copilot-cli

Added

• Managed sandbox sessions can now be disabled for the rest of the session from an approved bypass prompt.

Fixed

• A PowerShell write the sandbox blocks offers to run the command outside the sandbox
• When you have more than one GitHub account in your credential store, a sandboxed gh command now acts as the account gh is logged in as instead of an arbitrary one.
• The /rubber-duck command is hidden after a model refresh removes its compatible critic
• Sandboxed runs now use relocated developer-tool caches from env vars and tool config files
• On Windows, a sandboxed command that runs git without naming it — a hook, a build tool, or an npm install that clones over HTTPS — no longer dies inside the credential helper's MSYS2 shell.

2026-09-04

• Show running Copilot sessions in the Windows 11 taskbar with live hover status cards
• Add Client ID Metadata Document (CIMD) support for MCP OAuth sign-in
• Custom agents can list several models in model, tried in order until one is available to you, and model-policy: required keeps model changes on that list
• Adding support for claude-fable-5.1
• Add Recent, Created, Name, and classic None sorting to the split Sessions sidebar, with the selected order saved across restarts
• Enterprise admins can pin sign-in to approved GitHub organizations with the forceLoginOrgs managed setting
• Add automatic HTTPS proxy mTLS client certificate support for model and web requests
• Detect the herdr terminal multiplexer instead of mistaking it for tmux, so the Kitty keyboard protocol, color scheme following, terminal progress, /copy and notifications work in herdr panes
• A session lock that is re-entered on the same thread now fails with a reported error instead of freezing the CLI.
• Kerberos proxy authentication reconnects when the initial challenge answers with Connection: close
• Sandboxed gh commands now authenticate as the account configured for the repository instead of the Copilot CLI login
• MCP tools remain callable after MCP server restarts
• Sandboxed file tools now read the same developer-tool paths as sandboxed shell commands, including token-bearing registry config such as ~/.npmrc; set sandbox.allowDevToolAccess to false to turn these grants off
• Stopping a timed-out shell command now lets queued messages run and sessions return to idle
• A follow-up prompt typed while autopilot is running no longer disappears from the timeline
• Restart provides clearer update guidance when automatic restart cannot be completed
• MCP servers configured by your agent stay available after built-in sub-agent turns.
• Anthropic sessions continue after temporary fallback instead of failing on invalid thinking signatures
• Long-running sessions on Linux return freed memory to the system instead of holding gigabytes of it
• Enterprise-denied MCP servers can no longer start before the managed allow/deny policy resolves; server startup now waits for the managed-settings fetch instead of racing it
• Host-provided plugin customizations can be read without redundant path permission prompts
• A relative --add-dir or --plugin-dir path now resolves against the session's working directory under --resume=<id> and --worktree, instead of the directory the CLI was launched from. Relative values are also resolved after -C is applied, so -C no longer has to precede either option on the command line
• MCP servers contributed by a plugin are no longer labelled "User" in the MCP dashboard, and a server from a bundled plugin is now shown as built-in and names the plugin it came from.
• The newest line of output stays visible above the input box instead of hiding behind it, except while a prompt is pinned to the top of the transcript
• Exporting a resumed session with --share or --share-gist writes the whole transcript instead of only the latest run
• On macOS and Linux, sandboxed commands can no longer reach services running on your machine. On macOS this also blocks a server the command itself starts on 127.0.0.1, so test suites that bind a local port will fail; turn on Allow local network in /sandbox to reach localhost again.
• Linux sandboxing now needs slirp4netns, nsenter, iptables, ip6tables, iptables-restore and ip6tables-restore on PATH. Install them if sandboxed commands start failing to launch.
• CLI starts without the interrupted-session restore prompt by default.
• Resuming large sessions keeps the input prompt responsive sooner.
• Linux sandboxes now restrict network egress to the configured proxy; proxy mode requires slirp4netns, util-linux 2.35+, iptables, and /dev/net/tun access
• /mcp config and the MCP add/edit/authenticate forms now open in the plugins dashboard instead of a separate MCP manager, so closing a form returns to the server list.
• File path autocomplete stays fast in large repositories
• Plugin list commands and /plugin now show bundled built-in plugins.
• Improve sandboxed Bazel and Bazelisk runs by granting required cache and output paths; macOS requires a future Bazel release or additional sandbox capabilities
• The collapsed autopilot goal panel now reads as a single-line pinned prompt, keeping the frame it shares with a pinned prompt instead of compressing into a bare band wedged against the chrome above it
• Improve /sandbox policy by grouping path grants by source and showing detected developer tools
• Remove retired Claude and Gemini models from /model picker results

Added

• Show running Copilot sessions in the Windows 11 taskbar with live hover status cards

Improved

• On macOS and Linux, sandboxed commands can no longer reach services running on your machine. On macOS this also blocks a server the command itself starts on 127.0.0.1, so test suites that bind a local port will fail; turn on Allow local network in /sandbox to reach localhost again.
• Linux sandboxing now needs slirp4netns, nsenter, iptables, ip6tables, iptables-restore and ip6tables-restore on PATH. Install them if sandboxed commands start failing to launch.

Fixed

• A session lock that is re-entered on the same thread now fails with a reported error instead of freezing the CLI.
• Kerberos proxy authentication reconnects when the initial challenge answers with Connection: close
• Sandboxed gh commands now authenticate as the account configured for the repository instead of the Copilot CLI login
• MCP tools remain callable after MCP server restarts

Added

• Add Client ID Metadata Document (CIMD) support for MCP OAuth sign-in

Improved

• CLI starts without the interrupted-session restore prompt by default.
• Resuming large sessions keeps the input prompt responsive sooner.

Fixed

• Sandboxed file tools now read the same developer-tool paths as sandboxed shell commands, including token-bearing registry config such as ~/.npmrc; set sandbox.allowDevToolAccess to false to turn these grants off
• Stopping a timed-out shell command now lets queued messages run and sessions return to idle
• A follow-up prompt typed while autopilot is running no longer disappears from the timeline
• Restart provides clearer update guidance when automatic restart cannot be completed
• MCP servers configured by your agent stay available after built-in sub-agent turns.
• Anthropic sessions continue after temporary fallback instead of failing on invalid thinking signatures
• Long-running sessions on Linux return freed memory to the system instead of holding gigabytes of it
• Enterprise-denied MCP servers can no longer start before the managed allow/deny policy resolves; server startup now waits for the managed-settings fetch instead of racing it
• Host-provided plugin customizations can be read without redundant path permission prompts

Removed

• Remove retired Claude and Gemini models from /model picker results

Added

• Custom agents can list several models in model, tried in order until one is available to you, and model-policy: required keeps model changes on that list
• Adding support for claude-fable-5.1

