Repository navigation
preToolUse agent hook denial does not work #3874
Description
Describe the bug
Running chat session from Copilot CLI, I have installed a hook that denies all commands.
Affected version
- GitHub Copilot Chat Extension
v1.0.65
Steps to reproduce the behavior
.github/hooks/hooks.json
{
"version": 1,
"hooks": {
"preToolUse": [
{
"cwd": "src",
"bash": "bin/Debug/net10.0/hook",
"powershell": "bin/Debug/net10.0/hook",
"timeoutSec": 15
}
]
}
}A simple C# hook.exe program:
Program.cs
Console.WriteLine("{\"permissionDecision\":\"deny\"}");
Environment.Exit(2);Here is a simple session prompt:
Give me the latest powershell
Get-Date
I tried everything:
- Exit code
2 {"permissionDecision": "deny"}response topreToolUsehook events.{"behavior":"deny"}response topermissionRequesthook events.
Still, the tool is called and never denied.
Expected behavior
The tool call SHOULD be denied.
Additional context
No response
Activity
Necmttn commentedon Jun 21, 2026
The regression contract here can be very small.
For a
PreToolUseevent with a concretetool_use_id, if the hook response resolves topermissionDecision: "deny", then:run_in_terminalmust not executePostToolUseevent should be emitted for thattool_use_idI would also pin precedence in the test: top-level
permissionDecisionvshookSpecificOutput.permissionDecisionvs exit code 2. If multiple shapes are accepted, they should converge to the same internal verdict before tool dispatch, rather than each host path interpreting them separately.Generated with ax.
[-]VS Code agent `preToolUse` agent hook denial does not work[/-][+]`preToolUse` agent hook denial does not work[/+]springcomp commentedon Jun 30, 2026
I updated the issue to make it easier to reproduce
BGMLAI commentedon Jul 14, 2026
This looks like a dispatch invariant rather than only a hook-format problem: once any pre-tool hook returns deny, the matching tool_use_id must become non-dispatchable. It would help to normalize all accepted hook output shapes into one internal verdict before execution, then test the full path (hook -> denial event -> no process spawn), not just JSON parsing. Logging the normalized verdict and tool_use_id would also make failures much easier to diagnose.
W2182: refuse a Stride API call whose response reaches neither tier
copilot-cli-bot commentedon Sep 20, 2026
This appears to be resolved as of GitHub Copilot CLI v1.0.86. Please update to that release or a newer stable version. We're closing this as completed. If it still happens, please comment with your version and reproduction steps.