Download Latest Version v1.0.31 source code.zip (12.8 MB)
Home / v1.0.31
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2026-11-10 32.4 kB
0
v1.0.31 source code.tar.gz 2026-11-10 8.6 MB
0
v1.0.31 source code.zip 2026-11-10 12.8 MB
0
Totals: 3 Items   21.5 MB 0
  • Preserve proxy 407 errors for unsupported authentication challenges without waiting for unused target TLS configuration.
  • Sandbox config: add userPolicy.filesystem.enumeratePaths (Windows only), granting enumerate-only access to the listed paths.
  • Fixed: an empty sendMessages batch after a completed Claude turn no longer fails with "This model does not support assistant message prefill".
  • Node.js: when a tool result cannot be sent to the runtime, the SDK now logs the failure and answers the tool call with the error instead of leaving it unanswered.
  • Telemetry header helpers avoid blocking-pool admission when their executable path requires no filesystem search.
  • Reasoning effort changes made during a tool call now apply to the next model request without waiting for another user message.
  • Session opens that fail during post-construction initialization now await native-registration retirement before reporting the original error.
  • Requests to OpenAI-compatible chat-completions providers no longer include an internal message field on skill and tool messages.
  • Creating or resuming a session, or calling setTools, with two tools of the same name now fails with an error naming the tool, instead of offering the model the first definition while some SDKs ran the last handler.
  • Copilot SDK runtime now advertises MCP Apps only when a renderer is configured.
  • A customAgents entry that a built-in agent shadows now gets the session.custom_agents_updated warning without enableConfigDiscovery, and subagent.started no longer reports its description for the built-in run.
  • Java SDK replaces SpotBugs nullability annotations with JSpecify 1.0.0.
  • Avoid waiting for MCP transport handshakes during managed-policy restoration when matching cached tools are available.
  • Support managed settings assignments that enable plugins by default.
  • Python: with the TCP transport, the SDK now reads the runtime's stderr for as long as the runtime runs, so the runtime can no longer block on a full pipe, and a runtime that exits before announcing its port is reported with its exit code and stderr.
  • .NET: a SessionFs SQLite provider can return SQL NULL as DBNull.Value (what ADO.NET readers return); such cells are now sent as null instead of failing the query.
  • Fixed scheduled and queued SDK-registered slash commands not running their handlers.
  • Java and Python: a system message section transform that returns null or None now leaves the section unchanged, instead of removing it (Java) or replacing it with "None" (Python).
  • Fixed disabledSkills, session.skills.disable and session.skills.enable to match a skill name in any letter case, as invoking the skill does, instead of silently changing nothing when the case differs.
  • Blob attachments with a MIME type the runtime cannot send now reach the model as their display name and an "omitted" note instead of being dropped silently.
  • A refusal from an OpenAI model is now returned as the assistant's reply instead of failing the turn with "No response was returned".
  • Prevent initial managed-policy publication from invalidating repository hook loading during session creation.
  • Adds experimental decisions.ask and models.list decisionModels for Copilot decision models, behind the DECISIONS_API flag.
  • Session event streams no longer include the internal session.memory_changed and instruction.update_delivery events, which the SDKs do not model (.NET reported them as unknown).
  • Add experimental memory.storeMemory callback so apps can store agent memories in their own storage.
  • Fixed view continuation skipping line suffixes at page boundaries and explicitly marked partial output from oversized lines.
  • MAI Code 2 and MAI Code 2 Flash sessions now include model safety guidance in the existing SDK safety section, independently of identity customization; their child agents retain the same model policy.
  • Experimental MCP skills now expose readable server-qualified names, reuse cached discovery metadata, and avoid consent failures caused by catalog-only updates.
  • Session credentials set with accounts.set (setCredentials) or gitHubAuth.login are now refused when the supplied login is not the token's user, and no longer create a second account for a case-only variant of a saved login.