Improved

• Linux sandboxes now restrict network egress to the configured proxy; proxy mode requires slirp4netns, util-linux 2.35+, iptables, and /dev/net/tun access

Added

• Add Recent, Created, Name, and classic None sorting to the split Sessions sidebar, with the selected order saved across restarts
• Enterprise admins can pin sign-in to approved GitHub organizations with the forceLoginOrgs managed setting

Improved

• /mcp config and the MCP add/edit/authenticate forms now open in the plugins dashboard instead of a separate MCP manager, so closing a form returns to the server list.
• File path autocomplete stays fast in large repositories
• Plugin list commands and /plugin now show bundled built-in plugins.
• Improve sandboxed Bazel and Bazelisk runs by granting required cache and output paths; macOS requires a future Bazel release or additional sandbox capabilities
• The collapsed autopilot goal panel now reads as a single-line pinned prompt, keeping the frame it shares with a pinned prompt instead of compressing into a bare band wedged against the chrome above it

Fixed

• A relative --add-dir or --plugin-dir path now resolves against the session's working directory under --resume=<id> and --worktree, instead of the directory the CLI was launched from. Relative values are also resolved after -C is applied, so -C no longer has to precede either option on the command line
• MCP servers contributed by a plugin are no longer labelled "User" in the MCP dashboard, and a server from a bundled plugin is now shown as built-in and names the plugin it came from.

Added

• Add automatic HTTPS proxy mTLS client certificate support for model and web requests
• Detect the herdr terminal multiplexer instead of mistaking it for tmux, so the Kitty keyboard protocol, color scheme following, terminal progress, /copy and notifications work in herdr panes

Improved

• Improve /sandbox policy by grouping path grants by source and showing detected developer tools

Fixed

• The newest line of output stays visible above the input box instead of hiding behind it, except while a prompt is pinned to the top of the transcript
• Exporting a resumed session with --share or --share-gist writes the whole transcript instead of only the latest run

2026-08-29

• A message typed while /worktree or /move is preparing the worktree no longer breaks the switch into it
• Ctrl+E expands the plan approval card to show the full plan again
• Show the specific authentication failure (such as 401 Bad credentials) instead of only the /login prompt

Fixed

• A message typed while /worktree or /move is preparing the worktree no longer breaks the switch into it
• Ctrl+E expands the plan approval card to show the full plan again

Fixed

• Show the specific authentication failure (such as 401 Bad credentials) instead of only the /login prompt

2026-08-27

• The plugins dashboard is available to everyone: run /plugin, /mcp, or /skills. Set PLUGINS_DASHBOARD=false to opt out of it and the copilot plugins command.
• Ship MCP 2026-07-28 support to CLI, SDK, IDE, and in-memory clients
• Hooks can now receive the current OpenTelemetry trace context and emit correlated spans: inputs gain traceparent (plus tracestate when the span has vendor state); command hooks also get env vars.
• Windows: remote MCP servers protected by Microsoft Entra ID can now sign in through the OS authentication broker (WAM), usually with no prompt at all. Other platforms, --device-code, and machines without the broker library keep the existing browser flow.
• Add xhigh reasoning effort support for Grok 4.6
• Startup now offers to restore sessions that were still open when their CLI went away, so a crash or a machine restart no longer means reopening each terminal by hand
• models.list now includes service-published infoMessages and warningMessages per model
• Add copilot app to open the GitHub Copilot app in the current directory
• Add defaultMode and defaultPermissionMode settings to choose startup mode and approval behavior for new interactive sessions
• Add --with-token to copilot login to read an auth token from stdin
• Add support for Gemini 3.7 Flash
• Add Ctrl+E in /sandbox to open settings.json in your editor
• Add per-agent usage metrics to --usage-output-file JSON output
• Repeated read_agent calls now consistently return the full turn history unless since_turn is provided
• Hook lifecycle events (hook.start/hook.end) from hooks inside a subagent are now recorded on that subagent's session and re-emitted on its parent, instead of being dropped on an internal session.
• Repeatedly resuming the same session no longer crashes while telemetry is being replaced
• An MCP server blocked by an enterprise policy now shows as blocked in /mcp instead of spinning as pending forever
• Fixed an indefinite "Loading…/Resuming…" hang at startup when a repository plugin activates a contributed extension (or another extension reload races the initial load), which previously left the environment stuck on "still waiting on extensions"
• Vim mode badge stays visible beside the activity indicator during turns
• The startup status finishes after extension configuration during plugin reconciliation
• Signing out of an account now clears its cached enterprise managed settings, so signing back in generally re-fetches the policy rather than re-applying the one cached before sign-out
• An enterprise managed-settings policy is no longer rejected when permissions.disableBypassPermissionsMode carries an unrecognized value; it is now logged and enforced as disable.
• Sandboxed builds on Windows create their scratch caches on first run, so cargo, go, Gradle, and ccache work without a warm cache
• On macOS and Linux, shell commands resolve the same tools a bash login shell does, including project environments activated from a profile
• Canvas windows open and refresh in the background instead of stealing focus from your terminal
• A prompt sent while the agent is working no longer leaves a second copy of itself stuck as (pending) at the bottom of the transcript after it has been answered
• Turning allow-all off from an ACP client now reaches the permission engine whenever there is a runtime override or auto-approval to revoke, so the setting can no longer report success while permissions stay enabled (a baseline granted by --allow-all-* launch flags is still deliberately left intact)
• A failed tool call no longer stacks its (MCP: server) label one character per line down the timeline — the label and the error now share the row, with the longer side truncating
• Agents, skills and MCP servers contributed by installed plugins are no longer dropped in non-interactive (-p) runs, so --agent : works headlessly without --plugin-dir
• Typing $ and pressing Enter opens the interactive shell again, instead of clearing the prompt and doing nothing
• The prompt frame now renders in terminals it previously skipped, such as foot and alacritty, instead of a fixed list
• A prompt queued while the agent is working stays visible instead of vanishing when you send another one
• The sessions sidebar's keyboard cursor is visible again, and selected rows in the Select family, the diff viewer and custom picker rows now pair the selection fill with the text color derived for it.
• Keys sent to an unfocused terminal pane are no longer dropped: Enter and other keystrokes are handled even after a terminal focus-out report, so tmux and agent multiplexers can drive a background pane
• Compact the autopilot goal panel to its identity row on a short terminal (a paused goal keeps its resume note), with ctrl+x → g to expand or collapse it by hand
• Render the autopilot goal panel as a pinned prompt frame, drop its progress bar for the exact todo count, fold the subagent hint into the row it toggles, and keep its metrics on a narrow pane
• Resume large sessions faster by showing recent history first while older messages load.
• x is now the delete key everywhere: /sandbox config, /settings, /mcp, the sessions dialog and the diff comments summary move off d
• Auto mode now adapts model selection as your task evolves during a conversation
• /plugin now flags installed plugins and marketplaces that have a newer version upstream, and offers an Update action to pull it
• Show your last prompt as the inferred objective in the Autopilot status panel
• When --no-sandbox is ignored because enterprise policy could not be determined, the notice now says so, and no longer points at an administrator, instead of claiming a policy requires the sandbox. The unsupported-host warning says the same rather than contradicting it.
• Show model data retention warnings with links in the /model picker
• Path-sourced plugins in a local (directory-source) marketplace now load live from their real directory, so editing one takes effect on /restart or a new session — no /plugin update
• Skills and custom agents are discovered from directories added with --add-dir
• Use Ctrl+Space to toggle voice dictation.
• A session sandboxed by an enterprise managed policy now says so on the timeline, including when the policy arrives mid-session, instead of leaving the footer's sandbox chip as the only hint that commands are being restricted
• forceRemoteSettingsRefresh now fails closed: when set, the cached managed-settings policy is never served or used as a fetch-failure fallback (skipping both the 1h fast path and the 24h stale fallback), so a failed startup fetch blocks on the unconfirmed policy instead of reverting to a possibly-stale cached one. Concretely, until a fresh policy is fetched the session applies the restrictive undetermined-policy posture: non-default MCP servers are blocked, bypass-permissions mode cannot be enabled, and policy-gated plugin install/update mutations are blocked
• ACP clients receive subagent IDs, raw event subscriptions, and live title, mode, command, and plan updates
• Show each user instruction file separately in /instructions
• Managed settings now win per entry for enabledPlugins and extraKnownMarketplaces, so a plugin or marketplace your organization pins can't be overridden locally
• Use x to remove scheduled /every and /after prompts in Schedule Manager
• Update model configurations
• Removed the PLUGINS_DASHBOARD opt-out and the legacy skills picker it kept alive. /skills, bare /mcp, and /mcp show (with no server name) always open the dashboard; /mcp config still opens the dedicated MCP wizard.
• Removed /plugins; its resources moved to /plugin, /mcp and /skills, with /subagents and /instructions for agents and instructions.
• Enabling and disabling hooks and LSP servers is temporarily unavailable: those toggles existed only in the /plugins dashboard that this release removes.

