Optimize test-coverage-improver prompt/tool shape to reduce Copilot token burn

[Copilot]

test-coverage-improver was spending too many turns on exploratory file reads, driving high token usage. This change makes target selection deterministic in pre-steps, injects source/test context directly into the prompt, and tightens agent instructions to reduce turn count and schema overhead.

• Precompute and inject target context

  • Added a Select target file and inject content step to choose a priority low-coverage file from coverage/coverage-summary.json.
  • Exposes TARGET_FILE, SOURCE_CONTENT, and TEST_CONTENT as step outputs for direct prompt injection.

• Reduce bash tool surface

  • Removed per-file cat: and ls: exploration tools previously used for discovery.
  • Kept only focused read tools needed for test authoring (cat:src/*.test.ts, jest config reads) plus npm run test / npm run lint.

• Tighten prompt for low-turn execution

  • Added an explicit Turn Budget section (≤ 10 tool calls).
  • Replaced multi-phase verbose guidance with a concise task block focused on writing tests for the preselected file.
  • Injected preselected source/test content in-prompt and instructed the agent not to re-read those files.

• Keep optimization enforced in CI guard test

  • Updated scripts/ci/test-coverage-improver-workflow.test.ts to assert:
    • new target-injection step and prompt references are present
    • removed cat:/ls: entries and old phase text are absent
    • compiled lock workflow reflects the same reduced tool/config shape

- name: Select target file and inject content
  id: target
  run: |
    TARGET=$(node -e "
      const d = JSON.parse(require('fs').readFileSync('coverage/coverage-summary.json','utf8'));
      const priority = ['src/docker-manager.ts','src/cli.ts','src/host-iptables.ts','src/squid-config.ts','src/domain-patterns.ts'];
      const low = priority.find(f => d['/github/workspace/'+f]?.statements?.pct < 80);
      console.log(low || priority[0]);
    " 2>/dev/null || echo "src/docker-manager.ts")
    echo "TARGET_FILE=$TARGET" >> "$GITHUB_OUTPUT"

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	96.48%	96.62%	📈 +0.14%
Statements	96.35%	96.49%	📈 +0.14%
Functions	98.22%	98.22%	➡️ +0.00%
Branches	90.62%	90.78%	📈 +0.16%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
src/config-writer.ts	89.3% → 90.9% (+1.65%)	89.3% → 90.9% (+1.65%)
src/cli-workflow.ts	88.9% → 100.0% (+11.12%)	88.9% → 100.0% (+11.12%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

Smoke Test: Claude Engine

• ✅ GitHub API: 2 recent PR entries found
• ✅ GitHub check: playwright_check=PASS
• ✅ File verify: smoke-test-claude-26586781153.txt present

Result: PASS

💥 [THE END] — Illustrated by Smoke Claude

[Copilot]

Pull request overview

Optimizes the test-coverage-improver workflow to cut Copilot token/turn usage by deterministically pre-selecting a low-coverage target file and injecting both its source and current test file into the prompt, while trimming the agent's bash tool surface and replacing the multi-phase prompt with a tight ≤10-call task block. The CI guard test is updated to enforce the new shape.

Changes:

• Adds a Select target file and inject content step that picks a priority file and exposes TARGET_FILE/SOURCE_CONTENT/TEST_CONTENT.
• Removes per-file cat:/ls: exploration tools from the agent allow-list and replaces the multi-phase prompt with a Turn Budget + pre-selected target block.
• Updates the workflow guard test to assert the new step, prompt strings, and reduced tool list (both in .md and compiled .lock.yml).

Show a summary per file

File	Description
.github/workflows/test-coverage-improver.md	Adds target-selection step, trims tools, rewrites prompt with injected source/test content and Turn Budget.
.github/workflows/test-coverage-improver.lock.yml	Recompiled lock reflecting new step, env wiring of steps.target.outputs.*, and reduced --allow-tool list (also includes some unrelated re-compile diffs: sparse-checkout, local awf build, session-state copy).
scripts/ci/test-coverage-improver-workflow.test.ts	Updates assertions to require the new step/prompt markers and forbid the removed tool/phase strings.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 2

[github-actions]

🔥 Smoke Test: Copilot BYOK (Offline) Mode

Test	Result
GitHub MCP (list PRs)	✅ PR #3945 "[Test Coverage] Cover uncovered branches in cli-workflow runMainWorkflow"
GitHub.com connectivity	✅ (pre-step confirmed)
File write/read	✅ /tmp/gh-aw/agent/smoke-test-copilot-byok-26587671156.txt — "BYOK smoke test passed at Thu May 28 16:27:12 UTC 2026"
BYOK inference	✅ Agent responded successfully

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com

Overall: PASS — PR by @Copilot, assignees: @lpcox @Copilot

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

🔥 Smoke Test Results

Test	Result
GitHub MCP connectivity	✅ (PR #3945 fetched successfully)
GitHub.com HTTP	⚠️ pre-step data unavailable (template vars not substituted)
File write/read	⚠️ pre-step data unavailable (template vars not substituted)

PR: "Optimize test-coverage-improver prompt/tool shape to reduce Copilot token burn"
Author: @Copilot | Assignees: @lpcox, @Copilot

Overall: PARTIAL — MCP test passed; pre-computed test data was not injected into the workflow.

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

[Test Coverage] Cover uncovered branches in cli-workflow runMainWorkflow ✅
[docs] Document AWF_DIND env var and ARC/DinD sibling-socket auto-detection ✅
GitHub PR query ✅
Playwright GitHub title ✅
File write/read ✅
Discussion comment ✅
Build ❌
Overall: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions]

Smoke test passed

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	passed	✅ PASS
Go	env	✅	passed	✅ PASS
Go	uuid	✅	passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #3954 · sonnet46 762.5K · ◷

[github-actions]

Smoke Test: GitHub Actions Services Connectivity

Check	Result
Redis PING	❌ Timeout (no response)
PostgreSQL pg_isready	❌ No response on port 5432
PostgreSQL SELECT 1	❌ Skipped (pg_isready failed)

Overall: FAIL — host.docker.internal is not reachable from this environment. Service containers appear to be unavailable or the host resolution is not configured.

🔌 Service connectivity validated by Smoke Services