Safe execution — error handling, retries, rollbacks

The idea, in plain English

Three official sub-skills:

• Error handling — detect and stop/redirect bad actions and failures.
• Retries — re-attempt transient failures sensibly.
• Rollbacks — undo changes that shouldn't stand.

Plus the execution limits that bound a run so it can't loop forever. The main mechanism for catching things is hooks — scripts that fire at key moments and can block a tool before it runs.

Error handling — catch it before it runs

Hooks are the agent's tripwires: scripts that run automatically at session moments (config = JSON with "version": 1 in .github/hooks/*.json or ~/.copilot/hooks/). The key one for safety:

• preToolUse fires before each tool call and returns a permissionDecision: allow / deny / ask (in the cloud agent, 'ask' = 'deny'). Denying needs a permissionDecisionReason; you can even rewrite the call with modifiedArgs. Any deny blocks the tool.
• permissionRequest can allow/deny before the permission dialog; with interrupt: true a deny stops the whole agent.
• Exit codes (command hooks): 0 = success, 2 = deny (for permissionRequest), other non-zero = logged failure.

Retries + rollbacks

Retries — try again, sensibly:

• continueOnAutoMode — if the agent is rate-limited, it auto-switches to auto mode and retries (default off; doesn't cover global rate limits or BYOK).
• In Actions, retry is a workflow pattern — re-run a flaky step / route on if: failure().
• Principle (from 1.4/1.5): retry transient failures; escalate after repeated failure rather than looping (escalation = lesson 2.8).

Rollbacks — undo cleanly:

• /rewind (undo last turn) — undoes the last agent turn including any file edits. The local "ctrl-Z" for an agent step.
• Because the agent works on a branch → PR (2.5/2.6), the bigger rollback is never merging (or reverting) the PR — the base branch was never touched.
• The cloud agent's filesystem is temporary (deleted after the job), limiting how far a bad change persists — use an http hook to send out anything you want to keep.

Execution limits — bound the run

// .github/hooks/guard.json
{ "version": 1,
  "preToolUse": [
    { "matcher": "shell",
      "command": "grep -q 'rm -rf' <<< \"$TOOL_ARGS\" && echo '{\"permissionDecision\":\"deny\",\"permissionDecisionReason\":\"blocked rm -rf\"}' || true",
      "timeoutSec": 10 } ] }

The cert-language version

Safe execution combines error handling (hooks like preToolUse that allow/deny/modify a tool call before it runs — but fail-open), retries (e.g. continueOnAutoMode, Actions if: failure()), rollbacks (/rewind the last turn, or revert/don't-merge the PR), and execution limits (--max-autopilot-continues, subagent depth, hook timeout). These are guardrails layered on top of least-privilege and human review — not hard locks.

Our summary · grounded in GitHub Docs (Copilot hooks reference, CLI command reference, Actions expressions) + MS Learn — Agent tooling… · fetched 2026-05-30

Common confusions (read these or lose points)

• "A preToolUse deny hook is a hard security boundary." No — hooks are fail-open; if the hook errors, the agent continues. Guardrail, not lock.
• "In the cloud agent, ask pauses for approval." No — in the cloud agent 'ask' = 'deny' (no human to ask).
• "Don't worry about the autopilot continuation default." Don't rely on it — the --max-autopilot-continues default has changed across CLI versions; set it explicitly to bound a run.
• "Rollback means restoring production." Here it's usually /rewind (undo last turn) or not merging / reverting the PR — the base branch was never directly changed.
• "Cloud hooks work like local hooks." No — cloud loads only .github/hooks/*.json, bash only, on a temporary filesystem.