  • Python, .NET, Go, Rust and Java: when a tool result fails to send, the SDK now logs the failure and answers the tool call with the error instead of leaving the turn waiting
  • session.plan.readSqlTodos and readSqlTodosWithDependencies now read a SessionFs SQLite database instead of always answering empty.
  • Rust: the session_fs example now implements every core SessionFsProvider method and creates a session, and the SessionFsProvider docs say to implement all ten core methods instead of only the ones a backing store needs.
  • The Node.js, Python, Go and Rust manual tool resume samples now set a permission handler and stop clients gracefully, so they complete instead of hanging at the permission prompt.
  • Sessions whose client tools returned contents, causalDependencies or remediation values outside the event schema can be resumed again, instead of failing with "Session file is corrupted".
  • Add LSP inventory, warmup, startup probes, enablement, and shutdown APIs.
  • GitHub service calls made while a session's first sign-in is still resolving no longer fail with "The bound session credential source changed".
  • .NET: a tool whose AIFunction returns a string, for example through AIFunctionFactoryOptions.MarshalResult or an AIFunction subclass, now sends that text to the model as-is instead of as a quoted JSON string.
  • Rust, Java, Python: concurrent installs of the bundled CLI no longer replace a copy another process is already running, which could make the first connection fail on Linux.
  • Java: a system message section transform callback that throws or returns null no longer hangs the session; the section keeps its original text, as it does when the callback's future fails.
  • Session setup no longer holds the registry lock while waiting for another operation on that session.
  • Live tool discovery no longer reports a closed session when an LSP client reset publishes its next generation.
  • Fix diagnostic memory sampling prolonging native runtime teardown.
  • Fixed permission requests waiting for host event acknowledgements after a response was already settled.
  • Local-model registry lookup honors nonempty COPILOT_HOME even if HOME and USERPROFILE are unset.
  • Go: a canvas action that returns a ToolResult without ResultType now sends its text and images to the model like a tool result, instead of the whole value as JSON text.
  • Add an optional permissionMode to session create and resume configs so a session starts in Manual, Assisted or Allow all mode before its first turn or resumed work; the applied result is available on the session.
  • Replaced the experimental kerberosAuth client option with an experimental network option whose resolveProxy and authenticateNegotiate callbacks let the SDK host decide the runtime's proxies, or leave a request to the runtime's own proxy resolution, and supply its Kerberos tokens.
  • Python: a tool, slash command, elicitation, skill provider or memory store handler that raises a BaseException that is not an Exception, such as pytest.fail(), now fails its request instead of leaving it unanswered.
  • Allocate exclusively owned temporary directories for macOS language-server startup probes.
  • Java: a storeMemory callback that throws a non-fatal Error, such as AssertionError, now fails the store_memory call promptly instead of leaving it unanswered until the 60-second timeout.
  • Fix .NET client shutdown racing in-flight JSON-RPC sends and preserve terminal error stack traces.
  • Java: a slash command or elicitation handler that throws an Error, such as an AssertionError, now fails or cancels its request instead of leaving it unanswered.
  • Python: Pending RPC requests now fail when the client is stopped instead of waiting indefinitely.
  • MCP deny rules now match the tool name the MCP server advertises as well as the sanitized name exposed to the model.
  • .NET: Fix native resource leaks when in-process client startup fails before connection setup completes.
  • Fixed cold session create and resume failing with "Custom agent not found" when the requested agent comes from a plugin enabled by enterprise managed settings.
  • Preserve SDK correlation IDs in telemetry emitted during native session creation and cold resume.
  • A turn that ends while the session event log cannot be written now still emits session.idle, so sendAndWait no longer times out on a completed turn.
  • Added Auto mode recovery for failed explicit-model requests in the Copilot SDK.
  • The SDK now rejects HTTPS runtime URLs.
  • Correct large-tool-output documentation to match the runtime's default threshold of 20480 bytes.
