Update dependency npm:@github/copilot to v1.0.71

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
npm:@github/copilot	1.0.68 → 1.0.71

---

Release Notes

github/copilot-cli (npm:@​github/copilot)

v1.0.71

Compare Source

• copilot -p --autopilot no longer hangs when a background shell or agent outlives the turn; it now honors the COPILOT_TASK_WAIT_TIMEOUT_SECONDS timeout the same way plain -p does.
• Reopening the /subagents model picker keeps each agent's reasoning effort and context tier
• Refresh memory context after 30 minutes in long-lived sessions
• Keep MCP tool lists up to date when servers change
• Avoid leaving long-running background git processes after exit
• Add a configurable maximum for Ctrl+R command history
• On startup, an invalid settings.json now shows a warning identifying the offending value instead of silently ignoring your settings
• /terminal-setup no longer skips setup on terminals without real kitty keyboard support
• Add /voice devices to choose and persist the microphone for voice mode
• Limit which built-in agents are available to tasks and subagents
• Add canvas support in the CLI for extension-driven interactions
• Enforce the sandbox filesystem policy on LSP file reads and rename edits
• Allow empty owner and author emails in marketplace metadata
• Keep all MCP Server Type options visible on short terminals
• Mark disabled skills in copilot skill list and its JSON output
• Plan mode now hard-blocks built-in tool calls that would modify the workspace, so the agent can no longer edit files or run mutating shell commands while planning (built-in mutators like opening a pull request are blocked; MCP and external tools are still allowed)
• Improve /chronicle cost-tips recommendations with richer cost profiles
• Highlight standalone hex colors inline in Markdown
• Persist GitHub MCP toolset/tool config via settings.json (githubMcpToolsets, githubMcpTools, etc.)
• Add plugins marketplace subcommands to list, add, and remove plugin marketplaces
• Persist sidebar sessions across restarts
• Add plugins marketplace browse and update commands
• Split /worktree and /move: /worktree now creates a new worktree and leaves your uncommitted changes behind, while the new /move carries them into the new worktree
• Add local and cloud cost profiles to /chronicle cost-tips
• Switching to autopilot mid-turn now auto-answers questions asked during that same turn
• Custom agents that request a shell tool by alias now also receive the matching read, list, and stop shell tools
• Slash commands and their autocomplete now match regardless of case (e.g. /SESSION works like /session)
• Show repo-enabled plugins in /plugin list and skill pickers
• Press ? twice to dismiss quick help and start a prompt with a literal ?
• Shell completions suggest positional-argument choices
• Show the /app launch message and download link immediately on Linux
• Validate --max-autopilot-continues rejects NaN, negative, and fractional values
• Honor NO_COLOR in the CLI even when chalk cached a color level
• Apply updated session options (shell flags, streaming, custom agent defaults) immediately after /settings changes
• Announce the focused /model row for screen readers
• Announce the focused picker row to screen readers
• Show selected custom agents once in /agent and keep their source label when the file name differs from the display name
• Clear the /model pricing banner when no models match
• Keep /share file session and /share html session from using the full-session selector as an output path
• Honor --context in fresh interactive sessions
• Fixed the model picker changing a hidden model's reasoning effort or context window when the search matched no results, and hid the inert key hints shown in that empty state
• Display plugin root skills as /plugin instead of /plugin:plugin
• Keep valid hooks in a config file when one hook entry is malformed
• Denying write(path) now blocks only the specified path
• Using --add-github-mcp-tool "*" now enables all GitHub MCP tools
• Render empty untracked files without a phantom added line
• Show clean failure messages when copilot skill add fails
• Press Enter on a blank settings array item to show an error instead of saving an empty value
• Press Enter once to toggle booleans with a registered default in /settings
• Declining folder trust in /cwd keeps your live session open and returns to the previous folder
• Show a warning when a workspace MCP config is malformed or cannot be loaded
• Make bare copilot mcp and copilot skill print help and exit 0, matching copilot plugin. Consistent with plugin, the implicit help <subcommand> form is not supported for these groups; use copilot mcp <subcommand> --help (or copilot skill <subcommand> --help) instead.
• Show malformed allowed_models.txt policy errors cleanly in -p mode
• Resume synced sessions by name without a false multiple matches error
• Show an error when --name is used with --session-id for an existing session
• Show --plugin-dir plugins in copilot plugin list
• Keep backgrounded sessions alive when you switch away from them
• Link bare #number GitHub refs in -p --stream off output
• Show the startup banner only on the first launch when set to once
• Allow copilot update and /update to accept stable as a channel
• Surface --plugin-dir warnings in the terminal
• Surface the real load error for malformed custom agents
• Reject --continue when used with --resume
• Prompt mode now exits non-zero when a --share or --share-gist export fails
• Server mode reconnects OAuth MCP servers from cached tokens
• Keep stored Git credential helpers available for marketplace plugin installs
• The /model picker shows the Auto model description as markdown with a clickable Learn More link
• Keep sessions tied to their working directory across prompts, restarts, and workspace tools
• Always offer a custom answer in ask_user choice prompts
• Lower the default maximum sub-agent nesting depth from 6 to 4 to curb runaway recursive sub-agent delegation. Usage-based billing users can still adjust subagents.maxDepth (up to 128).
• Add a pinned prompts setting in /settings to control prompt pinning
• Add Repo and Repo (local) scope tabs to the /settings dashboard
• Interactive shell commands now fail with a retryable "reconfiguring" message instead of an "unknown shellManager handle" error after the shell manager is disposed, and a detached command's completion notification is no longer lost when the shell context is reconfigured while a read is in progress
• Reject custom-agent names that would create hidden files
• Reject malformed --allow-tool and --deny-tool patterns with an error message
• Show retained shell output in /tasks Shell Details for finished tasks
• Remove duplicate Error: prefixes from plugin command failures
• Shell completions stop suggesting subcommands as flag values
• Show singular message counts in /usage activity graph
• Keep /cd from switching to files or inaccessible directories
• Dismissing the quick-help overlay with ? no longer leaves a stray ? in the prompt
• --sandbox and --no-sandbox now show their "ignored" warning during interactive startup when the sandbox feature is unavailable (previously it was only visible in non-interactive mode)
• Show the full command with its arguments (not just the wrapper) in the /mcp server detail view
• Hide the inert navigate and view-log hints in the empty /lsp logs (LSP Services) panel
• Exit non-interactive prompt runs with a failure code when a prompt is blocked before responding
• Show the Auto discount in the redesigned inline model picker
• New sessions start in the default directory instead of the active session's cwd
• Fish completion only offers enum values for closed-choice flags
• Use targeted validation commands and lighter install guidance by default
• Use ctrl+x → x to close a session and ctrl+x → h to hide the split sidebar

