From 148082d94b3016d307cb20262ab2eee809ba812a Mon Sep 17 00:00:00 2001
From: Larry Ewing <lewing@microsoft.com>
Date: Sat, 21 Mar 2026 10:20:23 -0500
Subject: [PATCH 01/12] Replace per-skill AI disclosure with a PreToolUse hook

Move the AI-generated content disclosure from duplicated text in
copilot-instructions.md and 6 SKILL.md files into a single
.github/hooks/hooks.json PreToolUse hook that fires when gh CLI
commands post to GitHub (pr/issue create/comment/edit/review).

This eliminates token waste from repeated instructions and ensures
the disclosure applies uniformly to all GitHub-posting actions,
including any future skills that use gh.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/copilot-instructions.md               |  9 ---------
 .github/hooks/hooks.json                      | 17 +++++++++++++++++
 .github/skills/api-proposal/SKILL.md          |  2 --
 .github/skills/ci-analysis/SKILL.md           |  2 --
 .github/skills/code-review/SKILL.md           |  2 --
 .github/skills/issue-triage/SKILL.md          |  6 ------
 .github/skills/performance-benchmark/SKILL.md |  2 --
 .github/skills/vmr-codeflow-status/SKILL.md   |  2 --
 8 files changed, 17 insertions(+), 25 deletions(-)
 create mode 100644 .github/hooks/hooks.json

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index a23e28a783c9bc..d3c1221e713383 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -46,15 +46,6 @@ When NOT running under CCA, guidance for creating commits and pushing changes:
 - Never push to an active PR without being explicitly asked, even in autopilot/yolo mode. Always wait for explicit instruction to push.
 - Never chain commit and push in the same command. Always commit first, report what was committed, then wait for an explicit push instruction. This creates a mandatory decision point.
 - Prefer creating a new commit rather than amending an existing one. Exceptions: (1) explicitly asked to amend, or (2) the existing commit is obviously broken with something minor (e.g., typo or comment fix) and hasn't been pushed yet.
-- **Before posting to GitHub (PRs, issues, comments):** Include the AI-generated content disclosure (see below).
-
-## AI-Generated Content Disclosure
-
-When posting any content to GitHub under a user's credentials — opening PRs, creating issues, commenting on PRs or issues, posting review comments, or any other public-facing action — and the account is **not** a dedicated "copilot" or "bot" account/app, you **MUST** include a concise, visible note (e.g. a `> [!NOTE]` alert) indicating the content was AI/Copilot-generated.
-
-This applies to all GitHub interactions: PR descriptions, issue bodies, comments, review comments, etc. Exceptions:
-- The account is a recognized bot or Copilot app account (e.g., `github-actions[bot]`, `copilot`), where the AI origin is already apparent from the account identity.
-- The user explicitly asks you to omit the disclosure.
 
 ---
 
diff --git a/.github/hooks/hooks.json b/.github/hooks/hooks.json
new file mode 100644
index 00000000000000..53995d8f1fcd89
--- /dev/null
+++ b/.github/hooks/hooks.json
@@ -0,0 +1,17 @@
+{
+  "description": "Lifecycle hooks for dotnet/runtime — AI disclosure guardrails",
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node -e \"let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const i=JSON.parse(d);const cmd=i.tool_input?.command||'';if(/gh\\s+(pr|issue)\\s+(create|comment|edit|review|merge)/.test(cmd)){console.error('AI-GENERATED CONTENT DISCLOSURE: When posting to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. \\'> [!NOTE]\\') indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.')}}catch{}})\""
+          }
+        ],
+        "description": "Remind to include AI-generated content disclosure when posting to GitHub via gh CLI"
+      }
+    ]
+  }
+}
diff --git a/.github/skills/api-proposal/SKILL.md b/.github/skills/api-proposal/SKILL.md
index 8f1905b87d1428..efe1507ccd75a2 100644
--- a/.github/skills/api-proposal/SKILL.md
+++ b/.github/skills/api-proposal/SKILL.md
@@ -270,8 +270,6 @@ Present the complete draft to the user for review. Iterate based on feedback bef
 
 ### Phase 5: Publish
 
-> **AI-generated content disclosure:** When posting any content to GitHub (issue body, PR body, comments) under a user's credentials — i.e., the account is **not** a dedicated "copilot" or "bot" account/app — prepend a concise, visible note (e.g. a `> [!NOTE]` alert) indicating the content was AI/Copilot-generated. This applies to the initial proposal, iteration updates, and any follow-up comments posted on the user's behalf. Skip this if the user explicitly asks you to omit it.
-
 #### Step 1: Push and capture commit URL
 
 Commit prototype changes and push the branch to the user's fork (default) or ask for an alternative remote. Capture the commit URL for inclusion in the proposal (e.g., `https://github.com/<owner>/<repo>/commit/<sha>`).
diff --git a/.github/skills/ci-analysis/SKILL.md b/.github/skills/ci-analysis/SKILL.md
index 9c8fb5719b5aa6..5b42f8363ee1b2 100644
--- a/.github/skills/ci-analysis/SKILL.md
+++ b/.github/skills/ci-analysis/SKILL.md
@@ -9,8 +9,6 @@ Analyze CI build status and test failures in Azure DevOps and Helix for dotnet r
 
 > 🚨 **NEVER** use `gh pr review --approve` or `--request-changes`. Only `--comment` is allowed. Approval and blocking are human-only actions.
 
