Summary
A strict Copilot workflow with tools.github.min-integrity: none must set tools.bash: false, but gh-aw v0.86.2 still injects mcp_cli_tools_prompt.md and lists safeoutputs as a CLI executable. The generated prompt explicitly says to invoke it from bash and that it is not an MCP tool, while the agent has no Bash tool. This can produce a silent no-output run even though safeoutputs is present in the Copilot allow-list.
Reproduction
Compile a workflow with:
strict: true
tools:
bash: false
github:
min-integrity: none
safe-outputs:
add-labels:The v0.86.2 lock contains all of the following:
GH_AW_PROMPT_CONFIG includes safe_outputs_prompt.md and mcp_cli_tools_prompt.md.GH_AW_MCP_CLI_SERVERS_LIST includes safeoutputs.mcp_cli_tools_prompt.md says: "Invoke them from bash - they are not MCP tools" and "For safeoutputs ... always use the CLI commands above."- The Copilot invocation has
--allow-tool safeoutputs but no shell tool (--allow-tool github --allow-tool safeoutputs --allow-tool write).
${RUNNER_TEMP}/gh-aw/mcp-cli/bin is mounted on PATH, but the model cannot invoke it without Bash.
This was observed in dotnet/maui PR #37447 on the agentic-labeler workflow. The workflow cannot simply enable Bash because v0.86.2 correctly rejects min-integrity: none unless tools.bash: false; lowering integrity would prevent labeling first-time contributors.
Impact
The prompt directs the model to a tool path it cannot use. A model that follows the generated instruction can finish without emitting add_labels or noop; this workflow intentionally disables failure-issue reporting, so the failure may be silent.
Suggested fix
Align prompt generation with the actual tool surface when Bash is disabled. For example, omit CLI-only safeoutputs instructions and provide direct safeoutputs MCP-tool guidance when the Copilot harness exposes --allow-tool safeoutputs, or otherwise ensure the required safe-output path remains callable without Bash.
Related: #46259 / #46778 fixed omission of mounted servers from the Copilot CLI prompt list, but this is the opposite edge: the CLI prompt is present while Bash is deliberately unavailable.
Summary
A strict Copilot workflow with
tools.github.min-integrity: nonemust settools.bash: false, but gh-aw v0.86.2 still injectsmcp_cli_tools_prompt.mdand listssafeoutputsas a CLI executable. The generated prompt explicitly says to invoke it from bash and that it is not an MCP tool, while the agent has no Bash tool. This can produce a silent no-output run even though safeoutputs is present in the Copilot allow-list.Reproduction
Compile a workflow with:
The v0.86.2 lock contains all of the following:
GH_AW_PROMPT_CONFIGincludessafe_outputs_prompt.mdandmcp_cli_tools_prompt.md.GH_AW_MCP_CLI_SERVERS_LISTincludessafeoutputs.mcp_cli_tools_prompt.mdsays: "Invoke them from bash - they are not MCP tools" and "Forsafeoutputs... always use the CLI commands above."--allow-tool safeoutputsbut no shell tool (--allow-tool github --allow-tool safeoutputs --allow-tool write).${RUNNER_TEMP}/gh-aw/mcp-cli/binis mounted onPATH, but the model cannot invoke it without Bash.This was observed in dotnet/maui PR #37447 on the
agentic-labelerworkflow. The workflow cannot simply enable Bash because v0.86.2 correctly rejectsmin-integrity: noneunlesstools.bash: false; lowering integrity would prevent labeling first-time contributors.Impact
The prompt directs the model to a tool path it cannot use. A model that follows the generated instruction can finish without emitting
add_labelsornoop; this workflow intentionally disables failure-issue reporting, so the failure may be silent.Suggested fix
Align prompt generation with the actual tool surface when Bash is disabled. For example, omit CLI-only safeoutputs instructions and provide direct safeoutputs MCP-tool guidance when the Copilot harness exposes
--allow-tool safeoutputs, or otherwise ensure the required safe-output path remains callable without Bash.Related: #46259 / #46778 fixed omission of mounted servers from the Copilot CLI prompt list, but this is the opposite edge: the CLI prompt is present while Bash is deliberately unavailable.