Copilot CLI Updates & Release Notes

Added

• Add --trust-folder for one-off prompt-mode sessions started with -p or piped stdin
• Install verified Skills and plugins from GitHub install links via copilot plugin install "ghapp://air/install?..."

Improved

• Improve /login for Microsoft Entra by letting you choose a cached account or explicitly sign in with a different account
• Sandboxed git on github.com can use your configured GITHUB_TOKEN from credentials.envVars

Fixed

• HydraFusion keeps a pass expanded while its review runs, passes that were not kept stay expandable until you switch sessions or resume, and passes from an aborted turn say whether they were kept
• Managed account policy and bypass-mode warnings stay accurate after switching accounts, even when a policy cache miss happens.
• Avoid false context exhaustion and rollover refusal when tool definitions are deferred
• Custom agents that declare the documented search, web or todo tool aliases, or name github-mcp-server/web_search, now receive the matching tools
• CLI help and version flags exit reliably after printing their output
• Enterprise-managed ask permissions in Assisted mode now allow safe actions without unnecessary confirmation prompts.
• Keep your selected Microsoft Entra account pinned during sign-in and token renewal
• Up from sessions sidebar header actions wraps to the last visible session

Added

• Open /share without arguments to view a full-screen action menu for sharing the current session

Improved

• /sandbox can keep sandboxing enabled for the current session without enabling it globally
• Trusted repository plugins install and update automatically before chat runs.
• Rename the built-in browser plugin to browser-use and keep existing browser plugin preferences working after upgrade
• Sandbox allows local network access by default so commands can reach localhost and private-network services.

Fixed

• Plan, autopilot, and shell mode badges stay visible while startup components load and the agent works. The badge replaces the mode suffix that used to trail the activity text (Working - plan), and the startup Loading: row now truncates its diagnostics to keep the status row on one line
• Sandboxed commands can write package and build caches when developer tool access is enabled.
• Windows CLI Git commands now recover from thread-access-denied startup failures.
• A skill allowed-tools rule keeps commas inside its arguments instead of being split apart. Where a list's structure is ambiguous, its unscoped rules now prompt instead of being granted.
• MCP resource dashboard stays interactive while inventory adapters refresh
• Retry image-bearing Responses requests with smaller payload limits when providers reject oversized bodies
• Complete usage reporting no longer shows partial status or phantom unattributed spend after resume when billing data is complete.
• Assisted permissions send nested PowerShell and bash -c commands that only expand plain-data environment variables, single-quoted PowerShell, and PowerShell variable and alias statements to the permission judge instead of requiring unnecessary manual approval
• Path-specific instruction files in the repository root .github/instructions are now applied automatically when the agent reads or edits a matching file
• Start git, shell commands, and MCP servers on Windows when process snapshot thread enumeration fails

2026-10-14

• Add support for Gemini 4 Argon
• Command hooks complete reliably even when child-exit signals are lost under Node
• MCP status and /mcp commands stay synced to the active session after split-view session switches
• Resuming a session now respects abandoned pending-permission work and continues only active permission requests.
• Keep ordinary characters typed while the input box is still coming up at startup, instead of dropping them
• Expand /ask answers with Ctrl+E, copy the entire answer with Ctrl+Y, and reopen the last usable completed answer in the session with /ask or /btw.