-> 📝 **AI-generated content disclosure:** When posting any content to GitHub (PR comments, retry commands, analysis summaries) under a user's credentials — i.e., the account is **not** a dedicated "copilot" or "bot" account/app — you **MUST** include a concise, visible note (e.g. a `> [!NOTE]` alert) indicating the content was AI/Copilot-generated. Skip this if the user explicitly asks you to omit it.
-
 **Workflow**: Gather PR context (Step 0) → run the script → read the human-readable output + `[CI_ANALYSIS_SUMMARY]` JSON → synthesize recommendations yourself. The script collects data; you generate the advice. For supplementary investigation beyond the script, MCP tools (AzDO, Helix, GitHub) provide structured access when available; the script and `gh` CLI work independently when they're not.
 
 ## When to Use This Skill
diff --git a/.github/skills/code-review/SKILL.md b/.github/skills/code-review/SKILL.md
index 7afa18906a9c9d..7542b697368f0b 100644
--- a/.github/skills/code-review/SKILL.md
+++ b/.github/skills/code-review/SKILL.md
@@ -98,8 +98,6 @@ When the environment supports launching sub-agents with different models (e.g.,
 
 When presenting the final review (whether as a PR comment or as output to the user), use the following structure. This ensures consistency across reviews and makes the output easy to scan.
 
-> 📝 **AI-generated content disclosure:** When posting review content to GitHub (PR review comments, PR comments) under a user's credentials — i.e., the account is **not** a dedicated "copilot" or "bot" account/app — you **MUST** include a concise, visible note (e.g. a `> [!NOTE]` alert) indicating the content was AI/Copilot-generated. Skip this if the user explicitly asks you to omit it.
-
 ### Structure
 
 ```
diff --git a/.github/skills/issue-triage/SKILL.md b/.github/skills/issue-triage/SKILL.md
index a3c920021376e7..fe1cded0d58002 100644
--- a/.github/skills/issue-triage/SKILL.md
+++ b/.github/skills/issue-triage/SKILL.md
@@ -461,12 +461,6 @@ Key points:
   with these explicit instructions; the constraint above prevents *autonomous*
   actions before the human decision, not user-directed actions after it.
 
-  When posting any content to GitHub (issue comments, label changes with explanations)
-  under a user's credentials -- i.e., the account is **not** a dedicated "copilot"
-  or "bot" account/app -- you **MUST** include a concise, visible note (e.g. a
-  `> [!NOTE]` alert) indicating the content was AI/Copilot-generated. Skip this if
-  the user explicitly asks you to omit it.
-
 - **NEVER** use `gh issue close`, `gh issue edit`, `gh issue comment`, or
   `gh pr review --approve`/`--request-changes` **unless the user explicitly
   asks you to** after picking an outcome.
diff --git a/.github/skills/performance-benchmark/SKILL.md b/.github/skills/performance-benchmark/SKILL.md
index 9e1b8f0bbf6a31..bfbe80312cc0a0 100644
--- a/.github/skills/performance-benchmark/SKILL.md
+++ b/.github/skills/performance-benchmark/SKILL.md
@@ -125,8 +125,6 @@ public class Bench
 
 Post a comment on the PR to trigger EgorBot with your benchmark. The general format is:
 
-> 📝 **AI-generated content disclosure:** When posting benchmark comments to GitHub under a user's credentials — i.e., the account is **not** a dedicated "copilot" or "bot" account/app — you **MUST** include a concise, visible note (e.g. a `> [!NOTE]` alert) indicating the content was AI/Copilot-generated. Skip this if the user explicitly asks you to omit it.
-
 @EgorBot [targets] [options] [BenchmarkDotNet args]
 
 ```cs
diff --git a/.github/skills/vmr-codeflow-status/SKILL.md b/.github/skills/vmr-codeflow-status/SKILL.md
index f80352e5275bd3..01e3ce99930138 100644
--- a/.github/skills/vmr-codeflow-status/SKILL.md
+++ b/.github/skills/vmr-codeflow-status/SKILL.md
@@ -11,8 +11,6 @@ Analyze the health of VMR codeflow PRs in both directions:
 
 > 🚨 **NEVER** use `gh pr review --approve` or `--request-changes`. Only `--comment` is allowed. Approval and blocking are human-only actions.
 
-> 📝 **AI-generated content disclosure:** When posting any content to GitHub (PR comments, analysis summaries) under a user's credentials — i.e., the account is **not** a dedicated "copilot" or "bot" account/app — you **MUST** include a concise, visible note (e.g. a `> [!NOTE]` alert) indicating the content was AI/Copilot-generated. Skip this if the user explicitly asks you to omit it.
-
 **Workflow**: Run the script → read the human-readable output + `[CODEFLOW_SUMMARY]` JSON → synthesize recommendations yourself. The script collects data; you generate the advice.
 