  • Retry failed local MCP connections when their effective sandbox launch policy changes.
  • In-workspace reads are approved without a judge call.
  • Assisted Autopilot no longer asks a human for permission.
  • Assisted Autopilot denials return feedback to the agent.
  • Required denied work ends with outcome blocked.
  • session.task_complete adds blockedActions.
  • Task blockers add reason permission_recovery_run_limit.
  • Hosts should render blocker and blockedActions.
  • Owning hosts can call internal session.ui.handleHuman*.
  • handleHuman* covers ask_user, user input, plan exit.
  • handleHuman* answers count as human input for the judge.
  • Generic handlePending* answers stay non-authoritative.
  • Permission requests carry assistedApprovalAssessment.
  • The assessment shows judge outcome, exclusion or failure.
  • permission.completed stays the authoritative result.
  • Add assistedApprovalContext to permissions.configure.
  • Judge host context is bounded, per-source and advisory.
  • Shell command analysis always runs for SDK sessions.
  • Read-only shell commands no longer ask for permission.
  • enableScriptSafety is deprecated and ignored.
  • Sandbox-bypass requests never offer session approval.
  • PermissionDecisionContext adds optional userFeedback.
  • userFeedback reaches only restricted telemetry.
  • PermissionAssistedApproval adds judge evaluationId.
  • extension-permission-access requests skip the judge.
  • Extension capability requests need explicit user consent.
  • Approval reasonCode adds extension-permission-access.
  • Assisted judge calls no longer count as premium requests.
  • On Linux, language servers are no longer told that the files in a directory were deleted when the directory is renamed away and straight back.
  • release note from following text with a blank line.`). Another tag, a heading, a list, a fence or a comment may still follow directly. Otherwise descriptions parse as before, one note per line. This came from the deep review's finding.
  • MCP tools/call requests now carry the runtime tool call ID in _meta["com.github.copilot/toolCallId"].
  • user.message events carry the clientTurnId of the send that delivered the message, when one was supplied.
  • send and sendAndWait accept an optional clientTurnId, which the runtime adds to MCP tools/call requests in that turn as _meta["com.github.copilot/turnId"].
  • Add session.model.startupAdmission to read startup model state and claim model enablement.
  • Attaching an empty PDF or Office file no longer fails the turn on models that read documents natively; it is passed as a file reference instead.
  • Rust: a tool handler that panics now fails its tool call with the error "tool handler panicked" instead of leaving the call unanswered until the turn is aborted.
  • Add allowMultipleToolCalls to session creation and resume to request single-call model responses while preserving existing parallel defaults.
  • Rust: the continue_pending_work docs now say to hand off a session with Client::stop, because Client::force_stop can lose pending work when it terminates a runtime the client started.
  • Fixed team customizations and feedback uploads ignoring SDK client and OS proxy settings.
  • Java: a user input, exit plan mode or auto mode switch handler that throws an Error (such as an AssertionError) is now answered with an error instead of leaving the turn waiting.
  • On Linux, language servers are now told when a directory is renamed while other directories in the workspace are being created and removed, such as during a package install.
  • Azure OpenAI BYOK providers again receive the default prompt-caching request shape; modelProvider only affects telemetry.
  • Go and Rust use owner-only per-user temporary caches on Unix when normal user-cache discovery is unavailable, preserving no-home fallback support.
  • Java generated RPC and event DTOs now provide named builders, avoiding source changes when optional schema properties are added.
  • Reload invalidated skill catalogs before preparing configured agent skill contexts.
  • Go, Node.js, Python, Java: a disconnected session is no longer kept by its client until stop(), so a long-lived client that creates and disconnects many sessions no longer grows in memory.
  • Python: a failed or cancelled CopilotClient.start() now stops the runtime process it spawned instead of leaving it running.
  • Preserve structured provider diagnostics in session error events and sendAndWait completion errors, including optional providerErrorCode.