Improved

• Resume large sessions faster by showing recent history first while older messages load.

Fixed

• Repeated read_agent calls now consistently return the full turn history unless since_turn is provided

Added

• Hooks can now receive the current OpenTelemetry trace context and emit correlated spans: inputs gain traceparent (plus tracestate when the span has vendor state); command hooks also get env vars.

Fixed

• Hook lifecycle events (hook.start/hook.end) from hooks inside a subagent are now recorded on that subagent's session and re-emitted on its parent, instead of being dropped on an internal session.

Removed

• Removed the PLUGINS_DASHBOARD opt-out and the legacy skills picker it kept alive. /skills, bare /mcp, and /mcp show (with no server name) always open the dashboard; /mcp config still opens the dedicated MCP wizard.

Added

• Windows: remote MCP servers protected by Microsoft Entra ID can now sign in through the OS authentication broker (WAM), usually with no prompt at all. Other platforms, --device-code, and machines without the broker library keep the existing browser flow.

Fixed

• Repeatedly resuming the same session no longer crashes while telemetry is being replaced

Fixed

• An MCP server blocked by an enterprise policy now shows as blocked in /mcp instead of spinning as pending forever

New

• The plugins dashboard is available to everyone: run /plugin, /mcp, or /skills. Set PLUGINS_DASHBOARD=false to opt out of it and the copilot plugins command.

Improved

• x is now the delete key everywhere: /sandbox config, /settings, /mcp, the sessions dialog and the diff comments summary move off d
• Auto mode now adapts model selection as your task evolves during a conversation
• /plugin now flags installed plugins and marketplaces that have a newer version upstream, and offers an Update action to pull it
• Show your last prompt as the inferred objective in the Autopilot status panel
• When --no-sandbox is ignored because enterprise policy could not be determined, the notice now says so, and no longer points at an administrator, instead of claiming a policy requires the sandbox. The unsupported-host warning says the same rather than contradicting it.

Fixed

• Fixed an indefinite "Loading…/Resuming…" hang at startup when a repository plugin activates a contributed extension (or another extension reload races the initial load), which previously left the environment stuck on "still waiting on extensions"
• Vim mode badge stays visible beside the activity indicator during turns
• The startup status finishes after extension configuration during plugin reconciliation

Removed

• Removed /plugins; its resources moved to /plugin, /mcp and /skills, with /subagents and /instructions for agents and instructions.
• Enabling and disabling hooks and LSP servers is temporarily unavailable: those toggles existed only in the /plugins dashboard that this release removes.

Improved

• Show model data retention warnings with links in the /model picker

Added

• Add xhigh reasoning effort support for Grok 4.6

Improved

• Path-sourced plugins in a local (directory-source) marketplace now load live from their real directory, so editing one takes effect on /restart or a new session — no /plugin update
• Skills and custom agents are discovered from directories added with --add-dir

Fixed

• Signing out of an account now clears its cached enterprise managed settings, so signing back in generally re-fetches the policy rather than re-applying the one cached before sign-out

Added

• Startup now offers to restore sessions that were still open when their CLI went away, so a crash or a machine restart no longer means reopening each terminal by hand
• models.list now includes service-published infoMessages and warningMessages per model
• Add copilot app to open the GitHub Copilot app in the current directory

Improved

• Use Ctrl+Space to toggle voice dictation.
• A session sandboxed by an enterprise managed policy now says so on the timeline, including when the policy arrives mid-session, instead of leaving the footer's sandbox chip as the only hint that commands are being restricted
• forceRemoteSettingsRefresh now fails closed: when set, the cached managed-settings policy is never served or used as a fetch-failure fallback (skipping both the 1h fast path and the 24h stale fallback), so a failed startup fetch blocks on the unconfirmed policy instead of reverting to a possibly-stale cached one. Concretely, until a fresh policy is fetched the session applies the restrictive undetermined-policy posture: non-default MCP servers are blocked, bypass-permissions mode cannot be enabled, and policy-gated plugin install/update mutations are blocked

Fixed

• An enterprise managed-settings policy is no longer rejected when permissions.disableBypassPermissionsMode carries an unrecognized value; it is now logged and enforced as disable.
• Sandboxed builds on Windows create their scratch caches on first run, so cargo, go, Gradle, and ccache work without a warm cache
• On macOS and Linux, shell commands resolve the same tools a bash login shell does, including project environments activated from a profile

