[deps-release-notes] copilot-cli — upstream release action items

# Rolling upstream release action items — `copilot-cli`

This is the **single canonical tracking issue** for action items arising from
new releases of the `copilot-cli` dependency. The `update-awf-version` workflow
appends a new comment to this issue for each version bump going forward, so
**the most recent activity lives in the comments below**. This body is a
consolidated history of everything filed so far.

**Latest pinned version covered:** `1.0.81`

## Consolidated history (earliest → latest)

### `1.0.48` → `1.0.56` (was #803)
- **Security: secret scanning covers commit messages + PR descriptions** ([v1.0.51](https://github.com/github/copilot-cli/releases/tag/v1.0.51)): Redacts secrets before publishing.
- **Security: `permissions.disableBypassPermissionsMode`** ([v1.0.55](https://github.com/github/copilot-cli/releases/tag/v1.0.55)): Prevents enabling allow-all/yolo mode; relevant for sandboxed pipelines.
- **`--session-id=` flag** ([v1.0.51](https://github.com/github/copilot-cli/releases/tag/v1.0.51)): Resume/start sessions with a specific UUID — useful for pipeline correlation.
- **`postToolUse` hook `additionalContext` injected as system message** ([v1.0.49](https://github.com/github/copilot-cli/releases/tag/v1.0.49)): Instead of being discarded.
- **`preMcpToolCall` hook** ([v1.0.51](https://github.com/github/copilot-cli/releases/tag/v1.0.51)): Control outgoing MCP request metadata.
- **`deferred-tool-loading` frontmatter for custom agents** ([v1.0.52](https://github.com/github/copilot-cli/releases/tag/v1.0.52)): Reduces initial token overhead.
- **MCP tools with both `content` + `structuredContent` surface both** ([v1.0.56](https://github.com/github/copilot-cli/releases/tag/v1.0.56)): Review ado-aw MCP tools to ensure dual output is intentional.
- **Context window tier selection** ([v1.0.52](https://github.com/github/copilot-cli/releases/tag/v1.0.52)): Default ~200K vs 1M tokens enforced end-to-end.
- **Claude Opus 4.8 support** ([v1.0.55](https://github.com/github/copilot-cli/releases/tag/v1.0.55)).
- **Deprecation: `oauth.clientId`/`oauth.callbackPort` → `oauthClientId`/`auth.redirectPort`** ([v1.0.52](https://github.com/github/copilot-cli/releases/tag/v1.0.52)).

### `1.0.48` → `1.0.59` (was #843)
- **Breaking: `preToolUse` hook errors now deny the tool call** ([v1.0.57](https://github.com/github/copilot-cli/releases/tag/v1.0.57)): Previously hook errors silently allowed execution; now they block the call.
- **Breaking: Remote JSON RPC enabled by default** ([v1.0.58](https://github.com/github/copilot-cli/releases/tag/v1.0.58)): Verify this doesn't open unexpected network surface in AWF-sandboxed environments.
- **Breaking: `--plugin-dir` skills take precedence over personal-home skills** ([v1.0.55](https://github.com/github/copilot-cli/releases/tag/v1.0.55)): Skill resolution order: project > plugin-dir > personal > custom.
- **ADO-only repos: built-in GitHub MCP server exposes only `web_search`** ([v1.0.57](https://github.com/github/copilot-cli/releases/tag/v1.0.57)): Directly relevant to ado-aw; consider whether the GitHub MCP extension should account for ADO-repository detection.

### `1.0.48` → `1.0.60` (was #881)
- **Alpine Linux (musl libc) support** ([v1.0.49](https://github.com/github/copilot-cli/releases/tag/v1.0.49)): Now runs on Alpine-based containers.
- **Rubber Duck agent enabled by default** ([v1.0.58](https://github.com/github/copilot-cli/releases/tag/v1.0.58)): Check whether this adds unexpected turn overhead in automated runs.

