Make safeoutputs CLI transport fail loudly instead of fail open - #61427

This PR hardens safeoutputs CLI transport handling and improves diagnostics for runs producing no safe outputs.

Changes:

• Adds inline JSON payload support and stricter argument validation.
• Updates schemas, prompts, generated documentation, and noop aliases.
• Adds transcript-based failure diagnostics and synchronizes action pins.

Suppressed comments (4)

actions/setup/js/handle_agent_failure.cjs:3217

• Because " and ' are accepted as command boundaries, this regex matches safeoutputs noop inside a quoted payload, for example printf '{"message":"safeoutputs noop"}', even though no CLI invocation exists. A real piped command whose payload contains that text can also be classified as dropped-pipe by the first occurrence. Scan shell tokens or otherwise exclude quoted payload contents before recording/classifying commands.

    if (!/(^|[|;&(\s"'`])safeoutputs\s+[a-z_][a-z0-9_]*/i.test(line)) continue;

actions/setup/js/handle_agent_failure.cjs:3219

• These excerpts are add-mask redacted but otherwise inserted into a fenced Markdown block, and the failure issue body is not sanitized after template rendering. An agent command containing a triple backtick (for example, copied from an issue body) can close the fence and inject Markdown or mentions into the diagnostic issue. Escape the excerpt for the code block or sanitize this context before rendering it.

    const redacted = applyAddMaskRedaction(line, maskedValues);
    const truncated = redacted.length > SAFEOUTPUTS_CLI_EXCERPT_MAX_LENGTH ? `${redacted.slice(0, SAFEOUTPUTS_CLI_EXCERPT_MAX_LENGTH)}…` : redacted;

actions/setup/js/mcp_cli_bridge.cjs:1662

• The !jsonOutput guard lets an unrecognized positional argument pass whenever --json is also present. For example, safeoutputs <zero-input-tool> 'no action needed' --json produces an empty argument object and invokes the tool, silently dropping the positional text. Exempt only a command containing recognized output flags, or track/reject unrecognized positional arguments independently of response formatting.

  const usedStructuredPayload = shouldReadStdin || findInlineJsonPayloadArg(toolUserArgs) !== null;
  if (serverName === SAFEOUTPUTS_SERVER_NAME && Object.keys(toolArgs).length === 0 && toolUserArgs.length > 0 && !jsonOutput && !usedStructuredPayload) {

actions/setup/js/mcp_cli_bridge.cjs:757

• Requiring args.length === 1 means a documented inline payload followed by a CLI option (for example safeoutputs noop '{"message":"inline"}' --message fallback, or an inline payload plus --json) never enters inline mode. The JSON token is then skipped by the flag parser and only the other flags are sent, so the tool can emit a different payload or silently ignore the inline data. Detect/reject the inline payload independently of output flags instead of falling back to positional-argument skipping.

  if (args.length !== 1) return null;
  const trimmed = args[0].trim();
  return trimmed.startsWith("{") ? trimmed : null;

• Files reviewed: 11/11 changed files
• Comments generated: 3
• Review effort level: Lite (auto)

actions/setup/js/mcp_cli_bridge.cjs:L274: yagni: separate looksLikeInlineJsonObject helper with one caller. Inline the check into parseToolArgs until reused.

actions/setup/js/handle_agent_failure.cjs:L59: shrink: multiple constants/functions just to build a short diagnostics block. Fold extraction/classification into one compact pass over transcript lines.

actions/setup/js/handle_agent_failure.cjs:L130: delete: dropped-pipe special-case narrative branch in failure rendering. Keep generic command excerpt output and remove this extra explanatory branch.

Key Themes

• False-positive risk in isDroppedPipeSafeOutputsCommand: the regex only checks for absence of |;&>< between printf/echo and the literal token safeoutputs — it doesn't verify safeoutputs is actually the invoked command rather than prose inside the echoed string (e.g. echo "See docs: safeoutputs add_comment example" is misclassified as a dropped-pipe failure). This directly feeds the auto-generated failure report language ("the CLI never ran"), which could mislead future debugging.
• Missing regression test for that false-positive shape, even though the surrounding test suite is otherwise thorough (piped, dropped-pipe, dedup, --message flag cases are all covered).
• Unrelated .github/aw/actions-lock.json downgrade: docker/build-push-action and docker/setup-buildx-action are pinned back from v7.4.0/v4.4.0 to v7.3.0/v4.3.0, while every generated .lock.yml in the repo still references the newer SHAs — this looks like a stale rebase artifact unrelated to the safeoutputs fix and should be reverted or explained.

Positive Highlights

• ✅ The core fix (inline JSON as a first-class transport, keeping the binary first on the command line so malformed input fails loudly) directly and correctly addresses the root cause from #61391 — the dropped-pipe silent-success failure mode.
• ✅ Good test coverage for findInlineJsonPayloadArg, parseToolArgs inline mode, and the new "unrecognized args" failure path, including the {} zero-input exemption edge case.
• ✅ Docs, schema-derived examples (renderToolSignature/renderToolRecommendedExample), and the prompt markdown were all updated consistently with the new recommended form.