 ## Prerequisites

From 691492f1c7c971bfa59e5c67d40179896bd66e8d Mon Sep 17 00:00:00 2001
From: Larry Ewing <lewing@microsoft.com>
Date: Sat, 21 Mar 2026 10:27:26 -0500
Subject: [PATCH 02/12] Address review: pure shell hook, broader matcher, keep
 fallback pointer

- Replace node -e with grep+shell (no external runtime dependency)
- Broaden matcher to Bash|PowerShell for cross-platform coverage
- Add one-line disclosure pointer back to copilot-instructions.md
  for discoverability in environments without hook support

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/copilot-instructions.md | 1 +
 .github/hooks/hooks.json        | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index d3c1221e713383..23903d0e921534 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -46,6 +46,7 @@ When NOT running under CCA, guidance for creating commits and pushing changes:
 - Never push to an active PR without being explicitly asked, even in autopilot/yolo mode. Always wait for explicit instruction to push.
 - Never chain commit and push in the same command. Always commit first, report what was committed, then wait for an explicit push instruction. This creates a mandatory decision point.
 - Prefer creating a new commit rather than amending an existing one. Exceptions: (1) explicitly asked to amend, or (2) the existing commit is obviously broken with something minor (e.g., typo or comment fix) and hasn't been pushed yet.
+- **AI-generated content disclosure:** When posting to GitHub under a user account (not a bot/copilot app), include a visible `> [!NOTE]` indicating AI/Copilot-generated content. Enforced automatically via [`.github/hooks/hooks.json`](.github/hooks/hooks.json); skip only if the user explicitly opts out.
 
 ---
 
diff --git a/.github/hooks/hooks.json b/.github/hooks/hooks.json
index 53995d8f1fcd89..0c76ddadc95d34 100644
--- a/.github/hooks/hooks.json
+++ b/.github/hooks/hooks.json
@@ -3,11 +3,11 @@
   "hooks": {
     "PreToolUse": [
       {
-        "matcher": "Bash",
+        "matcher": "Bash|PowerShell",
         "hooks": [
           {
             "type": "command",
-            "command": "node -e \"let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const i=JSON.parse(d);const cmd=i.tool_input?.command||'';if(/gh\\s+(pr|issue)\\s+(create|comment|edit|review|merge)/.test(cmd)){console.error('AI-GENERATED CONTENT DISCLOSURE: When posting to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. \\'> [!NOTE]\\') indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.')}}catch{}})\""
+            "command": "grep -qE 'gh\\s+(pr|issue)\\s+(create|comment|edit|review|merge)' && echo 'AI-GENERATED CONTENT DISCLOSURE: When posting to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. > [!NOTE]) indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.' >&2; :"
           }
         ],
         "description": "Remind to include AI-generated content disclosure when posting to GitHub via gh CLI"

From d740af912080563ac1d5de1c4aa861f12f11805e Mon Sep 17 00:00:00 2001
From: Larry Ewing <lewing@microsoft.com>
Date: Sat, 21 Mar 2026 10:31:59 -0500
Subject: [PATCH 03/12] Use official hook format with bash/powershell keys
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use the version 1 hooks schema with separate bash and powershell
keys for cross-platform support. Pure shell builtins on both
platforms — no dependency on grep, node, or other external tools.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/hooks/hooks.json | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/.github/hooks/hooks.json b/.github/hooks/hooks.json
index 0c76ddadc95d34..33597af1dc261b 100644
--- a/.github/hooks/hooks.json
+++ b/.github/hooks/hooks.json
@@ -1,15 +1,14 @@
 {
+  "version": 1,
   "description": "Lifecycle hooks for dotnet/runtime — AI disclosure guardrails",
   "hooks": {
-    "PreToolUse": [
+    "preToolUse": [
       {
         "matcher": "Bash|PowerShell",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "grep -qE 'gh\\s+(pr|issue)\\s+(create|comment|edit|review|merge)' && echo 'AI-GENERATED CONTENT DISCLOSURE: When posting to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. > [!NOTE]) indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.' >&2; :"
-          }
-        ],
+        "type": "command",
+        "bash": "d=; while IFS= read -r l; do d=$d$l; done; case $d in *'gh pr '*|*'gh issue '*) echo 'AI-GENERATED CONTENT DISCLOSURE: When posting to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. > [!NOTE]) indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.' >&2;; esac; :",
+        "powershell": "$d = [Console]::In.ReadToEnd(); if ($d -match 'gh\\s+(pr|issue)\\s') { [Console]::Error.WriteLine('AI-GENERATED CONTENT DISCLOSURE: When posting to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. > [!NOTE]) indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.') }",
+        "timeoutSec": 5,
         "description": "Remind to include AI-generated content disclosure when posting to GitHub via gh CLI"
       }
     ]

From 081b325c50a2baca21d232fecfdfbc9fe32b4648 Mon Sep 17 00:00:00 2001
From: Larry Ewing <lewing@microsoft.com>
Date: Sat, 21 Mar 2026 10:34:50 -0500
Subject: [PATCH 04/12] Soften disclosure wording: reminder, not enforcement

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/copilot-instructions.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 23903d0e921534..b40b9693a41690 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -46,7 +46,7 @@ When NOT running under CCA, guidance for creating commits and pushing changes:
 - Never push to an active PR without being explicitly asked, even in autopilot/yolo mode. Always wait for explicit instruction to push.
 - Never chain commit and push in the same command. Always commit first, report what was committed, then wait for an explicit push instruction. This creates a mandatory decision point.
 - Prefer creating a new commit rather than amending an existing one. Exceptions: (1) explicitly asked to amend, or (2) the existing commit is obviously broken with something minor (e.g., typo or comment fix) and hasn't been pushed yet.
-- **AI-generated content disclosure:** When posting to GitHub under a user account (not a bot/copilot app), include a visible `> [!NOTE]` indicating AI/Copilot-generated content. Enforced automatically via [`.github/hooks/hooks.json`](.github/hooks/hooks.json); skip only if the user explicitly opts out.
+- **AI-generated content disclosure:** When posting to GitHub under a user account (not a bot/copilot app), include a visible `> [!NOTE]` indicating AI/Copilot-generated content. A `preToolUse` hook in [`.github/hooks/hooks.json`](.github/hooks/hooks.json) reminds you when using `gh`; skip only if the user explicitly opts out.
 