  • .NET: hooks, the permission handler and session event handlers no longer run under the Activity that was current when the client started or the session was created, so spans and calls made from them are no longer attributed to that finished trace. Hooks now run under the trace context the runtime sends in the hook input.
  • Rust: the session event loop span is now a root span, so permission, tool, hook and other callback spans are no longer recorded under the span that was current when the session was created or resumed.
  • Prevent cancelled MCP authentication catch-up requests from cancelling a valid connection.
  • Add the ephemeral session.compaction_summarized event, emitted when a background compaction summary settles and before it is applied.
  • A session that starts indexed search in a new folder while another session of the same process is still stopping its index server now waits for that server and indexes the folder, instead of falling back to ripgrep for the rest of the session.
  • .NET: after a failed StartAsync, the next StartAsync or automatic start runs a new startup instead of rethrowing the first error.
  • Java: after a failed start(), the next start(), or the next automatic start when auto-start is enabled, runs a new startup instead of failing with the first error.
  • Permission prompt events for URL requests now include an optional parentDomainPattern, a wildcard covering the registrable domain and its subdomains, which hosts can offer as a session-scoped approval.
  • Java: generated union types and session events now serialize their discriminator once instead of twice, and an unknown session event keeps its original type when serialized.
  • Fix missing namespaces when replaying standalone deferred tool calls after switching from Claude to GPT, and provide continuation guidance for unrepaired namespace errors.
  • Rust: when the bundled runtime cannot be extracted, Client::start now reports the directory and the I/O error instead of saying the CLI is not bundled, and the next Client::start retries the extraction.
  • Adds SDK-owned session operations for feature flags, managed settings, dynamic context, permissions, model-context directories, sandbox state, working-directory context, and builtin-agent overrides.
  • Preserves explicit null experiment overrides in Java SDK requests.
  • Preserves stored automatic approval separately from effective policy approval in SDK responses.
  • Preserves explicit host permission requirements when temporary providers detach.
  • Adds explicit Go permission envelopes for lossless managed review while preserving existing public types and legacy callbacks.
  • session.model.switchTo now rejects an unsupported reasoningSummary, verbosity or contextTier with the same error as session creation, instead of recording it and leaving the session impossible to resume.
  • Fixed inconsistent plugin IDs between built-in plugin hooks, agents, skills, instructions, and plugins.list.
  • Added client-side programmatic tool calling support in the Copilot runtime SDK.
  • Rust preserves existing event payload construction and exposes experimental program provenance through an additive metadata wrapper.
  • Go programmatic events and permission callbacks expose optional ProgramToolCallID fields while retaining concrete payload/request types; positional struct literals require updating.
  • Fixed managed plugin reconciliation being skipped when a completed preparation plan still had unapplied defaults.
  • Python, Go: abandoning session.featureFlags.read by timeout or cancellation now sends $/cancelRequest, so the runtime stops waiting and no longer sends the snapshot to the dropped request later.
  • Fix continuing a resumed session hanging on an abandoned SDK tool callback when its handler is registered again.
  • session.options.update now rejects an unsupported reasoningSummary, verbosity or contextTier with the same error session.create gives, instead of storing it.
  • A repository whose remote uses GitHub's SSH-over-443 host ssh.github.com is now reported as its github.com repository in the session context and git.reposFromRemotes.
  • session.lsp.set now changes only disabledServers in the user's lsp-config.json, and no longer erases the definitions of other servers disabled with "disabled": true.
  • session.tasks.getProgress on a client-owned task now returns at most the 20 most recent progress messages in recentActivity, matching agent tasks.
  • session.lsp.diagnose no longer reports a working stdio language server as exiting immediately when the sandbox is off.
  • Python, Go: the skill provider docs now say that a running provider call is cancelled when the connection closes or the client is force-stopped, instead of saying that it runs until it returns.
  • Session shutdown now stops eager authentication requests once their last shared owner is released.