v1.0.70

Compare Source

• Add GPT-5.6 model support
• Show a single Error prefix for mcp and skill command failures
• Show the real parse error when --agent selects a malformed custom agent
• web_fetch works through mandatory HTTPS proxies
• Hide / search on the Gists tab
• Treat superseded subagent runs as cancellations instead of failures
• Add paginated session.mcp.resources read/list/listTemplates RPCs for MCP server resources
• preToolUse hooks that exit with code 2 deny tool calls
• Create draft skills when Forge finds a clear workflow pattern
• Hide the GitHub App install nudge in remote terminals
• Pin plugins to an exact commit SHA using the sha field in plugin source configuration
• Add --sandbox and --no-sandbox flags to turn the OS-level shell sandbox on or off for the current session only, without changing your saved sandbox setting (useful with -p)
• Add /refine to rewrite a rough, stream-of-consciousness prompt into a clear one
• Add --repo and --local flags to /settings and /model
• Add a setting to show or hide timeline timestamps
• Let a trusted repository pin the model, effort level, and context tier and extend the URL/MCP/skill deny lists via .github/copilot/settings.json
• Expose SDK APIs to manage live MCP servers in running sessions
• Show the active user's models after /user switch
• Declining an extension's permission prompt no longer disables tool approvals for the rest of the session
• Avoid redundant background agent notifications after a blocking read_agent returns its result
• Startup auth errors recommend the real copilot login command
• Keep merge-semantics settings editable in /settings
• Re-sync managed plugins when their cache is missing or empty
• Copy the last assistant response even after command echoes
• Persist the last-logged-in user on every login so a restarted runtime client stays authenticated
• Hide /agent picker navigation hints when there is nothing to select
• Open the plan file or research report with Ctrl+Y in any mode
• Keep terminal color scheme changes in sync over SSH and remote shells
• Prefill /chronicle search so it can accept a query
• Show a distinct scrollbar thumb glyph in the /model picker on the no-color path (--no-color, non-color terminals) so the scroll position stays visible
• Skip launching a browser in remote terminals
• Arrow keys in /search and reverse search stay in search instead of switching tabs
• Restore tool event ordering so permission prompts appear after tool start
• Show only one cancellation message when streaming is aborted
• Keep /pr tables aligned in compact timeline view
• Show clear validation errors for empty or non-ASCII skill and command names
• Keep footer selection highlights aligned when the session bar is open
• Fail fast when marketplace plugin git auth needs a terminal prompt
• Dismiss other pending read and fetch sandbox-bypass prompts after you disable the sandbox
• Fix a crash on Windows triggered by desktop toast notifications
• Improve GPT-5.6 commentary guidance for tool-driven progress updates
• Highlight the sidebar toggle hint in the input footer
• Make markdown links and bare URLs in the timeline and tool output clickable
• Reclaim the blank line under the home tab bar: the timeline (and Sessions+Current split) sits flush under the tabs when a prompt is pinned, keeping one breathing line only while nothing is pinned
• Press Tab to switch the context window in /model
• Long-running sessions refresh enterprise managed settings hourly
• Mark locally-spawned MCP servers that run inside the sandbox in /mcp list (e.g. connected (sandboxed))

