Copilot gets Gemini 4 Argon, forced policy refresh, and agent-scoped hooks

Introduction

A frontier model in the Copilot picker is not the same as a Gemini API rollout. Spend lands on usage-based billing, admins inherit default model enablement, and agent fleets need hooks that still work when no human is watching Autopilot. October 13 packaged those decisions together.

Primary sources: Argon in Copilot, managed settings enforcement, Copilot CLI v1.0.97, and hooks reference. Adjacent: Gemini 4 Argon routing, Oct 12 Copilot governance, and sandbox / Haiku ops.

Argon in the Copilot model picker

GitHub positions Argon for complex coding, agentic, and reasoning tasks, with early internal testing showing larger gains in Copilot CLI than prior Gemini models. Availability covers VS Code, Visual Studio, Copilot CLI, coding agent, Copilot app, JetBrains, Xcode, and Eclipse. Rollout is gradual. Business and Enterprise admins manage access through Copilot model policy. Under default model enablement, new models turn on unless the global default is disabled or Argon is explicitly turned off.

• Decide enablement before the picker populates for most users.
• Budget for provider list pricing, not seat-included Gemini quotas.
• Keep a named comparison set: Argon vs Opus 5.5 vs GPT-6.1 Sol on the same repos.
• Do not assume API long-decode behavior is identical inside Copilot clients.

forceRemoteSettingsRefresh fails closed

Cached managed settings are convenient and fragile. Setting `forceRemoteSettingsRefresh` to true through server-managed, MDM, or file-based delivery forces Copilot CLI, VS Code, and the Copilot app to retrieve current policy at startup. A cached response cannot satisfy freshness while the setting is active. If the client cannot confirm current policy, it fails closed instead of running on stale rules. MDM and file-based delivery can require freshness even before first sign-in. Server-managed values start requiring refreshes on later startups after the client has received the setting once.

Sandbox key now carries a client version floor

After local sandboxing GA on October 7, GitHub started attaching minimum client version enforcement to governance-focused managed settings keys, beginning with `sandbox`. When that key is present, users pinning old Copilot clients must update to keep using Copilot. This closes the loophole where a fleet “enabled sandbox in policy” while half the laptops stayed on pre-GA builds.

Agent-scoped hooks in Copilot CLI 1.0.97

Declarative hooks can now live in a custom agent’s frontmatter and run only while that agent is selected. They still compose with session, user, repository, plugin, and policy hooks. Autopilot treats a preToolUse “ask” decision as deny because no operator is present. That is the correct default for unattended coding agents. The same release fixes GitHub MCP write-tool endpoint selection, revalidates cached MCP tool definitions after concurrent catalog refreshes, discovers deep or large custom-agent trees, and keeps repository-local marketplace plugin hooks alive after `--resume`.

What this means for developers

• Upgrade Copilot CLI to 1.0.97+ before relying on agent-scoped hooks or MCP write tools.
• Put agent-specific denylist hooks in frontmatter instead of one global hook file that fights every agent.
• Expect Autopilot to deny “ask” preToolUse outcomes. Encode allow/deny, not interactive prompts.
• If Argon appears in the picker, measure it on CLI and coding agent separately from the Gemini API.

What this means for businesses

• Model policy, freshness enforcement, and sandbox version floors are one governance pack, not three tickets.
• Failing closed on stale policy is safer than silent drift after Oct 12 identity telemetry and Oct 10 MCP auto-start controls.
• Argon spend can appear in Copilot usage before Gemini console owners notice. Align FinOps owners.
• Custom-agent fleets need hook ownership per agent the same way MCP allowlists need ownership per team.

One-week control board

1. 01
   Model policy

   Enable Argon only for a pilot OU, or disable it org-wide until evals finish.
2. 02
   Freshness

   Turn on forceRemoteSettingsRefresh for fleets that just changed sandbox, MCP, or model policy.
3. 03
   Client floor

   Confirm sandbox managed settings and block pre-GA Copilot builds.
4. 04
   Hooks

   Upgrade CLI to 1.0.97, move agent-specific rules into frontmatter, retest Autopilot deny behavior.
5. 05
   MCP

   Retest GitHub MCP write tools and catalog refresh after the endpoint and cache fixes.

Conclusion

October 13 made Gemini 4 Argon easy to select inside Copilot and harder to run on stale policy. That is the right pairing. Admit the model through a named pilot, force policy freshness where governance just changed, and scope hooks to the agents that need them. Capability without enforcement is how agent fleets invent their own exceptions.

Sources: github.blog — 2026 10 13 gemini 4 argon in github copilot ; github.blog ; GitHub ; GitHub