Rolling upstream release action items — copilot-cli

This is the single canonical tracking issue for action items arising from new releases of the copilot-cli dependency. The update-awf-version workflow appends a new comment to this issue for each version bump going forward, so the most recent activity lives in the comments below. This body is a consolidated history of everything filed so far.

Latest pinned version covered: 1.0.95

Consolidated history (earliest → latest)

1.0.48 → 1.0.56 (was #803)

• Security: secret scanning covers commit messages + PR descriptions (v1.0.51): Redacts secrets before publishing.
• Security: permissions.disableBypassPermissionsMode (v1.0.55): Prevents enabling allow-all/yolo mode; relevant for sandboxed pipelines.
• --session-id=<id> flag (v1.0.51): Resume/start sessions with a specific UUID — useful for pipeline correlation.
• postToolUse hook additionalContext injected as system message (v1.0.49): Instead of being discarded.
• preMcpToolCall hook (v1.0.51): Control outgoing MCP request metadata.
• deferred-tool-loading frontmatter for custom agents (v1.0.52): Reduces initial token overhead.
• MCP tools with both content + structuredContent surface both (v1.0.56): Review ado-aw MCP tools to ensure dual output is intentional.
• Context window tier selection (v1.0.52): Default ~200K vs 1M tokens enforced end-to-end.
• Claude Opus 4.8 support (v1.0.55).
• Deprecation: oauth.clientId/oauth.callbackPort → oauthClientId/auth.redirectPort (v1.0.52).

1.0.48 → 1.0.59 (was #843)

• Breaking: preToolUse hook errors now deny the tool call (v1.0.57): Previously hook errors silently allowed execution; now they block the call.
• Breaking: Remote JSON RPC enabled by default (v1.0.58): Verify this doesn't open unexpected network surface in AWF-sandboxed environments.
• Breaking: --plugin-dir skills take precedence over personal-home skills (v1.0.55): Skill resolution order: project > plugin-dir > personal > custom.
• ADO-only repos: built-in GitHub MCP server exposes only web_search (v1.0.57): Directly relevant to ado-aw; consider whether the GitHub MCP extension should account for ADO-repository detection.

1.0.48 → 1.0.60 (was #881)

• Alpine Linux (musl libc) support (v1.0.49): Now runs on Alpine-based containers.
• Rubber Duck agent enabled by default (v1.0.58): Check whether this adds unexpected turn overhead in automated runs.

1.0.60 → 1.0.61 (was #951)

• Auto-load MCP servers from .github/mcp.json (v1.0.61): ado-aw uses --additional-mcp-config; consider guarding against auto-loading interference.
• Claude Fable 5 model support (v1.0.61): Add to validated models in src/engine.rs/docs/engine.md.
• mTLS + private-CA for OTLP telemetry (v1.0.61): Added http/protobuf OTLP export via OTel env vars.
• Bug fix: grep/glob single-path fix (v1.0.61): Previously missed results with single path argument.
• Bug fix: shell validation false positives (v1.0.61): Fixed blocking of harmless commands with words like "kill" in string literals/heredocs.

1.0.60 → 1.0.62 (was #1002)

• Breaking: write_bash interactive input removed (v1.0.62): Shell commands now use lightweight process spawning; interactive input no longer supported. ado-aw exposes write_bash as a first-class tool — assess whether tool surface/docs need updating.
• Configure subagent model, reasoning effort, context tier (v1.0.62): Consider surfacing reasoning_effort/context-tier as front-matter fields.
• Kerberos/SPNEGO proxy auth (v1.0.62): Auto-auth through corporate forward proxies; relevant for enterprise ADO environments.

1.0.62 → 1.0.63 (was #1057)

• deferTools MCP server config option (v1.0.63): Keeps server tools available even when tool search is enabled. ado-aw could use this for safe-outputs and GitHub MCP servers to prevent them from being filtered out.

