Fixed

• PDF attachments on Grok 4.7 and Grok 4.6 fall back to file references instead of failing the turn
• With the sandbox on, a running local MCP server is now restarted after /cd, so it follows the new directory's denied paths instead of keeping those of the directory the session left.

Added

• Add sandbox.userPolicy.filesystem.enumeratePaths in settings.json for Windows enumerate-only directory grants
• Add /index commands and enable managed shared tgrep indexing by default for eligible repositories

Improved

• Answer questions about Copilot CLI behavior from this build's own documentation and clearly say when docs do not cover a question.
• Keep successful command output and file diffs collapsed in concise transcript mode until expanded, while keeping running output and failure details visible.
• Show MCP form validation errors beside inputs, focus the first invalid field, and improve screen-reader labels and cursor positioning
• Since 1.0.106, Autopilot with Assisted Permissions no longer stops for permission prompts; the agent tries another approach and reports the actions it could not take
• Managed plugin assignments with state "defaultEnabled" now install and activate plugins by default while preserving user overrides.

Fixed

• A file attachment sent through the SDK that points at a named pipe, socket or device is now tagged as an error instead of stalling the turn until something writes to the pipe.
• The canvas tools now tell the model which instance IDs open_canvas accepts, instead of calling them free-form.
• /model now lists models when Copilot answers the model list request with 421 Misdirected Request, for example after a plan change, by re-resolving your account's endpoint as chat turns already do instead of showing "Error loading model list".
• Requests to OpenAI-compatible chat-completions providers no longer include an internal message field on skill and tool messages.
• Ctrl+C now stops a running /compact, as Esc Esc does, instead of only arming the exit hint and quitting the CLI on a second press.
• The /config help no longer shows literal backticks or uses a model outside the model list as its example.
• Your defaultMode setting now applies when you close the startup session picker while the session is still loading its model, instead of the session staying in its previous mode.
• A disabledSkills entry, skills.disable and skills.enable now match a skill name in any letter case, as invoking the skill does, instead of silently doing nothing when the case differs.
• Creating or resuming an SDK session, or replacing its tools, with two custom tools of the same name is now an error. Before, the model was offered the first definition while some SDKs ran the handler of the last one.
• Copilot no longer crashes with an unhandled exception at startup when it cannot save its first-launch timestamp, for example because the disk holding the Copilot home directory is full. The failure is logged and startup continues.
• The Getting started box no longer suggests /init in a folder where you ran /init suppress, in a repository that already has Copilot instructions, or outside a git repository.
• copilot help config now names the .claude/rules instruction files and the .claude/settings.json repository settings the CLI reads.
• copilot help input now says that esc esc also stops a running /compact, and that in shell mode a single esc or ctrl+c on an empty prompt leaves shell mode
• /help now describes ctrl+d (exits only on an empty prompt, otherwise deletes the next character) and ctrl+z on Windows correctly, and lists ctrl+j, ctrl+v, ctrl+y and the voice input keys.
• copilot help limits now quotes the rate-limit prompt as local sessions show it, "Switch to Copilot Fusion mode?", instead of "Switch to auto mode?".
• copilot help mcp now says that a directory's .github/mcp.json is ignored when the same directory has a .mcp.json, instead of implying the two files are merged
• copilot help monitoring now describes the github.copilot.sandbox.operation.count metric as counting every sandbox decision by kind, not only deduplicated posture changes.
• Pasting an image path again after clearing its [image: ...] label with Ctrl+U, Ctrl+K, Ctrl+W or an Up-arrow history recall attaches the image again instead of inserting the plain path.
• Backspace, an arrow key, Ctrl+U or Shift+Enter pressed right after a paste now acts after the pasted text instead of on the text in front of it.
• Picking an MCP server type by its number in the add or edit form now moves focus to the next field for that type.
• /permissions default in Autopilot now asks again how to handle permissions on the next prompt, as /permissions manual does, instead of leaving Autopilot to deny every tool request.
• A queued /ask or /btw that runs while another side answer is open now shows that it is still thinking, instead of showing the previous answer as its own finished answer for Ctrl+Y to copy.
• copilot --resume and /resume now find a session whose name has an accent typed precomposed or decomposed, whichever spelling the session was saved with.