 ---
 

From f750f38206ac89bf81a292e5b6f7e3f8eba9991c Mon Sep 17 00:00:00 2001
From: Larry Ewing <lewing@microsoft.com>
Date: Sat, 21 Mar 2026 10:39:07 -0500
Subject: [PATCH 05/12] Broaden hook to cover all GitHub interactions, not just
 gh CLI

- Shell hook: match any command mentioning 'github' or 'gh' (covers
  gh CLI, curl to api.github.com, etc.)
- GitHub MCP tools hook: unconditional reminder for any tool with
  'github' in the name
- copilot-instructions.md: remove gh-specific wording; the rule
  applies to all GitHub posting methods

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/copilot-instructions.md |  2 +-
 .github/hooks/hooks.json        | 14 +++++++++++---
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index b40b9693a41690..ca335d85b7a8b0 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -46,7 +46,7 @@ When NOT running under CCA, guidance for creating commits and pushing changes:
 - Never push to an active PR without being explicitly asked, even in autopilot/yolo mode. Always wait for explicit instruction to push.
 - Never chain commit and push in the same command. Always commit first, report what was committed, then wait for an explicit push instruction. This creates a mandatory decision point.
 - Prefer creating a new commit rather than amending an existing one. Exceptions: (1) explicitly asked to amend, or (2) the existing commit is obviously broken with something minor (e.g., typo or comment fix) and hasn't been pushed yet.
-- **AI-generated content disclosure:** When posting to GitHub under a user account (not a bot/copilot app), include a visible `> [!NOTE]` indicating AI/Copilot-generated content. A `preToolUse` hook in [`.github/hooks/hooks.json`](.github/hooks/hooks.json) reminds you when using `gh`; skip only if the user explicitly opts out.
+- **AI-generated content disclosure:** When posting content to GitHub under a user account (not a bot/copilot app), include a visible `> [!NOTE]` indicating AI/Copilot-generated content. Skip only if the user explicitly opts out. See [`.github/hooks/hooks.json`](.github/hooks/hooks.json) for the automated reminder.
 
 ---
 
diff --git a/.github/hooks/hooks.json b/.github/hooks/hooks.json
index 33597af1dc261b..03d384c35b4359 100644
--- a/.github/hooks/hooks.json
+++ b/.github/hooks/hooks.json
@@ -6,10 +6,18 @@
       {
         "matcher": "Bash|PowerShell",
         "type": "command",
-        "bash": "d=; while IFS= read -r l; do d=$d$l; done; case $d in *'gh pr '*|*'gh issue '*) echo 'AI-GENERATED CONTENT DISCLOSURE: When posting to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. > [!NOTE]) indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.' >&2;; esac; :",
-        "powershell": "$d = [Console]::In.ReadToEnd(); if ($d -match 'gh\\s+(pr|issue)\\s') { [Console]::Error.WriteLine('AI-GENERATED CONTENT DISCLOSURE: When posting to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. > [!NOTE]) indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.') }",
+        "bash": "d=; while IFS= read -r l; do d=$d$l; done; case $d in *github*|*'gh '*) echo 'AI-GENERATED CONTENT DISCLOSURE: When posting content to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. > [!NOTE]) indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.' >&2;; esac; :",
+        "powershell": "$d = [Console]::In.ReadToEnd(); if ($d -match 'github|\\bgh\\b') { [Console]::Error.WriteLine('AI-GENERATED CONTENT DISCLOSURE: When posting content to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. > [!NOTE]) indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.') }",
         "timeoutSec": 5,
-        "description": "Remind to include AI-generated content disclosure when posting to GitHub via gh CLI"
+        "description": "Remind about AI disclosure when shell commands interact with GitHub"
+      },
+      {
+        "matcher": "github",
+        "type": "command",
+        "bash": "echo 'AI-GENERATED CONTENT DISCLOSURE: When posting content to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. > [!NOTE]) indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.' >&2; :",
+        "powershell": "[Console]::Error.WriteLine('AI-GENERATED CONTENT DISCLOSURE: When posting content to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. > [!NOTE]) indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.')",
+        "timeoutSec": 5,
+        "description": "Remind about AI disclosure when using GitHub MCP tools"
       }
     ]
   }

From 8605e503ee4be12d9de5d8f41d6eafbb70cf942c Mon Sep 17 00:00:00 2001
From: Larry Ewing <lewing@microsoft.com>
Date: Sat, 21 Mar 2026 10:49:44 -0500
Subject: [PATCH 06/12] =?UTF-8?q?Drop=20MCP=20tool=20hook=20=E2=80=94=20ke?=
 =?UTF-8?q?ep=20it=20simple?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The copilot-instructions.md rule is the source of truth. The shell
hook is a best-effort nudge when gh/github commands run, not a gate.
Remove the overly broad GitHub MCP tool matcher that would spam on
every read-only query.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/hooks/hooks.json | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.github/hooks/hooks.json b/.github/hooks/hooks.json
index 03d384c35b4359..5a8b7a359b0442 100644
--- a/.github/hooks/hooks.json
+++ b/.github/hooks/hooks.json
@@ -10,14 +10,6 @@
         "powershell": "$d = [Console]::In.ReadToEnd(); if ($d -match 'github|\\bgh\\b') { [Console]::Error.WriteLine('AI-GENERATED CONTENT DISCLOSURE: When posting content to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. > [!NOTE]) indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.') }",
         "timeoutSec": 5,
         "description": "Remind about AI disclosure when shell commands interact with GitHub"
-      },
-      {
-        "matcher": "github",
-        "type": "command",
-        "bash": "echo 'AI-GENERATED CONTENT DISCLOSURE: When posting content to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. > [!NOTE]) indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.' >&2; :",
-        "powershell": "[Console]::Error.WriteLine('AI-GENERATED CONTENT DISCLOSURE: When posting content to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. > [!NOTE]) indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.')",
-        "timeoutSec": 5,
-        "description": "Remind about AI disclosure when using GitHub MCP tools"
       }
     ]
   }

