@github/copilot 1.0.106-3 on Node.js NPM

Added

Add opt-in session management tools and @mentions for opted-in local sessions

Improved

Managed-account policy refresh warnings now include Policy Helper findings and clear once policy resolves

Fixed

Reuse valid saved MCP OAuth credentials for anonymous connections and initial challenges without requiring another sign-in
On the colorblind theme, unread sessions in the Sessions sidebar and its legend are marked with * instead of the same blue dot as finished sessions.
MCP reload now reports one settled connection summary per reconciliation
Copilot Free signup completes when account setup overlaps model refreshes
Resuming an autopilot objective no longer starts a duplicate continuation prompt
/context shows updated usage details after switching models in an active session
Repository disableAllHooks continues suppressing user hooks after trusted-workspace rebuilds
Extensions no longer prompt for permission after their connection closes during initialization
Permission prompts keep your current selection when options update during loading
Entra sign-in uses the VS Code application registration again by default
Preserve typed and pasted typeahead input across later cwd loading gates
Copilot's built-in documentation tool now returns the installed CLI's own commands, flags and help topics instead of an error line about a missing README
/add-dir and /cd now accept a directory wrapped in quotes, such as a path pasted from a shell or file manager, instead of reporting that it does not exist.
Assistant replies, other rendered markdown and the expanded Read, Create, Edit and Search rows no longer pass escape sequences and control characters from their text to the terminal, so a reply or a file cannot restyle the timeline or hide its own lines
The first @ of a session now highlights the first suggested file instead of the working directory, so Tab or Enter inserts that file. A suggestion you pick with the arrow keys still stays highlighted while results update.
The busy indicator shortens a long tool name instead of cutting off its elapsed time and output size
A ! shell command cancelled after it printed output now shows that output once, instead of repeating it above the cancellation message.
Canvas windows no longer reappear or revert to an older URL after being closed or updated while a session is still loading
Code blocks in assistant replies keep their lines and indentation after a line that starts with a triple-backtick code span, a fence line with a language inside another code block, or indented text right after a closing fence, instead of being joined into one line.
Collapsed tool result previews no longer show a replacement character when an emoji falls where the preview is cut, and wide characters no longer overrun the preview width
The autopilot completion check label now matches the decision autopilot acts on: a reviewer verdict with non-English text right after the verdict word no longer shows as passed.
Confirmation dialogs such as "Enable autopilot mode" and "Confirm folder trust" keep their title, highlighted option and key hints on screen in a short terminal
Ctrl+U and Cmd+Backspace at the start of a prompt whose first line is empty no longer add a blank line
The terminal cursor no longer stays in an unfocused pane, such as the /config right pane after returning to the sidebar
A directory name containing escape sequences no longer restyles the session picker Location column, the footer working directory or the /session info Directory row; the path is drawn as plain text
A long name that wraps beside other text in a row, such as in /extensions manage or the /agent picker, no longer loses a character where it wraps.
The Getting started box no longer suggests /model in sessions that use a model from your own provider, where /model is not available.
HTML exports (/export html, /share html, research reports) and rich text copied with /copy keep inline <br> line breaks, including in table cells, instead of joining the lines
The "Agent finished" desktop notification no longer shows a reply from an earlier turn or from another session when a prompt ends without a reply of its own, such as a prompt blocked by a hook.
The /instructions picker no longer lets terminal escape sequences or line breaks in an instruction file name or plugin name restyle the list or draw extra rows.
copilot -p --output-format json and copilot workflow run no longer write 8-bit terminal control characters (C1 and DEL) from model replies, tool output or workflow results raw: they are escaped in the JSON, which parses to the same values, and workflow run failure messages on stderr show them as spaces.
A prompt that starts with a combining accent no longer hides the last typed character or puts the cursor one column too far right; the accent is drawn on the cell before it, as the terminal itself draws it.
--max-ai-credits with NaN, inf or a number too large to represent now fails with an error that names the value you typed, instead of reporting it as "null".
