bug: resolveIssueNumber should strip surrounding quotes from `item_number` values

[wtgodbe]

resolveIssueNumber should strip surrounding quotes from item_number values

Summary

When the Copilot agent passes a string-typed item_number with embedded quote characters (e.g., "aw_blazwasm" instead of aw_blazwasm), the resolveIssueNumber function in temporary_id.cjs fails to recognize it as a valid temporary ID. The isTemporaryId regex (/^aw_[A-Za-z0-9_]{3,12}$/i) rejects the value because of the leading " character, and the function falls through to the parseInt path which produces NaN → Invalid item_number.

This is ultimately caused by non-determinism in the agent — the agent sometimes wraps string values in extra quotes. But the handler could be more robust by stripping surrounding quote characters from the value before processing, similar to how it already strips the # prefix.

Reproduction

1. Configure a workflow with create_issue and add_comment safe outputs.
2. Have the agent call create_issue(temporary_id: "aw_foo", ...) followed by add_comment(item_number: "aw_foo", body: "...").
3. Observe that create_issue succeeds and the temp ID mapping is registered, but add_comment fails with Invalid item_number specified: "aw_foo".

Evidence

Working run (2026-04-03)

Workflow run: https://github.com/dotnet/aspnetcore/actions/runs/23942839944

The agent passed item_number without embedded quotes — note single quoting in the log:

● add_comment (MCP: safeoutputs) · item_number: "aw_redir1", body: "## Re-quarantine Investigation …
✓ safeoutputs-add_comment(item_number: aw_redir1, body: ## Re-quarantine Investigation

The safe_outputs job resolved the temp ID successfully:

Using explicitly provided item_number: #66118          ← resolved ✓
✓ Message 9 (add_comment) completed successfully

Broken run (2026-04-13)

Workflow run: https://github.com/dotnet/aspnetcore/actions/runs/24338805833

The agent passed item_number with embedded quote characters — note the double-quoting in the log:

● add_comment (MCP: safeoutputs) · item_number: ""aw_blazwasm"", body: "## Investigation  All three…

The safe_outputs job rejected the value:

##[warning]Invalid item_number specified: "aw_blazwasm"
##[error]✗ Message 3 (add_comment) failed: Invalid item_number specified: "aw_blazwasm"

The isTemporaryId regex (/^aw_[A-Za-z0-9_]{3,12}$/i) rejects "aw_blazwasm" because of the leading " character.

Root cause

In temporary_id.cjs, resolveIssueNumber (line ~298) does:

const valueStr = String(value).trim();
const valueWithoutHash = valueStr.startsWith("#") ? valueStr.substring(1) : valueStr;

It strips # prefixes but does not strip surrounding quote characters. When the agent passes "aw_blazwasm" (with literal quotes), the value fails isTemporaryId() and falls through to parseInt() which returns NaN.

Suggested fix

Add quote-stripping to resolveIssueNumber in temporary_id.cjs, immediately after the trim:

const valueStr = String(value).trim();
// Strip surrounding quotes (agent sometimes double-quotes string values)
const unquoted = /^["'](.+)["']$/.test(valueStr) ? valueStr.slice(1, -1) : valueStr;
const valueWithoutHash = unquoted.startsWith("#") ? unquoted.substring(1) : unquoted;

This is a defensive fix — the root cause is agent non-determinism, but the handler should be resilient to this common LLM output formatting quirk.