preToolUse: silent command rewrite via updatedInput — confirmation dialog appears even with permissionDecision: allow

[jeziellopes]

Summary

When a preToolUse hook rewrites a command using updatedInput with permissionDecision: allow, Copilot CLI v1.0.24 still shows an interactive confirmation dialog to the user on every rewritten command. There is currently no way for a hook to silently rewrite a command.

Environment

• Copilot CLI version: 1.0.24
• OS: Linux

Context

Consider a tool that automatically prepends a proxy prefix to dev commands (e.g. git status → proxy git status) to reduce LLM token consumption. Users install a preToolUse hook so the agent's commands are transparently rewritten without friction.

Before v1.0.24, updatedInput was not supported in Copilot CLI (#2013), so the hook used deny-with-suggestion as a workaround. When v1.0.24 shipped updatedInput support, the hook was upgraded to use updatedInput + permissionDecision: allow.

What I expected

A hook returning:

{
  "hookSpecificOutput": {
    "hookEventName": "PreToolUse",
    "permissionDecision": "allow",
    "permissionDecisionReason": "proxy auto-rewrite",
    "updatedInput": {
      "command": "proxy git status",
      "description": "check repo status"
    }
  }
}

should silently rewrite the command and run it — no confirmation needed, since:

1. The user explicitly installed the hook (opt-in)
2. permissionDecision is allow
3. The rewrite is mechanical (just prepending a proxy prefix)

What happened instead

Copilot CLI shows a confirmation dialog on every rewritten command:

╭─────────────────────────────────────────────────────╮
│ Hook permission request                             │
│ ⚠ proxy auto-rewrite                               │
│                                                     │
│  Tool: bash                                         │
│  Args: {"command": "proxy git status", ...}         │
│                                                     │
│ Do you want to allow this tool call?                │
╰─────────────────────────────────────────────────────╯

This dialog appears for every single command the agent runs that gets rewritten — making the hook more disruptive than the old deny-with-suggestion workaround.

Proposed solution

Add a way for hooks to indicate a rewrite should be applied silently. Options:

Option A — permissionDecision: allow should suppress the dialog (most intuitive):

If the hook already decided allow, no confirmation should be needed.

Option B — New field showConfirmation: false:

{
  "hookSpecificOutput": {
    "permissionDecision": "allow",
    "updatedInput": { ... },
    "showConfirmation": false
  }
}

Option C — New permissionDecision value "silent-allow" or "allow-silent"

Option A seems most consistent with the existing semantics — allow already means the hook approved it.

Impact

Without silent rewrite, updatedInput is not practical for high-frequency mechanical rewrites (like token optimization proxies). The old deny-with-suggestion workaround was less disruptive because denials are handled gracefully by the agent without surfacing a modal to the user.

cc @MRayermannMSFT (from #2013)

[examon]

This was fixed across two releases. In v1.0.18, permissionDecision: "allow" was updated to suppress the tool approval prompt. In v1.0.24, updatedInput support was added so hooks can rewrite tool arguments before execution. These features compose, so returning allow together with updatedInput on v1.0.24 should rewrite the command without showing a dialog. If you are still seeing the prompt on v1.0.24, please comment with a minimal repro or sanitized hook output and we will take another look.

[jeziellopes]

Confirmed still happening on v1.0.24. Here's a minimal repro.

Hook config (.github/hooks/rtk-rewrite.json)

{
  "hooks": {
    "PreToolUse": [
      {
        "type": "command",
        "command": "proxy-hook",
        "cwd": ".",
        "timeout": 5
      }
    ]
  }
}

Hook input (from Copilot CLI)

{"toolName":"bash","toolArgs":"{\"command\":\"git log --oneline -3\",\"description\":\"check repo\"}"}

Hook output (what the hook returns)

{
  "hookSpecificOutput": {
    "hookEventName": "PreToolUse",
    "permissionDecision": "allow",
    "permissionDecisionReason": "proxy auto-rewrite",
    "updatedInput": {
      "command": "proxy git log --oneline -3",
      "description": "check repo"
    }
  }
}

What happened

Despite permissionDecision: allow, Copilot CLI v1.0.24 shows this dialog:

╭──────────────────────────────────────────────────────────────────╮
│ Hook permission request                                          │
│ ⚠ proxy auto-rewrite                                            │
│                                                                  │
│  Tool: bash                                                      │
│  Args: {"command": "git log --oneline -3", "description": "..."}│
│                                                                  │
│ Do you want to allow this tool call?                             │
│ ❯ 1. Yes                                                         │
│   2. No (Esc to stop)                                            │
╰──────────────────────────────────────────────────────────────────╯

Note: the dialog shows the original args, not the rewritten updatedInput. The permissionDecisionReason ("proxy auto-rewrite") is shown as the dialog title, which confirms the hook output was received — but the dialog still appears.

This happens on every rewritten command. A mechanical rewrite hook where the user explicitly opted in by installing the hook becomes unusable because it interrupts every single agent command.

[ChristofferKarlsson]

Experiencing the same thing as @jeziellopes, and the problem is still present on 1.0.25, @examon.

[specter119]

@examon this was not fixed.

[examon]

@jeziellopes Thanks for the concrete repro. I retested this with an isolated Copilot CLI v1.0.39 and a fresh config containing only the posted PreToolUse hook. In that run, permissionDecision: "allow" plus updatedInput rewrote the bash command to the proxy command, executed the proxy command, and did not show a Hook permission request dialog.

To find the delta with the failing setup, could you please share three details from a single failing run?

1. Can you reproduce in a fresh empty config with only the posted PreToolUse hook? If yes, could you please share the exact launch command/config path?
2. For one failing tool call, please share the raw hook stdin, stdout, stderr, and exit status exactly as Copilot CLI saw them (before any jq or formatting, etc.)
3. From that same run, please share the exact dialog text and what executes after approving: the original command or the rewritten proxy command.

Thanks a lot