• In /search, Up, Down and Enter bring a single match back into view after you scroll away, and a shorter terminal no longer leaves the current match off screen.
• /security-review help now says it reviews the branch diff when the working tree is clean, not only staged and unstaged changes
• Escape sequences in checkpoint titles, file names, Copilot home paths and generated agent names no longer restyle /session info or the /agent wizard.
• Long values in /session info, such as the log and session file paths, now wrap under their own column instead of back under the label
• Switching to another session no longer occasionally replaces that session's model with Auto while the model list reloads.
• /share usage no longer implies that /share alone exports a markdown file; it shows that a bare path must contain /, . or ~.
• A path or URL route in a prompt, such as /docs/setup.md, no longer loads a skill named after its first segment (docs) as if you had invoked that skill.
• Subcommands of /pr, /lsp, /skills, /plugin, /user and /collect-debug-logs now match in any letter case, so /lsp TEST my-server runs the test instead of showing usage text.
• Help for /experimental and /theme now marks /experimental on|off and /theme <mode> as deprecated and points at /settings, and /mcp disable is no longer described as temporary: it is saved across sessions.
• A repository sessionStart prompt hook that runs /clear <prompt> or /new now starts one new session instead of starting another one in every session it creates.
• The duration shown on a sub-agent no longer counts the time its tool calls spent at permission prompts.
• The /subagents help no longer promises a default subagent model. It now says the command configures each subagent's model and settings and turns subagents on or off.
• Tab characters in replies, error messages, agent names and other text are now shown as spaces instead of being dropped, so tab-separated words no longer run together.
• The duration shown on a tool call no longer counts the time spent at its permission prompt, and it does not tick while the prompt is open.
• The /update channel choices now say that picking stable or prerelease also saves it as your update channel for future updates.
• Preserve input queued behind a paste when resizing the terminal
• Memory import reports malformed repository scopes without a false unsupported host error
• Show a warning when a selected custom agent's configured skills are missing or cannot be loaded
• Include session start, resume, and model-change events in -p --output-format json output
• Keep built-in agents selected with --agent active when opening /agent or refreshing available agents
• Interactive CLI sessions pass local MCP server environment values literally; use ${NAME} to reference a host environment variable
• Allow semantic code search to find renamed repositories when the checkout still uses the old name
• Use Ctrl+T to show and hide First Pass reasoning when Fusion is selected through a routing profile
• Keep the selected match in view when opening /search or /find instead of jumping to the bottom of the conversation.
• Allow the system to sleep again after a background MCP reload finishes when using /keep-alive busy.
• Keep the footer's plan hint visible when a nonempty plan is available
• Interactive Autopilot waits for your response to MCP input and consent requests instead of automatically declining them
• /mcp enable now respects repository settings that disable an MCP server
• Renaming files with the patch tool now succeeds without requiring changes to their contents
• File diffs in the concise transcript show terminal escape sequences as visible characters and preserve added and removed line colors
• Reduce CPU usage during builds in large worktrees when language servers watch for file changes
• Headless runs now report an error when resuming a session in use by another Copilot process, keeping its history intact.
• MCP deny rules now block a tool named the way its MCP server advertises it (for example server(weather.lookup)), not only its sanitized name, even with --allow-all-tools
• On Linux, language servers are no longer told that the files in a directory were deleted when the directory is renamed away and straight back.
• On Linux, language servers are now told when a directory is renamed (the old files deleted, the new ones created) while other directories in the workspace are being created and removed, such as during a package install.
• A canvas that was open when a session was resumed is now restored even if its extension restarts while the canvas is being reopened, instead of staying unavailable.
• When a preToolUse hook asks about several parallel tool calls, each call gets its own confirmation again: answering No with feedback to one no longer denies the others without asking.
• Attaching an empty PDF or Office document no longer fails the turn on models that read documents natively; the empty file is passed as a file reference instead.
• Connect to an already running /voice server even when i...

