method GET "repos/$GH_REPO/pulls" -f state=open -f head="$HEAD_OWNER:$HEAD_BRANCH" --jq 'if length == 1 then .[0].number else empty end')" + trusted_workflow_id="$(gh api "repos/$GH_REPO/actions/workflows/close-invalid.yml" --jq .id)" + workflow_run="$(gh api "repos/$GH_REPO/actions/runs/$WORKFLOW_RUN_ID")" + + if [ "$(jq -r .workflow_id <<<"$workflow_run")" != "$trusted_workflow_id" ] || + [ "$(jq -r .event <<<"$workflow_run")" != "pull_request" ] || + [ "$(jq -r .repository.full_name <<<"$workflow_run")" != "$GH_REPO" ]; then + echo "Workflow run is not a trusted pull_request run from $GH_REPO; skipping." + exit 0 fi - if [ -z "${PR_NUMBER:-}" ]; then - echo "Unable to identify a single open PR for workflow run; skipping." + if [ "$(jq '.pull_requests | length' <<<"$workflow_run")" -ne 1 ]; then + echo "Workflow run is not associated with exactly one PR; skipping." exit 0 fi - pr_state="$(gh api "repos/$GH_REPO/pulls/$PR_NUMBER" --jq .state)" - if [ "$pr_state" != "open" ]; then - echo "PR #$PR_NUMBER is $pr_state; skipping." + pr_number="$(jq -r .pull_requests[0].number <<<"$workflow_run")" + run_head_sha="$(jq -r .head_sha <<<"$workflow_run")" + run_head_repo="$(jq -r '.head_repository.full_name // empty' <<<"$workflow_run")" + pr="$(gh api "repos/$GH_REPO/pulls/$pr_number")" + + if [ -z "$run_head_repo" ] || + [ "$(jq -r .base.repo.full_name <<<"$pr")" != "$GH_REPO" ] || + [ "$(jq -r '.head.repo.full_name // empty' <<<"$pr")" != "$run_head_repo" ] || + [ "$(jq -r .head.sha <<<"$pr")" != "$run_head_sha" ]; then + echo "PR #$pr_number no longer matches the workflow run head; skipping." exit 0 fi - if ! gh api "repos/$GH_REPO/issues/$PR_NUMBER/labels" --jq '.[].name' | grep -Fxq invalid; then - echo "PR #$PR_NUMBER does not currently have the invalid label; skipping." + if [ "$(jq -r .state <<<"$pr")" != "open" ] || + ! jq -e 'any(.labels[]?; .name == "invalid")' >/dev/null <<<"$pr"; then + echo "PR #$pr_number is not open with the invalid label; skipping." exit 0 fi - gh api -X PATCH "repos/$GH_REPO/pulls/$PR_NUMBER" -f state=closed + gh api -X PATCH "repos/$GH_REPO/pulls/$pr_number" -f state=closed + + reconcile-invalid-prs: + if: > + github.repository == 'github/copilot-cli' && + (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') + runs-on: ubuntu-latest + permissions: + pull-requests: write + concurrency: + group: close-invalid-pr-reconciliation + cancel-in-progress: false + steps: + - name: Close open PRs with the invalid label + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_REPO: ${{ github.repository }} + run: | + set -euo pipefail + + gh api --paginate "repos/$GH_REPO/pulls?state=open&per_page=100" \ + --jq '.[] | select(any(.labels[]?; .name == "invalid")) | .number' | + while read -r pr_number; do + pr="$(gh api "repos/$GH_REPO/pulls/$pr_number")" + + if [ "$(jq -r .state <<<"$pr")" = "open" ] && + jq -e 'any(.labels[]?; .name == "invalid")' >/dev/null <<<"$pr"; then + gh api -X PATCH "repos/$GH_REPO/pulls/$pr_number" -f state=closed + fi + done diff --git a/.github/workflows/close-invalid.yml b/.github/workflows/close-invalid.yml index b1fa4801..18288ff0 100644 --- a/.github/workflows/close-invalid.yml +++ b/.github/workflows/close-invalid.yml @@ -1,6 +1,6 @@ name: Close issue/PR on adding invalid label -# **What it does**: This action closes issues and PRs that are labeled as invalid in the repo. +# **What it does**: This action closes invalid issues and signals invalid PRs to a trusted writer. on: issues: @@ -33,8 +33,10 @@ jobs: github.event_name == 'pull_request' && github.event.label.name == 'invalid' runs-on: ubuntu-latest - permissions: - pull-requests: read + permissions: {} steps: - name: Record invalid PR label signal - run: echo "Invalid label signal for PR #${{ github.event.pull_request.number }}" + env: + PR_NUMBER: ${{ github.event.pull_request.number }} + run: | + echo "Invalid label signal for PR #$PR_NUMBER" From da6329cc64f78f2ea9643e5d4b121f3b2bcfe8a4 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 14 Aug 2026 02:28:40 +0000 Subject: [PATCH 6/6] Update changelog.md for version 1.0.80 --- changelog.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/changelog.md b/changelog.md index 48f07df8..381986dd 100644 --- a/changelog.md +++ b/changelog.md @@ -1,3 +1,7 @@ +## 1.0.80 - 2026-08-14 + +- Update model configurations + ## 1.0.79 - 2026-08-10 - The /sandbox configuration dialog shows where sandbox settings are stored in settings.json