Copilot CLI 1.0.97 Autopilot denies a hook's ask: paid Sume calls

In Copilot CLI 1.0.97-0, Autopilot now denies a preToolUse hook's "ask" decision instead of stopping on a permission dialog nobody is watching. For a paid Sume MCP call that means an unattended Autopilot run will not render when your hook says "ask": the call is refused and the run moves on. The release notes state this in one line under Fixed.

Sume's own gates sit behind that decision. They are separate from Copilot's permission flow, and they are what you rely on when a hook says "allow".

What exactly changed in Copilot CLI 1.0.97-0?

The release lists a fix that reads: "Autopilot denies a preToolUse hook's "ask" decision instead of stopping on a permission dialog nobody is watching." The same release adds agent-scoped declarative hooks for custom agents. Before the fix, an "ask" in an unattended run could leave the session waiting on a dialog. After it, the answer is a denial.

Nothing in the release changes how MCP servers are added. Sume is still a remote HTTP server at https://mcp.sume.com/mcp.

Why does a denied ask matter for paid Sume tools?

Sume's generation tools (generate_image, generate_video, music_create, tts_create and the other create tools) are paid and write tools. A hook that returns "ask" for them is a sensible way to put a person in the loop. In an attended session that works. In an Autopilot run there is no person, so the new behavior turns "ask a human" into "do not run".

That is the safe direction. A failed render attempt costs nothing. A silent stall inside a scheduled run is harder to notice.

Which Sume gates still apply when a hook allows the call?

Per the tools and gates page, write and paid operations need an idempotency_key. Two optional gates are available on top: dry_run=true returns a cost estimate in credits without submitting a job, and max_spend_credits is a spending cap Sume enforces when the request includes it. The legacy allow_write and allow_paid parameters are accepted but cannot bypass scope.

Scope is the first gate. With OAuth, a token that holds only mcp:read sees read-only tools; adding mcp:write exposes the full hosted toolset. There is no mcp:paid scope, per the OAuth page, so each paid submit still goes through wallet and admission checks. An API key is equivalent to full write access.

• Connect Autopilot runs with OAuth and leave Write off when the run only needs to look things up (catalog_list, balance_get, jobs_status).
• For runs that must render, have the agent call dry_run=true first and only then submit with a fresh idempotency_key.
• Send max_spend_credits on every paid call so the cap does not depend on the hook.

How do I set up the connection for an unattended run?

The quickstart lists the hosted endpoint and says read-only access is the default, with Write enabled by a toggle at consent. After connecting, call mcp_health and tools_list to confirm what your credential can see. If paid tools are missing from the list, the session is read-only, and a call to a restricted tool returns insufficient_scope.

Keep the hook as a second line of defense, not the only one. A hook can be misconfigured or fail; the credential's scope and the max_spend_credits value in the request are enforced by Sume itself.

What should I test after upgrading?

Run one Autopilot task that tries a paid call with a hook returning "ask" and confirm it is denied. Then run the same task with a read-only token and confirm the paid tool is not listed at all. Finally run an attended session with dry_run=true and check the credit estimate before you approve anything real.