Local MCP servers start once per session when the first credential resolves
An MCP tool title, or tool arguments the model writes, can no longer use 8-bit control characters to erase or redraw the tool approval dialog or the timeline row
The "Agent finished" desktop notification now shows inline code such as src/*.ts as written, keeps spaced-out asterisks such as 2 * 3, and no longer leaves part of a link's address behind when the address contains parentheses.
Permission prompts show the control characters in a directory or file name instead of letting its escape sequences restyle the path or its line feeds split the row
The /permissions picker keeps its title, the highlighted mode, the Assisted Permissions security statement and its key hints on screen on short terminals, such as 80x12 or 60x14, instead of pushing the title and the first modes above the top of the screen.
Plugin rules whose globs is a comma-separated string, such as "*.ts,*.tsx", now apply to the files those patterns match instead of never applying.
In -p mode, a sub-agent's streamed reply now ends with a line break, so --silent no longer prints it and the main agent's answer as one line and the default output no longer glues it to the front of the task tool's row.
Typing ? in Ctrl+R reverse search or at a permission prompt no longer opens quick help, and pressing it twice no longer leaves a stray ? in the prompt.
/remote on tries again after an earlier attempt failed, instead of reporting "Remote control status: connecting." and doing nothing until the CLI is restarted.
/rename and /session rename refuse a session name with a double quote or a control character, as --name and /fork already do, instead of storing it.
A repository's .github/copilot/settings.json can no longer color, hide or add lines to the startup warning or the /settings Problems explanation that reports its invalid settings: keys and values from the file are shown escaped, and a setting's value containing a line feed is no longer shown in the Problems explanation.
Show unresolved GitHub repositories in /chronicle reindex results when some sessions cannot be synced.
copilot --resume and --continue now fail at once with the permission error when the session store cannot be read, instead of printing nothing and never exiting.
Ctrl+C closes a Ctrl+R history search without clearing the prompt you were typing or arming "ctrl+c again to exit", so pressing it twice no longer quits the CLI.
copilot sandbox ca trust --allow-host '*' now reports an invalid host rule, like other invalid hosts, instead of an unrelated masked-credential error
The /sandbox dialog now fits short terminals: it keeps its title, its tabs, the highlighted setting and its key hints on screen and scrolls the settings instead of cutting them off.
A command scheduled with /after or /every that cannot be scheduled, such as /clear or /exit, now reports in the timeline that it cannot be scheduled when it fires, instead of silently doing nothing.
With --screen-reader, /plugin, /skills and other labelled lists read their rows and their empty message instead of only the list name
Under --screen-reader, the "User message" label on a sent message stays on one row beside the message instead of breaking into a column of two-letter pieces, and the "Search" label in /search and the model picker is now separated from the text you type.
With --screen-reader, the session browser no longer reads the label of its Source tabs twice ("Source: source: current tab").
With --screen-reader, the home screen no longer goes blank and stops responding in a very small terminal, such as 15 columns by 8 rows.
A search path naming the working directory with a trailing slash is now shown as the current directory instead of an empty path
/session delete refuses an unknown option such as --force with a usage error. Before, an unknown option placed before a session ID consumed the ID, and the command deleted the current session without asking.
With context management tools on, session_history search now matches the conversation text, so a query that contains a line break, a quote or a backslash finds the message it was copied from, and read_item returns the message text instead of its JSON encoding.
Escape sequences in a session name, branch or working directory no longer restyle rows in the Sessions tab and session pickers, or show up as stray text such as [31m on the Sessions sidebar cards; the text is drawn plain
/session prune and /session delete-all reject malformed days, unknown flags and stray arguments instead of deleting sessions
In /settings list editors, an item that wraps onto a second line no longer pulls its text one column left of the other items and against the selection marker
The /settings value picker no longer draws its options over each other or over its border in short terminals, and keeps the highlighted choice on screen.
