Fix prompt-exhaustion misclassification and restore Avenger's bash tool access - #67411

Root cause #1 — misclassification (fixed)

buildEmptyOutputOutcome() in actions/setup/js/empty_output_outcome.cjs computed the failureCause for a missing_terminal_safe_output / invalid_safe_outputs incompletion with:

const failureCause = isPromptExhaustion ? "prompt_exhaustion" : isRequestRejection ? "request_rejection" : isEngineOutage ? "engine_outage" : "prompt_exhaustion";

The final fallback defaulted to "prompt_exhaustion" whenever none of the three evidence-backed buckets matched — i.e. no effective_tokens_limit_exceeded/invocation_cap_exceeded category, no 4xx/request-rejection signal, and no 5xx/engine-driver-failure signal. Absence of evidence was being treated as evidence of prompt exhaustion.

This is confirmed across the duplicate source issues clustered under #66817 (e.g. #67330, #67358): all show Failure classification: prompt_exhaustion with Retry attempts observed: 0 and no token/cache-miss/invocation-cap diagnostics — exactly the "no evidence" fallback path, not real prompt exhaustion.

Fix: Added a new unknown failure cause (EMPTY_OUTPUT_FAILURE_CAUSES.unknown = "finished without a clear failure cause") and changed the fallback to use it instead of guessing prompt_exhaustion. This flows into buildFailureIssueTitle() (handle_agent_failure.cjs) and the failure_cause: issue marker used for dedup/search.

Root cause #2 — Avenger's specific silent "no terminal output" failures (fixed)

Review correctly flagged that fixing the classification label alone did not address Avenger's explicit acceptance criterion: Avenger was one of the misclassified workflows, and its real runs were failing for a concrete, separate reason, not budget/token exhaustion.

Downloaded and inspected real Avenger run logs (e.g. run 37994092775, issue #67282). Evidence: a single turn, ~16s codex process duration, usage {input_tokens:78281, output_tokens:245} (nowhere near exhaustion), and the agent's own message:

"Unable to proceed: this session exposes no shell tool, CI job/log reader, or safe-output tools... No changes or PR were created."

Traced to pkg/workflow/codex_config.go (buildNativeConfig): the Codex engine unconditionally sets features.shell_tool = false (and code_mode/code_mode_only = false) whenever engine.model-provider resolves to github — regardless of whether tools.bash is enabled. This is an intentional, documented compatibility workaround (PRs #65654, #66179) because "the Copilot compatibility adapter does not support the Codex exec custom tool" — but Codex has no MCP-routed fallback for bash (codexNativeServerDefaults never maps bash/cli-proxy to an MCP server), so for any workflow combining engine: codex + model-provider: github + tools.bash, bash is declared but completely non-functional at runtime, silently stripping tool access. Avenger declared tools.bash: ["*"] while using exactly this combination.

Fix: switched Avenger (.github/workflows/avenger.md) from engine.id: codex to engine.id: copilot, which enforces tools.bash natively (--allow-tool shell) with no GitHub-provider restriction — no prompt/model/permission changes. Confirmed via recompile that avenger.lock.yml no longer disables shell_tool and now runs through copilot_harness.cjs with --allow-tool shell.

Added pkg/workflow/avenger_engine_regression_test.go — a regression test that reads Avenger's live frontmatter and fails if it ever reverts to an engine that can't enforce a bash allowlist while model-provider: github + tools.bash remain enabled. Verified the test fails when engine.id is reverted to codex and passes with copilot.

Scope note: this is Avenger-specific. A broader survey found ~20 other workflows combine engine: codex + GitHub-provider inference + tools.bash, which share the same latent gap — out of scope for this PR but worth a follow-up.

Files changed

• actions/setup/js/empty_output_outcome.cjs — classification fix
• actions/setup/js/empty_output_outcome.test.cjs, handle_agent_failure.test.cjs, collect_ndjson_output.test.cjs — updated expectations/fixtures
• .github/workflows/avenger.md, .github/workflows/avenger.lock.yml — engine switch (codex → copilot) to restore bash/tool access
• pkg/workflow/avenger_engine_regression_test.go — new regression guard

Validation

• make agent-report-progress (full gate): Go lint ✓, JS lint ✓, schema freshness ✓, impacted tests ✓, 614/614 JS tests passed
• make recompile: 334/334 workflows compiled successfully; confirmed avenger.lock.yml no longer contains "shell_tool":false and now invokes copilot_harness.cjs --allow-tool shell
• New regression test (TestAvengerUsesBashCapableEngine) added and manually verified to fail when the engine is reverted to codex
• Limitation: this fix is validated against historical run-log evidence, static config, and tests — not a live re-run, since triggering scheduled workflows is out of scope for this change. The next real Avenger CI-fix-needed run will be the first live confirmation.

Fixes #66817