2026-11-06

• Rex terminals render inline images using Kitty direct placements.
• Add /code command to open the current session in VS Code
• Add a Fusion tier setting to copilot config.
• Make /settings open the unified dashboard for all users and add global search across settings and local resources.
• Interactive CLI reports program status to supporting terminals, including when attention is needed.
• Add opt-in session management tools and @mentions for opted-in local sessions
• Add COPILOT_SESSION_CWD for launching and expanding LSP and local MCP server configs
• Add GPT-6.1 Terra as a selectable model under New models when available to your account
• Add a Sandbox extensions setting to run extension processes inside the sandbox
• Add MATS telemetry for Entra authentication through OneAuth, respecting client telemetry opt-out.
• An image removed from the prompt with Ctrl+U, Ctrl+K or Ctrl+W, or replaced by a recalled history entry, is no longer sent with the message, and Ctrl+S can stash the prompt afterwards.
• Pasted text containing NEL, Unicode line or paragraph separators now fills separate prompt lines, and pasted DEL and C1 control characters are dropped, instead of being kept in the prompt and cutting characters off the end of the row.
• In copilot -p --plan, the agent is no longer told to suggest Shift+Tab to leave plan mode, which only works in the interactive interface, and is asked to include the plan's key points in its reply instead.
• copilot --resume <id> no longer waits with no output and no end when the Copilot task service does not respond; the task lookup now gives up after 10 seconds and resolution continues.
• Sandboxed grep, rg, and glob now report Windows launch failures instead of silent no-match results
• Model picker shows context window size for flat, unpriced, and single-tier models
• Sandboxed local MCP servers respect relative filesystem permissions from the session directory, even when configured with a different working directory.
• PowerShell commands work on Windows when the CLI is installed in a long directory path
• Switching sessions while other sessions are busy no longer crashes the CLI and leaves a blank terminal
• Keep readable image attachments when retrying a prompt that contains a corrupt image
• MCP Entra authentication now falls back to the VS Code registration when Copilot CLI preauthorization is unavailable.
• Sandboxed local MCP servers now start correctly when configured with a relative cwd.
• On Windows, sandboxed sessions in nested Git directories can change to and write at the repository root
• Autopilot no longer starts implementing its own recommendation after a request that only asked for a review or analysis
• Suppress unnecessary MCP reload summaries when plugin servers remain unchanged
• A model request that Copilot's service answers with an empty 404 while under load is now retried instead of ending the turn with "Execution failed: 404".
• copilot help config now lists every setting the settings catalog offers, including the ones that were missing from its hand-written text, such as askUser, effortLevel, planModel, toolSearch and worktreeBaseRef
• ACP clients can switch a session started with --yolo out of autopilot, and allow-all stays on, instead of the switch failing as blocked by policy and a second attempt turning allow-all off.
• The @ file picker now underlines a name with a capital dotted I, such as İstanbul.txt, when the query is typed without the dot, and no longer shortens that row's matched folder.
• The @ file picker now underlines matches in names stored with decomposed accents or found by a query typed without accents, and no longer shortens such a row's matched folder.
• Up and Down in a multi-line prompt keep the column you started from when they pass through a shorter line, instead of leaving the caret near the start of the line.
• Ctrl+Y and /share research skip research folder entries that are not readable files, such as a broken link or a folder named like a report, instead of failing or offering them.
• Show each agent's selection ID in /agent when multiple agents share a display name.
• The edit tool now fails at once on a named pipe, socket or device instead of waiting forever for the other end of a FIFO, which stalled the turn.
• An empty plan.md no longer shows the ctrl+y plan hint or Plan: yes in /session, and ctrl+y opens the research report instead, matching /session plan.
• The footer keeps the "N scheduled", sandbox, YOLO and CI status items whole on narrow terminals by shortening the directory and branch first, instead of cutting the items off the end of the row.
• Pull request, issue and gist details, and their load errors, no longer let escape sequences in titles, names, branches, gist files or server messages restyle the terminal.
• Show the saved paused goal and continuation guidance when resuming an autopilot session.
• Issues and pull requests picked with # are no longer dropped from the message when another one is picked in front of them, and an issue picked twice is sent once.
• copilot help billing now says the footer shows the AI credits used in this session (nothing by default on the legacy billing platform), and that the /statusline quota item is off by default and ai-used is on.
• copilot help config now says copyOnSelect is on by default on macOS, that /keep-alive changes only the current session, that logLevel is set in the /settings dialog or settings.json rather than copilot config, and that trustedFolders lives in config.json and is filled by the folder-trust prompt.
• copilot help environment now says a COPILOT_AUTO_TIER value of "fast" is ignored with a notice rather than rejected, and that USE_TGREP=true does not override whether indexed search is available for your account or USE_BUILTIN_RIPGREP=false.
• copilot help config, copilot help environment and copilot help acp no longer name the hidden --prefer-version, --server and --stdio options.
• copilot help limits shows a status example at the real minimum AI credit limit and says the final-call warning appears when 10% or less of the limit remains
• copilot help monitoring now says an http:// OTLP endpoint disables export only when an OTLP CA certificate or client certificate/key variable is set, not for every http:// endpoint.
• copilot help permissions now documents glob patterns in write(path) and read(path) rules, lists the read and memory kinds, and explains that an unscoped write rule approves shell output redirection but not the command itself; it no longer says wildcard matching is coming in the future.
• copilot --help and copilot help --help now list the acp help topic, and copilot help --help no longer prints its description and topic list with stray indentation.
• Form and settings text fields show the control characters of a stored value, such as an MCP server command, instead of letting them recolor or hide its text.
• Issue and pull request details on the home screen hide HTML comments from the description, as GitHub does, instead of printing template instructions as text
• Issue and pull request details also hide an HTML comment that a blank line splits inside a <details> or other HTML block, instead of showing its opening and its text.
• Assistant replies keep angle-bracket words that are not HTML, such as Vec<String>, Set<T> and <file> placeholders, instead of silently dropping them from the sentence.
• Removing a local marketplace now refuses while one of its plugins is enabled, --force also clears that plugin, and /plugin marketplace remove accepts --force before the name.
• A follow-up sent while an earlier one is pending is no longer rejected with "Submission failed" when it mentions a file with a very long number after a colon (@file:99999999999999999999).
• The model picker keeps its Context and Reasoning column labels when a search or scroll hides the first model group.
• The /model picker shows token prices in terminals narrower than 64 columns, and the dot leaders start right after each price label.
• --no-ask-user and the askUser setting now say they remove the ask_user question form, and that the agent can still ask questions in its replies; they no longer say the agent stops asking questions.
• The /user switch, environment and /mcp auth pickers, the Run on: status and the Outgoing connections list no longer let escape sequences in names, paths or URLs restyle the terminal.
• Plugin rules with alwaysApply: false now stay out of the prompt until you enable them in /instructions; before, every session applied them until /instructions or /plugins was opened.
• /pr shows the pull request's title, labels and branch as written, so a title such as Fix init.py exports no longer loses its underscores and turns bold.
• /pr shows a closed or merged draft as Closed or Merged, keeps branch names and labels that contain a | intact, and counts a check run that failed to start or is waiting on an action as failing instead of pending.
• A repository hook file under .github/hooks that cannot be read, or a hook entry in it that is invalid, is now reported with the file and the reason, at startup and after /cd into the repository, instead of being skipped silently.
• /session delete --yes=false and a mistyped --yes=<value> no longer delete the current session, and /session delete --local-only <id> now previews that session.
• Completed /ask and /btw answers left open now reappear when you return to their session within the same CLI process.
• copilot skill remove and /skills remove now forget the removed skill's disabled state, so a skill added later under the same name no longer starts disabled.
• When --ui-server cannot start its server (port already in use or out of range), the session now shows why instead of starting without it silently
• Sessions where a tool returned a binary result of a type other th...