  • Session shutdown keeps credential bindings available while final session and process consumers drain.
  • MCP lifecycle requests now respect required sandbox admission while teardown remains available.
  • Installing a plugin from a GitHub or git repository that uses Git LFS downloads only the LFS files under the plugin's own path, so an unavailable LFS object elsewhere in the repository no longer fails the install.
  • Adds session preference updates through session.options.update.settings.
  • Python: fix intermittent Windows runtime installation failures when concurrent installers initialize the same cache lock file.
  • The task tool now dispatches to a custom agent added to .github/agents/ mid-session without requiring an agent reload.
  • Text after /init is now sent to the model as additional instructions instead of being dropped.
  • Disposed SDK sessions are now cleaned up.
  • The built-in web_fetch tool no longer strips markup from, or re-decodes, application/json and text/plain responses that quote an html tag near their start.
  • Unavailable models selected through environment variables or saved settings now fail when used instead of silently selecting another model.
  • Re-enabled and restarted local MCP servers use the session's current sandbox policy.
  • The built-in web_fetch tool rejects a negative start_index and a max_length below 1 with a validation error instead of reading them from the end of the page.
  • Sessions whose session.shutdown record holds a non-integer code-change line count, as some earlier CLI versions wrote, can be resumed again.
  • MCP list, listTools, OAuth login and OAuth state-change requests now respect required sandbox admission, and Apps diagnose no longer starts servers on a blocked session.
  • Local-model servers with persist: true are recorded and reused across runs when the runtime is launched without HOME or COPILOT_HOME.
  • listModels() before a session is created now recovers from 421 Misdirected Request after a plan change by re-resolving the account's endpoint once, instead of failing until a session is created.
  • Staff settings are written to the account's ~/.copilot/config.json instead of the working directory when the runtime is launched without HOME or COPILOT_HOME.
  • Go: Stop() and ForceStop() on a client connected with URIConnection no longer print "use of closed network connection" errors.
  • Invalid context values passed to session.metadata.recordContextChange and invalid type values passed to session.shutdown are now rejected with an error instead of making the session impossible to resume.
  • Fix a native crash when cancelling client-side JavaScript programs during compilation.
  • Resuming a stored session now reports a customAgents entry that a built-in agent shadows in session.custom_agents_updated, as create and resume of an open session already did.
  • .NET: Reduce JSON-RPC receive-buffer copying for coalesced messages.
  • A sessionStart or preToolUse file hook that returns "additionalContext": null no longer sends the text null to the model; null is treated as absent.
  • session.agent.list no longer fails with "Agent discovery inputs were superseded" when the agent catalog is invalidated concurrently.
  • Release consumed callback buffers in the .NET, Java, and Go in-process transports instead of retaining them while idle.
  • Model information now reports the resolved Copilot Fusion tier.
  • client.getAuthStatus() now includes login for a client signed in with the gitHubToken option, as it already did for GH_TOKEN.
  • After continuing from the session limit prompt, the session no longer records a stale "Session limit reached" notice.
  • Fixed the experimental network.resolveProxy callback not being asked for a session's remote MCP servers when it is registered with the default connection scope.
  • On Linux, a burst of file writes in a large workspace no longer costs seconds of CPU while a language server watches files.
  • Workflow resume now reports a limit that does not raise the approved one with a message naming the value it must exceed, instead of the out-of-range message.
  • Rust: Stop sending frames after a stream write failure while continuing to drain pending responses.
  • On Linux, language servers are now told about files created in a workspace directory that was deleted and recreated in one quick step, such as a build regenerating its output directories.
  • Fixed session rewind to report session-busy when a turn is running.
  • Fixed MCP OAuth for servers whose 401 names the protected-resource metadata with a relative resource_metadata path.
  • Session events: each assistant.message of a model response split at a reasoning boundary now carries chunkIndex and chunkCount, so clients can group the parts and find the last one.
