Tools deny permission in format of --deny-tool doesn't work

[aamsel-intel]

Setting permission for tools in the format of the --deny-tool flag doesn't work ( --deny-tool='shell(git push))

I tried both sending --deny-tool='shell(git push)' as a connection argument to the client and as an excluded tool to the session.
In both cases the tool is permitted

SDK version = 1.0.11

[github-actions]

Investigation findings

Thanks for the report! After investigating the relevant code, this appears to be a usage question rather than a bug. The SDK's tool-filtering API is different from the CLI's --deny-tool flag syntax.

What I investigated

• nodejs/src/types.ts — SessionConfig.excludedTools and its pattern syntax
• nodejs/src/client.ts — how excludedTools is validated and passed to the runtime
• The CLI's --deny-tool flag format (shell(git push)) vs the SDK's filter format

What I found

The Copilot CLI accepts --deny-tool='shell(git push)' as a command-line flag that restricts specific sub-commands of built-in tools (e.g., the shell tool). However, the SDK exposes a different, higher-level API for tool filtering:

// Correct SDK approach — exclude the shell tool entirely:
await client.startSession({
  excludedTools: ["shell"],          // bare name match
  // or using source-qualified form:
  excludedTools: new ToolSet().addBuiltIn("shell").toArray(),
});

The pattern syntax supported by excludedTools is:

• builtin:* — all built-in tools
• builtin:<name> — a specific built-in tool (e.g., builtin:shell)
• mcp:<name> — a specific MCP tool
• custom:<name> — a specific custom tool
• Bare name (e.g., "shell") — exact match across any source

The CLI's shell(git push) sub-command restriction format is not part of the SDK's filter syntax. Passing --deny-tool='shell(git push)' as a connection argument does not work because the SDK communicates via JSON-RPC and the CLI args are not forwarded in that way.

Recommendation

If you want to block the shell tool entirely via the SDK, use excludedTools: ["shell"] or new ToolSet().addBuiltIn("shell"). Sub-command-level restrictions (git push within shell) are a CLI-only concept and are not currently exposed through the SDK's excludedTools API.

Relabeling this as a usage question. If sub-command-level tool restrictions via the SDK are something you need, please describe your use case and we can evaluate it as a feature request.

Generated by Bug Handler for #2350 · sonnet46 31.6 AIC · ⌖ 5.23 AIC · ⊞ 5.9K · ◷