Improved

• Update model configurations

2026-08-14

• Update model configurations

Fixes and changes

Added

• Add --enable-mcp-server to re-enable MCP servers disabled in settings for the current run
• A session shared with another CLI now says so: in --ahp mode a row for a session you have joined leads with 2 clients (or more) when somebody else is attached to it, in both the Sessions tab and the sidebar, and /ahp status reports the same number. Presence is announced on attach and refreshed on a heartbeat, so a client that joins shows up at once and one that goes away stops being counted
• /ahp cloud <environment-id> puts a Mission Control environment in the Sessions tab's source picker alongside your local daemons, so the compute --cloud runs on is somewhere you can switch to with h and create sessions on — marked CLOUD, because Mission Control wakes it on connect and this CLI cannot start or stop it
• /ahp codespace <name> forwards a Codespace's copilotd port to your machine with gh and puts it in the Sessions tab's source picker, so a session running in a Codespace is one h away. It is named after the Codespace and marked CS, the tunnel closes when you exit or with /ahp stop <name>, and a missing codespace scope tells you the gh auth refresh line to run
• --ahp now finds the AHP daemons already running on your machine and puts them in the Sessions tab's source picker, so a host you started in another terminal is there without being named again -- including one you start while the CLI is open. Turn it off with COPILOT_AHP_DISCOVER=0
• In --ahp mode the Sessions tab and the sidebar now list the host's sessions — including ones started by another CLI — so enter joins a session running elsewhere, n creates the new session on the host, and closing a row disposes it there for every attached CLI; each host row shows whether that session is running, waiting on input, or idle right now, and the busy ones sort to the top of the host's list; every row that lives on the host is marked with it, including the sessions you have already joined, so a shared session no longer reads like a private local one, and a host session is listed once instead of reappearing lower down as a stale local copy of itself
• In --ahp mode the Sessions tab and the sidebar now show the host itself above the list — which daemon these sessions come from, what it is running (copilotd 0.6.5), and whether it is still answering — so a host that stops responding is visible instead of leaving every host row on screen as a photograph; losing the host is also announced once in the timeline, since that is rarely the screen you are looking at, and /ahp status now reports the same identity and health plus whether this CLI started the daemon or attached to one that was already running
• /ahp start [port], /ahp stop <host> and /ahp restart <host> manage the AHP daemons themselves from inside the CLI. start serves the current directory, so it is the fix for a healthy host refusing a new session with permission denied; stop only ever signals a process it can see is an AHP host on this machine, waits for the socket to close, and asks for --force before disconnecting the session you are in; restart relaunches on the workspace the daemon was already serving (staff-only for now: --ahp and /ahp are gated on the AHP_CLIENT feature flag)
• The Sessions tab now shows where its sessions come from -- this CLI process first, then every AHP daemon you named -- with each host's health beside it, and h switches between them. --ahp and COPILOT_AHP_URL take a comma-separated list of hosts, /ahp connect <url> adds one live, /ahp hosts lists them and /ahp use <host> switches from the timeline. The list shows only the selected source's sessions and n creates there, so attaching to a host is no longer a one-way door away from your local sessions
• copilot --ahp attaches the CLI to an Agent Host Protocol host, so sessions live on the host instead of in the CLI: several terminals can attach to the same session and watch its turns stream live, /ahp sessions|attach|new reaches the host's session list, and a bare --ahp starts a local host when none is running; typing while a turn is streaming — including a turn another terminal started — behaves as it does locally: enter steers the prompt into the running turn, ctrl+q queues it for the next one, ctrl+c takes it back, and every attached terminal sees it either way (staff-only for now: --ahp and /ahp are gated on the AHP_CLIENT feature flag)
• Add /plugin marketplace update [name] to refresh marketplace catalogs
• Add support for MAI Code 1.1 Flash
• Add --usage-output-file to write final usage metrics to a JSON file
• Set explicit objectives with /autopilot without experimental mode