1.0.62 → 1.0.64 (was #1183)

• New OTel cache + reasoning token fields (v1.0.64): gen_ai.usage.cache_read.input_tokens, gen_ai.usage.cache_creation.input_tokens, gen_ai.usage.reasoning.output_tokens per GenAI semconv (old underscore-separated names gone). Update src/agent_stats.rs to parse new attribute names.
• Static OAuth client overrides for MCP server auth (v1.0.64): ado-aw could expose in MCP server config front-matter.
• Autopilot mode auto-handles ask_user, elicitation, sampling, permission prompts (v1.0.64): Reliability improvement for unattended pipeline runs.
• Deprecation: report_intent tool removed (v1.0.64): INTERNAL_TOOL_NAMES exclusion in src/agent_stats.rs containing "execute_tool report_intent" is now dead code; can be cleaned up.

1.0.64 → 1.0.67 (was #1272)

• Claude Sonnet 5 model support (v1.0.67): Add to src/engine.rs model allowlist + docs.
• Subagent sessions inherit parent tool restrictions (v1.0.67): Security-relevant behavior change; verify against expected security model.
• MCP OAuth against Microsoft Entra vanity domain servers (v1.0.67): Fixes AADSTS auth failures for Entra vanity domains; relevant for enterprise Azure AD MCP tools.
• copilot skill subcommand (v1.0.65): New /skill alias for listing/adding/removing skills; may be relevant for agency plugin scaffolding.
• Deprecation: Claude Opus 4.6 Fast → Claude Opus 4.8 Fast (v1.0.66): Update any ado-aw references to claude-opus-4.6-fast.

1.0.64 → 1.0.68 (was #1305)

• Breaking: session limits require minimum 30 AI credits (v1.0.67): Pipelines with session-limit: below 30 AI credits will be rejected at runtime. Review compiler defaults.
• Claude Opus 4.8 Fast model support (v1.0.66): Add claude-opus-4.8-fast to src/engine.rs allowlist.
• kimi-k2.7-code model support (v1.0.68): Add to model allowlist.

1.0.70 → 1.0.81 (was #2041)

• Breaking (v1.0.79): Sandbox settings keys renamed from sandbox.gitAuth/sandbox.ghAuth to sandbox.auth.git/sandbox.auth.gh, with no migration path. Old keys are silently ignored, and SDK requests using the old keys are rejected as invalid. Any ado-aw-generated engine config or docs referencing the old sandbox setting names need to be updated. See the v1.0.79 release.
• Breaking (v1.0.79): --worktree default behavior changed — worktreeBaseRef now defaults to HEAD instead of the remote default branch. Could change output for any ado-aw workflow relying on worktree creation defaults. See the v1.0.79 release.
• Security (v1.0.78): The /allow-all auto safety-judge model is no longer user-configurable — hardens against downgrade to a weaker safety judge. See the v1.0.78 release.
• Security (v1.0.78): Managed-settings fetch failure behavior changed from fail-closed to fail-open — worth confirming this doesn't weaken ado-aw's sandboxed-agent posture when managed settings can't be reached. See the v1.0.78 release.
• Security (v1.0.72): Sandbox macOS keychain access now defaults to off, reducing default credential exposure inside the sandboxed agent. See the v1.0.72 release.
• v1.0.81: Support for MCP protocol version 2026-07-28, OpenTelemetry trace-context propagation (traceparent/tracestate) into hooks, and per-agent usage metrics via --usage-output-file — could improve ado-aw's OTel-based agent stats correlation (src/agent_stats.rs). See the v1.0.81 release.
• v1.0.81: Windows Entra ID broker-based MCP auth (no-prompt sign-in) — relevant if ado-aw ever needs Windows-hosted agent auth flows.
• v1.0.81: Plan mode now hard-blocks mutating tool calls — a safety property ado-aw could rely on/document for plan-only agent configurations.
• v1.0.76/v1.0.77: Enterprise admins can enforce a restrictive sandbox floor and managed sandbox policy via macOS/Windows native MDM — relevant to ado-aw's OneBranch sandboxing story for enterprise consumers. See the v1.0.76 release and v1.0.77 release.
• v1.0.72: Opt-in git/gh auth inside the OS sandbox — worth evaluating against ado-aw's own credential-isolation model (ado-proxy).