Added

• Add defaultMode and defaultPermissionMode settings to choose startup mode and approval behavior for new interactive sessions
• Add --with-token to copilot login to read an auth token from stdin

Improved

• ACP clients receive subagent IDs, raw event subscriptions, and live title, mode, command, and plan updates
• Show each user instruction file separately in /instructions
• Managed settings now win per entry for enabledPlugins and extraKnownMarketplaces, so a plugin or marketplace your organization pins can't be overridden locally

Fixed

• Canvas windows open and refresh in the background instead of stealing focus from your terminal

Fixed

• A prompt sent while the agent is working no longer leaves a second copy of itself stuck as (pending) at the bottom of the transcript after it has been answered

Added

• Add support for Gemini 3.7 Flash
• Add Ctrl+E in /sandbox to open settings.json in your editor
• Add per-agent usage metrics to --usage-output-file JSON output

Improved

• Use x to remove scheduled /every and /after prompts in Schedule Manager

Fixed

• Turning allow-all off from an ACP client now reaches the permission engine whenever there is a runtime override or auto-approval to revoke, so the setting can no longer report success while permissions stay enabled (a baseline granted by --allow-all-* launch flags is still deliberately left intact)
• A failed tool call no longer stacks its (MCP: server) label one character per line down the timeline — the label and the error now share the row, with the longer side truncating
• Agents, skills and MCP servers contributed by installed plugins are no longer dropped in non-interactive (-p) runs, so --agent : works headlessly without --plugin-dir
• Typing $ and pressing Enter opens the interactive shell again, instead of clearing the prompt and doing nothing
• The prompt frame now renders in terminals it previously skipped, such as foot and alacritty, instead of a fixed list
• A prompt queued while the agent is working stays visible instead of vanishing when you send another one
• The sessions sidebar's keyboard cursor is visible again, and selected rows in the Select family, the diff viewer and custom picker rows now pair the selection fill with the text color derived for it.
• Keys sent to an unfocused terminal pane are no longer dropped: Enter and other keystrokes are handled even after a terminal focus-out report, so tmux and agent multiplexers can drive a background pane

Added

• Add --enable-mcp-server to re-enable MCP servers disabled in settings for the current run
• A session shared with another CLI now says so: in --ahp mode a row for a session you have joined leads with 2 clients (or more) when somebody else is attached to it, in both the Sessions tab and the sidebar, and /ahp status reports the same number. Presence is announced on attach and refreshed on a heartbeat, so a client that joins shows up at once and one that goes away stops being counted
• /ahp cloud <environment-id> puts a Mission Control environment in the Sessions tab's source picker alongside your local daemons, so the compute --cloud runs on is somewhere you can switch to with h and create sessions on — marked CLOUD, because Mission Control wakes it on connect and this CLI cannot start or stop it
• /ahp codespace <name> forwards a Codespace's copilotd port to your machine with gh and puts it in the Sessions tab's source picker, so a session running in a Codespace is one h away. It is named after the Codespace and marked CS, the tunnel closes when you exit or with /ahp stop <name>, and a missing codespace scope tells you the gh auth refresh line to run
• --ahp now finds the AHP daemons already running on your machine and puts them in the Sessions tab's source picker, so a host you started in another terminal is there without being named again -- including one you start while the CLI is open. Turn it off with COPILOT_AHP_DISCOVER=0
• In --ahp mode the Sessions tab and the sidebar now list the host's sessions — including ones started by another CLI — so enter joins a session running elsewhere, n creates the new session on the host, and closing a row disposes it there for every attached CLI; each host row shows whether that session is running, waiting on input, or idle right now, and the busy ones sort to the top of the host's list; every row that lives on the host is marked with it, including the sessions you have already joined, so a shared session no longer reads like a private local one, and a host session is listed once instead of reappearing lower down as a stale local copy of itself
• In --ahp mode the Sessions tab and the sidebar now show the host itself above the list — which daemon these sessions come from, what it is running (copilotd 0.6.5), and whether it is still answering — so a host that stops responding is visible instead of leaving every host row on screen as a photograph; losing the host is also announced once in the timeline, since that is rarely the screen you are looking at, and /ahp status now reports the same identity and health plus whether this CLI started the daemon or attached to one that was already running
• /ahp start [port], /ahp stop <host> and /ahp restart <host> manage the AHP daemons themselves from inside the CLI. start serves the current directory, so it is the fix for a healthy host refusing a new session with permission denied; stop only ever signals a process it can see is an AHP host on this machine, waits for the socket to close, and asks for --force before disconnecting the session you are in; restart relaunches on the workspace the daemon was already serving (staff-only for now: --ahp and /ahp are gated on the AHP_CLIENT feature flag)
• The Sessions tab now shows where its sessions come from -- this CLI process first, then every AHP daemon you named -- with each host's health beside it, and h switches between them. --ahp and COPILOT_AHP_URL take a comma-separated list of hosts, /ahp connect <url> adds one live, /ahp hosts lists them and /ahp use <host> switches from the timeline. The list shows only the selected source's sessions and n creates there, so attaching to a host is no longer a one-way door away from your local sessions
• copilot --ahp attaches the CLI to an Agent Host Protocol host, so sessions live on the host instead of in the CLI: several terminals can attach to the same session and watch its turns stream live, /ahp sessions|attach|new reaches the host's session list, and a bare --ahp starts a local host when none is running; typing while a turn is streaming — including a turn another terminal started — behaves as it does locally: enter steers the prompt into the running turn, ctrl+q queues it for the next one, ctrl+c takes it back, and every attached terminal sees it either way (staff-only for now: --ahp and /ahp are gated on the AHP_CLIENT feature flag)
• Add /plugin marketplace update [name] to refresh marketplace catalogs
• Add support for MAI Code 1.1 Flash
• Add --usage-output-file to write final usage metrics to a JSON file
• Set explicit objectives with /autopilot without experimental mode