2026-10-13

Updates

• Add agent-scoped declarative hooks for custom agents
• Remote plugin marketplace and plugin fetches retry once with your signed-in GitHub token after HTTPS auth fails.
• Streamed responses behind TLS-intercepting proxies complete when close_notify is omitted
• Fix parsing of GitHub SCP remotes with absolute paths so repository owner and name resolve correctly
• Discover all custom agents even when repositories define more than 100 or nest agent files deeply.
• Autopilot denies a preToolUse hook's "ask" decision instead of stopping on a permission dialog nobody is watching
• Keep Windows taskbar agent icons grouped across CLI updates by using a stable icon path
• Keep saved settings such as dismissed prompts, trusted folders and sign-ins when one entry in config.json is invalid, instead of resetting them on every launch
• In /config, managed permission rules are read-only and hidden unless set by your organization.
• Show billed AI Credits in /usage for token-billed sessions, including after resume
• File reads using a view_range that is not exactly two elements, such as a lone start line, now show their line range and line count in the timeline, and session exports no longer contain the literal text undefined
• Dragging to select text in the transcript no longer occasionally highlights and copies the row below the pointer.
• Power BI and Bluebird MCP servers accept their published resource scopes during sign-in
• Redact secrets safely in --output-format json output while preserving valid variable references
• Resuming suspended sessions now reports interrupted tool calls and avoids replaying canceled writes.
• Synchronous /task JSON output now includes failed child error and lifecycle events before completion.
• Explicit GitHub MCP tool and toolset selections use the correct endpoint, so requested write tools stay available.
• Cached MCP tool calls recheck their definition when a concurrent tool-list refresh changes the catalog.
• Skills and custom agents from --plugin-dir plugins now reach autocomplete and invocation instead of going missing.
• Fixed resumed sessions rebuilding plugin hooks from the wrong plugin list, so hooks from repository-local marketplace plugins now keep running after --resume, and hooks from plugins your configuration disabled no longer come back
• Keep /user switch new-session choices visible after account checks in short terminals
• Unavailable permission recovery attempts are now tracked per request, so unrelated calls no longer consume each other's retry budget.
• Background-shell wait status no longer animates when no foreground work is running
• Emergency memory relief in long sessions can now bypass its cooldown before V8 aborts, so a session that would have been killed by a JavaScript heap out of memory crash may survive with compacted history instead
• Inline images render by default on supported terminals without enabling experimental mode. Use /settings inlineImages false to turn them off

Added

• Add agent-scoped declarative hooks for custom agents

Improved

• Inline images render by default on supported terminals without enabling experimental mode. Use /settings inlineImages false to turn them off

Fixed

• Autopilot denies a preToolUse hook's "ask" decision instead of stopping on a permission dialog nobody is watching
• Keep Windows taskbar agent icons grouped across CLI updates by using a stable icon path
• Keep saved settings such as dismissed prompts, trusted folders and sign-ins when one entry in config.json is invalid, instead of resetting them on every launch
• In /config, managed permission rules are read-only and hidden unless set by your organization.
• Show billed AI Credits in /usage for token-billed sessions, including after resume
• File reads using a view_range that is not exactly two elements, such as a lone start line, now show their line range and line count in the timeline, and session exports no longer contain the literal text undefined
• Dragging to select text in the transcript no longer occasionally highlights and copies the row below the pointer.
• Power BI and Bluebird MCP servers accept their published resource scopes during sign-in
• Redact secrets safely in --output-format json output while preserving valid variable references
• Resuming suspended sessions now reports interrupted tool calls and avoids replaying canceled writes.
• Synchronous /task JSON output now includes failed child error and lifecycle events before completion.
• Explicit GitHub MCP tool and toolset selections use the correct endpoint, so requested write tools stay available.
• Cached MCP tool calls recheck their definition when a concurrent tool-list refresh changes the catalog.
• Skills and custom agents from --plugin-dir plugins now reach autocomplete and invocation instead of going missing.
• Fixed resumed sessions rebuilding plugin hooks from the wrong plugin list, so hooks from repository-local marketplace plugins now keep running after --resume, and hooks from plugins your configuration disabled no longer come back
• Keep /user switch new-session choices visible after account checks in short terminals
• Unavailable permission recovery attempts are now tracked per request, so unrelated calls no longer consume each other's retry budget.
• Background-shell wait status no longer animates when no foreground work is running
• Emergency memory relief in long sessions can now bypass its cooldown before V8 aborts, so a session that would have been killed by a JavaScript heap out of memory crash may survive with compacted history instead

2026-10-12

• Interactive sandbox settings suggest possible environment secrets and let you add masking hosts before saving.
• Make model IDs in /model and /config model case-insensitive and save canonical IDs
• Keep /allow-all available during startup while enterprise policy is still resolving
• /add-dir grants sandbox access to added directories for the current session
• /user list shows the authentication source for each signed-in account
• Show retry progress messages before recovered responses after transient model failures
• Model completions no longer show an authentication warning when an account-owned catalog is unavailable while signed out
• Interactive sessions in git repositories reach the input prompt sooner
• Timeline now shows whether you, Assisted Permissions, policy, or unattended fallback made each permission decision.