Improved

• --cloud now puts the environment it provisions in the Sessions tab's source picker, so the compute your cloud session runs on is somewhere you can switch back to, create more sessions on, and inspect with /ahp
• /ahp codespace now accepts the display name you gave a Codespace, not just the auto-generated one gh prints — and when the name matches nothing it lists the Codespaces you do have, or says the account has none, instead of reporting a 404 URL
• The Sessions tab's source strip is now drawn as the same chip the filter: scope selector uses -- the source in force is a bold value on a filled badge, in the same fonts, foregrounds and backgrounds -- instead of a hand-rolled line of ASCII brackets and glyphs in a visual language of its own. It keeps its own line directly above filter: and still names every source -- each daemon marked AHP so it is clear the sessions are not this process's -- separated by the same · a session card uses, with h moving the highlight along it. Every entry reserves the badge's padding whether or not it is selected, so the line never re-flows as the highlight moves. Each host's health rides on the colour of its own entry, and where the line cannot hold every source -- the docked sidebar is around 42 columns -- it collapses to the source in force and counts what it could not draw, instead of silently truncating the selected host's address mid-number
• Show LSP progress percentages in all service states and clear them when progress ends
• Spec plugins that leave commands, agents, rules, hooks, LSP or MCP config at the plugin root now report the file and where to move it, instead of losing the component silently
• MCP server timeout settings now apply to tool discovery, with a 30-second default so slow servers can load their tools reliably.
• Improve CLI rendering performance for streaming assistant output
• Show per-file headers when viewing expanded multi-file apply_patch diffs
• Show /autopilot and /goal objective hints in slash-command autocomplete
• Show structured ask_user forms by default in interactive CLI sessions
• When an enterprise policy requires the sandbox, --no-sandbox now explains that it was ignored instead of silently having no effect.
• extraKnownMarketplaces "autoUpdate" is now honored from managed (MDM/server) settings too, not just user settings

Fixed

• copilot --ahp no longer fails with "no AHP host is listening" when daemons are running — it attaches to one already on this machine (preferring one whose workspace covers your directory) instead of insisting on the default address, and only reports a failure when there is genuinely nothing to attach to and none can be started
• /clear and /new are available again on a session that lives on an AHP host, and they now replace it on that host. Previously they were hidden because they built the replacement session locally: the timeline looked cleared, but every prompt after it ran in this process instead of on the host, and no other attached CLI could join it
• A --ahp host reached with a connection token (--ahp "wss://host:8765?tkn=…", how a Codespace or LAN host is protected) no longer prints that token back: /ahp status, the /ahp session lists, the connection errors and the host-status notices all redact the query string, so a transcript can be shared without leaking it. A host that refuses the upgrade with 401 now says the connection token is what it wants
• An --ahp session now runs in the directory you started the CLI from, when the host's workspace covers it, instead of always at the host's workspace root — so a daemon serving a parent directory no longer puts your agent in the wrong project
• Host skills no longer vanish from an --ahp session moments after it opens: a relay reconnect snapshot that omits customizations is no longer read as "the host has none"
• The status line no longer sits on Loading: … — still waiting on extensions for the whole life of a session that runs in another process — every --ahp session, and Mission Control remote sessions too. The CLI cannot load its extensions into a session it does not own, and now reports that instead of waiting forever
• copilot init no longer silently drops --sandbox / --no-sandbox. The flag now applies to the init session, subject to the same feature gating and enterprise sandbox floor as other entry points.
• Sandboxed MCP servers launched with npx or uvx now get a writable Copilot-owned package cache, plus the Windows toolchain and Playwright browser grants they were missing (needs dev-tool access)
• A sandbox readonlyPaths entry nested inside your working directory now blocks writes from the built-in file tools
• Turning off sandbox.allowDevToolAccess now also withholds the tool directories discovered on PATH and in toolchain environment variables, such as a relocated CARGO_HOME.
• Footer AI credit total updates as background subagents spend, instead of waiting for the next turn
• Moved unknown and ineffective settings into an actionable /settings Problems tab and cleaned up retired CLI-owned keys
• Pressing Enter now always acts on your message instead of sometimes leaving it in the queue
• Very large sessions no lo...

