Skip to content

Prevent shell-permission stops in scheduled agents #65401

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 3 commits into from
Oct 3, 2026
Merged

Prevent shell-permission stops in scheduled agents #65401

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5dc8587
Initial plan
Copilot Oct 3, 2026
2dc93a2
Keep scheduled agents within permitted shell commands
Copilot Oct 3, 2026
221aea2
Apply remaining changes
Copilot Oct 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions .github/skills/agentic-workflows/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,10 +87,10 @@ Load these files from `github/gh-aw` (they are not available locally).
- `.github/aw/update-agentic-workflow.md`
- `.github/aw/upgrade-agentic-workflows.md`
- `.github/aw/visual-regression.md`
- `.github/aw/work-queue.md`
- `.github/aw/workflow-constraints.md`
- `.github/aw/workflow-editing.md`
- `.github/aw/workflow-patterns.md`
- `.github/aw/work-queue.md`

After loading the matching workflow prompt or skill, follow it directly:
- Design workflows from scratch via interview: `.github/aw/designer.md`
Expand All @@ -106,7 +106,6 @@ After loading the matching workflow prompt or skill, follow it directly:
- Render compact markdown charts: `.github/aw/asciicharts.md`
- Map CLI commands to MCP usage: `.github/aw/cli-commands.md`
- Choose workflow architecture and patterns: `.github/aw/patterns.md`
- Orchestrate durable work with a work queue (dispatcher/worker roles or queue inspection): `.github/aw/work-queue.md`
- Optimize token usage and cost: `.github/aw/token-optimization.md`
- Design long-running multi-agent research workflows: `.github/aw/multi-agent-research.md`
- Add skills or agent plugins requested by the user (`skills:` / `plugins:` frontmatter, never on-the-fly installs): `.github/aw/skills.md`
Expand Down
7 changes: 4 additions & 3 deletions .github/workflows/code-scanning-fixer.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 5 additions & 3 deletions .github/workflows/code-scanning-fixer.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ imports:
- shared/graders.md
tools:
cli-proxy: true
bash: ["cat:*", "git diff:*", "git restore:*", "git status:*", grep, "head:*", jq, ls, "sed:*", tail, wc]
bash: ["cat:*", "git diff:*", "git diff --binary --no-ext-diff | wc -c", "git restore:*", "git status:*", grep, "head:*", jq, ls, "sed:*", tail, wc]

@github-actions github-actions Bot Oct 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[/codebase-design] The new allowlist entry "git diff --binary --no-ext-diff | wc -c" works only because Copilot CLI does literal prefix matching on the entire string, pipe included — it is not a generic "pipes are allowed" mechanism, it's one hard-coded exact string.

💡 Why this is fragile

If the agent (or a future edit) reformats the command with different spacing, quoting, or flag order (e.g. git diff --no-ext-diff --binary | wc -c), the prefix match fails and the denial-budget problem this PR fixes recurs silently. This repo's own sanitizeCopilotShellCommand comment documents prefix matching for simple commands like shell(jq), but a multi-token piped command baked into the allowlist as one literal string is a different, more brittle use of that mechanism and isn't called out anywhere as a supported pattern.

Consider instead keeping bash command granularity (git diff:*, wc) and only using narrower instruction text (as already done) to tell the agent to chain them in one invocation, rather than encoding the full compound command as a single allowlist literal. If this literal-compound-command approach is intentional, it's worth a one-line comment in the workflow or a doc note so future editors don't "simplify" it back to separate tokens and silently break the fix.

@copilot please address this.

github:
mode: local
github-token: "${{ secrets.GITHUB_TOKEN }}"
Expand Down Expand Up @@ -92,7 +92,9 @@ You are a security-focused code analysis agent that automatically fixes code sca
- Edit files: use the `edit` tool
- Do not use the Copilot `read` tool for temporary files; use allowed shell readers such as `cat`, `head`, or `sed`
- If a tool output is saved to a temporary file because it is too large, inspect it with simple allowed shell commands such as `grep`, `head`, `jq`, `sed`, or `tail`; do not use `python3` or compound shell assignment snippets for JSON parsing
- Create pull request: emit a `create-pull-request` safe output after edits
- Run each allowed shell command separately; do not chain commands with `;` or `&&`, use heredocs or redirection to write files, or wrap commands in `python3`. Do not run builds or formatters through the restricted shell.
- Write cache records with the `edit` tool, not shell redirection.
- Create pull request: emit a `create-pull-request` safe output directly after edits; do not invoke `safeoutputs` through bash

@github-actions github-actions Bot Oct 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Saying to emit create-pull-request directly after edits conflicts with step 7's required patch-size preflight, so the agent can skip the size check and recreate the same safe-output failure path this PR is trying to close.

Why this blocks the fix path

The later section is explicit that the agent must measure the patch before creating the PR. This new sentence introduces a stronger local instruction that says to create the PR immediately after editing, which gives the agent two incompatible orderings for the same action.

Please change this to say the PR safe output should run only after the step-7 patch-size preflight passes, while keeping the rule against invoking safeoutputs through bash.

- Report a stalled prior attempt: emit a `create-issue` safe output (diagnostic only, never a fix)

**Self-Assessment Checkpoint**: This workflow has a hard 40-minute timeout. A hang or timeout during the fix-attempt phase (steps 5-6) previously produced zero output and zero visibility. To avoid that:
Expand Down Expand Up @@ -185,7 +187,7 @@ Create code changes to address the security issue:
### 7. Create Pull Request

Before emitting `create-pull-request`, preflight the complete generated patch, including binary removals:
- Measure `git diff --binary --no-ext-diff` in bytes. The default `create-pull-request` safe-output limit is 4,096 KB (4,194,304 bytes).
- Measure the patch in bytes with the explicitly allowed single command `git diff --binary --no-ext-diff | wc -c`. The default `create-pull-request` safe-output limit is 4,096 KB (4,194,304 bytes).
Comment on lines 189 to +190
- If the patch exceeds that limit, do not emit `create-pull-request`. Append an oversized-patch JSON record to `/tmp/gh-aw/cache-memory/fixed-alerts.jsonl` using the selected alert number, its fingerprint, measured patch size, limit, and current timestamp.
- Discard all local edits for that attempt, emit `noop` stating that the alert was skipped because its patch exceeds 4,096 KB, and exit successfully.
- Do not record a patch-size outcome when measurement itself fails; report that tool failure normally.
Expand Down
Loading
Loading