2026-11-05

• Rex terminals render inline images using Kitty direct placements.
• Add /code command to open the current session in VS Code
• Add a Fusion tier setting to copilot config.
• Make /settings open the unified dashboard for all users and add global search across settings and local resources.
• Interactive CLI reports program status to supporting terminals, including when attention is needed.
• Add opt-in session management tools and @mentions for opted-in local sessions
• Add COPILOT_SESSION_CWD for launching and expanding LSP and local MCP server configs
• Add GPT-6.1 Terra as a selectable model under New models when available to your account
• Add a Sandbox extensions setting to run extension processes inside the sandbox
• Add MATS telemetry for Entra authentication through OneAuth, respecting client telemetry opt-out.
• An image removed from the prompt with Ctrl+U, Ctrl+K or Ctrl+W, or replaced by a recalled history entry, is no longer sent with the message, and Ctrl+S can stash the prompt afterwards.
• Pasted text containing NEL, Unicode line or paragraph separators now fills separate prompt lines, and pasted DEL and C1 control characters are dropped, instead of being kept in the prompt and cutting characters off the end of the row.
• In copilot -p --plan, the agent is no longer told to suggest Shift+Tab to leave plan mode, which only works in the interactive interface, and is asked to include the plan's key points in its reply instead.
• copilot --resume <id> no longer waits with no output and no end when the Copilot task service does not respond; the task lookup now gives up after 10 seconds and resolution continues.
• Sandboxed grep, rg, and glob now report Windows launch failures instead of silent no-match results
• Model picker shows context window size for flat, unpriced, and single-tier models
• Sandboxed local MCP servers respect relative filesystem permissions from the session directory, even when configured with a different working directory.
• PowerShell commands work on Windows when the CLI is installed in a long directory path
• Switching sessions while other sessions are busy no longer crashes the CLI and leaves a blank terminal
• Keep readable image attachments when retrying a prompt that contains a corrupt image
• MCP Entra authentication now falls back to the VS Code registration when Copilot CLI preauthorization is unavailable.
• Sandboxed local MCP servers now start correctly when configured with a relative cwd.
• On Windows, sandboxed sessions in nested Git directories can change to and write at the repository root
• Autopilot no longer starts implementing its own recommendation after a request that only asked for a review or analysis
• Suppress unnecessary MCP reload summaries when plugin servers remain unchanged
• A model request that Copilot's service answers with an empty 404 while under load is now retried instead of ending the turn with "Execution failed: 404".
• copilot help config now lists every setting the settings catalog offers, including the ones that were missing from its hand-written text, such as askUser, effortLevel, planModel, toolSearch and worktreeBaseRef
• ACP clients can switch a session started with --yolo out of autopilot, and allow-all stays on, instead of the switch failing as blocked by policy and a second attempt turning allow-all off.
• The @ file picker now underlines a name with a capital dotted I, such as İstanbul.txt, when the query is typed without the dot, and no longer shortens that row's matched folder.
• The @ file picker now underlines matches in names stored with decomposed accents or found by a query typed without accents, and no longer shortens such a row's matched folder.
• Up and Down in a multi-line prompt keep the column you started from when they pass through a shorter line, instead of leaving the caret near the start of the line.
• Ctrl+Y and /share research skip research folder entries that are not readable files, such as a broken link or a folder named like a report, instead of failing or offering them.
• Show each agent's selection ID in /agent when multiple agents share a display name.
• The edit tool now fails at once on a named pipe, socket or device instead of waiting forever for the other end of a FIFO, which stalled the turn.
• An empty plan.md no longer shows the ctrl+y plan hint or Plan: yes in /session, and ctrl+y opens the research report instead, matching /session plan.
• The footer keeps the "N scheduled", sandbox, YOLO and CI status items whole on narrow terminals by shortening the directory and branch first, instead of cutting the items off the end of the row.
• Pull request, issue and gist details, and their load errors, no longer let escape sequences in titles, names, branches, gist files or server messages restyle the terminal.
• Show the saved paused goal and continuation guidance when resuming an autopilot session.
• Issues and pull requests picked with # are no longer dropped from the message when another one is picked in front of them, and an issue picked twice is sent once.
• copilot help billing now says the footer shows the AI credits used in this session (nothing by default on the legacy billing platform), and that the /statusline quota item is off by default and ai-used is on.
• copilot help config now says copyOnSelect is on by default on macOS, that /keep-alive changes only the current session, that logLevel is set in the /settings dialog or settings.json rather than copilot config, and that trustedFolders lives in config.json and is filled by the folder-trust prompt.
• copilot help environment now says a COPILOT_AUTO_TIER value of "fast" is ignored with a notice rather than rejected, and that USE_TGREP=true does not override whether indexed search is available for your account or USE_BUILTIN_RIPGREP=false.
• copilot help config, copilot help environment and copilot help acp no longer name the hidden --prefer-version, --server and --stdio options.
• copilot help limits shows a status example at the real minimum AI credit limit and says the final-call warning appears when 10% or less of the limit remains
• copilot help monitoring now says an http:// OTLP endpoint disables export only when an OTLP CA certificate or client certificate/key variable is set, not for every http:// endpoint.
• copilot help permissions now documents glob patterns in write(path) and read(path) rules, lists the read and memory kinds, and explains that an unscoped write rule approves shell output redirection but not the command itself; it no longer says wildcard matching is coming in the future.
• copilot --help and copilot help --help now list the acp help topic, and copilot help --help no longer prints its description and topic list with stray indentation.
• Form and settings text fields show the control characters of a stored value, such as an MCP server command, instead of letting them recolor or hide its text.
• Issue and pull request details on the home screen hide HTML comments from the description, as GitHub does, instead of printing template instructions as text
• Issue and pull request details also hide an HTML comment that a blank line splits inside a <details> or other HTML block, instead of showing its opening and its text.
• Assistant replies keep angle-bracket words that are not HTML, such as Vec<String>, Set<T> and <file> placeholders, instead of silently dropping them from the sentence.
• Removing a local marketplace now refuses while one of its plugins is enabled, --force also clears that plugin, and /plugin marketplace remove accepts --force before the name.
• A follow-up sent while an earlier one is pending is no longer rejected with "Submission failed" when it mentions a file with a very long number after a colon (@file:99999999999999999999).
• The model picker keeps its Context and Reasoning column labels when a search or scroll hides the first model group.
• The /model picker shows token prices in terminals narrower than 64 columns, and the dot leaders start right after each price label.
• --no-ask-user and the askUser setting now say they remove the ask_user question form, and that the agent can still ask questions in its replies; they no longer say the agent stops asking questions.
• The /user switch, environment and /mcp auth pickers, the Run on: status and the Outgoing connections list no longer let escape sequences in names, paths or URLs restyle the terminal.
• Plugin rules with alwaysApply: false now stay out of the prompt until you enable them in /instructions; before, every session applied them until /instructions or /plugins was opened.
• /pr shows the pull request's title, labels and branch as written, so a title such as Fix init.py exports no longer loses its underscores and turns bold.
• /pr shows a closed or merged draft as Closed or Merged, keeps branch names and labels that contain a | intact, and counts a check run that failed to start or is waiting on an action as failing instead of pending.
• A repository hook file under .github/hooks that cannot be read, or a hook entry in it that is invalid, is now reported with the file and the reason, at startup and after /cd into the repository, instead of being skipped silently.
• /session delete --yes=false and a mistyped --yes=<value> no longer delete the current session, and /session delete --local-only <id> now previews that session.
• Completed /ask and /btw answers left open now reappear when you return to their session within the same CLI process.
• copilot skill remove and /skills remove now forget the removed skill's disabled state, so a skill added later under the same name no longer starts disabled.
• When --ui-server cannot start its server (port already in use or out of range), the session now shows why instead of starting without it silently
• Sessions where a tool returned a binary result of a type other th...