From 44b9d436fcd033a63320b4951f4476c5ef86ace4 Mon Sep 17 00:00:00 2001
From: Larry Ewing <lewing@microsoft.com>
Date: Sat, 21 Mar 2026 10:52:30 -0500
Subject: [PATCH 07/12] Add write-only MCP tool hook alongside shell hook

Two hooks:
1. Shell (Bash|PowerShell): fires when command mentions github/gh
2. MCP tools: matcher catches write verbs (create|comment|update|
   edit|review|push|merge), then body checks for 'github' in the
   tool args to avoid false positives from non-GitHub tools

No metadata on MCP tools to distinguish read vs write, so we match
on tool name patterns containing write-like verbs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/hooks/hooks.json | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/hooks/hooks.json b/.github/hooks/hooks.json
index 5a8b7a359b0442..8ae455e081ee1e 100644
--- a/.github/hooks/hooks.json
+++ b/.github/hooks/hooks.json
@@ -10,6 +10,14 @@
         "powershell": "$d = [Console]::In.ReadToEnd(); if ($d -match 'github|\\bgh\\b') { [Console]::Error.WriteLine('AI-GENERATED CONTENT DISCLOSURE: When posting content to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. > [!NOTE]) indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.') }",
         "timeoutSec": 5,
         "description": "Remind about AI disclosure when shell commands interact with GitHub"
+      },
+      {
+        "matcher": "create|comment|update|edit|review|push|merge",
+        "type": "command",
+        "bash": "d=; while IFS= read -r l; do d=$d$l; done; case $d in *github*) echo 'AI-GENERATED CONTENT DISCLOSURE: When posting content to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. > [!NOTE]) indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.' >&2;; esac; :",
+        "powershell": "$d = [Console]::In.ReadToEnd(); if ($d -match 'github') { [Console]::Error.WriteLine('AI-GENERATED CONTENT DISCLOSURE: When posting content to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. > [!NOTE]) indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.') }",
+        "timeoutSec": 5,
+        "description": "Remind about AI disclosure for write-capable GitHub MCP tools"
       }
     ]
   }

From 1c10b95543cd7c587693570e13158427565bee0c Mon Sep 17 00:00:00 2001
From: Larry Ewing <lewing@microsoft.com>
Date: Sat, 21 Mar 2026 11:00:39 -0500
Subject: [PATCH 08/12] Tighten hook: write-only gh subcommands + short message
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Shell hook now only fires on gh pr/issue create/comment/review/edit/
merge/close — not on reads like 'gh pr view' or 'gh issue list'.
Message shortened to ~15 tokens referencing copilot-instructions.md
for the full rule, avoiding context bloat in long sessions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/hooks/hooks.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/hooks/hooks.json b/.github/hooks/hooks.json
index 8ae455e081ee1e..3247113029368e 100644
--- a/.github/hooks/hooks.json
+++ b/.github/hooks/hooks.json
@@ -6,16 +6,16 @@
       {
         "matcher": "Bash|PowerShell",
         "type": "command",
-        "bash": "d=; while IFS= read -r l; do d=$d$l; done; case $d in *github*|*'gh '*) echo 'AI-GENERATED CONTENT DISCLOSURE: When posting content to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. > [!NOTE]) indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.' >&2;; esac; :",
-        "powershell": "$d = [Console]::In.ReadToEnd(); if ($d -match 'github|\\bgh\\b') { [Console]::Error.WriteLine('AI-GENERATED CONTENT DISCLOSURE: When posting content to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. > [!NOTE]) indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.') }",
+        "bash": "d=; while IFS= read -r l; do d=$d$l; done; case $d in *'gh pr create'*|*'gh pr comment'*|*'gh pr review'*|*'gh pr edit'*|*'gh pr merge'*|*'gh issue create'*|*'gh issue comment'*|*'gh issue edit'*|*'gh issue close'*) echo 'Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md' >&2;; esac; :",
+        "powershell": "$d = [Console]::In.ReadToEnd(); if ($d -match 'gh (pr|issue) (create|comment|review|edit|merge|close)') { [Console]::Error.WriteLine('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md') }",
         "timeoutSec": 5,
-        "description": "Remind about AI disclosure when shell commands interact with GitHub"
+        "description": "Remind about AI disclosure when posting to GitHub via gh CLI"
       },
       {
         "matcher": "create|comment|update|edit|review|push|merge",
         "type": "command",
-        "bash": "d=; while IFS= read -r l; do d=$d$l; done; case $d in *github*) echo 'AI-GENERATED CONTENT DISCLOSURE: When posting content to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. > [!NOTE]) indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.' >&2;; esac; :",
-        "powershell": "$d = [Console]::In.ReadToEnd(); if ($d -match 'github') { [Console]::Error.WriteLine('AI-GENERATED CONTENT DISCLOSURE: When posting content to GitHub under a user account (not a bot/copilot app account), include a visible note (e.g. > [!NOTE]) indicating the content was AI/Copilot-generated. Skip only if the user explicitly asked to omit it.') }",
+        "bash": "d=; while IFS= read -r l; do d=$d$l; done; case $d in *github*) echo 'Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md' >&2;; esac; :",
+        "powershell": "$d = [Console]::In.ReadToEnd(); if ($d -match 'github') { [Console]::Error.WriteLine('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md') }",
         "timeoutSec": 5,
         "description": "Remind about AI disclosure for write-capable GitHub MCP tools"
       }