### `1.0.60` → `1.0.61` (was #951)
- **Auto-load MCP servers from `.github/mcp.json`** ([v1.0.61](https://github.com/github/copilot-cli/releases/tag/v1.0.61)): ado-aw uses `--additional-mcp-config`; consider guarding against auto-loading interference.
- **Claude Fable 5 model support** ([v1.0.61](https://github.com/github/copilot-cli/releases/tag/v1.0.61)): Add to validated models in `src/engine.rs`/`docs/engine.md`.
- **mTLS + private-CA for OTLP telemetry** ([v1.0.61](https://github.com/github/copilot-cli/releases/tag/v1.0.61)): Added `http/protobuf` OTLP export via OTel env vars.
- **Bug fix: `grep`/`glob` single-path fix** ([v1.0.61](https://github.com/github/copilot-cli/releases/tag/v1.0.61)): Previously missed results with single path argument.
- **Bug fix: shell validation false positives** ([v1.0.61](https://github.com/github/copilot-cli/releases/tag/v1.0.61)): Fixed blocking of harmless commands with words like "kill" in string literals/heredocs.

### `1.0.60` → `1.0.62` (was #1002)
- **Breaking: `write_bash` interactive input removed** ([v1.0.62](https://github.com/github/copilot-cli/releases/tag/v1.0.62)): Shell commands now use lightweight process spawning; interactive input no longer supported. ado-aw exposes `write_bash` as a first-class tool — assess whether tool surface/docs need updating.
- **Configure subagent model, reasoning effort, context tier** ([v1.0.62](https://github.com/github/copilot-cli/releases/tag/v1.0.62)): Consider surfacing `reasoning_effort`/context-tier as front-matter fields.
- **Kerberos/SPNEGO proxy auth** ([v1.0.62](https://github.com/github/copilot-cli/releases/tag/v1.0.62)): Auto-auth through corporate forward proxies; relevant for enterprise ADO environments.

### `1.0.62` → `1.0.63` (was #1057)
- **`deferTools` MCP server config option** ([v1.0.63](https://github.com/github/copilot-cli/releases/tag/v1.0.63)): Keeps server tools available even when tool search is enabled. ado-aw could use this for safe-outputs and GitHub MCP servers to prevent them from being filtered out.

### `1.0.62` → `1.0.64` (was #1183)
- **New OTel cache + reasoning token fields** ([v1.0.64](https://github.com/github/copilot-cli/releases/tag/v1.0.64)): `gen_ai.usage.cache_read.input_tokens`, `gen_ai.usage.cache_creation.input_tokens`, `gen_ai.usage.reasoning.output_tokens` per GenAI semconv (old underscore-separated names gone). Update `src/agent_stats.rs` to parse new attribute names.
- **Static OAuth client overrides for MCP server auth** ([v1.0.64](https://github.com/github/copilot-cli/releases/tag/v1.0.64)): ado-aw could expose in MCP server config front-matter.
- **Autopilot mode auto-handles `ask_user`, elicitation, sampling, permission prompts** ([v1.0.64](https://github.com/github/copilot-cli/releases/tag/v1.0.64)): Reliability improvement for unattended pipeline runs.
- **Deprecation: `report_intent` tool removed** ([v1.0.64](https://github.com/github/copilot-cli/releases/tag/v1.0.64)): `INTERNAL_TOOL_NAMES` exclusion in `src/agent_stats.rs` containing `"execute_tool report_intent"` is now dead code; can be cleaned up.

### `1.0.64` → `1.0.67` (was #1272)
- **Claude Sonnet 5 model support** ([v1.0.67](https://github.com/github/copilot-cli/releases/tag/v1.0.67)): Add to `src/engine.rs` model allowlist + docs.
- **Subagent sessions inherit parent tool restrictions** ([v1.0.67](https://github.com/github/copilot-cli/releases/tag/v1.0.67)): Security-relevant behavior change; verify against expected security model.
- **MCP OAuth against Microsoft Entra vanity domain servers** ([v1.0.67](https://github.com/github/copilot-cli/releases/tag/v1.0.67)): Fixes `AADSTS` auth failures for Entra vanity domains; relevant for enterprise Azure AD MCP tools.
- **`copilot skill` subcommand** ([v1.0.65](https://github.com/github/copilot-cli/releases/tag/v1.0.65)): New `/skill` alias for listing/adding/removing skills; may be relevant for agency plugin scaffolding.
- **Deprecation: Claude Opus 4.6 Fast → Claude Opus 4.8 Fast** ([v1.0.66](https://github.com/github/copilot-cli/releases/tag/v1.0.66)): Update any ado-aw references to `claude-opus-4.6-fast`.