Fixed

• apply_patch no longer counts one extra line for each file it adds or deletes, so the timeline summary, permission prompt, /usage and exit summary show the real line counts
• copilot config now warns when a value of the wrong type makes settings.json ignored, instead of reading every setting as unset and reporting writes into that file as if they took effect
• Deleting text in front of Chinese, Japanese or Korean characters in the prompt no longer leaves the line garbled until the next edit.
• Markdown output no longer turns colon-delimited text such as file.ts:100:5 or crate::id::Id into emoji.
• A top-level SKILL.md in a skills directory now produces a warning in /skills explaining that subdirectories are resources, not separate skills, and how to load them.
• A message sent while the agent is working that mentions a file or directory (@path) is no longer rejected with "Submission failed" when an earlier one is still waiting.
• /keep-alive busy releases sleep prevention once all tracked sessions finish working, including background turns and standalone local-shell commands
• Git URL caches use short paths and diagnose path-length failures. Old caches are copied, not moved, and kept for older CLIs; delete the originals manually when no longer needed.
• ACP session/prompt and session/cancel stop only the active turn, keeping background tasks and shell commands running
• Long conversations now recover from oversized requests by trimming historical reasoning and retrying.
• Prompt before out-of-workspace access through dangling symlinks
• Rewinding and resubmitting a prompt now keeps image and file attachments.
• Sessions recover from unavailable program endpoints and continue answering prompts
• Skill calls explain when model invocation is disabled instead of reporting the skill as not found
• /memory now reports when Memory is disabled for the session by an experiment and clarifies /memory on behavior.

