OrcaProduct update
Orca · v1.4.221
Orca v1.4.221 fixes a Copilot security issue: when Orca marked a folder as trusted for GitHub Copilot the ~/.copilot/config.json file, which can hold login tokens, could end up readable by other users on the same machine, and v1.4.219 and v1.4.220 did this on SSH hosts too; the file is now owner-only after Orca writes it. Codex on Windows now uses the user's own ~/.codex folder, copying over any sign-in made inside Orca, though MCP servers added only inside Orca must be added again, and Orca can now launch Qoder CLI China and Qwen Code.
When Orca marked a folder as trusted for GitHub Copilot, it could leave ~/.copilot/config.json readable by other users on the same machine. That file can hold your Copilot login tokens.
Saved . A shortened excerpt from GitHub Releases; the original publisher retains authorship.