/share file and /share html list a message's images as [Image: name] instead of leaving an image-only message blank, and the HTML page title comes from the first message with text
Markdown session exports (--share, /share file, /share gist) now show shell commands, search patterns and file paths exactly as they ran: a * or __init__.py no longer turns into italic or bold text, and a heredoc no longer becomes headings, lists or a code block that swallows the sections after it.
/share file and /share html no longer keep the quotes around a pasted output path in the file name
/share research and /share html research add .md or .html to a file path given without an extension, as /share file and /share html already do, and the saved HTML report now carries a link to open it.
Output from ! shell commands that print terminal hyperlinks or window titles, such as ls --hyperlink=always, is shown in full instead of disappearing along with every later shell result.
Shell output that redraws a progress line in place, such as git checkout or curl, now shows the line's final state inside the output once the command finishes, instead of every frame on rows outside it.
Pressing Enter on a slash command whose arguments follow a non-ASCII space, such as the ideographic space a CJK input method types, now runs the command with those arguments instead of dropping them: /allow-all off no longer turns Allow All on.
Tab-indented files keep their indentation in the expanded file view, in expanded grep and glob results, and in the gist details screen, instead of rendering every line at column 0.
copilot workflow run and copilot -p text output now redact --secret-env-vars values and recognized tokens in lines a workflow or extension logs, as the JSON output and the final result already did.
Opening /theme in a terminal 6 columns wide or narrower, or narrowing the terminal while it is open, no longer blanks and freezes the whole session
The /theme picker keeps the highlighted choice visible in short terminals by hiding the sample preview and scrolling the list.
Error messages in the timeline no longer lose their last characters, or a wrapped line ending in a path, when they nearly fill the terminal width
Timeline rows for file tools show the control characters in a file name instead of letting its escape sequences restyle the row or its line feeds split it
Todo timeline entries show the right status for updates whose title or description contains the word where
Text cut to fit the terminal, such as a setting value in /settings, a cell in the subagent table, or a long objective in the pinned goal panel under --screen-reader, now ends in an ellipsis instead of stopping mid-word, so a cut value no longer reads as a complete one.
An unquoted -p or -i prompt that contains a command name such as update, login or help now gets the quoting hint instead of a parser error about an unknown subcommand.
The /usage activity graph now places each month label over its own week in Japanese, Chinese and other locales whose month names use wide characters, instead of shifting each label further right.
In Vim mode, typing an emoji or a math letter in NORMAL mode no longer inserts it into the prompt; it is ignored like any other key that has no command.
In Vim mode, t and dt stop before an emoji or conjunct when the target character is part of it, instead of landing on it and deleting it, and dF deletes the whole emoji instead of splitting it.
When web_fetch cuts a page at its 10 MiB limit, the model is now told the page was truncated even when the cut falls inside a script, style sheet or HTML comment.
An invalid server entry in a trusted workspace .mcp.json, or a file that is malformed or unreadable, is now reported as an MCP warning in interactive sessions and in copilot -p (stderr, or a session.warning event with --output-format json) instead of the server silently missing; before, only copilot mcp list said why.
/worktree and /move now run after you answer "Yes" to the folder trust prompt for the current session, instead of being refused as waiting for folder trust until the folder was remembered
Page Up and Page Down move through the settings list again.
Show "Operation cancelled by user" immediately when you press Ctrl+C, without waiting for cancellation cleanup
One-line search fields keep emoji intact when moving the cursor and deleting text
Restart keeps your current /model selection after switching models in-session
/settings unset now directs hidden subagent array keys to /subagents
Resumed handoff and compaction timeline text is sanitized to prevent style injection and extra label rows.
Fix @ file picker match highlighting and path compression for case-expanding Unicode names
Keep Unicode /diff comments and cursor visible in narrow terminal panes
Show files with non-ASCII names in /diff local-changes output
Autopilot says so when it runs with limited permissions because bypass-permissions mode is disabled and assisted approval is not in effect
Tools that embed the CLI now attach to the session requested with --resume instead of a temporary one while it loads.