Improved

• Windows local model downloads install llama.cpp automatically and show engine installation progress.
• /memory show indicates when repository memory scope is unavailable

Fixed

• Warn on stderr when the agent selected with -p --agent has frontmatter keys Copilot ignores, and log every agent file's warnings
• Auto mode falls back to a valid default when a saved Efficiency preference is unavailable.
• /fork no longer fails with "Failed to copy fork session database" when the session's session.db cannot be read; the fork is created without the todo list, and a fork that does fail no longer leaves a half-created session directory behind.
• Hook config files saved with a UTF-8 byte-order mark, as Windows PowerShell 5 and older Notepad versions write them, are now loaded instead of being skipped with only a log entry.
• /share html exports now keep a numbered list's first number and the checkbox and state of task-list items, and both these exports and rich-text copies keep the text inside a raw HTML block such as
  instead of dropping it.
• /ide draws IDE and folder names as plain text, one row each, and keeps its title, highlighted row and key hints on screen with a long workspace list or on a short terminal.
• A warning about an invalid entry in an LSP config file now names the server it belongs to, so a file with several servers can be fixed without bisecting it.
• A tool call to an HTTP MCP server that fails with a server error or a dropped connection no longer shows an internal Rust type name in front of the reason.
• An image or file path pasted into a message that starts with an absolute path, such as /var/log/app.log, is now attached instead of being sent as plain text.
• copilot plugin uninstall now removes a plugin that copilot plugin list still shows after its installed files went missing, instead of reporting that it is not installed
• Question forms show control characters in a prefilled default answer instead of sending its escape sequences to the terminal.
• Pasting two images or documents that share a file name from different folders now attaches both instead of silently sending only the second.
• The /tasks dialog draws each task on one row, so a line break in a task description no longer adds a row that looks like another task, and escape sequences no longer restyle it.
• A ~/ entry in the skillDirectories setting now loads skills from your home directory instead of a folder named ~ in the current directory.
• Model loading now fails faster on unreachable network endpoints and shows connectivity guidance.
• ACP sessions now appear in session history, /chronicle, and session_store_sql results.
• PowerShell approval prompts now explain when full-script review is required for valid commands.
• Session persistence failures now show one error and one recovery notice instead of repeating on every retry.
• copilot plugin install now reports a plugin manifest field it ignored, instead of installing a plugin with no skills in silence.
• CLI falls back to direct networking when PAC/WPAD or system proxy resolution fails.
• Fix Windows mouse selection copy so pasted text matches the selected content.

Added

• Rex terminals render inline images using Kitty direct placements.
• Add /code command to open the current session in VS Code
• Add a Fusion tier setting to copilot config.

Improved

• Update the built-in browser-use plugin to 0.1.0 with improved setup and browser integration behavior
• Improve Claude token estimation so context budgeting and trimming decisions are more accurate.