From 5a6fd8909f9260fda28de68635e7f504029bc7e5 Mon Sep 17 00:00:00 2001
From: Larry Ewing <lewing@microsoft.com>
Date: Sat, 21 Mar 2026 11:03:13 -0500
Subject: [PATCH 09/12] Restore full disclosure section in
 copilot-instructions.md
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The hook message is a short pointer ('per copilot-instructions.md'),
so the full rule needs to live here. Restores the original section
from #125842. The per-skill duplicates remain removed — the hook
provides the point-of-action reminder, this section is the source
of truth.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/copilot-instructions.md | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index ca335d85b7a8b0..a23e28a783c9bc 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -46,7 +46,15 @@ When NOT running under CCA, guidance for creating commits and pushing changes:
 - Never push to an active PR without being explicitly asked, even in autopilot/yolo mode. Always wait for explicit instruction to push.
 - Never chain commit and push in the same command. Always commit first, report what was committed, then wait for an explicit push instruction. This creates a mandatory decision point.
 - Prefer creating a new commit rather than amending an existing one. Exceptions: (1) explicitly asked to amend, or (2) the existing commit is obviously broken with something minor (e.g., typo or comment fix) and hasn't been pushed yet.
-- **AI-generated content disclosure:** When posting content to GitHub under a user account (not a bot/copilot app), include a visible `> [!NOTE]` indicating AI/Copilot-generated content. Skip only if the user explicitly opts out. See [`.github/hooks/hooks.json`](.github/hooks/hooks.json) for the automated reminder.
+- **Before posting to GitHub (PRs, issues, comments):** Include the AI-generated content disclosure (see below).
+
+## AI-Generated Content Disclosure
+
+When posting any content to GitHub under a user's credentials — opening PRs, creating issues, commenting on PRs or issues, posting review comments, or any other public-facing action — and the account is **not** a dedicated "copilot" or "bot" account/app, you **MUST** include a concise, visible note (e.g. a `> [!NOTE]` alert) indicating the content was AI/Copilot-generated.
+
+This applies to all GitHub interactions: PR descriptions, issue bodies, comments, review comments, etc. Exceptions:
+- The account is a recognized bot or Copilot app account (e.g., `github-actions[bot]`, `copilot`), where the AI origin is already apparent from the account identity.
+- The user explicitly asks you to omit the disclosure.
 
 ---
 

From 1e2ccafa13b04fb42bb985ae421e49d1ba1cc3a6 Mon Sep 17 00:00:00 2001
From: Larry Ewing <lewing@microsoft.com>
Date: Sat, 21 Mar 2026 12:40:13 -0500
Subject: [PATCH 10/12] Consolidate AI disclosure hooks into a single
 preToolUse hook

Merge the two separate preToolUse hooks (one for Bash/PowerShell gh CLI
commands, one for GitHub MCP tools) into a single hook that covers both
surfaces. This halves the number of hook executions per tool call,
reducing context overhead.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/hooks/hooks.json | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/.github/hooks/hooks.json b/.github/hooks/hooks.json
index 3247113029368e..8459f4f4bb1529 100644
--- a/.github/hooks/hooks.json
+++ b/.github/hooks/hooks.json
@@ -4,20 +4,12 @@
   "hooks": {
     "preToolUse": [
       {
-        "matcher": "Bash|PowerShell",
+        "matcher": "Bash|PowerShell|create|comment|update|edit|review|push|merge",
         "type": "command",
-        "bash": "d=; while IFS= read -r l; do d=$d$l; done; case $d in *'gh pr create'*|*'gh pr comment'*|*'gh pr review'*|*'gh pr edit'*|*'gh pr merge'*|*'gh issue create'*|*'gh issue comment'*|*'gh issue edit'*|*'gh issue close'*) echo 'Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md' >&2;; esac; :",
-        "powershell": "$d = [Console]::In.ReadToEnd(); if ($d -match 'gh (pr|issue) (create|comment|review|edit|merge|close)') { [Console]::Error.WriteLine('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md') }",
+        "bash": "d=; while IFS= read -r l; do d=$d$l; done; case $d in *'gh pr create'*|*'gh pr comment'*|*'gh pr review'*|*'gh pr edit'*|*'gh pr merge'*|*'gh issue create'*|*'gh issue comment'*|*'gh issue edit'*|*'gh issue close'*|*github*) echo 'Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md' >&2;; esac; :",
+        "powershell": "$d = [Console]::In.ReadToEnd(); if ($d -match 'gh (pr|issue) (create|comment|review|edit|merge|close)' -or $d -match 'github') { [Console]::Error.WriteLine('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md') }",
         "timeoutSec": 5,
-        "description": "Remind about AI disclosure when posting to GitHub via gh CLI"
-      },
-      {
-        "matcher": "create|comment|update|edit|review|push|merge",
-        "type": "command",
-        "bash": "d=; while IFS= read -r l; do d=$d$l; done; case $d in *github*) echo 'Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md' >&2;; esac; :",
-        "powershell": "$d = [Console]::In.ReadToEnd(); if ($d -match 'github') { [Console]::Error.WriteLine('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md') }",
-        "timeoutSec": 5,
-        "description": "Remind about AI disclosure for write-capable GitHub MCP tools"
+        "description": "Remind about AI disclosure when posting to GitHub via gh CLI or MCP tools"
       }
     ]
   }