2026-08-10

• The /sandbox configuration dialog shows where sandbox settings are stored in settings.json
• Add support for enterprise allow-auto-only policy so /allow-all auto works while full allow-all remains blocked.
• Allow enterprise-managed sandbox policy to enforce a proxy URL while credentials remain user-controlled
• A tool directory inside your workspace that is on PATH (.venv/bin, node_modules/.bin, an in-repo GOPATH) no longer turns that part of the workspace read-only in the sandbox
• The /sandbox configuration dialog groups the git, gh, and (on macOS) keychain settings under a new Auth tab, and the settings keys moved from sandbox.gitAuth/sandbox.ghAuth to sandbox.auth.git/sandbox.auth.gh. There is no migration: the old keys are ignored in settings files, and SDK requests that still send them are rejected as invalid rather than ignored
• Added a worktreeBaseRef setting that controls whether /worktree, /worktree new, and --worktree start from HEAD or the remote default branch. All three now default to HEAD; previously --worktree started from the remote default branch.
• Model picker groups models into Recent, Recommended, New, and other sections, and Shift+Tab switches grouping views.
• Large monorepos now use tgrep (trigram-indexed grep for fast regex search in large codebases) instead of ripgrep
• Agent Plugins spec plugins can now ship extensions under a com.github.copilot/extensions/ directory
• Add support for the kimi-k3 model
• Combine --plan with --mode autopilot to plan first and then implement without waiting for approval
• The /app command now opens the current session in the GitHub Copilot desktop app instead of landing on Home with the wrong folder (requires GitHub Copilot app 1.1.3 or later)
• On macOS, a sandbox read-only path nested inside a writable one now stays read-only instead of inheriting the write permission from the wider path
• On macOS, sandboxed commands can use UNIX-domain sockets again, so tools that talk over a local IPC pipe (tsx, vite, esbuild, jest workers) no longer fail with listen EPERM
• Sandboxed commands work when the working directory lives on a Windows Dev Drive
• /theme now only shows its deprecation notice for a valid color mode, so a mistyped mode no longer suggests an invalid command or hides the notice from your next valid /theme.
• Sandboxed git now authenticates to Azure DevOps, GitHub Enterprise Server, GitLab, and other non-GitHub remotes you have stored HTTPS credentials for
• Ask user multi-select prompts include an Other option for free-text answers
• Improve teleported subagent /tasks navigation with nested tree browsing, current/all and finished-task filters, and a live timeline you can steer
• A rare internal delay no longer prints a diagnostic warning on top of the interactive UI
• A failed session-history load no longer leaves the timeline permanently empty: the failure was silently discarded, so the transcript stayed blank for the rest of the session with nothing logged. It is now retried, and reported in the transcript and the log if it still fails
• Resuming a long session no longer collapses the timeline's scroll range while history renders in the background: entries that had not finished rendering were published as if they did not exist, so the scrollbar and scroll position jumped until the background render caught up
• Manage multiple concurrent sessions from the Sessions tab and sidebar
• Sandboxed wrapper builds (make and friends) get the dev tool caches their recipes need, based on the build manifests in the working directory
• Prompt pinning is off by default; set pinnedPrompts to true to enable it.
• Sandboxed commands can reach the network again on recent Windows builds, where every outbound connection was blocked even with outbound access enabled and no proxy configured
• Plugin custom agents honor deferred-tool-loading frontmatter
• Use /worktree new to start a new session in a new worktree
• A sandbox that cannot start an MCP server now fails in seconds instead of stalling the session, and sandbox startup failures for both MCP and language servers now say the sandbox was at fault and how to fix or opt out of it
• Login links are clickable during web and device-code sign-in
• Pin the current prompt one row higher, in the row the tab bar already reserves, so it keeps the shape of the prompt it copies while costing the timeline one row less
• Leave the pinned prompt off by default on terminals under 30 rows, where it would crowd the output; set pinnedPrompts explicitly to override at any size
• Compute /context attribution against the Auto-resolved model so token totals are accurate for Free/Student users
• Disabling an extension no longer breaks elicitation, canvases, or tool permission prompts for other extensions
• A prompt stashed with ctrl+s now stays with the session it was typed for, so switching away and back and pressing ctrl+s restores it instead of finding it gone
• On Linux, searches and most shell commands blocked by the sandbox now offer to re-run outside it
• BREAKING: the sandbox setting allowDevToolCaches is renamed allowDevToolAccess, since it grants dev-tool config and registries too, not just caches. The old key is no longer read and is ignored silently, so an existing false opt-out reverts to the default (on). Rename it in settings.json and in any managed/MDM policy.
• Add /sandbox policy to show effective sandbox paths, denials, and network access
• Queue prompts, shell commands, and supported slash commands in local sessions to run in order after the current task finishes
• Set "autoUpdate": true on an extraKnownMarketplaces entry in your user settings to auto-update its plugins at session start
• /sandbox tags inactive settings as (disabled) and explains why they are locked, and documents dev tool caches in copilot help sandbox
• Show "pending · ctrl+c to cancel" for in-flight steering prompts
• Make /model session-scoped by default, and use /config model to set defaults for future sessions.
• Pin the current prompt as a single line instead of a three-row framed block, so it reads as chrome and returns rows to the timeline; with the tab bar on it sits directly below the tabs and costs the timeline nothing