Fixed

• Box-drawing and block characters in prompts display as entered in the composer and timeline.
• Preserve the draft caret position after command mode so editing continues at the original cursor location
• Sandboxed Hugo commands can use Hugo and Go caches when developer-tool access is enabled
• Managed sandbox policy errors now tell you to contact your administrator and include the failed sandbox test command when it cannot start.
• Sandboxed commands on macOS can read files inside the default Xcode.app bundle.
• ACP mode now honors --agent so the selected agent persona, prompt, and tools are applied at startup.
• Unchanged cached MCP tools remain callable when another tool refreshes while permission is pending
• The Sessions tab and the home tab bar now respond to keys after Ctrl+X / runs /session over a draft with an open slash-command or @ menu, and one Escape closes /ide without clearing that draft.
• File diffs in permission prompts and /diff show control characters from the file as visible symbols instead of letting escape sequences restyle or hide lines.
• The footer draws a git branch name that holds control characters as plain text, so the branch can no longer recolour the footer or set the terminal window title.
• On narrow terminals the footer no longer leaves a stray separator where a hint did not fit or cuts the permission mode mid-name.
• A hook's permission message and the reason a hook queues as the next message no longer pass escape sequences to the terminal, so they cannot hide text or start a link in the hook prompt or the queued-message list.
• MCP, LSP and plugin.json config files saved with a UTF-8 byte-order mark, as Windows PowerShell 5 and older Notepad versions write them, are now loaded instead of being rejected or ignored.
• Command approval prompts and completion notices no longer pass escape sequences from a model-written description to the terminal, so that text cannot be hidden, recolored or made a link.
• copilot plugin list and copilot plugin update no longer pass control characters from a plugin's name, marketplace or version through to the terminal.
• When a /settings JSON value saved from your editor is not valid JSON, the error now shows any control characters it quotes from the file instead of letting them restyle the dialog.
• Changing a setting through /experimental, the status line picker, the subagent or extension pickers and similar commands no longer replaces a settings.json the CLI cannot read with just that one setting. The change is refused with an error and the file is left untouched.
• Searching a /share html export or an exported research report now highlights the text you searched for, instead of a shifted span or a broken emoji, when the conversation contains a capital dotted I (İ).
• Command output in the timeline no longer passes DEL and 8-bit C1 control characters to the terminal, so a file or command output can no longer change the window title or break the output rows; each one is shown as a space.
• Stopping an unknown shell ID fails without stopping a command and directs you to list active shell sessions.
• A failed tool call's error text, such as an MCP server's, no longer passes escape sequences to the terminal, so it cannot hide text or start a link in the failure row.
• The move of an older $XDG_CONFIG_HOME/.copilot directory into ~/.copilot now also brings over your MCP servers, language servers, saved folder permissions, personal instructions, custom agents and skills, and no longer replaces a symlink in ~/.copilot whose target is missing.
• Copying text on Linux no longer prints "Somebody else owns the clipboard now" over the UI when another app takes the clipboard
• Pressing Backspace to cancel command mode now preserves your draft text.
• Queue manager stays open when pending updates refresh concurrently
• Background Autopilot sessions auto-answer ask_user prompts without requiring you to foreground the session
• Warn when older messages are dropped for context limits and include compaction/truncation events in JSON output.
• /diff uses the active worktree after changing the session working directory
• Custom subagents with private MCP connections no longer start inherited servers excluded by their resolved tool list.
• Prompt for path access when long-option values like --name=/path reference files outside allowed directories
• Keep the Selected marker readable in /settings when screen reader mode is enabled
• Prevent /settings external editor save from overwriting concurrent settings changes
• Local models added from the /model picker now stay under their provider's section when grouped by vendor, instead of moving to Other models
• Unknown root options after a subcommand now suggest moving the option before the subcommand
• New files created with create and apply_patch now follow repository-declared line endings.
• Clicking tool calls in /tasks sub-agent details now expands and collapses their output
• SDK extensions.discover() now lists extensions from enabled plugins installed from a local directory marketplace, which sessions already load, and extensions.enable accepts them under plugin-only extension policy.
• LSP servers whose fileExtensions keys omit the leading dot (for example "java" instead of ".java") now handle file-based requests instead of reporting that no language server is available.
• Fix grouped grep results so files with names like 2024-01-15 stay correctly attributed in assistant responses
• Footer text selection highlighting stays aligned while transcript lines change
• Shell safety warnings no longer appear twice in the timeline during command approvals.
• Nested subagents inherit and can use MCP tools allowed by the session policy.
• --yolo and --allow-all now take effect when resuming a local session with --resume or --continue

Added

• Make /settings open the unified dashboard for all users and add global search across settings and local resources.
• Interactive CLI reports program status to supporting terminals, including when attention is needed.

Improved

• MCP content addressed only to the user is no longer sent to the model, and the interactive CLI shows such images inline, even in collapsed tool calls, or as saved files

Fixed

• Expand failed tool-call entries to show complete error output in the timeline.
• Prevent over-limit turns from re-running the same tool calls and instead return the existing prompt-budget error
• Pressing Escape or Ctrl+G dismisses slash-command argument suggestions in one keypress
• Returning from /lsp logs detail keeps the LSP server list visible and preserves the selected server.
• Esc in a question form clears the text in the current field instead of discarding the whole form; press Esc again on an empty field, or Ctrl+C, to cancel
• Keep /diff comment boxes closed beside the scrollbar, and shorten wide or astral file names in their titles without drawing a replacement character.
• In /diff, a mouse click selects the line under the pointer after the view scrolls past wrapped lines, and the scrollbar shows when wrapped lines overflow the view.
• When an MCP server fails to connect, the warning now shows the server's error text as plain text, so escape sequences in it can no longer hide or recolor the warning or split it across extra lines.
• Question forms show control characters in field titles, descriptions and options, and in the answered question row, instead of letting escape sequences hide or restyle that text.
• In /sandbox, pressing Enter right after Tab opens a folder in the add-path picker now keeps that folder, and Esc after Tab on an empty path cancels at once.
• The SQL tools no longer hang the session on a query that never finishes: the query stops after 60 seconds with an error, and interrupting it frees the session for the next prompt
• Tool rows and the memory prompt no longer let escape sequences in text the model wrote hide words or add links. Search patterns and memory text show their control characters instead.
• The web fetch permission prompt shows control characters in the requested URL instead of letting escape sequences hide text, add a link or split the URL across lines.
• Commands prefixed with VAR=value or env no longer trigger path-access prompts for non-path API endpoints.
• Company announcements no longer appear twice when repo settings keep or override global announcements
• Attach @mentioned images in -p prompts and reject --attachment image files whose contents are not a valid image
• In copilot -p streaming mode, sub-agent replies now print as complete blocks instead of interleaving mid-token.
• Large-file view guidance references your available search tool, and apply_patch returns a clear error when deleting a missing file.
• Use explicit --model with custom agents unless the agent requires a specific model
• Tool results that arrive before their calls are now ordered correctly and no longer duplicated.
• Open extension picker updates failed extensions from "starting" to "failed".
• Fallback retries now succeed when Claude refusals end with reasoning blocks.
• Show one oversized-request warning with the total removed attachments instead of repeated warnings.
• Ctrl+C copies selected text in ask_user prompts without cancelling the prompt
• PowerShell commands that clear the screen with cls or Clear-Host no longer fail on Windows or skip the rest of the command
• Fix /cd refusal messages to show only the directory error reason, without internal request names
• Keep configured skills available on the first request during startup reconciliation.

