[deps-release-notes] copilot-cli — upstream release action items

这是一个用于跟踪依赖项更新的 issue。工作内容包括阅读 copilot-cli 版本 1.0.88 的链接发布说明，理解与托管设置和 OAuth 相关的安全修复，并确认是否有任何 ado-aw 功能使用了受影响的 CLI 模式（--acp、--ahp-host、--server）。首先查看标题为 'chore(deps): update COPILOT_CLI_VERSION to 1.0.88' 的配套版本更新 PR 以及仓库的工作流配置。当发布中的行动项被评估且所有必要的更新被记录或实施后，即视为完成。

Rolling upstream release action items — copilot-cli

This is the single canonical tracking issue for action items arising from
new releases of the copilot-cli dependency. The update-awf-version workflow
appends a new comment to this issue for each version bump going forward, so
the most recent activity lives in the comments below. This body is a
consolidated history of everything filed so far.

Latest pinned version covered: 1.0.88

Consolidated history (earliest → latest)

1.0.48 → 1.0.56 (was #803)

• Security: secret scanning covers commit messages + PR descriptions (v1.0.51): Redacts secrets before publishing.
• Security: permissions.disableBypassPermissionsMode (v1.0.55): Prevents enabling allow-all/yolo mode; relevant for sandboxed pipelines.
• --session-id=<id> flag (v1.0.51): Resume/start sessions with a specific UUID — useful for pipeline correlation.
• postToolUse hook additionalContext injected as system message (v1.0.49): Instead of being discarded.
• preMcpToolCall hook (v1.0.51): Control outgoing MCP request metadata.
• deferred-tool-loading frontmatter for custom agents (v1.0.52): Reduces initial token overhead.
• MCP tools with both content + structuredContent surface both (v1.0.56): Review ado-aw MCP tools to ensure dual output is intentional.
• Context window tier selection (v1.0.52): Default ~200K vs 1M tokens enforced end-to-end.
• Claude Opus 4.8 support (v1.0.55).
• Deprecation: oauth.clientId/oauth.callbackPort → oauthClientId/auth.redirectPort (v1.0.52).

1.0.48 → 1.0.59 (was #843)

• Breaking: preToolUse hook errors now deny the tool call (v1.0.57): Previously hook errors silently allowed execution; now they block the call.
• Breaking: Remote JSON RPC enabled by default (v1.0.58): Verify this doesn't open unexpected network surface in AWF-sandboxed environments.
• Breaking: --plugin-dir skills take precedence over personal-home skills (v1.0.55): Skill resolution order: project > plugin-dir > personal > custom.
• ADO-only repos: built-in GitHub MCP server exposes only web_search (v1.0.57): Directly relevant to ado-aw; consider whether the GitHub MCP extension should account for ADO-repository detection.

1.0.48 → 1.0.60 (was #881)

• Alpine Linux (musl libc) support (v1.0.49): Now runs on Alpine-based containers.
• Rubber Duck agent enabled by default (v1.0.58): Check whether this adds unexpected turn overhead in automated runs.

1.0.60 → 1.0.61 (was #951)

• Auto-load MCP servers from .github/mcp.json (v1.0.61): ado-aw uses --additional-mcp-config; consider guarding against auto-loading interference.
• Claude Fable 5 model support (v1.0.61): Add to validated models in src/engine.rs/docs/engine.md.
• mTLS + private-CA for OTLP telemetry (v1.0.61): Added http/protobuf OTLP export via OTel env vars.
• Bug fix: grep/glob single-path fix (v1.0.61): Previously missed results with single path argument.
• Bug fix: shell validation false positives (v1.0.61): Fixed blocking of harmless commands with words like "kill" in string literals/heredocs.

1.0.60 → 1.0.62 (was #1002)

• Breaking: write_bash interactive input removed (v1.0.62): Shell commands now use lightweight process spawning; interactive input no longer supported. ado-aw exposes write_bash as a first-class tool — assess whether tool surface/docs need updating.
• Configure subagent model, reasoning effort, context tier (v1.0.62): Consider surfacing reasoning_effort/context-tier as front-matter fields.
• Kerberos/SPNEGO proxy auth (v1.0.62): Auto-auth through corporate forward proxies; relevant for enterprise ADO environments.

1.0.62 → 1.0.63 (was #1057)

• deferTools MCP server config option (v1.0.63): Keeps server tools available even when tool search is enabled. ado-aw could use this for safe-outputs and GitHub MCP servers to prevent them from being filtered out.

1.0.62 → 1.0.64 (was #1183)

• New OTel cache + reasoning token fields (v1.0.64): gen_ai.usage.cache_read.input_tokens, gen_ai.usage.cache_creation.input_tokens, gen_ai.usage.reasoning.output_tokens per GenAI semconv (old underscore-separated names gone). Update src/agent_stats.rs to parse new attribute names.
• Static OAuth client overrides for MCP server auth (v1.0.64): ado-aw could expose in MCP server config front-matter.
• Autopilot mode auto-handles ask_user, elicitation, sampling, permission prompts (v1.0.64): Reliability improvement for unattended pipeline runs.
• Deprecation: report_intent tool removed (v1.0.64): INTERNAL_TOOL_NAMES exclusion in src/agent_stats.rs containing "execute_tool report_intent" is now dead code; can be cleaned up.

