Copilot CLI Releases 1.0.93 to 1.0.95 Add an Enterprise Domain-Limit Setting and a Managed-Policy Switch for Assisted Permissions

Overview

Three GitHub Copilot CLI releases published between October 7 and October 9, 2026 carry a cluster of administrator-facing changes. According to the project’s changelog file, version 1.0.93 (dated 2026-10-07) adds “enterprise permissions.limitTo to enforce managed domain boundaries for network requests”, and version 1.0.94 (dated 2026-10-08) states that “Managed policy can disable Assisted Permissions and keep sessions in Manual Approval mode.” Version 1.0.95 (dated 2026-10-09) adjusts how managed plugin setup retries. The descriptions of these three releases rest on that single changelog, which is written by GitHub, the vendor of the tool.

What We Know

Version 1.0.93, 2026-10-07. Beyond the permissions.limitTo entry quoted above, the changelog lists “Command sandboxing is available to all users via /sandbox and —sandbox.” That matches the general-availability announcement for local sandboxing that The Machine Herald previously reported. The same release notes say “MCP server configuration changes apply between turns without restarting the session.” It also says user settings are read only from ~/.copilot/settings.json, and that user-setting keys in ~/.copilot/config.json are ignored.

Version 1.0.94, 2026-10-08. Three entries in the changelog concern permissions and policy:

• “Assisted permissions send visible shell code to the permission judge instead of requiring unnecessary manual approval”.
• “Managed policy can disable Assisted Permissions and keep sessions in Manual Approval mode.”
• “Show a policy warning when startup bypass-permission flags are suppressed by managed settings.”

A fourth entry says the CLI will “Show update guidance when managed settings request a newer CLI version without blocking normal prompts.”

Version 1.0.95, 2026-10-09. The changelog says “Managed plugin setup retries hourly or after policy changes instead of on every message failure.” It also says copilot config now supports sandbox credential injectHosts keys, with key completion in Bash, Zsh, and Fish.

How bypass flags relate to managed settings. GitHub’s enterprise managed settings reference describes a separate key, disableBypassPermissionsMode. It says bypass mode “lets an agent run commands, access files, and fetch URLs without asking for approval.” When the key is set to “disable”, the page states that in Copilot CLI the command-line options --yolo, --allow-all, --allow-all-tools, --allow-all-paths and --allow-all-urls “are suppressed at startup and cannot grant elevated permissions.” The 1.0.94 warning entry appears to concern this situation, though the changelog does not spell out which managed settings trigger it.

The same reference page says a managed ask rule “can’t be satisfied by bypass mode (also known as allow-all or YOLO mode), an auto-approval setting, a hook or other approval shortcut, or a grant persisted from an earlier approval.” It also describes network rules through a Domain(...) selector, where “A bare host defaults to HTTPS, and host matching is case-insensitive.” Whether permissions.limitTo is related to that selector is not stated in either source.

What We Don’t Know

• What permissions.limitTo accepts. The changelog line is one sentence. When the docs page above was read on October 11, 2026, its text contained no mention of limitTo, so the key’s syntax, scope and the clients that honour it were not documented there.
• What Assisted Permissions does in detail. The changelog refers to a “permission judge” that receives visible shell code. It does not say what the judge is, whether it is a model or a rule engine, or what it decides. The same docs page, as read on October 11, did not mention Assisted Permissions either.
• Whether the changes were independently tested. The Machine Herald did not run these releases. Every behaviour described above is GitHub’s own description in release notes, not an observation of the software.
• Which warning conditions trigger the policy message. The 1.0.94 entry says the warning appears when startup bypass-permission flags are suppressed by managed settings, but the changelog does not give the warning text.

Analysis

The entries show GitHub applying its managed-settings model, which the docs page says can be defined in MDM-managed, server-managed or file-based sources, to more of the CLI’s behaviour: network domains, an approval mode and the way policy decisions are surfaced to the user. Because the only description of permissions.limitTo and of the Assisted Permissions policy switch is a one-line changelog entry from the vendor, administrators weighing these controls would need to test the behaviour themselves until fuller documentation appears.