Improved

• --cloud now puts the environment it provisions in the Sessions tab's source picker, so the compute your cloud session runs on is somewhere you can switch back to, create more sessions on, and inspect with /ahp
• /ahp codespace now accepts the display name you gave a Codespace, not just the auto-generated one gh prints — and when the name matches nothing it lists the Codespaces you do have, or says the account has none, instead of reporting a 404 URL
• The Sessions tab's source strip is now drawn as the same chip the filter: scope selector uses -- the source in force is a bold value on a filled badge, in the same fonts, foregrounds and backgrounds -- instead of a hand-rolled line of ASCII brackets and glyphs in a visual language of its own. It keeps its own line directly above filter: and still names every source -- each daemon marked AHP so it is clear the sessions are not this process's -- separated by the same · a session card uses, with h moving the highlight along it. Every entry reserves the badge's padding whether or not it is selected, so the line never re-flows as the highlight moves. Each host's health rides on the colour of its own entry, and where the line cannot hold every source -- the docked sidebar is around 42 columns -- it collapses to the source in force and counts what it could not draw, instead of silently truncating the selected host's address mid-number
• Show LSP progress percentages in all service states and clear them when progress ends
• Spec plugins that leave commands, agents, rules, hooks, LSP or MCP config at the plugin root now report the file and where to move it, instead of losing the component silently
• MCP server timeout settings now apply to tool discovery, with a 30-second default so slow servers can load their tools reliably.
• Improve CLI rendering performance for streaming assistant output
• Show per-file headers when viewing expanded multi-file apply_patch diffs
• Show /autopilot and /goal objective hints in slash-command autocomplete
• Show structured ask_user forms by default in interactive CLI sessions
• When an enterprise policy requires the sandbox, --no-sandbox now explains that it was ignored instead of silently having no effect.
• extraKnownMarketplaces "autoUpdate" is now honored from managed (MDM/server) settings too, not just user settings

Fixed

• copilot --ahp no longer fails with "no AHP host is listening" when daemons are running — it attaches to one already on this machine (preferring one whose workspace covers your directory) instead of insisting on the default address, and only reports a failure when there is genuinely nothing to attach to and none can be started
• /clear and /new are available again on a session that lives on an AHP host, and they now replace it on that host. Previously they were hidden because they built the replacement session locally: the timeline looked cleared, but every prompt after it ran in this process instead of on the host, and no other attached CLI could join it
• A --ahp host reached with a connection token (--ahp "wss://host:8765?tkn=…", how a Codespace or LAN host is protected) no longer prints that token back: /ahp status, the /ahp session lists, the connection errors and the host-status notices all redact the query string, so a transcript can be shared without leaking it. A host that refuses the upgrade with 401 now says the connection token is what it wants
• An --ahp session now runs in the directory you started the CLI from, when the host's workspace covers it, instead of always at the host's workspace root — so a daemon serving a parent directory no longer puts your agent in the wrong project
• Host skills no longer vanish from an --ahp session moments after it opens: a relay reconnect snapshot that omits customizations is no longer read as "the host has none"
• The status line no longer sits on Loading: … — still waiting on extensions for the whole life of a session that runs in another process — every --ahp session, and Mission Control remote sessions too. The CLI cannot load its extensions into a session it does not own, and now reports that instead of waiting forever
• copilot init no longer silently drops --sandbox / --no-sandbox. The flag now applies to the init session, subject to the same feature gating and enterprise sandbox floor as other entry points.
• Sandboxed MCP servers launched with npx or uvx now get a writable Copilot-owned package cache, plus the Windows toolchain and Playwright browser grants they were missing (needs dev-tool access)
• A sandbox readonlyPaths entry nested inside your working directory now blocks writes from the built-in file tools
• Turning off sandbox.allowDevToolAccess now also withholds the tool directories discovered on PATH and in toolchain environment variables, such as a relocated CARGO_HOME.
• Footer AI credit total updates as background subagents spend, instead of waiting for the next turn
• Moved unknown and ineffective settings into an actionable /settings Problems tab and cleaned up retired CLI-owned keys
• Pressing Enter now always acts on your message instead of sometimes leaving it in the queue
• Very large sessions no longer fail to load their history after a rewind or a compaction

Removed

• Breaking: Agent Plugins spec plugins now read commands/, agents/, rules/, hooks/hooks.json, lsp.json, and extensions/ only under com.github.copilot/ — no longer from the plugin root

2026-08-10

• The /sandbox configuration dialog shows where sandbox settings are stored in settings.json
• Add support for enterprise allow-auto-only policy so /allow-all auto works while full allow-all remains blocked.
• Allow enterprise-managed sandbox policy to enforce a proxy URL while credentials remain user-controlled
• A tool directory inside your workspace that is on PATH (.venv/bin, node_modules/.bin, an in-repo GOPATH) no longer turns that part of the workspace read-only in the sandbox
• The /sandbox configuration dialog groups the git, gh, and (on macOS) keychain settings under a new Auth tab, and the settings keys moved from sandbox.gitAuth/sandbox.ghAuth to sandbox.auth.git/sandbox.auth.gh. There is no migration: the old keys are ignored in settings files, and SDK requests that still send them are rejected as invalid rather than ignored
• Added a worktreeBaseRef setting that controls whether /worktree, /worktree new, and --worktree start from HEAD or the remote default branch. All three now default to HEAD; previously --worktree started from the remote default branch.
• Model picker groups models into Recent, Recommended, New, and other sections, and Shift+Tab switches grouping views.
• Large monorepos now use tgrep (trigram-indexed grep for fast regex search in large codebases) instead of ripgrep
• Agent Plugins spec plugins can now ship extensions under a com.github.copilot/extensions/ directory
• Add support for the kimi-k3 model
• Combine --plan with --mode autopilot to plan first and then implement without waiting for approval
• The /app command now opens the current session in the GitHub Copilot desktop app instead of landing on Home with the wrong folder (requires GitHub Copilot app 1.1.3 or later)
• On macOS, a sandbox read-only path nested inside a writable one now stays read-only instead of inheriting the write permission from the wider path
• On macOS, sandboxed commands can use UNIX-domain sockets again, so tools that talk over a local IPC pipe (tsx, vite, esbuild, jest workers) no longer fail with listen EPERM
• Sandboxed commands work when the working directory lives on a Windows Dev Drive
• /theme now only shows its deprecation notice for a valid color mode, so a mistyped mode no longer suggests an invalid command or hides the notice from your next valid /theme.
• Sandboxed git now authenticates to Azure DevOps, GitHub Enterprise Server, GitLab, and other non-GitHub remotes you have stored HTTPS credentials for
• Ask user multi-select prompts include an Other option for free-text answers
• Improve teleported subagent /tasks navigation with nested tree browsing, current/all and finished-task filters, and a live timeline you can steer
• A rare internal delay no longer prints a diagnostic warning on top of the interactive UI
• A failed session-history load no longer leaves the timeline permanently empty: the failure was silently discarded, so the transcript stayed blank for the rest of the session with nothing logged. It is now retried, and reported in the transcript and the log if it still fails
• Resuming a long session no longer collapses the timeline's scroll range while history renders in the background: entries that had not finished rendering were published as if they did not exist, so the scrollbar and scroll position jumped until the background render caught up
• Manage multiple concurrent sessions from the Sessions tab and sidebar
• Sandboxed wrapper builds (make and friends) get the dev tool caches their recipes need, based on the build manifests in the working directory
• Prompt pinning is off by default; set pinnedPrompts to true to enable it.
• Sandboxed commands can reach the network again on recent Windows builds, where every outbound connection was blocked even with outbound access enabled and no proxy configured
• Plugin custom agents honor deferred-tool-loading frontmatter
• Use /worktree new to start a new session in a new worktree
• A sandbox that cannot start an MCP server now fails in seconds instead of stalling the session, and sandbox startup failures for both MCP and language servers now say the sandbox was at fault and how to fix or opt out of it
• Login links are clickable during web and device-code sign-in
• Pin the current prompt one row higher, in the row the tab bar already reserves, so it keeps the shape of the prompt it copies while costing the timeline one row less
• Leave the pinned prompt off by default on terminals under 30 rows, where it would crowd the output; set pinnedPrompts explicitly to override at any size
• Compute /context attribution against the Auto-resolved model so token totals are accurate for Free/Student users
• Disabling an extension no longer breaks elicitation, canvases, or tool permission prompts for other extensions
• A prompt stashed with ctrl+s now stays with the session it was typed for, so switching away and back and pressing ctrl+s restores it instead of finding it gone
• On Linux, searches and most shell commands blocked by the sandbox now offer to re-run outside it
• BREAKING: the sandbox setting allowDevToolCaches is renamed allowDevToolAccess, since it grants dev-tool config and registries too, not just caches. The old key is no longer read and is ignored silently, so an existing false opt-out reverts to the default (on). Rename it in settings.json and in any managed/MDM policy.
• Add /sandbox policy to show effective sandbox paths, denials, and network access
• Queue prompts, shell commands, and supported slash commands in local sessions to run in order after the current task finishes
• Set "autoUpdate": true on an extraKnownMarketplaces entry in your user settings to auto-update its plugins at session start
• /sandbox tags inactive settings as (disabled) and explains why they are locked, and documents dev tool caches in copilot help sandbox
• Show "pending · ctrl+c to cancel" for in-flight steering prompts
• Make /model session-scoped by default, and use /config model to set defaults for future sessions.
• Pin the current prompt as a single line instead of a three-row framed block, so it reads as chrome and returns rows to the timeline; with the tab bar on it sits directly below the tabs and costs the timeline nothing

