[deps-release-notes] copilot-cli — upstream release action items

This is a tracking issue for dependency updates. The work involves reading the linked release notes for copilot-cli version 1.0.88, understanding the security fixes related to managed settings and OAuth, and confirming if any ado-aw features use the affected CLI modes (--acp, --ahp-host, --server). Start by reviewing the companion version-bump PR titled 'chore(deps): update COPILOT_CLI_VERSION to 1.0.88' and the repository's workflow configuration. Done when the action items from the release are assessed and any necessary updates are documented or implemented.

Rolling upstream release action items — copilot-cli

This is the single canonical tracking issue for action items arising from
new releases of the copilot-cli dependency. The update-awf-version workflow
appends a new comment to this issue for each version bump going forward, so
the most recent activity lives in the comments below. This body is a
consolidated history of everything filed so far.

Latest pinned version covered: 1.0.88

Consolidated history (earliest → latest)

1.0.48 → 1.0.56 (was #803)

• Security: secret scanning covers commit messages + PR descriptions (v1.0.51): Redacts secrets before publishing.
• Security: permissions.disableBypassPermissionsMode (v1.0.55): Prevents enabling allow-all/yolo mode; relevant for sandboxed pipelines.
• --session-id=<id> flag (v1.0.51): Resume/start sessions with a specific UUID — useful for pipeline correlation.
• postToolUse hook additionalContext injected as system message (v1.0.49): Instead of being discarded.
• preMcpToolCall hook (v1.0.51): Control outgoing MCP request metadata.
• deferred-tool-loading frontmatter for custom agents (v1.0.52): Reduces initial token overhead.
• MCP tools with both content + structuredContent surface both (v1.0.56): Review ado-aw MCP tools to ensure dual output is intentional.
• Context window tier selection (v1.0.52): Default ~200K vs 1M tokens enforced end-to-end.
• Claude Opus 4.8 support (v1.0.55).
• Deprecation: oauth.clientId/oauth.callbackPort → oauthClientId/auth.redirectPort (v1.0.52).

1.0.48 → 1.0.59 (was #843)

• Breaking: preToolUse hook errors now deny the tool call (v1.0.57): Previously hook errors silently allowed execution; now they block the call.
• Breaking: Remote JSON RPC enabled by default (v1.0.58): Verify this doesn't open unexpected network surface in AWF-sandboxed environments.
• Breaking: --plugin-dir skills take precedence over personal-home skills (v1.0.55): Skill resolution order: project > plugin-dir > personal > custom.
• ADO-only repos: built-in GitHub MCP server exposes only web_search (v1.0.57): Directly relevant to ado-aw; consider whether the GitHub MCP extension should account for ADO-repository detection.

1.0.48 → 1.0.60 (was #881)

• Alpine Linux (musl libc) support (v1.0.49): Now runs on Alpine-based containers.
• Rubber Duck agent enabled by default (v1.0.58): Check whether this adds unexpected turn overhead in automated runs.

1.0.60 → 1.0.61 (was #951)

• Auto-load MCP servers from .github/mcp.json (v1.0.61): ado-aw uses --additional-mcp-config; consider guarding against auto-loading interference.
• Claude Fable 5 model support (v1.0.61): Add to validated models in src/engine.rs/docs/engine.md.
• mTLS + private-CA for OTLP telemetry (v1.0.61): Added http/protobuf OTLP export via OTel env vars.
• Bug fix: grep/glob single-path fix (v1.0.61): Previously missed results with single path argument.
• Bug fix: shell validation false positives (v1.0.61): Fixed blocking of harmless commands with words like "kill" in string literals/heredocs.

1.0.60 → 1.0.62 (was #1002)

• Breaking: write_bash interactive input removed (v1.0.62): Shell commands now use lightweight process spawning; interactive input no longer supported. ado-aw exposes write_bash as a first-class tool — assess whether tool surface/docs need updating.
• Configure subagent model, reasoning effort, context tier (v1.0.62): Consider surfacing reasoning_effort/context-tier as front-matter fields.
• Kerberos/SPNEGO proxy auth (v1.0.62): Auto-auth through corporate forward proxies; relevant for enterprise ADO environments.

1.0.62 → 1.0.63 (was #1057)

• deferTools MCP server config option (v1.0.63): Keeps server tools available even when tool search is enabled. ado-aw could use this for safe-outputs and GitHub MCP servers to prevent them from being filtered out.

1.0.62 → 1.0.64 (was #1183)

• New OTel cache + reasoning token fields (v1.0.64): gen_ai.usage.cache_read.input_tokens, gen_ai.usage.cache_creation.input_tokens, gen_ai.usage.reasoning.output_tokens per GenAI semconv (old underscore-separated names gone). Update src/agent_stats.rs to parse new attribute names.
• Static OAuth client overrides for MCP server auth (v1.0.64): ado-aw could expose in MCP server config front-matter.
• Autopilot mode auto-handles ask_user, elicitation, sampling, permission prompts (v1.0.64): Reliability improvement for unattended pipeline runs.
• Deprecation: report_intent tool removed (v1.0.64): INTERNAL_TOOL_NAMES exclusion in src/agent_stats.rs containing "execute_tool report_intent" is now dead code; can be cleaned up.

