GitHub's Copilot CLI got its 1.0.79 release on Monday, and most of the weight is on the enterprise sandbox. Admins can now enforce an allow-auto-only policy — `/allow-all auto` works while a blanket allow-all stays blocked — and a managed sandbox policy can pin proxy URLs while leaving credentials in the user's hands. The sandbox dialog finally tells you where its settings actually live in settings.json, and tool directories on PATH no longer silently flip workspace sections to read-only. There's a config gotcha worth flagging before you upgrade: the auth keys moved. `sandbox.gitAuth` and `sandbox.ghAuth` are now `sandbox.auth.git` and `sandbox.auth.gh`, tucked under a new Auth tab. Beyond that it's quality-of-life — a model picker grouped into Recent/Recommended/New, kimi-k3 support, tgrep instead of ripgrep for large monorepos, concurrent sessions via a Sessions tab, and a `worktreeBaseRef` setting that decides whether `/worktree` starts from HEAD or the remote default branch. Update if you run Copilot CLI under an enterprise policy; check your auth keys on the way in.