  • Go: concurrent installs of the bundled CLI no longer replace a CLI another process already started when the install lock cannot be acquired.
  • A device Policy Helper's policy is applied again when a session without a GitHub sign-in is resumed, so repository hooks it locks no longer run.
  • The runtime now asks a session's gitHubTokenProvider for a refresh before each model call once the token has an hour or less left, not only at the start of a user message.
  • Update Node.js SDK Koffi and refresh compatible Rust SDK dependencies.
  • Fixed standalone host reporting rejected SDK tokens as missing tokens.
  • Fixed failures in MCP startup and session.send caused by slow configuration writes.
  • Fixed shared SDK commands becoming unavailable to the remaining client when the owner leaves.
  • Java: in-process clients that start at the same time on a cold runtime cache now extract the native runtime once instead of once per client.
  • .NET: SendAndWaitAsync no longer throws when the CLI exits right after completing a turn while an event handler is still running.
  • Fixed: session.agent.reload no longer fails with "Agent discovery inputs were superseded" when another change refreshes the agent catalog during the reload; it reloads again and returns the current catalog.
  • Fix plugin subagent dispatch after custom-agent catalog invalidation.
  • Rust: clients that start at the same time with the same bundled_cli_extract_dir now extract the bundled runtime once instead of once per client, and no longer install a second copy in a version subdirectory.
  • Fixed: indexed search now deletes cached per-repository indexes of repositories and worktrees that no longer exist, including indexes written before 1.0.108.
  • Fixed: with a custom session filesystem and the sandbox enabled, an attachment path that matched only a host-derived grant such as the runtime's temp directory is now denied, matching the file tools.
  • Sessionless agents, skills, hooks and instructions discovery now include plugins installed from a local directory marketplace.
  • Added built-in subagent allowlist configuration to create and resume sessions in all SDKs, including disabling built-ins while retaining custom agents.
  • The sandbox bypass decision event now reports prompt_unavailable, not user_prompted, when a host rejects the bypass prompt with an automated decisionContext.source such as host_policy.
  • Fixed mcp.oauth_required carrying grantType authorization_code for a client supplied to mcp.oauth.login; grantType is now present only for client_credentials, as the event schema declares.
  • Improved runtime reliability by recovering permission prompts after a host-acknowledgement timeout.
  • Resuming a session during a HydraFusion turn with the same GitHub token no longer makes the turn's remaining review and repair phases fail instantly.
  • Custom agents loaded from agent files or plugins without a tools list are now reported with the documented all-tools encoding (null tools in session.custom_agents_updated, no tools in AgentInfo) instead of the list ["*"].
  • Add connection-owned local model management through the SDK.
  • Skills and custom agents that an AHP host session gets from a plugin are now reported with source plugin, so the Python and Java SDKs can decode session.skills_loaded, skills.list and agent.list for those sessions.
  • Approving a plan written by HydraFusion, or switching models during a HydraFusion turn, now keeps the turn's first answer instead of failing its review and repair phases instantly.
  • session.mcp.listTools returns the declared McpTools shape again, with ui populated from a tool's MCP Apps metadata and without the raw tools/list fields.
  • The session.usage_info event's isInitial field is now true only for a session's first usage report, as documented, instead of for the first model request of every message.
  • External tool definitions accept an optional idempotent hint so the runtime can safely re-run a programmatic tool call whose outcome was lost; ProtocolExternalToolDefinition gains the field (source break for Go positional and exhaustive Rust literals).
  • session.tools.getCurrentMetadata entries now match CurrentToolMetadata: they no longer carry an undeclared title, and a tool registered without a description reports an empty description instead of omitting the required field.
  • session.permissions.modifyRules now rejects a scope other than "session" or "location" with an error, instead of reporting success without removing the requested rules.
