github / github/copilot-cli

`preToolUse` agent hook denial does not work

Offen
#3,874 3 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
area:permissions area:plugins
Vorherrschende Sprache
Shell
Sterne
11.2k
Forks
1.9k
Ø Merge
14 Std. 16 Min.
Gemergte PRs (30 T.)
6

Beschreibung

### Describe the bug

Running chat session from Copilot CLI, I have installed a hook that denies all commands.

### Affected version

- GitHub Copilot Chat Extension `v1.0.65`

### Steps to reproduce the behavior

**.github/hooks/hooks.json**

```json
{
"version": 1,
"hooks": {
"preToolUse": [
{
"cwd": "src",
"bash": "bin/Debug/net10.0/hook",
"powershell": "bin/Debug/net10.0/hook",
"timeoutSec": 15
}
]
}
}
```

A simple C# `hook.exe` program:

**Program.cs**

```csharp
Console.WriteLine("{\"permissionDecision\":\"deny\"}");
Environment.Exit(2);
```

Here is a simple session prompt:

> Give me the latest powershell `Get-Date`

I tried _everything_:

- Exit code `2`
- `{"permissionDecision": "deny"}` response to `preToolUse` hook events.
- `{"behavior":"deny"}` response to `permissionRequest` hook events.

Still, the tool is called and never denied.

### Expected behavior

The tool call SHOULD be denied.

### Additional context

_No response_

Beitragsleitfaden

Beitragsleitfaden öffnen

Rechercherichtung

Start by reproducing the denial flow from .github/hooks/hooks.json with the C# Program.cs hook and the Copilot CLI session described. Compare the preToolUse exit code and permissionDecision output with the observed tool call; done means the requested tool is not executed when the hook denies it.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
csharp, powershell, shell
Bereich
cli, security
Issue-Typ
Bug
Schwierigkeit
3/5
Geschätzter Aufwand
1-2 Tage
Aktivitätsstatus
Ruhig
Klarheit
Größtenteils klar
Anfängerfreundlichkeit
58/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.