`preToolUse` agent hook denial does not work

[springcomp]

Describe the bug

Running chat session from Copilot CLI, I have installed a hook that denies all commands.

Affected version

• GitHub Copilot Chat Extension v1.0.65

Steps to reproduce the behavior

.github/hooks/hooks.json

{
  "version": 1,
  "hooks": {
    "preToolUse": [
      {
        "cwd": "src",
        "bash": "bin/Debug/net10.0/hook",
        "powershell": "bin/Debug/net10.0/hook",
        "timeoutSec": 15
      }
    ]
  }
}

A simple C# hook.exe program:

Program.cs

Console.WriteLine("{\"permissionDecision\":\"deny\"}");
Environment.Exit(2);

Here is a simple session prompt:

Give me the latest powershell Get-Date

I tried everything:

• Exit code 2
• {"permissionDecision": "deny"} response to preToolUse hook events.
• {"behavior":"deny"} response to permissionRequest hook events.

Still, the tool is called and never denied.

Expected behavior

The tool call SHOULD be denied.

Additional context

No response

[Necmttn]

The regression contract here can be very small.

For a PreToolUse event with a concrete tool_use_id, if the hook response resolves to permissionDecision: "deny", then:

• run_in_terminal must not execute
• no successful PostToolUse event should be emitted for that tool_use_id
• the transcript should record a denied tool result with the hook reason

I would also pin precedence in the test: top-level permissionDecision vs hookSpecificOutput.permissionDecision vs exit code 2. If multiple shapes are accepted, they should converge to the same internal verdict before tool dispatch, rather than each host path interpreting them separately.

---

Generated with ax.

[springcomp]

I updated the issue to make it easier to reproduce

[BGMLAI]

This looks like a dispatch invariant rather than only a hook-format problem: once any pre-tool hook returns deny, the matching tool_use_id must become non-dispatchable. It would help to normalize all accepted hook output shapes into one internal verdict before execution, then test the full path (hook -> denial event -> no process spawn), not just JSON parsing. Logging the normalized verdict and tool_use_id would also make failures much easier to diagnose.

[copilot-cli-bot]

This appears to be resolved as of GitHub Copilot CLI v1.0.86. Please update to that release or a newer stable version. We're closing this as completed. If it still happens, please comment with your version and reproduction steps.