Removed

• New sessions no longer show startup tips under the header.

Fixed

• includeCoAuthoredBy: false is now honored in ACP mode (copilot --acp), so ACP clients no longer instruct the agent to add a Co-authored-by trailer to commits.
• Targeted /settings commands show the selected setting immediately
• A telemetry-disabled warning raised while resuming a session is saved to the session history, so later events no longer reference a missing parent.
• A BYOK provider key that is not a valid HTTP header value, such as key command output with a status line before the key, is no longer printed in the model error or saved in the session log.
• copilot mcp enable now fails with a clear message for a server the repository disables, instead of reporting success and changing nothing
• A prompt hook that returns an empty modifiedPrompt or modifiedTransformedPrompt no longer sends the model an empty prompt. A hook value that is ignored because it is empty or not a string now shows a warning naming the field.
• copilot sessions import --name "" is now rejected as an invalid name in both --dry-run and a real import, instead of passing the dry run and then failing with a persistence error.
• A ~/ directory in skillDirectories, COPILOT_SKILLS_DIRS or COPILOT_CUSTOM_INSTRUCTIONS_DIRS now resolves to your home directory, so its skills and instructions load.
• The .vscode/mcp.json migration notice now appears in repository subdirectories and after /cd into another workspace, and no longer appears for repositories already migrated to .mcp.json.
• Skill and background-agent timeline entries now show sanitized, readable errors and results
• Allow /mcp enable and /mcp disable for servers granted GitHub auth at startup
• Gemini models automatically defer tools behind search when requests exceed the 512-function limit.
• Removed repository hook configs no longer block later tool calls in the same session.
• In --autopilot, background task completions that arrive after a run stops are delivered with your next message instead of being dropped.
• Collect debug logs keeps the active invocation and ignores stale completion results
• Resuming a session with an unreadable event log now reports a load error instead of not found
• Copying text on native Windows no longer changes your console code page.
• Keep the selected task visible in /tasks when long lists exceed terminal height
• Signing in to a remote MCP server whose protected resource is a bare origin such as https://mcp.example.com no longer sends the resource with an added trailing slash, which authorization servers that compare it exactly rejected.
• Write remote session handoff cleanup failures to the debug log and show a clear error when no remote session is prepared
• Keep command-mode drafts after accepted commands so you can continue typing immediately.

Fixed

• Empty sessions no longer flash into the session picker before disappearing
• An @file mention written inside parentheses, brackets, braces, angle brackets, quotes or backticks now attaches the file, and expands correctly in ! shell commands, instead of being silently ignored.
• Custom agents that share a built-in agent's name are no longer offered to the model as a second agent type, since delegating to that name always runs the built-in agent
• The details view in /skills, /plugin and /mcp no longer passes terminal control characters from a skill, plugin or server's metadata through to the terminal; its trust and data blocks now show them escaped.
• Wrapped lines in the /ide dialog now continue under their text instead of under the bullet or row number
• After choosing Go back on the startup session-in-use prompt, sessions opened later with /resume show the in-use warning again.
• Instruction files whose frontmatter is not valid YAML now keep an applyTo or paths list and excludeAgent, instead of applying to every file, to none, or to an agent they exclude
• A preToolUse hook that returns "modifiedArgs": null no longer makes the tool call fail with "Expected JSON object but got null"; null now leaves the arguments unchanged, as it does for the hook's other fields.
• Escape and Ctrl+G leave Ctrl+R reverse search in one press when it was started from a slash command, /cd path or command-mode draft, instead of clearing the draft.
• Pressing Enter on a search with no matches in the session browser or the custom agent picker, or Tab in the agent picker, no longer adds a space to the search text.
• Messages such as the /rename confirmation now show 8-bit control characters from the text they echo as spaces instead of sending them to the terminal.
• copilot sessions import now reports a second session header as "Only the first record may be a session header." and an unknown record type as unsupported, instead of asking for a record id and timestamp those lines never needed.
• When the editor opened with Ctrl+E in /settings saves the file and then exits with an error, the edit is now kept in a recovery file and its path is shown, instead of being deleted with a message saying the editor did not save.
• When signed out, the Issues and Pull requests tabs no longer offer a / search that could only fail with "Search failed."; / there now opens the slash-command picker, as on the Gists tab.
• Keep the /statusline dialog's preview and toggle descriptions inside its border when the sessions sidebar is open.
• The view tool now fails at once on a named pipe, socket or device instead of waiting forever for a FIFO writer, which left non-interactive runs hanging.
• Expanding a tool call with Ctrl+O now shows the values of object and array arguments instead of a {…} or [N items] placeholder, so MCP calls that take a nested parameters object can be inspected
• Command hooks receive COPILOT_HOOK_DEPTH so hook-launched sessions can stop recursive agentStop chains
• Remote HTTP MCP servers connect through proxies that require Kerberos (Negotiate) authentication.