Copilot CLI Updates & Release Notes

2026-10-07

• Add enterprise permissions.limitTo to enforce managed domain boundaries for network requests
• Run safe /user commands immediately during active turns, reject unsafe remote commands during active turns without opening dialogs, and queue commands advertised by relay hosts
• Plugin skill commands stay available after reloading enabled plugins
• Sandbox local-network allowlists now include localhost and loopback hosts.
• GitHub.com Connector users can expand GitHub CLI permissions in place and retry connections without switching sign-in methods.
• Honor --context long_context at startup and show accurate context allowance in /context
• Connecting a Connector without the required GitHub scope now prompts to update your authorization instead of failing with an authentication error
• Warmed language servers stay running across LSP requests when sandboxing is disabled
• Clicking a truncated compact shell command expands it
• Command sandboxing is available to all users via /sandbox and --sandbox.
• MCP server configuration changes apply between turns without restarting the session.
• Model picker updates the recommended list to prioritize GPT-6.1 Sol, GPT-6 Astra/Luna, and Claude 5.5 models.
• Read user settings only from ~/.copilot/settings.json; user-setting keys in ~/.copilot/config.json are ignored.

Added

• Add enterprise permissions.limitTo to enforce managed domain boundaries for network requests

Improved

• Model picker updates the recommended list to prioritize GPT-6.1 Sol, GPT-6 Astra/Luna, and Claude 5.5 models.

Fixed

• GitHub.com Connector users can expand GitHub CLI permissions in place and retry connections without switching sign-in methods.
• Honor --context long_context at startup and show accurate context allowance in /context
• Connecting a Connector without the required GitHub scope now prompts to update your authorization instead of failing with an authentication error

Removed

• Read user settings only from ~/.copilot/settings.json; user-setting keys in ~/.copilot/config.json are ignored.

2026-10-05

• Add copilot config subcommands to list, read, set, and remove settings.
• Add a pre-conversation Ctrl+E environment picker to switch between local and cloud runs
• Entra-protected MCP servers can silently renew access-token-only credentials.
• Legacy HTTP+SSE MCP connections no longer hang indefinitely when a message POST is never acknowledged; the acknowledgement is bounded by the server's configured timeout
• Voice runtime install errors name why the download from nuget.org failed, not only the fallback feed's 401
• Compaction keeps your latest prompt when requests exceed context limits
• Large Anthropic requests rejected by provider size limits now retry after downscaling images or removing attachments
• Custom agent model entries keep model-bound reasoning effort only when that model is selected
• Shell tool calls now stream live stdout and stderr output reliably in the timeline
• Usage reporting preserves provider-reported reasoning token totals when available
• Sessions no longer slow to a crawl for minutes after the agent writes a very large file in one step
• Sandboxed shells now withhold ambient GITHUB_TOKEN unless explicitly configured.
• Plan usage reflects the current billing period after quota resets
• Custom agents launched through ACP task calls now resolve and run correctly
• Remote session resume now uses your configured GitHub auth for --resume and --connect …

Added

• Add copilot config subcommands to list, read, set, and remove settings.

Improved

• Improve first-run startup by extracting the bundled CLI package in a child process
• Improve startup responsiveness when connecting many MCP servers at once
• Canvas actions can now return images to the model in invoke_canvas_action.

Fixed

• Legacy HTTP+SSE MCP connections no longer hang indefinitely when a message POST is never acknowledged; the acknowledgement is bounded by the server's configured timeout
• Voice runtime install errors name why the download from nuget.org failed, not only the fallback feed's 401
• Compaction keeps your latest prompt when requests exceed context limits
• Large Anthropic requests rejected by provider size limits now retry after downscaling images or removing attachments
• Custom agent model entries keep model-bound reasoning effort only when that model is selected
• Shell tool calls now stream live stdout and stderr output reliably in the timeline
• Usage reporting preserves provider-reported reasoning token totals when available
• Sessions no longer slow to a crawl for minutes after the agent writes a very large file in one step
• Sandboxed shells now withhold ambient GITHUB_TOKEN unless explicitly configured.
• Plan usage reflects the current billing period after quota resets
• Custom agents launched through ACP task calls now resolve and run correctly …