From 4d276249b59787e0d5841c5de8ed123f2ea4d234 Mon Sep 17 00:00:00 2001
From: Larry Ewing <lewing@microsoft.com>
Date: Sat, 21 Mar 2026 14:15:13 -0500
Subject: [PATCH 11/12] Universal hook format: works on all four agent hosts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Switch to Claude nested format (PascalCase events, matcher→hooks
structure) — the only format that works across all tools:
- bash key: pure shell builtins (Copilot CLI, VS Code on Linux/macOS)
- powershell key: native PS (Copilot CLI, VS Code on Windows)
- command key: node -e fallback (Claude Code, Gemini CLI)

Add .claude/settings.json with command-only hooks since Claude Code
doesn't read .github/hooks/.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .claude/settings.json    | 24 ++++++++++++++++++++++++
 .github/hooks/hooks.json | 32 +++++++++++++++++++++++---------
 2 files changed, 47 insertions(+), 9 deletions(-)
 create mode 100644 .claude/settings.json

diff --git a/.claude/settings.json b/.claude/settings.json
new file mode 100644
index 00000000000000..f18532ee4ce15d
--- /dev/null
+++ b/.claude/settings.json
@@ -0,0 +1,24 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash|PowerShell",
+        "hooks": [
+          {
+            "command": "node -e \"let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const a=JSON.parse(d).toolArgs||'';if(/gh\\s+(pr|issue)\\s+(create|comment|review|edit|merge|close)/.test(a))process.stderr.write('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md\\n')}catch{}})\""
+          }
+        ],
+        "description": "Remind about AI disclosure when posting to GitHub via gh CLI"
+      },
+      {
+        "matcher": "create|comment|update|edit|review|push|merge",
+        "hooks": [
+          {
+            "command": "node -e \"let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const i=JSON.parse(d);if(/github/i.test(i.toolName||''))process.stderr.write('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md\\n')}catch{}})\""
+          }
+        ],
+        "description": "Remind about AI disclosure for write-capable GitHub MCP tools"
+      }
+    ]
+  }
+}
diff --git a/.github/hooks/hooks.json b/.github/hooks/hooks.json
index 8459f4f4bb1529..137e35799b90e7 100644
--- a/.github/hooks/hooks.json
+++ b/.github/hooks/hooks.json
@@ -1,15 +1,29 @@
 {
-  "version": 1,
-  "description": "Lifecycle hooks for dotnet/runtime — AI disclosure guardrails",
   "hooks": {
-    "preToolUse": [
+    "PreToolUse": [
       {
-        "matcher": "Bash|PowerShell|create|comment|update|edit|review|push|merge",
-        "type": "command",
-        "bash": "d=; while IFS= read -r l; do d=$d$l; done; case $d in *'gh pr create'*|*'gh pr comment'*|*'gh pr review'*|*'gh pr edit'*|*'gh pr merge'*|*'gh issue create'*|*'gh issue comment'*|*'gh issue edit'*|*'gh issue close'*|*github*) echo 'Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md' >&2;; esac; :",
-        "powershell": "$d = [Console]::In.ReadToEnd(); if ($d -match 'gh (pr|issue) (create|comment|review|edit|merge|close)' -or $d -match 'github') { [Console]::Error.WriteLine('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md') }",
-        "timeoutSec": 5,
-        "description": "Remind about AI disclosure when posting to GitHub via gh CLI or MCP tools"
+        "matcher": "Bash|PowerShell",
+        "hooks": [
+          {
+            "command": "node -e \"let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const a=JSON.parse(d).toolArgs||'';if(/gh\\s+(pr|issue)\\s+(create|comment|review|edit|merge|close)/.test(a))process.stderr.write('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md\\n')}catch{}})\"",
+            "bash": "d=; while IFS= read -r l; do d=$d$l; done; case $d in *'gh pr create'*|*'gh pr comment'*|*'gh pr review'*|*'gh pr edit'*|*'gh pr merge'*|*'gh issue create'*|*'gh issue comment'*|*'gh issue edit'*|*'gh issue close'*) echo 'Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md' >&2;; esac; :",
+            "powershell": "$d = [Console]::In.ReadToEnd(); if ($d -match 'gh (pr|issue) (create|comment|review|edit|merge|close)') { [Console]::Error.WriteLine('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md') }",
+            "timeout": 5
+          }
+        ],
+        "description": "Remind about AI disclosure when posting to GitHub via gh CLI"
+      },
+      {
+        "matcher": "create|comment|update|edit|review|push|merge",
+        "hooks": [
+          {
+            "command": "node -e \"let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const i=JSON.parse(d);if(/github/i.test(i.toolName||''))process.stderr.write('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md\\n')}catch{}})\"",
+            "bash": "d=; while IFS= read -r l; do d=$d$l; done; case $d in *github*) echo 'Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md' >&2;; esac; :",
+            "powershell": "$d = [Console]::In.ReadToEnd(); if ($d -match 'github') { [Console]::Error.WriteLine('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md') }",
+            "timeout": 5
+          }
+        ],
+        "description": "Remind about AI disclosure for write-capable GitHub MCP tools"
       }
     ]
   }

