⚠️ Important: This demo requires GitHub Copilot CLI version 0.0.396 or later (released January 27, 2026). Earlier versions do not support using pre-tool-use hooks to block tools.

This repository demonstrates how to use GitHub Copilot CLI hooks to prevent the agent from accessing certain files. This is useful for protecting sensitive files like credentials, private keys, or proprietary code that you don't want the AI to read or use.

1. A preToolUse hook intercepts all tool calls before they execute
2. For file-accessing tools (view, edit, create, grep, glob), the hook extracts the file path
3. The path is checked against patterns in .github/blocked-files.txt
4. If matched, the tool call is denied with an explanatory message
5. The agent sees the denial and should respect it

.github/
├── hooks/
│   └── block-files.json       # Hook configuration
├── scripts/
│   ├── check-file-access.sh   # Bash implementation (macOS/Linux)
│   └── check-file-access.ps1  # PowerShell implementation (Windows)
└── blocked-files.txt          # Patterns for blocked files

secrets/                        # Example blocked directory
├── api-credentials.txt
└── database.key

src/
└── app.js                      # Example allowed file

The blocked-files.txt file supports a simplified glob syntax:

Lines starting with # are comments. Empty lines are ignored.

# Block all files in the secrets directory
secrets/**

# Block private key files
*.pem
*.key

# Block specific sensitive files
.env.production
config/database.yml

1. Open this repository with GitHub Copilot CLI
2. Ask the agent to read a blocked file:

   Show me the contents of secrets/api-credentials.txt
   

3. The agent should receive a denial message and refuse to read the file
4. Ask the agent to read an allowed file:

   Show me the contents of src/app.js
   

5. This should work normally

• Bash commands: The hook checks paths passed to file tools, but cannot parse arbitrary bash commands like cat secrets/file.txt
• Indirect access: The agent could potentially work around this by using bash to read files directly
• Pattern matching: The simplified glob syntax doesn't support {a,b} alternation or [abc] character classes

To add more robust protection:

1. Block bash access to sensitive paths: Modify the hook to inspect bash commands for blocked paths
2. Add more tools: Extend the tool list in the scripts to cover additional file-accessing tools
3. Support more patterns: Enhance glob_to_regex to support character classes and alternation

• macOS/Linux: bash, jq
• Windows: PowerShell 5.1+

MIT