1.0.87 → 1.0.88 (was #2232)

• None identified. This is a routine point release with terminal/UX and MCP reliability fixes.
• Security: Enterprise managed settings now apply to sessions opened in ACP mode (copilot --acp), by AHP hosts (copilot --ahp-host), and by the published --server session, which previously ran with no managed MCP, permission, or plugin policy (v1.0.88). ado-aw invokes the CLI in its default sandboxed one-shot mode, not --acp/--ahp-host/--server, so no immediate action, but worth confirming if any future ado-aw feature drives the CLI through one of those modes.
• Security: GitHub MCP scope escalation now uses the CLI OAuth app's registered /callback redirect URI (v1.0.88) — tightens an OAuth flow ado-aw does not directly configure.
• No notable features identified as directly adoptable by ado-aw in this range. No deprecations identified in this range.

1.0.88 → 1.0.95 (was #2322) — canonical

Releases analyzed: v1.0.89, v1.0.90, v1.0.91, v1.0.92, v1.0.93, v1.0.94, v1.0.95. The companion version-bump PR is titled chore(deps): update COPILOT_CLI_VERSION to 1.0.95.

Breaking changes

• v1.0.89: "Fix Auto tier selection to cycle correctly in /model and remove the unsupported Fast profile; a previously stored, exported, or resumed Fast preference now falls back to Balance instead of routing on it." Any pinned ado-aw workflow that selected a fast routing tier for the copilot engine will silently behave as balance after this bump.
• v1.0.93: "Read user settings only from ~/.copilot/settings.json; user-setting keys in ~/.copilot/config.json are ignored." If ado-aw's sandbox provisioning or engine.env/config-seeding logic writes Copilot CLI settings into config.json, those settings will stop being honored.

Security fixes

• v1.0.91: "Sandboxed shells now withhold ambient GITHUB_TOKEN unless explicitly configured" (listed under v1.0.92's notes, originating from a security-hardening change) — tightens default credential exposure inside the sandboxed shell; worth confirming ado-aw's AWF network-isolated sandbox still receives GITHUB_TOKEN where intentionally configured via tools.github.
• v1.0.93: "Sandbox local-network allowlists now include localhost and loopback hosts." — expands default local-network reachability for sandboxed sessions; relevant to AWF's network-isolation model if ado-aw relies on Copilot CLI's own sandbox for any additional isolation guarantees.

Notable features for ado-aw to adopt

• v1.0.90: "Add --mcp-github-auth to scope GitHub account auth to approved MCP server origins." Potentially useful for scoping the GitHub MCP extension's auth surface more tightly than today.
• v1.0.92: "Add copilot config subcommands to list, read, set, and remove settings." Could simplify how ado-aw seeds/validates Copilot CLI configuration in the generated pipeline bash steps instead of hand-editing config files.
• v1.0.93: "Add enterprise permissions.limitTo to enforce managed domain boundaries for network requests." Complementary to AWF's L7 allowlist — could be surfaced as an additional defense-in-depth layer for the copilot engine's own egress controls.
• v1.0.94: "Managed policy can disable Assisted Permissions and keep sessions in Manual Approval mode." Relevant if ado-aw wants a stricter non-interactive mode guarantee for pipeline runs.
• v1.0.95: "Use native Microsoft Entra broker authentication on macOS when available, with browser fallback." Not directly relevant to ADO pipeline runners (Linux), but worth tracking if local/dev tooling expands to macOS.

Deprecations

• v1.0.89: "Fix Auto tier selection to cycle correctly in /model and remove the unsupported Fast profile" effectively retires the Fast routing-tier preference (see Breaking changes above — falls back to Balance).

Consolidated by the Deps Release-Notes Consolidator workflow. Superseded per-release issues were closed and point here.> Generated by Deps Release-Notes Consolidator · auto · 27.8 AIC · ⊞ 10.4K · ◷