@github/copilot 1.0.106-7

on Node.js NPM

Added

• Rex terminals render inline images using Kitty direct placements.
• Add /code command to open the current session in VS Code
• Add a Fusion tier setting to copilot config.

Improved

• Update the built-in browser-use plugin to 0.1.0 with improved setup and browser integration behavior
• Improve Claude token estimation so context budgeting and trimming decisions are more accurate.

Fixed

• Box-drawing and block characters in prompts display as entered in the composer and timeline.
• Preserve the draft caret position after command mode so editing continues at the original cursor location
• Sandboxed Hugo commands can use Hugo and Go caches when developer-tool access is enabled
• Managed sandbox policy errors now tell you to contact your administrator and include the failed sandbox test command when it cannot start.
• Sandboxed commands on macOS can read files inside the default Xcode.app bundle.
• ACP mode now honors --agent so the selected agent persona, prompt, and tools are applied at startup.
• Unchanged cached MCP tools remain callable when another tool refreshes while permission is pending
• The Sessions tab and the home tab bar now respond to keys after Ctrl+X / runs /session over a draft with an open slash-command or @ menu, and one Escape closes /ide without clearing that draft.
• File diffs in permission prompts and /diff show control characters from the file as visible symbols instead of letting escape sequences restyle or hide lines.
• The footer draws a git branch name that holds control characters as plain text, so the branch can no longer recolour the footer or set the terminal window title.
• On narrow terminals the footer no longer leaves a stray separator where a hint did not fit or cuts the permission mode mid-name.
• A hook's permission message and the reason a hook queues as the next message no longer pass escape sequences to the terminal, so they cannot hide text or start a link in the hook prompt or the queued-message list.
• MCP, LSP and plugin.json config files saved with a UTF-8 byte-order mark, as Windows PowerShell 5 and older Notepad versions write them, are now loaded instead of being rejected or ignored.
• Command approval prompts and completion notices no longer pass escape sequences from a model-written description to the terminal, so that text cannot be hidden, recolored or made a link.
• copilot plugin list and copilot plugin update no longer pass control characters from a plugin's name, marketplace or version through to the terminal.
• When a /settings JSON value saved from your editor is not valid JSON, the error now shows any control characters it quotes from the file instead of letting them restyle the dialog.
• Changing a setting through /experimental, the status line picker, the subagent or extension pickers and similar commands no longer replaces a settings.json the CLI cannot read with just that one setting. The change is refused with an error and the file is left untouched.
• Searching a /share html export or an exported research report now highlights the text you searched for, instead of a shifted span or a broken emoji, when the conversation contains a capital dotted I (İ).
• Command output in the timeline no longer passes DEL and 8-bit C1 control characters to the terminal, so a file or command output can no longer change the window title or break the output rows; each one is shown as a space.
• Stopping an unknown shell ID fails without stopping a command and directs you to list active shell sessions.
• A failed tool call's error text, such as an MCP server's, no longer passes escape sequences to the terminal, so it cannot hide text or start a link in the failure row.
• The move of an older $XDG_CONFIG_HOME/.copilot directory into ~/.copilot now also brings over your MCP servers, language servers, saved folder permissions, personal instructions, custom agents and skills, and no longer replaces a symlink in ~/.copilot whose target is missing.
• Copying text on Linux no longer prints "Somebody else owns the clipboard now" over the UI when another app takes the clipboard
• Pressing Backspace to cancel command mode now preserves your draft text.
• Queue manager stays open when pending updates refresh concurrently
• Background Autopilot sessions auto-answer ask_user prompts without requiring you to foreground the session
• Warn when older messages are dropped for context limits and include compaction/truncation events in JSON output.
• /diff uses the active worktree after changing the session working directory
• Custom subagents with private MCP connections no longer start inherited servers excluded by their resolved tool list.
• Prompt for path access when long-option values like --name=/path reference files outside allowed directories
• Keep the Selected marker readable in /settings when screen reader mode is enabled
• Prevent /settings external editor save from overwriting concurrent settings changes
• Local models added from the /model picker now stay under their provider's section when grouped by vendor, instead of moving to Other models
• Unknown root options after a subcommand now suggest moving the option before the subcommand
• New files created with create and apply_patch now follow repository-declared line endings.
• Clicking tool calls in /tasks sub-agent details now expands and collapses their output
• SDK extensions.discover() now lists extensions from enabled plugins installed from a local directory marketplace, which sessions already load, and extensions.enable accepts them under plugin-only extension policy.
• LSP servers whose fileExtensions keys omit the leading dot (for example "java" instead of ".java") now handle file-based requests instead of reporting that no language server is available.
• Fix grouped grep results so files with names like 2024-01-15 stay correctly attributed in assistant responses
• Footer text selection highlighting stays aligned while transcript lines change
• Shell safety warnings no longer appear twice in the timeline during command approvals.
• Nested subagents inherit and can use MCP tools allowed by the session policy.
• --yolo and --allow-all now take effect when resuming a local session with --resume or --continue