1.0.64 → 1.0.67 (was #1272)

• Claude Sonnet 5 model support (v1.0.67): Add to src/engine.rs model allowlist + docs.
• Subagent sessions inherit parent tool restrictions (v1.0.67): Security-relevant behavior change; verify against expected security model.
• MCP OAuth against Microsoft Entra vanity domain servers (v1.0.67): Fixes AADSTS auth failures for Entra vanity domains; relevant for enterprise Azure AD MCP tools.
• copilot skill subcommand (v1.0.65): New /skill alias for listing/adding/removing skills; may be relevant for agency plugin scaffolding.
• Deprecation: Claude Opus 4.6 Fast → Claude Opus 4.8 Fast (v1.0.66): Update any ado-aw references to claude-opus-4.6-fast.

1.0.64 → 1.0.68 (was #1305)

• Breaking: session limits require minimum 30 AI credits (v1.0.67): Pipelines with session-limit: below 30 AI credits will be rejected at runtime. Review compiler defaults.
• Claude Opus 4.8 Fast model support (v1.0.66): Add claude-opus-4.8-fast to src/engine.rs allowlist.
• kimi-k2.7-code model support (v1.0.68): Add to model allowlist.

1.0.70 → 1.0.81 (was #2041)

• Breaking (v1.0.79): Sandbox settings keys renamed from sandbox.gitAuth/sandbox.ghAuth to sandbox.auth.git/sandbox.auth.gh, with no migration path. Old keys are silently ignored, and SDK requests using the old keys are rejected as invalid. Any ado-aw-generated engine config or docs referencing the old sandbox setting names need to be updated. See the v1.0.79 release.
• Breaking (v1.0.79): --worktree default behavior changed — worktreeBaseRef now defaults to HEAD instead of the remote default branch. Could change output for any ado-aw workflow relying on worktree creation defaults. See the v1.0.79 release.
• Security (v1.0.78): The /allow-all auto safety-judge model is no longer user-configurable — hardens against downgrade to a weaker safety judge. See the v1.0.78 release.
• Security (v1.0.78): Managed-settings fetch failure behavior changed from fail-closed to fail-open — worth confirming this doesn't weaken ado-aw's sandboxed-agent posture when managed settings can't be reached. See the v1.0.78 release.
• Security (v1.0.72): Sandbox macOS keychain access now defaults to off, reducing default credential exposure inside the sandboxed agent. See the v1.0.72 release.
• v1.0.81: Support for MCP protocol version 2026-07-28, OpenTelemetry trace-context propagation (traceparent/tracestate) into hooks, and per-agent usage metrics via --usage-output-file — could improve ado-aw's OTel-based agent stats correlation (src/agent_stats.rs). See the v1.0.81 release.
• v1.0.81: Windows Entra ID broker-based MCP auth (no-prompt sign-in) — relevant if ado-aw ever needs Windows-hosted agent auth flows.
• v1.0.81: Plan mode now hard-blocks mutating tool calls — a safety property ado-aw could rely on/document for plan-only agent configurations.
• v1.0.76/v1.0.77: Enterprise admins can enforce a restrictive sandbox floor and managed sandbox policy via macOS/Windows native MDM — relevant to ado-aw's OneBranch sandboxing story for enterprise consumers. See the v1.0.76 release and v1.0.77 release.
• v1.0.72: Opt-in git/gh auth inside the OS sandbox — worth evaluating against ado-aw's own credential-isolation model (ado-proxy).

1.0.87 → 1.0.88 (was #2232) — canonical

• None identified. This is a routine point release with terminal/UX and MCP reliability fixes.
• Security: Enterprise managed settings now apply to sessions opened in ACP mode (copilot --acp), by AHP hosts (copilot --ahp-host), and by the published --server session, which previously ran with no managed MCP, permission, or plugin policy (v1.0.88). ado-aw invokes the CLI in its default sandboxed one-shot mode, not --acp/--ahp-host/--server, so no immediate action, but worth confirming if any future ado-aw feature drives the CLI through one of those modes.
• Security: GitHub MCP scope escalation now uses the CLI OAuth app's registered /callback redirect URI (v1.0.88) — tightens an OAuth flow ado-aw does not directly configure.
• No notable features identified as directly adoptable by ado-aw in this range. No deprecations identified in this range.

Consolidated by the Deps Release-Notes Consolidator workflow. Superseded per-release issues were closed and point here.> Generated by Deps Release-Notes Consolidator · auto · 74.6 AIC · ⌖ 4.15 AIC · ⊞ 9.6K · ◷