Troubleshooting guide · GitHub Docs checked Nov 3, 2026
Diagnose Copilot CLI permission failures during long scripted runs
Separate documented approval behavior in noninteractive Copilot CLI runs from one reported mid-session failure. Check the CLI version, permission scope, and policy boundaries, then capture a minimal reproduction without assuming a flag fixes the report.
Why does Copilot CLI say it cannot request permission in a noninteractive run?
A -p run has no person available to answer an approval prompt. GitHub documents that permission requests which still need user approval are denied in unattended runs. This explains why a particular operation may be denied in a headless run; it does not by itself explain a failure that begins partway through a session that was already working.
What does issue #4433 report?
One user reports that write-capable tool calls began failing during longer -p sessions on Windows 11 with Copilot CLI 1.0.78 and 1.0.79, while a short run with the same flags and working directory succeeded. The author says the failure also occurred with --allow-all and extra allow-tool entries. This is a report from one setup, not proof of a general bug, a root cause, prevalence, or behavior in current releases.
How should I narrow down a similar failure?
Record the exact version from copilot --version, operating system, whether a terminal is attached, working directory, custom agent, full command and flags, and the first operation that fails. Check the installed version's supported options with copilot help. In a safe test repository, compare a short task with a longer one using the same version, agent, directory, and permissions; change one condition at a time. A short run that passes and a long run that fails help describe the setup but do not identify a cause by themselves.
What permission settings should I inspect?
Identify the tool and path involved in the first denial. GitHub treats tool permissions, allowed paths, and URLs as distinct controls. Check scoped allow rules, deny rules, sandbox settings, and any managed policy that applies. GitHub recommends granting only the permissions needed for the task and cautions against broad grants outside a sandbox.
Can --assisted-approval prevent long-run permission failures?
GitHub documents assisted approval for eligible requests in noninteractive runs. It does not override deny rules, mandatory approval requirements, or sandbox protections, and requests that still need a person remain denied. Check stderr to see whether assisted approval was enabled. The documentation does not say this option fixes the mid-session behavior in issue #4433.
Does adding --allow-all fix issue #4433?
No documented fix is established. The issue author says --allow-all did not prevent the reported failure. GitHub defines --allow-all as a broad grant covering tools, paths, and URLs; that makes it neither a narrow diagnostic step nor a verified repair for this report.
Is there a documented recovery for the reported mid-session failure?
The issue asks whether there is a supported way to keep approvals stable or force a clean re-resolution. The linked current programmatic-use guide describes permission flags and assisted approval, but does not document a recovery procedure for that reported condition. A fresh short run is a comparison, not a promised repair. If the failure persists, keep a minimal reproduction and report the exact CLI version and diagnostic output through the project issue tracker.
What should an unattended job capture and do when permission is denied?
Capture stdout, stderr, and the process exit status. Treat an unexpected denial as a failed job for review rather than assuming the requested change completed. Do not retry with broader access unless the task's reviewed requirements justify it. Before sharing logs or a session transcript, remove tokens, private repository details, user data, and sensitive paths; GitHub notes that transcripts can contain sensitive information.
Sources
- GitHub Docs: Running Copilot CLI programmatically · noninteractive usage and minimal permissions · checked Nov 3, 2026
- GitHub Docs: Copilot CLI programmatic reference · permission flags and assisted approval · checked Nov 3, 2026
- GitHub Copilot CLI issue #4433 · individual report about mid-session denial in -p mode · opened Aug 11, 2026