Improved

• The /sandbox configuration dialog shows where sandbox settings are stored in settings.json

Added

• Add support for enterprise allow-auto-only policy so /allow-all auto works while full allow-all remains blocked.
• Allow enterprise-managed sandbox policy to enforce a proxy URL while credentials remain user-controlled

Improved

• The /sandbox configuration dialog groups the git, gh, and (on macOS) keychain settings under a new Auth tab, and the settings keys moved from sandbox.gitAuth/sandbox.ghAuth to sandbox.auth.git/sandbox.auth.gh. There is no migration: the old keys are ignored in settings files, and SDK requests that still send them are rejected as invalid rather than ignored
• Added a worktreeBaseRef setting that controls whether /worktree, /worktree new, and --worktree start from HEAD or the remote default branch. All three now default to HEAD; previously --worktree started from the remote default branch.
• Model picker groups models into Recent, Recommended, New, and other sections, and Shift+Tab switches grouping views.
• Large monorepos now use tgrep (trigram-indexed grep for fast regex search in large codebases) instead of ripgrep

Fixed

• A tool directory inside your workspace that is on PATH (.venv/bin, node_modules/.bin, an in-repo GOPATH) no longer turns that part of the workspace read-only in the sandbox

Added

• Agent Plugins spec plugins can now ship extensions under a com.github.copilot/extensions/ directory
• Add support for the kimi-k3 model
• Combine --plan with --mode autopilot to plan first and then implement without waiting for approval

Improved

• Ask user multi-select prompts include an Other option for free-text answers
• Improve teleported subagent /tasks navigation with nested tree browsing, current/all and finished-task filters, and a live timeline you can steer

Fixed

• The /app command now opens the current session in the GitHub Copilot desktop app instead of landing on Home with the wrong folder (requires GitHub Copilot app 1.1.3 or later)
• On macOS, a sandbox read-only path nested inside a writable one now stays read-only instead of inheriting the write permission from the wider path
• On macOS, sandboxed commands can use UNIX-domain sockets again, so tools that talk over a local IPC pipe (tsx, vite, esbuild, jest workers) no longer fail with listen EPERM
• Sandboxed commands work when the working directory lives on a Windows Dev Drive
• /theme now only shows its deprecation notice for a valid color mode, so a mistyped mode no longer suggests an invalid command or hides the notice from your next valid /theme.
• Sandboxed git now authenticates to Azure DevOps, GitHub Enterprise Server, GitLab, and other non-GitHub remotes you have stored HTTPS credentials for

Fixed

• A rare internal delay no longer prints a diagnostic warning on top of the interactive UI
• A failed session-history load no longer leaves the timeline permanently empty: the failure was silently discarded, so the transcript stayed blank for the rest of the session with nothing logged. It is now retried, and reported in the transcript and the log if it still fails
• Resuming a long session no longer collapses the timeline's scroll range while history renders in the background: entries that had not finished rendering were published as if they did not exist, so the scrollbar and scroll position jumped until the background render caught up

Added

• Manage multiple concurrent sessions from the Sessions tab and sidebar

Improved

• Prompt pinning is off by default; set pinnedPrompts to true to enable it.

Fixed

• Sandboxed wrapper builds (make and friends) get the dev tool caches their recipes need, based on the build manifests in the working directory