Added

• Add a pre-conversation Ctrl+E environment picker to switch between local and cloud runs

Fixed

• Keyboard, paste, and mouse input now stay ordered and responsive during rapid interaction.
• Sandboxed shell commands offer a network bypass prompt whenever the proxy blocks a destination
• Sandboxed scripts that run Git now authenticate with masked credentials and SSH remote rewrites
• Sub-agents keep working after you replace your GitHub authentication credentials

Removed

• Remove retired models from the model picker and supported CLI selections

2026-10-01

• Add copilot sandbox ca commands to check, create, trust, rotate, and remove proxy CA trust, including unattended Windows setup; /sandbox ca install becomes create and trust
• Session timelines now clear busy status after interrupted turns finish.
• Sandboxed commands run on Windows versions without filesystem enumeration support, with a warning that PowerShell's current location may be wrong
• Footer text selection stays on the same visible line when the footer grows or shrinks.
• Offer sandbox network bypass for Node/npm EACCES socket denials on Windows
• CLI shutdown flushes pending telemetry before exit, with a bounded delay when telemetry is still initializing.
• Complete, statically analyzable read-only shell pipelines can now enter execution-evidence review, while incomplete or unbound pipelines require explicit approval.

Added

• Add copilot sandbox ca commands to check, create, trust, rotate, and remove proxy CA trust, including unattended Windows setup; /sandbox ca install becomes create and trust

Improved

• CLI shutdown flushes pending telemetry before exit, with a bounded delay when telemetry is still initializing.

Fixed

• Session timelines now clear busy status after interrupted turns finish.
• Sandboxed commands run on Windows versions without filesystem enumeration support, with a warning that PowerShell's current location may be wrong
• Footer text selection stays on the same visible line when the footer grows or shrinks.

2026-09-30

• Add support for GPT-6.1 Sol in model selection
• Add --mcp-github-auth to scope GitHub account auth to approved MCP server origins
• Add session-scoped read-only directory approvals to path access prompts
• Permission prompts remain answerable after resuming interrupted sessions.
• Auto-approval now takes into account messages you type while the agent is working, as it already did for prompts sent while it was idle
• Compaction now returns a summary even when instructions ask for tool use.
• Copying selected text on Wayland now finishes as soon as wl-copy accepts it, instead of timing out and falling back to the in-process clipboard that can print "Somebody else owns the clipboard now" over the UI
• A narrow Sessions sidebar drops keyboard hints that do not fit instead of cutting one off mid-word
• MCP tools recover after transient discovery failures without restarting the session; unchanged catalogs remain available during recovery.
• "No supported model available" is no longer shown on launch or in the model picker when a configured provider already supplies a model
• MCP tool calls complete even when servers keep sending progress updates after responding
• A fresh launch no longer prints "Failed to read model provider attribution" errors while it signs in
• MCP OAuth sign-in to servers such as Datadog reuses a still-valid cached token
• Withdrawn running prompts stay removed after session resume …

Added

• Add support for GPT-6.1 Sol in model selection

Improved

• Click anywhere on expanded tool calls in compact timeline to collapse them
• Holding Space and Ctrl+X V explain when voice mode is off or still getting ready

Fixed

• Permission prompts remain answerable after resuming interrupted sessions.
• Auto-approval now takes into account messages you type while the agent is working, as it already did for prompts sent while it was idle
• Compaction now returns a summary even when instructions ask for tool use.
• Copying selected text on Wayland now finishes as soon as wl-copy accepts it, instead of timing out and falling back to the in-process clipboard that can print "Somebody else owns the clipboard now" over the UI
• A narrow Sessions sidebar drops keyboard hints that do not fit instead of cutting one off mid-word
• MCP tools recover after transient discovery failures without restarting the session; unchanged catalogs remain available during recovery.