Improved

• The /sandbox configuration dialog shows where sandbox settings are stored in settings.json

Added

• Add support for enterprise allow-auto-only policy so /allow-all auto works while full allow-all remains blocked.
• Allow enterprise-managed sandbox policy to enforce a proxy URL while credentials remain user-controlled

Improved

• The /sandbox configuration dialog groups the git, gh, and (on macOS) keychain settings under a new Auth tab, and the settings keys moved from sandbox.gitAuth/sandbox.ghAuth to sandbox.auth.git/sandbox.auth.gh. There is no migration: the old keys are ignored in settings files, and SDK requests that still send them are rejected as invalid rather than ignored
• Added a worktreeBaseRef setting that controls whether /worktree, /worktree new, and --worktree start from HEAD or the remote default branch. All three now default to HEAD; previously --worktree started from the remote default branch.
• Model picker groups models into Recent, Recommended, New, and other sections, and Shift+Tab switches grouping views.
• Large monorepos now use tgrep (trigram-indexed grep for fast regex search in large codebases) instead of ripgrep

Fixed

• A tool directory inside your workspace that is on PATH (.venv/bin, node_modules/.bin, an in-repo GOPATH) no longer turns that part of the workspace read-only in the sandbox

Added

• Agent Plugins spec plugins can now ship extensions under a com.github.copilot/extensions/ directory
• Add support for the kimi-k3 model
• Combine --plan with --mode autopilot to plan first and then implement without waiting for approval

Improved

• Ask user multi-select prompts include an Other option for free-text answers
• Improve teleported subagent /tasks navigation with nested tree browsing, current/all and finished-task filters, and a live timeline you can steer

Fixed

• The /app command now opens the current session in the GitHub Copilot desktop app instead of landing on Home with the wrong folder (requires GitHub Copilot app 1.1.3 or later)
• On macOS, a sandbox read-only path nested inside a writable one now stays read-only instead of inheriting the write permission from the wider path
• On macOS, sandboxed commands can use UNIX-domain sockets again, so tools that talk over a local IPC pipe (tsx, vite, esbuild, jest workers) no longer fail with listen EPERM
• Sandboxed commands work when the working directory lives on a Windows Dev Drive
• /theme now only shows its deprecation notice for a valid color mode, so a mistyped mode no longer suggests an invalid command or hides the notice from your next valid /theme.
• Sandboxed git now authenticates to Azure DevOps, GitHub Enterprise Server, GitLab, and other non-GitHub remotes you have stored HTTPS credentials for

Fixed

• A rare internal delay no longer prints a diagnostic warning on top of the interactive UI
• A failed session-history load no longer leaves the timeline permanently empty: the failure was silently discarded, so the transcript stayed blank for the rest of the session with nothing logged. It is now retried, and reported in the transcript and the log if it still fails
• Resuming a long session no longer collapses the timeline's scroll range while history renders in the background: entries that had not finished rendering were published as if they did not exist, so the scrollbar and scroll position jumped until the background render caught up

Added

• Manage multiple concurrent sessions from the Sessions tab and sidebar

Improved

• Prompt pinning is off by default; set pinnedPrompts to true to enable it.

Fixed

• Sandboxed wrapper builds (make and friends) get the dev tool caches their recipes need, based on the build manifests in the working directory

Improved

• Pin the current prompt one row higher, in the row the tab bar already reserves, so it keeps the shape of the prompt it copies while costing the timeline one row less
• Leave the pinned prompt off by default on terminals under 30 rows, where it would crowd the output; set pinnedPrompts explicitly to override at any size

Fixed

• A sandbox that cannot start an MCP server now fails in seconds instead of stalling the session, and sandbox startup failures for both MCP and language servers now say the sandbox was at fault and how to fix or opt out of it
• Login links are clickable during web and device-code sign-in

Improved

• BREAKING: the sandbox setting allowDevToolCaches is renamed allowDevToolAccess, since it grants dev-tool config and registries too, not just caches. The old key is no longer read and is ignored silently, so an existing false opt-out reverts to the default (on). Rename it in settings.json and in any managed/MDM policy.

