[copilot-cli-research] Copilot CLI Deep Research - 2026-06-10

[github-actions[bot]]

Analysis Date: 2026-06-10 | Run: §27254548925 | Scope: 245 total, 132 Copilot (54%)

---

📊 Executive Summary

Run #8 of longitudinal Copilot CLI adoption tracking. Key findings:

1. 🚀 engine.agent surged: 13 → 34 workflows (+161%) in 2 days
2. 💰 max-ai-credits tripled: 5 → 14 workflows
3. 🌐 web-fetch doubled: 12 → 25 workflows
4. 📉 Repository cleanup: 340 → 245 workflows (−28%)
5. 🔴 6 features at 0% usage across 17+ consecutive research runs

Primary Recommendation: Add max-ai-credits to the 118 Copilot workflows missing it — lowest-effort, highest-security win available today.

---

Critical Findings

🔴 High Priority

• 118/132 Copilot workflows (89%) have no max-ai-credits budget guardrail
• 65/132 (49%) have zero network restrictions
• 117/132 (89%) have no AWF sandbox

🟡 Medium Priority

• 53/132 (40%) missing strict: true
• 126/132 (95%) not using max-continuations autopilot mode
• 5 agent files in .github/agents/ unused across all 8 runs: grumpy-reviewer, create-safe-output-type, interactive-agent-designer, w3c-specification-writer, custom-engine-implementation

---

2️⃣ Feature Usage Matrix

Feature	Count	Rate	Trend
copilot-sdk	63/132	48%	Stable
engine.agent	34/132	26%	🚀 13→34
strict: true	79/132	60%	Stable
network:	67/132	51%	Stable
sandbox: awf	20/132	15%	Stable
max-ai-credits	14/132	11%	↑ 5→14
max-turns	13/132	10%	Stable
engine.bare	15/132	11%	Stable
max-continuations	6/132	5%	Stable
engine.env (BYOK)	2/132	2%	Stable
engine.args	0/132	0%	❌ 17+ runs
engine.api-target	0/132	0%	❌ 17+ runs
engine.version (pin)	0/132	0%	❌ persistent
engine.harness	0/132	0%	❌ never
engine.mcp-timeout	0/132	0%	❌ never
engine.token-weights	0/132	0%	❌ never

---

3️⃣ Missed Opportunities

🔴 Add max-ai-credits (89% missing)

max-ai-credits: 1500   # recommended default

🔴 Add network restrictions (49% open)

network:
  allowed: [defaults, github.com, api.github.com]

🔴 Add AWF sandbox for edit-enabled workflows (89% missing)

sandbox:
  agent: awf

🟡 Add strict: true (40% missing) — Enforces permission scoping, prevents credential leakage

🟡 Assign unused agent files — 5 agents created but never used in any workflow; assign or remove

🟡 Try max-continuations for complex workflows (only contribution-check, test-quality-sentinel, mattpocock-skills-reviewer, smoke-copilot, smoke-copilot-aoai-apikey, smoke-otel-backends use it)

🟡 Pin engine.version for smoke tests — all 132 Copilot workflows use latest

---

4️⃣ Trends (8 Runs: 2026-05-21 → 2026-06-10)

Metric	05-21	05-31	06-08	06-10	Δ
Total workflows	233	236	340	245	Volatile
engine.agent	~10	—	13	34	🚀
copilot-sdk	0	0	63	63	Spike+hold
copilot-sdk-driver	0	0	3	5	Growing
max-ai-credits	~5	~5	5	14	↑
engine.args	0	0	0	0	❌
engine.harness	0	0	0	0	❌

Features that crossed 0% adopted quickly (copilot-sdk hit 48% immediately). Features stuck at 0% for 17+ runs likely serve enterprise/GHES use cases not applicable here.

---

7️⃣ Action Items

Immediate (this week):

• Add max-ai-credits: 1500 to ~118 Copilot workflows missing it
• Enable strict: true on 53 workflows missing it
• Assign or remove 5 unused agent files in .github/agents/

Short-term (this month):

• Add network: restrictions to 65 fully-open Copilot workflows
• Add sandbox: agent: awf to edit:-enabled workflows
• Pilot max-continuations on 3-5 complex workflows
• Pin engine.version for smoke tests

Long-term (this quarter):

• Document use cases for engine.args, api-target, harness (6 features at 0% for 17+ runs)
• Evaluate model: small for triage/classification (99 workflows use default model)
• Expand copilot-sdk-driver usage beyond current 5 workflows

---

References: §27254548925 · Engine Docs · Agent Files

Generated by 🔬 Copilot CLI Deep Research Agent · ⌖ 20 AIC · ⊞ 19.9K · ◷

• expires on Jun 10, 2026, 9:25 PM UTC-08:00