Finding / github-copilot-cli

2026-10-24-github-copilot-cli-one-session-folder-trust-replaces-persistent-setup-while-trusted-repository-inputs-do-more

One-session folder trust replaces persistent setup, while trusted repository inputs do more. --trust-folder trusts the working directory’s hooks, workspace MCP servers, and repository plugin settings for one new -p or piped-input session. It does not persist trustedFolders, cover neighboring directories, or grant tool/path/URL permissions; resume, continue, and explicit session IDs cannot be combined with it. In 1.0.100, trusted repository plugins install/update before chat, managed plugin activation changes reach existing sessions, and matching root .github/instructions files are delivered on reads or edits. GitHub install links can install Skills/plugins. 1.0.101 also adds Team-assigned plugins from Team marketplaces; docs distinguish optional defaults from enforced managed plugins. 1.0.102 adds git-subdir marketplace sources.

Channel: tagged-release. Half: both. Date: 2026-10-19.

Operator consequence: Replace automation that permanently edits trustedFolders with a reviewed, one-run trust decision where appropriate. Inspect hooks, MCP configuration, repository marketplaces, and newly selected instruction files before using it. Trust removes setup friction by loading executable configuration; it does not substitute for narrow grants or verified plugin provenance. The Plugin4Shell checkout question remains separate from these activation and distribution changes.

Receipt

Finding metadata

Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0

Finding ID: 2026-10-24-github-copilot-cli-one-session-folder-trust-replaces-persistent-setup-while-trusted-repository-inputs-do-more

Profile citations

Source links

Primary links, including exact changelog lines when available.