Fixed

• Compute /context attribution against the Auto-resolved model so token totals are accurate for Free/Student users
• Disabling an extension no longer breaks elicitation, canvases, or tool permission prompts for other extensions
• A prompt stashed with ctrl+s now stays with the session it was typed for, so switching away and back and pressing ctrl+s restores it instead of finding it gone
• On Linux, searches and most shell commands blocked by the sandbox now offer to re-run outside it

2026-08-03

• Timeline headers show how long each tool call took, right-aligned and ticking live while it runs (for calls of at least 5 seconds). On by default — disable with /settings showToolDurations.
• First-party plugins automatically update to the latest version at session start
• Add the experimental /new-worktree command to create a new worktree and start a new conversation in it
• Copilot login now defaults to the browser flow for local desktop subprocesses without a TTY, including IDE integrations, while remote and headless environments continue using device code
• Interactive shell shortcut now launches on Enter and shows an inline hint when "$" is armed
• Extension slash commands run their handler exactly once per invocation when several extensions are loaded
• Inline images no longer render with their first row repeated down the whole picture after the timeline scrolls
• A run whose prompt is piped over stdin now treats its sessionEnd hook the same way -p does: the hook fires once per completed agent turn with reason complete (or error if the turn failed), instead of once at shutdown with user_exit. As with -p, a piped run that exits before completing a turn fires no sessionEnd hook
• Split-view sidebar: the red close confirmation now reads x again to close (or x again to exit CLI on the last session) instead of x close, so a second press is clearly what closes
• Expose token usage in ACP prompt results and live usage_update notifications
• Added a forceRemoteSettingsRefresh managed setting that requires a fresh managed-settings fetch on startup
• Disabling the sandbox from a bypass prompt applies only to that session; new sessions start sandboxed again
• Managed settings now fall back to the persistent cache whenever a server-managed settings fetch fails for any reason (network error, a non-success HTTP status, or a malformed/unparseable response), and fail open — starting without the unconfirmed server restriction rather than the prior fail-closed behavior — when no usable cached policy is available
• When the sandbox blocks a shell command and bypass is allowed, CLI offers to re-run it outside the sandbox without asking the model
• /rewind no longer requires git and restores only the files Copilot changed, skipping any file whose contents no longer match what Copilot last wrote, with a conversation-only or conversation + files choice
• Add /permissions to switch between approval modes.
• ACP mode supports closing sessions with the closeSession request.
• Ctrl+Q now enqueues the highlighted mid-text skill completion instead of the partial token
• Switching sessions no longer restarts MCP servers or rebuilds hook state, so a turn running in another session is never halted with a stale-hook error
• Refresh deferred MCP tools after OAuth authentication
• New sandbox setting allowDevToolCaches (on by default): grants sandboxed builds access to toolchain caches, registries, and installs so builds work without extra setup. Set false to opt out.
• Honor explicit GitHub MCP toolset/tool config: keep gh-overlap tools and stop steering to the gh CLI when you opt in
• Warn on startup about unknown top-level keys in user settings.json (e.g. a misspelled setting) instead of silently ignoring them
• Shell completion for --model now suggests auto and supported model names
• Render long session transcripts progressively to keep scrolling responsive
• Resuming a long session is dramatically faster and far lighter on memory, because its history is now read once at startup (in parallel, across CPU cores) instead of being re-read in full for every check the CLI runs before it can paint. In our benchmark a 230MB, 74k-event transcript came back in well under a second instead of about ten, at roughly a quarter of the peak memory; the exact gain depends on your machine's core count and disk
• The /allow-all auto safety-judge model is no longer user-configurable; the judge model is now selected automatically.

Added

• Add the experimental /new-worktree command to create a new worktree and start a new conversation in it

Improved

• Interactive shell shortcut now launches on Enter and shows an inline hint when "$" is armed

Fixed

• Copilot login now defaults to the browser flow for local desktop subprocesses without a TTY, including IDE integrations, while remote and headless environments continue using device code

Improved

• Split-view sidebar: the red close confirmation now reads x again to close (or x again to exit CLI on the last session) instead of x close, so a second press is clearly what closes

Fixed

• Extension slash commands run their handler exactly once per invocation when several extensions are loaded
• Inline images no longer render with their first row repeated down the whole picture after the timeline scrolls
• A run whose prompt is piped over stdin now treats its sessionEnd hook the same way -p does: the hook fires once per completed agent turn with reason complete (or error if the turn failed), instead of once at shutdown with user_exit. As with -p, a piped run that exits before completing a turn fires no sessionEnd hook

Added

• Add /permissions to switch between approval modes.
• ACP mode supports closing sessions with the closeSession request.

Improved

• New sandbox setting allowDevToolCaches (on by default): grants sandboxed builds access to toolchain caches, registries, and installs so builds work without extra setup. Set false to opt out.
• Honor explicit GitHub MCP toolset/tool config: keep gh-overlap tools and stop steering to the gh CLI when you opt in
• Warn on startup about unknown top-level keys in user settings.json (e.g. a misspelled setting) instead of silently ignoring them
• Shell completion for --model now suggests auto and supported model names
• Render long session transcripts progressively to keep scrolling responsive
• Resuming a long session is dramatically faster and far lighter on memory, because its history is now read once at startup (in parallel, across CPU cores) instead of being re-read in full for every check the CLI runs before it can paint. In our benchmark a 230MB, 74k-event transcript came back in well under a second instead of about ten, at roughly a quarter of the peak memory; the exact gain depends on your machine's core count and disk

Fixed

• Ctrl+Q now enqueues the highlighted mid-text skill completion instead of the partial token
• Switching sessions no longer restarts MCP servers or rebuilds hook state, so a turn running in another session is never halted with a stale-hook error
• Refresh deferred MCP tools after OAuth authentication

Removed

• The /allow-all auto safety-judge model is no longer user-configurable; the judge model is now selected automatically.