  • Corrected the session.context_cleared event documentation, which named a Session.clearContextMessages method that no longer exists and omitted that the runtime also emits the event when it starts a fresh context window.
  • session.workspaces.truncateSummaries now rejects a missing, negative or non-integer keepCount instead of deleting every compaction checkpoint; an explicit 0 still deletes all of them.
  • Token providers: a lifetime rejection after token validation now reports the expiresIn the provider returned and what remained, without a GenericFailure, prefix, and the docs state that more than one hour must remain after the runtime validates the token.
  • Assisted Permissions grants (authenticatedAuthority) accept optional userMessages, the user's own messages from another session, which the judge reads as the user's messages; statements may be empty when they are present. A session started by another agent's message gets its task only from such a grant.
  • Reduce .NET SDK JSON-RPC allocations and session-history conversion overhead while preserving existing behavior.
  • Reduce Rust SDK allocations for large typed RPC responses by deserializing directly from response frames.
  • Support typed TelemetryConfig for independently owned in-process clients across all six SDKs.
  • Fix Rust-host extension consent and reconciliation, explicit cache flags, elicitation validation, and turn admission after disconnect.
  • Permission prompt requests can carry assistedApproval.approvalRequiredCommandSegments, the shell command segments an Assisted Permissions denial named as needing approval (experimental).
  • Fixed a bug where resumeSession could restore a BYOK model that had been withdrawn by the provider or deselected during sync.
  • availableTools and excludedTools now compose by default; SDK create/resume no longer sends toolFilterPrecedence, while explicit options.update precedence remains supported.
  • Fixed an issue where an invalid MCP server configuration caused every send to hang.
  • Resuming a saved session on the standalone runtime host now returns before its extensions start, so an extension's startup consent prompt reaches the client.
  • Prevent further descendant inference after factory cancellation while preserving child transcript cancellation boundaries without extra user-interruption reports.
  • Fixed session.compaction_complete for a compaction that blocks the turn sometimes arriving after that turn's session.idle.
  • An MCP server that throttles its first connection now reconnects automatically once the server lifts the block, instead of staying failed for the rest of the session.
  • session.permissions.resetSessionApprovals and session.permissions.configure({ urls }) now actually revoke URLs the user approved for the session; URLs from configuration or persisted settings are unaffected.
  • Added per-server reporting of MCP tool-definition token costs in the SDK.
  • Preserve prepared session tools when unchanged session-management settings are reapplied.
  • Sandbox allowedHosts and blockedHosts support strict IPv4/IPv6 CIDRs and resolved-address enforcement with deny precedence.
  • createSession now rejects reasoningEffort: "none" for models that don't support it instead of creating a session whose turns all fail.
  • Prevent duplicate cancellation notices when a new prompt follows an abort.
  • Sandboxed shells honor explicitly configured GH_TOKEN masking instead of replacing the token with automatic gh authentication.
  • Add an automation message source (automation- followed by an automation ID) for turns a host sends on behalf of a user-configured automation; such a turn defines the session's task without carrying human authority.
  • Limit incoming LLM HTTP responses and WebSocket messages to 128 MiB by default, configurable with COPILOT_LLM_RESPONSE_MAX_BYTES, including SDK callback ingress.
  • .NET: Incoming messages nested deeper than 64 levels, such as a tool call with deeply nested arguments, are no longer dropped, which had left the tool unrun and SendAndWaitAsync waiting.
  • Session history kept for enableSessionStore no longer loses a turn when two clients work on the same session one after the other.
  • Add experimental server-level offline trajectory analytics with ATIF input, request-local judge configuration, validation, classifier selection, bounded concurrency, exact retries, and structured rate-limit failures.
  • Go: A request handler no longer keeps memory for each response the runtime cancels after the handler has finished it, such as a response rejected for exceeding the response size limit.
  • Runtime now lazily activates opted-in native extensions, reducing upfront activation work until those extensions are needed.
Source: README.md, updated 2026-11-10