From b6477d3fd56c692fb9de2e947efff9817872a4d9 Mon Sep 17 00:00:00 2001
From: Larry Ewing <lewing@microsoft.com>
Date: Sat, 21 Mar 2026 14:18:55 -0500
Subject: [PATCH 12/12] Consolidate back to single hook entry

Two entries double the context cost since both matchers fire on
Bash tool calls. One combined entry with merged matcher and stdin
checks covers both gh CLI and GitHub MCP tools.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .claude/settings.json    | 15 +++------------
 .github/hooks/hooks.json | 22 +++++-----------------
 2 files changed, 8 insertions(+), 29 deletions(-)

diff --git a/.claude/settings.json b/.claude/settings.json
index f18532ee4ce15d..b38eb1db0d2718 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -2,22 +2,13 @@
   "hooks": {
     "PreToolUse": [
       {
-        "matcher": "Bash|PowerShell",
+        "matcher": "Bash|PowerShell|create|comment|update|edit|review|push|merge",
         "hooks": [
           {
-            "command": "node -e \"let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const a=JSON.parse(d).toolArgs||'';if(/gh\\s+(pr|issue)\\s+(create|comment|review|edit|merge|close)/.test(a))process.stderr.write('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md\\n')}catch{}})\""
+            "command": "node -e \"let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const i=JSON.parse(d);const a=i.toolArgs||'';const n=i.toolName||'';if(/gh\\s+(pr|issue)\\s+(create|comment|review|edit|merge|close)/.test(a)||/github/i.test(n))process.stderr.write('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md\\n')}catch{}})\""
           }
         ],
-        "description": "Remind about AI disclosure when posting to GitHub via gh CLI"
-      },
-      {
-        "matcher": "create|comment|update|edit|review|push|merge",
-        "hooks": [
-          {
-            "command": "node -e \"let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const i=JSON.parse(d);if(/github/i.test(i.toolName||''))process.stderr.write('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md\\n')}catch{}})\""
-          }
-        ],
-        "description": "Remind about AI disclosure for write-capable GitHub MCP tools"
+        "description": "Remind about AI disclosure when posting to GitHub via gh CLI or MCP tools"
       }
     ]
   }
diff --git a/.github/hooks/hooks.json b/.github/hooks/hooks.json
index 137e35799b90e7..8f956c2ffb96a3 100644
--- a/.github/hooks/hooks.json
+++ b/.github/hooks/hooks.json
@@ -2,28 +2,16 @@
   "hooks": {
     "PreToolUse": [
       {
-        "matcher": "Bash|PowerShell",
+        "matcher": "Bash|PowerShell|create|comment|update|edit|review|push|merge",
         "hooks": [
           {
-            "command": "node -e \"let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const a=JSON.parse(d).toolArgs||'';if(/gh\\s+(pr|issue)\\s+(create|comment|review|edit|merge|close)/.test(a))process.stderr.write('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md\\n')}catch{}})\"",
-            "bash": "d=; while IFS= read -r l; do d=$d$l; done; case $d in *'gh pr create'*|*'gh pr comment'*|*'gh pr review'*|*'gh pr edit'*|*'gh pr merge'*|*'gh issue create'*|*'gh issue comment'*|*'gh issue edit'*|*'gh issue close'*) echo 'Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md' >&2;; esac; :",
-            "powershell": "$d = [Console]::In.ReadToEnd(); if ($d -match 'gh (pr|issue) (create|comment|review|edit|merge|close)') { [Console]::Error.WriteLine('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md') }",
+            "command": "node -e \"let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const i=JSON.parse(d);const a=i.toolArgs||'';const n=i.toolName||'';if(/gh\\s+(pr|issue)\\s+(create|comment|review|edit|merge|close)/.test(a)||/github/i.test(n))process.stderr.write('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md\\n')}catch{}})\"",
+            "bash": "d=; while IFS= read -r l; do d=$d$l; done; case $d in *'gh pr create'*|*'gh pr comment'*|*'gh pr review'*|*'gh pr edit'*|*'gh pr merge'*|*'gh issue create'*|*'gh issue comment'*|*'gh issue edit'*|*'gh issue close'*|*github*) echo 'Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md' >&2;; esac; :",
+            "powershell": "$d = [Console]::In.ReadToEnd(); if ($d -match 'gh (pr|issue) (create|comment|review|edit|merge|close)' -or $d -match 'github') { [Console]::Error.WriteLine('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md') }",
             "timeout": 5
           }
         ],
-        "description": "Remind about AI disclosure when posting to GitHub via gh CLI"
-      },
-      {
-        "matcher": "create|comment|update|edit|review|push|merge",
-        "hooks": [
-          {
-            "command": "node -e \"let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const i=JSON.parse(d);if(/github/i.test(i.toolName||''))process.stderr.write('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md\\n')}catch{}})\"",
-            "bash": "d=; while IFS= read -r l; do d=$d$l; done; case $d in *github*) echo 'Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md' >&2;; esac; :",
-            "powershell": "$d = [Console]::In.ReadToEnd(); if ($d -match 'github') { [Console]::Error.WriteLine('Include AI-generated content disclosure (> [!NOTE]) per copilot-instructions.md') }",
-            "timeout": 5
-          }
-        ],
-        "description": "Remind about AI disclosure for write-capable GitHub MCP tools"
+        "description": "Remind about AI disclosure when posting to GitHub via gh CLI or MCP tools"
       }
     ]
   }