v1.0.69

Compare Source

• Label built-in file edits with a (sandbox policy) badge instead of (sandboxed), since they follow the sandbox policy on a best-effort basis rather than running in the OS-level sandbox
• Reload installed plugin extensions without restarting a session
• Add a /plugins dashboard to manage installed plugins
• Open quick help from an empty prompt without leaving a stray ?
• Add minimal reasoning effort for gemini-3.5-flash
• Show a scrollbar in the /model picker list
• Show disabled servers as disabled in /lsp test
• Let built-in file edits bypass the sandbox when you approve it
• web_fetch now follows the active sandbox network policy (denying outbound or local targets the policy blocks) and, when the host opts in via sandbox.allowBypass, lets you approve a one-time bypass from the fetch prompt
• Show exact local assistant usage in Chronicle and session SQL
• Confirm before resuming a remote session from a different repository
• Delay read-only remote session creation until you send the first message
• Display reasoning-effort labels in the CLI footer
• Show descriptions for sandbox userPolicy settings in /settings
• Reject explicitly empty --name= values when starting a session
• Create delegate PRs against the current branch by default, with /delegate --base to choose another PR target branch
• Make /copy fall back to wl-copy on Wayland
• Improve /sandbox add-path suggestions so they open only when you ask for them
• Improve /chronicle cost-tips with more precise evidence-backed recommendations
• Hold Alt (Option on macOS) while scrolling to move one line at a time
• Resume and switch large sessions faster
• Speed up /diff rendering and scrolling on large diffs
• Keep the full /model picker on screen when the timeline is full, re-snapping as its details banner grows so the search box and hint bar are no longer clipped below the terminal
• Hide transient console windows when the CLI starts helper processes on Windows
• Auto-approval timeline entries now include the request subject, such as the command, path, URL, or tool name
• /allow-all auto now requires experimental mode (/experimental on or --experimental) instead of the AUTO_APPROVAL env var or feature flag
• Show /rubber-duck in pre-auth help and self-documentation
• Include files inside new untracked directories in /diff local edits
• A prompt taller than the screen stays scrollable when its top scrolls off, instead of collapsing to a pinned header
• Require Copilot login before ACP authenticate returns success
• Show the full assistant response in prompt mode when --stream is off
• Disconnect a repo-scoped plugin's MCP server when the repo disables it or the session leaves the declaring repository
• Prevent copilot init from hanging in non-interactive mode
• Reject empty --session-id= values instead of ignoring them
• Reject empty --resume= values instead of starting a new session
• Preserve emoji in truncated timeline tool arguments
• Show plain Shift+Enter in /terminal-setup output
• Keep session resume working when token timing includes fractional milliseconds
• Complete @​-mentions for files whose names start with [DIR]
• Sign in to MCP servers through the CLI OAuth callback flow
• Reveal the full /user switch picker when the timeline is full so its hint bar is no longer clipped below the terminal
• Add /mcp list to show attached MCP servers and their status, and allow /mcp list and /plugin list to run while the agent is working
• Allow opening the /mcp manager while the agent is working to enable or disable servers mid-turn; add, edit, delete, and re-auth stay paused until the turn finishes
• Add auto allow-all mode that auto-approves requests an LLM judge evaluates as acceptable
• Add a stayInAutopilot setting (default false) that keeps the CLI in autopilot mode after an autopilot task completes
• Pinned prompts keep their full frame aligned while scrolling
• Suppress macOS pasteboard stderr during clipboard reads and writes
• Keep colons intact in rendered markdown output
• Warn when multiple plugins define the same MCP server
• Collect debug logs without truncating large files or dropping multiline secrets
• Find PRs from worktree branches when the local branch name differs from the PR head ref
• Skip the autopilot permission prompt when bypass mode is disabled by policy
• Allow WSL UNC paths for local files in the CLI
• Apply --reasoning-effort reliably when the CLI starts
• Keep slash-command picker rows intact in tab-expanding terminals
• Keep model switches working when tool call IDs include punctuation
• Double-press Esc now interrupts the running main turn (flushing queued messages), or stops background agents when the main agent is idle
• Prevent benign Windows crash reports when the CLI exits
• Wrap clipboard writes in tmux passthrough so copy reaches the outer terminal
• OAuth-gated MCP servers now register their tools after reconnect
• Keep CLI authentication working in one-shot sessions
• Ctrl+C dismisses ask_user and elicitation prompts like Escape
• Show Authenticate for cancelled MCP OAuth requests
• Keep /help from listing rewind/undo twice
• Keep MCP servers in needs-auth after OAuth cancellation
• Hide staff-only commands from pre-auth help and self-documentation
• Surface skill loading errors and warnings in skill list
• Browse and filter models more easily in the CLI model picker
• Resume sessions faster by removing quadratic work when rebuilding the timeline
• Warn when static context uses most of the prompt budget and block requests when little conversation room remains
• Improve CLI responsiveness when reading and writing session databases
• Improve slash-command and theme picker option descriptions
• Remove inert sandbox host lists and the Clear policy on exit toggle
• Add file and folder completion to /sandbox path entries
• Update a backgrounded session's branch label in the Sessions split view when its working directory changes
• Skip unnecessary MCP reloads when returning to an already-loaded session
• Prevent the tgrep indexer from running out of memory on large monorepos, and fall back to ripgrep if the indexer is killed instead of repeatedly restarting it

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • "before 8am on Saturday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.