2026-07-30

• Unconditional autopilot approval now disables sandbox for the current session when bypass is allowed
• Ctrl+G opens your editor to edit ask_user freeform answers without closing the prompt
• Add a browser-based (web) OAuth login flow, now the default for copilot login on local interactive terminals (device code remains the default on remote/headless terminals). Use --web-flow/--device-code to force a mode, or pick one in the interactive /login command
• Support enforcing managed sandbox policy via macOS and Windows native MDM settings
• Allow reasoning effort to be omitted so the server can select the default

Added

• Add a browser-based (web) OAuth login flow, now the default for copilot login on local interactive terminals (device code remains the default on remote/headless terminals). Use --web-flow/--device-code to force a mode, or pick one in the interactive /login command
• Support enforcing managed sandbox policy via macOS and Windows native MDM settings

Improved

• Allow reasoning effort to be omitted so the server can select the default

2026-07-29

• Add enable/disable controls in /plugins for plugins, instructions, agents, LSP servers, and hooks
• Add support for the grok-4.5 model
• Sandbox denied paths are enforced for relative and symlinked entries on macOS and Linux (Windows cannot deny per path)
• Unsent prompt text now stays with the session it was typed for (for the rest of the CLI session) instead of following you to the session you switch to
• Resuming a session now restores its autopilot or plan mode instead of reverting to interactive, so the autopilot-only task_complete tool stays available and the mode matches the session you left
• URL permission prompts now keep their sandbox-bypass warning and the model's reason when a host integration rebuilds the prompt, so an elevated fetch is no longer shown as an ordinary one
• When an update is auto-downloaded, the notification suggests /restart and drops the warning color
• /diff scrolls and syntax-highlights large multi-file diffs faster
• Split-view sidebar: hover-to-focus is now off by default (opt in with sidebar.hoverFocus), the active session card is accented by default (opt out with sidebar.accentActiveSession), and the closed-state open sidebar hint always renders in the neutral hint color
• web_fetch now follows HTTP redirects instead of failing, asking permission for the redirect target when it is on a different origin and showing where the redirect came from
• Add a directable queue manager (staff) to reorder, edit, remove, repeat, and immediately send queued messages
• New Sessions sidebar for managing multiple concurrent sessions: switch between them, spawn new ones, and see their status at a glance. Turn it on with experimental mode (/experimental on).
• Enterprise administrators can enforce a restrictive sandbox floor: managed settings tighten (but never loosen) the user's sandbox policy, and the /sandbox dialog surfaces the org-configured managed values with locked fields and managed filesystem paths so admins can confirm what is enforced.
• Sessions no longer fail every turn with "Holder terminated during creation" after a subagent finishes
• Startup tips only suggest /init in repositories that don't already have Copilot instructions
• A userPromptSubmitted hook returning a non-string value for modifiedPrompt, modifiedTransformedPrompt, or a handled responseContent no longer corrupts the session; the value is ignored, a type-only warning naming the field is logged, an empty-string replacement is rejected instead of blanking the model-facing content, a hook that sets handled without a usable responseContent is now diagnosed instead of silently falling through to the model, and a null additionalContext is treated as absent instead of being injected as the literal text null; hook output is also bounded at 10 MiB per invocation, so an HTTP or command hook returning an unbounded response can no longer exhaust memory or leave an oversized session behind
• Show recent shell output for large commands that write to a file
• The /instructions picker now respects --no-custom-instructions.
• Render inline images in Rio terminals that support Kitty graphics
• Sandboxed searches now offer an immediate bypass prompt and avoid duplicate bypass prompts.
• Voice mode pauses playing media before recording and resumes it afterward, where supported (macOS and Windows)
• Show the number of active scheduled prompts in the footer
• Add /limits predict to suggest a session AI-credit limit from similar sessions.
• Add configurable timed refreshes for custom status-line commands
• Queued messages list no longer shows a blank row or inflated count, and Ctrl+C removes your own newest queued message
• Changing the mouse setting mid-session now takes effect immediately, from both /settings mouse on|off and the /settings dialog, instead of being saved but ignored until the CLI restarted
• web_fetch routes through the configured sandbox proxy when outbound is allowed, and denies egress when network.allowOutbound is false (a proxy no longer overrides the user's outbound policy); when a proxied fetch fails it warns that curl/wget share the same proxy, and suggests requestSandboxBypass only when the sandbox proxy itself is unreachable
• Improve subagent delegation for small tasks and parallel work
• Queue mid-turn /model changes and apply them after the current response finishes
• Restore the early warning when unreclaimable system and tool context nears the limit, before automatic compaction is blocked
• Session working directory no longer reverts to the original checkout shortly after /worktree switches into a new worktree
• MCP tools load faster from definition-scoped snapshots, with process-wide and per-server cache opt-outs.
• Autopilot stays selected after task_complete by default; set stayInAutopilot to false to return to interactive mode after each task

Added

• Add enable/disable controls in /plugins for plugins, instructions, agents, LSP servers, and hooks
• Add support for the grok-4.5 model

Fixed

• Sandbox denied paths are enforced for relative and symlinked entries on macOS and Linux (Windows cannot deny per path)

Improved

• When an update is auto-downloaded, the notification suggests /restart and drops the warning color
• /diff scrolls and syntax-highlights large multi-file diffs faster
• Split-view sidebar: hover-to-focus is now off by default (opt in with sidebar.hoverFocus), the active session card is accented by default (opt out with sidebar.accentActiveSession), and the closed-state open sidebar hint always renders in the neutral hint color
• web_fetch now follows HTTP redirects instead of failing, asking permission for the redirect target when it is on a different origin and showing where the redirect came from

Fixed

• Unsent prompt text now stays with the session it was typed for (for the rest of the CLI session) instead of following you to the session you switch to
• Resuming a session now restores its autopilot or plan mode instead of reverting to interactive, so the autopilot-only task_complete tool stays available and the mode matches the session you left
• URL permission prompts now keep their sandbox-bypass warning and the model's reason when a host integration rebuilds the prompt, so an elevated fetch is no longer shown as an ordinary one

Added

• Add a directable queue manager (staff) to reorder, edit, remove, repeat, and immediately send queued messages
• New Sessions sidebar for managing multiple concurrent sessions: switch between them, spawn new ones, and see their status at a glance. Turn it on with experimental mode (/experimental on).
• Enterprise administrators can enforce a restrictive sandbox floor: managed settings tighten (but never loosen) the user's sandbox policy, and the /sandbox dialog surfaces the org-configured managed values with locked fields and managed filesystem paths so admins can confirm what is enforced.

Improved

• Sandboxed searches now offer an immediate bypass prompt and avoid duplicate bypass prompts.

Fixed

• Sessions no longer fail every turn with "Holder terminated during creation" after a subagent finishes
• Startup tips only suggest /init in repositories that don't already have Copilot instructions
• A userPromptSubmitted hook returning a non-string value for modifiedPrompt, modifiedTransformedPrompt, or a handled responseContent no longer corrupts the session; the value is ignored, a type-only warning naming the field is logged, an empty-string replacement is rejected instead of blanking the model-facing content, a hook that sets handled without a usable responseContent is now diagnosed instead of silently falling through to the model, and a null additionalContext is treated as absent instead of being injected as the literal text null; hook output is also bounded at 10 MiB per invocation, so an HTTP or command hook returning an unbounded response can no longer exhaust memory or leave an oversized session behind
• Show recent shell output for large commands that write to a file
• The /instructions picker now respects --no-custom-instructions.
• Render inline images in Rio terminals that support Kitty graphics