Connector authorization stays actionable while plugin inventory is loading
Plugin installs and uninstalls keep unrelated extension processes running in active sessions.
Keep MCP registry forms and review summaries readable by sanitizing labels and truncating on grapheme boundaries
/diff shows each file's own patch when file names include glob characters or start with a colon
Keep @ file completion suggestions open when navigating folders with spaces
Tool calls that finish after you abort now show their final completion status in the timeline
Keep tab bar arrows and visible tabs on one row in narrow ask-user forms
Fix /share messaging for sessions without a GitHub repository to clearly report creator-only access
/context correctly separates custom instructions from the system prompt
Tools run on the first prompt even when ambient GitHub login finishes after the turn starts
Pressing Ctrl+C during startup on Windows now exits cleanly and runs shutdown before the TUI mounts.
Auto model routing now preserves your selected Auto tier when account policy refreshes during startup
copilot help config now says autoUpdate defaults to off in CI environments and that non-interactive -p runs start with memory off unless --enable-memory is passed
Installing plugins from different GitHub or URL sources keeps separate cache directories.
Keep previously approved directories accessible after turning allow-all off and changing cwd
MCP servers no longer reload when plugin activation fingerprints change without changing active plugins or trust.
Retry /voice on after a voice model load failure without toggling /voice off first
Resuming a remote session locally no longer requires a clean working tree: uncommitted changes stay in place, and the branch checkout stops only if it would overwrite them
Enforce listed choices in MCP enum and multi-select prompts so tool calls submit valid values.
Non-vision models now get an explicit note when a tool returns an image that is not sent.
Reopening a settings enum editor keeps the cursor on the saved value
Terminal setup prompt defaults to No so pressing Enter on a first prompt does not change keybindings.
copilot plugin list shows a plugin that managed policy enables as enabled instead of [disabled].
In cloud sessions, /chronicle standup now checks local history before reporting no recent activity
Browser sign-in lets you press any key to copy the sign-in link and reopen your browser.
Mouse wheel scrolls the timeline while the /ask quick question box is open
Keep Markdown table layout stable while long link URLs stream in replies
Backspace works correctly in Windows console editors opened with Ctrl+G
ACP sessions include skills from live local marketplace plugins in /skills list and available commands.
Ctrl+D while typing an answer in a question form now deletes the character under the cursor instead of declining the form and discarding the answer.
Keep winget launcher symlinks intact when running copilot update on Windows
Fix caret placement after rendering at the terminal's last column
Plugin uninstall on Windows now explains when another app is using a plugin file and how to resolve it.
Rejected prompt submissions are saved to command history so you can press Up Arrow to resend.
Local plugins with matching directory names now install into separate cache directories.
Keep the /settings and /agent search carets at the cursor when long queries wrap, so no query character is hidden.
Rejected working-directory changes now keep tools and shell commands in the current directory
Resuming a session no longer gets stuck as in use after a crashed process PID is reused.
Keep externally edited prompt text in a recovery file when the editor exits with an error
Submitting /ask or /btw while scrolled up keeps your place in the timeline
Pressing Enter on /quit or /exit now exits immediately while a turn is running
Running agents in /workflows now show their current activity in run details.
Install PyPI MCP registry servers with pinned package versions
MCP stdio requests fail immediately when a response exceeds the 16 MiB line limit.
Large pastes saved in the same millisecond on one session now each get their own file instead of overwriting each other.
When the session folder is deleted mid-session, a ! shell command now says the working directory no longer exists instead of reporting GenericFailure, No such file or directory.
Fix URL permission prompts to keep ${VAR} placeholders in extracted URLs
Resumed renamed sessions now show the correct /share heading instead of New session
MCP servers dashboard keeps your active search and selection while startup authentication resolves
A remote session started outside a GitHub repository now says that it is not linked to one, instead of reporting success with no mention of it
Clicking or hovering a timeline entry no longer targets the entry below it when a word-wrapped line above paints more rows than its width divides into