### `1.0.64` → `1.0.68` (was #1305)
- **Breaking: session limits require minimum 30 AI credits** ([v1.0.67](https://github.com/github/copilot-cli/releases/tag/v1.0.67)): Pipelines with `session-limit:` below 30 AI credits will be rejected at runtime. Review compiler defaults.
- **Claude Opus 4.8 Fast model support** ([v1.0.66](https://github.com/github/copilot-cli/releases/tag/v1.0.66)): Add `claude-opus-4.8-fast` to `src/engine.rs` allowlist.
- **kimi-k2.7-code model support** ([v1.0.68](https://github.com/github/copilot-cli/releases/tag/v1.0.68)): Add to model allowlist.

### `1.0.70` → `1.0.81` (was #2041) — canonical
- **Breaking (v1.0.79)**: Sandbox settings keys renamed from `sandbox.gitAuth`/`sandbox.ghAuth` to `sandbox.auth.git`/`sandbox.auth.gh`, with **no migration path**. Old keys are silently ignored, and SDK requests using the old keys are rejected as invalid. Any ado-aw-generated engine config or docs referencing the old sandbox setting names need to be updated. See the [v1.0.79 release](https://github.com/github/copilot-cli/releases/tag/v1.0.79).
- **Breaking (v1.0.79)**: `--worktree` default behavior changed — `worktreeBaseRef` now defaults to `HEAD` instead of the remote default branch. Could change output for any ado-aw workflow relying on worktree creation defaults. See the [v1.0.79 release](https://github.com/github/copilot-cli/releases/tag/v1.0.79).
- **Security (v1.0.78)**: The `/allow-all auto` safety-judge model is no longer user-configurable — hardens against downgrade to a weaker safety judge. See the [v1.0.78 release](https://github.com/github/copilot-cli/releases/tag/v1.0.78).
- **Security (v1.0.78)**: Managed-settings fetch failure behavior changed from fail-closed to fail-open — worth confirming this doesn't weaken ado-aw's sandboxed-agent posture when managed settings can't be reached. See the [v1.0.78 release](https://github.com/github/copilot-cli/releases/tag/v1.0.78).
- **Security (v1.0.72)**: Sandbox macOS keychain access now defaults to **off**, reducing default credential exposure inside the sandboxed agent. See the [v1.0.72 release](https://github.com/github/copilot-cli/releases/tag/v1.0.72).
- **v1.0.81**: Support for MCP protocol version 2026-07-28, OpenTelemetry trace-context propagation (`traceparent`/`tracestate`) into hooks, and per-agent usage metrics via `--usage-output-file` — could improve ado-aw's OTel-based agent stats correlation (`src/agent_stats.rs`). See the [v1.0.81 release](https://github.com/github/copilot-cli/releases/tag/v1.0.81).
- **v1.0.81**: Windows Entra ID broker-based MCP auth (no-prompt sign-in) — relevant if ado-aw ever needs Windows-hosted agent auth flows.
- **v1.0.81**: Plan mode now hard-blocks mutating tool calls — a safety property ado-aw could rely on/document for plan-only agent configurations.
- **v1.0.76/v1.0.77**: Enterprise admins can enforce a restrictive sandbox floor and managed sandbox policy via macOS/Windows native MDM — relevant to ado-aw's OneBranch sandboxing story for enterprise consumers. See the [v1.0.76 release](https://github.com/github/copilot-cli/releases/tag/v1.0.76) and [v1.0.77 release](https://github.com/github/copilot-cli/releases/tag/v1.0.77).
- **v1.0.72**: Opt-in git/gh auth inside the OS sandbox — worth evaluating against ado-aw's own credential-isolation model (`ado-proxy`).

---
*Consolidated by the Deps Release-Notes Consolidator workflow. Superseded per-release issues were closed and point here.*> Generated by [Deps Release-Notes Consolidator](https://github.com/githubnext/ado-aw/actions/runs/33234357474) · auto · 76.3 AIC · ⌖ 11.6 AIC · ⊞ 10.6K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fado-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fado-aw%2Fdeps-notes-consolidator%22&type=issues)

Start by reviewing the copilot-cli 1.0.79–1.0.81 release notes and the references to src/engine.rs and src/agent_stats.rs. Then inspect ado-aw-generated engine configuration, sandbox settings, documentation, and related tests to determine which upstream changes apply. Done means the applicable action items are implemented, validated, and documented; the issue does not define a single scoped acceptance test.

Written by the indexing model from the issue text.