[dotnet-port-fixes] Gate approval-required Copilot tools

[github-actions]

Summary

Align provider/copilotprovider with the .NET Copilot approval fix by installing a default OnPreToolUse hook for approval-required tools when the caller has not provided one. The hook returns ask for tools that require approval, preserves caller-supplied Hooks.OnPreToolUse, and clones tool/hook state so per-run session assembly does not mutate the caller's SessionConfig.

Ported .NET PRs

• .NET: Enforce ApprovalRequiredAIFunction in GitHub Copilot provider via OnPreToolUse hook agent-framework#6674 - enforce approval-required GitHub Copilot tools through the Copilot SDK pre-tool-use hook.
• Upstream commit: d5c5fb9d3de3a19c0f55d958464646dfefdb59e3 (https://github.com/microsoft/agent-framework/commit/d5c5fb9d3de3a19c0f55d958464646dfefdb59e3)

Breaking Changes

No.

Tests and Examples

• go test ./provider/copilotprovider -count=1
• go test ./provider/... -count=1
• Added internal tests covering create-session and resume-session approval gating, preservation of caller-supplied OnPreToolUse hooks, and non-mutation of source SessionConfig.

Notes

• Other recent upstream candidates were skipped because they were broader API work or upstream-only test churn.
• This Go port keeps caller-provided Hooks.OnPreToolUse authoritative; unlike the upstream .NET change, it does not add a new logger surface just to warn when callers override approval handling.

Generated by .NET to Go Fixes and Test Porting Agent · 953.8 AIC · ⌖ 32.3 AIC · ⊞ 21.7K · ◷

---

Note

This was originally intended as a pull request, but GitHub Actions is not permitted to create or approve pull requests in this repository.
The changes have been pushed to branch dotnet-port-fixes/copilot-approval-hook-948902a819b965e3.

Click here to create the pull request

To fix the permissions issue, go to Settings → Actions → General and enable Allow GitHub Actions to create and approve pull requests. See also: gh-aw FAQ

Show patch preview (235 of 235 lines)

From c25d05bc5674d4b10056f6dd36517b38321fbff1 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 03:43:12 +0000
Subject: [PATCH] provider/copilotprovider: gate approval-required tools

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 provider/copilotprovider/copilot.go           |  48 ++++++-
 .../copilotprovider/copilot_internal_test.go  | 126 ++++++++++++++++++
 2 files changed, 173 insertions(+), 1 deletion(-)
 create mode 100644 provider/copilotprovider/copilot_internal_test.go

diff --git a/provider/copilotprovider/copilot.go b/provider/copilotprovider/copilot.go
index 1f6d9ee88..3f86af336 100644
--- a/provider/copilotprovider/copilot.go
+++ b/provider/copilotprovider/copilot.go
@@ -236,6 +236,7 @@ func (p *provider) sessionConfig(streaming bool, options []agent.Option) copilot
 	cfg.Streaming = copilot.Bool(streaming)
 	cfg.SystemMessage = systemMessageWithInstructions(cfg.SystemMessage, slices.Collect(agent.AllOptions(options, agent.WithInstructions)))
 	cfg.Tools = append(cfg.Tools, copilotTools(options)...)
+	cfg.Hooks = sessionHooksWithApprovalRequests(cfg.Tools, cfg.Hooks)
 	return cfg
 }
 
@@ -244,6 +245,7 @@ func (p *provider) resumeSessionConfig(streaming bool, options []agent.Option) c
 	cfg.Streaming = copilot.Bool(streaming)
 	cfg.SystemMessage = systemMessageWithInstructions(cfg.SystemMessage, slices.Collect(agent.AllOptions(options, agent.WithInstructions)))
 	cfg.Tools = append(cfg.Tools, copilotTools(options)...)
+	cfg.Hooks = sessionHooksWithApprovalRequests(cfg.Tools, cfg.Hooks)
 	return cfg
 }
 
@@ -252,6 +254,7 @@ func copySessionConfig(source *copilot.SessionConfig) copilot.SessionConfig {
 		return copilot.SessionConfig{Streaming: copilot.Bool(true)}
 	}
 	clone := *source
+	clone.Tools = slices.Clone(source.Tools)
 	clone.Streaming = copyBoolDefaultTrue(source.Streaming)
 	return clone
 }
@@ -263,7 +266,7 @@ func copyResumeSessionConfig(source 
... (truncated)

[michelle-clayton-work]

Opened pull request #459, which will close this issue when merged.