1.0.64 → 1.0.67 (was #1272)

• Claude Sonnet 5 model support (v1.0.67): Add to src/engine.rs model allowlist + docs.
• Subagent sessions inherit parent tool restrictions (v1.0.67): Security-relevant behavior change; verify against expected security model.
• MCP OAuth against Microsoft Entra vanity domain servers (v1.0.67): Fixes AADSTS auth failures for Entra vanity domains; relevant for enterprise Azure AD MCP tools.
• copilot skill subcommand (v1.0.65): New /skill alias for listing/adding/removing skills; may be relevant for agency plugin scaffolding.
• Deprecation: Claude Opus 4.6 Fast → Claude Opus 4.8 Fast (v1.0.66): Update any ado-aw references to claude-opus-4.6-fast.

1.0.64 → 1.0.68 (was #1305)

• Breaking: session limits require minimum 30 AI credits (v1.0.67): Pipelines with session-limit: below 30 AI credits will be rejected at runtime. Review compiler defaults.
• Claude Opus 4.8 Fast model support (v1.0.66): Add claude-opus-4.8-fast to src/engine.rs allowlist.
• kimi-k2.7-code model support (v1.0.68): Add to model allowlist.

1.0.70 → 1.0.81 (was #2041)

• Breaking (v1.0.79): Sandbox settings keys renamed from sandbox.gitAuth/sandbox.ghAuth to sandbox.auth.git/sandbox.auth.gh, with no migration path. Old keys are silently ignored, and SDK requests using the old keys are rejected as invalid. Any ado-aw-generated engine config or docs referencing the old sandbox setting names need to be updated. See the v1.0.79 release.
• Breaking (v1.0.79): --worktree default behavior changed — worktreeBaseRef now defaults to HEAD instead of the remote default branch. Could change output for any ado-aw workflow relying on worktree creation defaults. See the v1.0.79 release.
• Security (v1.0.78): The /allow-all auto safety-judge model is no longer user-configurable — hardens against downgrade to a weaker safety judge. See the v1.0.78 release.
• Security (v1.0.78): Managed-settings fetch failure behavior changed from fail-closed to fail-open — worth confirming this doesn't weaken ado-aw's sandboxed-agent posture when managed settings can't be reached. See the v1.0.78 release.
• Security (v1.0.72): Sandbox macOS keychain access now defaults to off, reducing default credential exposure inside the sandboxed agent. See the v1.0.72 release.
• v1.0.81: Support for MCP protocol version 2026-07-28, OpenTelemetry trace-context propagation (traceparent/tracestate) into hooks, and per-agent usage metrics via --usage-output-file — could improve ado-aw's OTel-based agent stats correlation (src/agent_stats.rs). See the v1.0.81 release.
• v1.0.81: Windows Entra ID broker-based MCP auth (no-prompt sign-in) — relevant if ado-aw ever needs Windows-hosted agent auth flows.
• v1.0.81: Plan mode now hard-blocks mutating tool calls — a safety property ado-aw could rely on/document for plan-only agent configurations.
• v1.0.76/v1.0.77: Enterprise admins can enforce a restrictive sandbox floor and managed sandbox policy via macOS/Windows native MDM — relevant to ado-aw's OneBranch sandboxing story for enterprise consumers. See the v1.0.76 release and v1.0.77 release.
• v1.0.72: Opt-in git/gh auth inside the OS sandbox — worth evaluating against ado-aw's own credential-isolation model (ado-proxy).

1.0.87 → 1.0.88 (was #2232) — canonical

• None identified. This is a routine point release with terminal/UX and MCP reliability fixes.
• Security: Enterprise managed settings now apply to sessions opened in ACP mode (copilot --acp), by AHP hosts (copilot --ahp-host), and by the published --server session, which previously ran with no managed MCP, permission, or plugin policy (v1.0.88). ado-aw invokes the CLI in its default sandboxed one-shot mode, not --acp/--ahp-host/--server, so no immediate action, but worth confirming if any future ado-aw feature drives the CLI through one of those modes.
• Security: GitHub MCP scope escalation now uses the CLI OAuth app's registered /callback redirect URI (v1.0.88) — tightens an OAuth flow ado-aw does not directly configure.
• No notable features identified as directly adoptable by ado-aw in this range. No deprecations identified in this range.

Consolidated by the Deps Release-Notes Consolidator workflow. Superseded per-release issues were closed and point here.> Generated by Deps Release-Notes Consolidator · auto · 74.6 AIC · ⌖ 4.15 AIC · ⊞ 9.6K · ◷