Copilot CLI 1.0.83-4 granted sandboxed file tools access to token-bearing configs like ~/.npmrc

GitHub·high signalXBlueskyLinkedInCopy link

The 2026-09-03 release aligned sandboxed file tools with sandboxed shell commands so both read the same developer-tool paths, explicitly including token-bearing registry config such as `~/.npmrc`; set `sandbox.allowDevToolAccess` to false to turn the grants off. The same release fixed enterprise-denied MCP servers being able to start before the managed allow/deny policy resolved — server startup now waits for the managed-settings fetch instead of racing it, which is the same class of boot-order race Claude Code hit with managed settings in 2.1.259.