Skip to content

fix(ddg): raise max-turns to 15, clarify MCP safe-output path#29419

Closed
Copilot wants to merge 2 commits intomainfrom
copilot/fix-ddg-agent-max-turns-issue
Closed

fix(ddg): raise max-turns to 15, clarify MCP safe-output path#29419
Copilot wants to merge 2 commits intomainfrom
copilot/fix-ddg-agent-max-turns-issue

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented May 1, 2026

The Design Decision Gate hits error_max_turns on complex PRs (docs changes, large diffs) because 12 turns isn't enough — these PRs consume 12–13 turns before the agent can post a comment. Simple fix PRs complete in 4–5 turns and are unaffected.

Changes

design-decision-gate.md

  • max-turns: 12 → 15 — 3-turn headroom for complex PRs
  • Turn budget table: reserve band updated to turns 8–15
  • Stopping criteria: emergency-emit threshold updated to turn 14 (hard limit turn 15)
  • Added explicit ⚠️ note: invoke safe outputs via MCP (mcp__safeoutputs__add_comment, etc.), not bash safeoutputs add_comment — the bash CLI path was causing permission denials in failing sessions

design-decision-gate.lock.yml — recompiled; reflects --max-turns 15 and GH_AW_MAX_TURNS: 15

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuremote.origin.url (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet -o KmlD/j7-H0S8Wrpdk-9IzKmlD -trimpath .cfg -p unicode -lang=go1.25 ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json 8601/parse.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE me: String!) { repository(owne-f GOINSECURE GOMOD GOMODCACHE go env k/gh-aw/gh-aw/.github/workflows GO111MODULE ml GOINSECURE GOMOD DiscussionsEnabl/tmp/gh-aw-test-runs/20260501-024835-62855/test-source-field-variant-3089756994 sh (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv xterm-color aw.test /usr/bin/git se 5374934/b019/vetrev-parse .cfg git rev-�� --show-toplevel ache/go/1.25.8/xorigin /usr/bin/git t2849547410/.gitnode 5374934/b155/vet/opt/hostedtoolcache/node/24.14.1/x64/bin/npm ache/go/1.25.8/xinstall git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel infocmp (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv GOMODCACHE sh /usr/bin/git k/gh-aw/gh-aw GOPROXY k.yml git rev-�� --show-toplevel sh /usr/bin/git k/gh-aw/gh-aw/.ggit node /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv 4132-34257/test-535201697/.github/workflows 5374934/b288/vet.cfg verutil.test -p crypto/dsa -lang=go1.25 verutil.test 6353�� -unreachable=false /tmp/go-build3635374934/b030/vet.cfg /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -goversion go1.25.8 -c=4 /opt/hostedtoolcache/go/1.25.8/xremote.origin.url (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel ortcfg /usr/bin/git g/constants/consgit g/constants/engirev-parse ser.test git rev-�� --show-toplevel ser.test /usr/bin/git 5374934/b410/congit /tmp/go-build363rev-parse 5374934/b410/imp--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 1/x64/bin/node sv /tmp/TestGuardPogit config /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linucurrent (local changes) /usr/bin/git /tmp/go-build363git git om/org1/repo.git--show-toplevel git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv -bool -buildtags 64/pkg/tool/linux_amd64/vet =receive -ifaceassert -nilfunc 64/pkg/tool/linux_amd64/vet -ato�� licyBlockedUsersCommaSeparatedCompiledOutput7795go1.25.8 .cfg 1/x64/bin/node l -ifaceassert -nilfunc git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv -bool -buildtags 1/x64/bin/node -errorsas -ifaceassert -nilfunc 1/x64/bin/node /tmp�� -stringintconv -tests /usr/bin/git -json f x_amd64/compile git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv sistency_WithImports1285965500/001/main.md x_amd64/asm /usr/bin/git -json GO111MODULE x_amd64/compile git -C /tmp/compile-all-instructions-test-2012250148/.github/workflows s/1/artifacts /usr/bin/git remote.origin.urgit GO111MODULE x_amd64/vet git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git -unreachable=falgit /tmp/go-build363status 5374934/b357/vet.cfg git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linutest@example.com /usr/bin/git '/tmp/TestParseDgit '/tmp/TestParseDrev-parse /opt/hostedtoolc--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git 4835-62855/test-git rev-parse /snap/bin/bash git rev-�� --show-toplevel bash (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json /context.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/infocmp 098614/b099/_pkggit .cfg 64/pkg/tool/linu--show-toplevel infocmp -1 xterm-color 64/pkg/tool/linumyorg /usr/bin/git 098614/b241/_pkggit 7Ps3/Xuna8G_bMUXrev-parse util.test git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel /usr/bin/gh /usr/bin/git k/gh-aw/gh-aw -f kflows/repo-audi--show-toplevel git rev-�� --show-toplevel git /usr/bin/git 277162923/.githugit show (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /tmp/compile-all-instructions-test-2012250148 s/4/artifacts /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json GO111MODULE x_amd64/vet node /tmp�� /tmp/TestHashConsistency_GoAndJavaScript1501779740/001/test-frontmatter-with-arrays.md x_amd64/vet /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json GO111MODULE x_amd64/vet node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --git-dir 64/pkg/tool/linuTest User /usr/bin/git LsRemoteWithRealgit LsRemoteWithRealrev-parse 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linuorigin /usr/bin/git e-analyzer.md V7o_/18xeupG6XnJrev-parse .cfg git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json GO111MODULE /opt/hostedtoolc-v node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/archie.md l /opt/hostedtoolcache/node/24.14.1/x64/bin/node ithub/workflows erena-mcp-serverrev-parse (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv -bool -buildtags /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -errorsas -ifaceassert -nilfunc /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linuorigin -ato�� -bool -buildtags ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -errorsas -ifaceassert -nilfunc ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /tmp/go-build3635374934/b416/_pkg_.a -trimpath "warnings":[]}] -p github.com/githurev-parse -lang=go1.25 git comm�� -m initial commit (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv :latest remote.origin.url /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -json (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/compile /usr/bin/gh -json t/format.go x_amd64/compile gh api /repos/actions/github-script/git/ref/tags/v9 l /usr/bin/git -json GO111MODULE x_amd64/vet git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv -m initial commit /usr/bin/git ys.md GO111MODULE /opt/hostedtoolc--show-toplevel git -C /tmp/gh-aw-test-runs/20260501-024835-62855/test-1983547104/.github/workflows rev-parse /usr/bin/git -json GO111MODULE /home/REDACTED/nodxterm-color git (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv . ache/node/24.14.1/x64/bin/node odules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/git -b 55bd5e5e node git init�� -q (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv . ache/node/24.14.1/x64/bin/node k/_temp/uv-python-dir/git full1.txt 55bd5e5e git git init�� -q (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env h ../../../.pret.prettierignore GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch .go git 1/x64/bin/node --count 3f70b704df3fa665-1 es/.bin/git 1/x64/bin/node ve -q tions/setup/js/node_modules/vitest/suppress-warnings.cjs repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -exist b2d6bbf64e247ad3-C bin/git tions/setup/js/nconfig (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch k/gh-aw/gh-aw/.gremote.origin.url /home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/vitest/suppress-warnings.cjs me: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } node --conditions development /opt/hostedtoolcrev-parse -o ithub/workflows -importcfg /opt/hostedtoolcache/node/24.14.-f -s -w -buildmode=exe /opt/hostedtoolcshow (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch -json GO111MODULE 86_64/sh GOINSECURE GOMOD GOMODCACHE go env .js' --ignore-path .prettierignore GO111MODULE repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --show-toplevel 8n/W7nDXlF-2wrJGrRo2mzy/Er_eZaAbremote /usr/bin/infocmp rtcfg .cfg 64/pkg/tool/linu--show-toplevel infocmp -1 xterm-color 64/pkg/tool/linumyorg /usr/bin/git mpiledOutput4156git wDwi/8TvZlM4P0nfrev-parse ache/go/1.25.8/x--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --git-dir git /usr/bin/git k/gh-aw/gh-aw/.ggit rev-parse /usr/bin/git git rev-�� --show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv se 5374934/b114/vet.cfg ache/node/24.14.1/x64/bin/node remote.origin.urgit GO111MODULE 64/bin/go git t-20�� k/gh-aw/gh-aw/.github/workflows/archie.md config /usr/bin/git remote.origin.urgit GO111MODULE x_amd64/vet git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv /tmp/TestHashStability_SameInputSameOutput2131200416/001/stability-test.md erignore /usr/bin/git ithub/workflows GO111MODULE /opt/hostedtoolc--show-toplevel git -C /tmp/TestGuardPolicyMinIntegrityOnlyrepos_only_without_min-integrity1947121394/0-errorsas config /opt/hostedtoolcache/node/24.14.1/x64/bin/node remote.origin.urgit GO111MODULE repository(owne--show-toplevel /opt/hostedtoolcache/node/24.14.1/x64/bin/node (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/compile /usr/bin/git -json GO111MODULE x_amd64/link git rev-�� --show-toplevel x_amd64/link /usr/bin/git -json GO111MODULE x_amd64/vet git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv git-receive-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitcustom_branch503898768/001' l /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json GO111MODULE /opt/hostedtoolc--show-toplevel node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/ai-moderator.md go /usr/bin/gh k/gh-aw/gh-aw GO111MODULE kflows/auto-triagraphql gh (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-24 GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet rtcf�� 098614/b037/_pkg_.a .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE t GOMODCACHE 64/pkg/tool/linuInitial commit (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-01 GOMOD GOMODCACHE 64/pkg/tool/linu-goversion rtcf�� ty-test.md .cfg 64/pkg/tool/linu-importcfg GOINSECURE fips140deps/cpu GOMODCACHE 64/pkg/tool/linu/home/REDACTED/work/gh-aw/gh-aw/pkg/stringutil/identifiers.go (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-01-31 GOMOD GOMODCACHE 64/pkg/tool/linuremote.origin.url rtcf�� ty-test.md .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuTest User (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GO111MODULE x_amd64/compile GOINSECURE contextprotocol/rev-parse ache/go/1.25.8/x--git-dir x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 .cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE 098614/b078/js_jrev-parse ache/go/1.25.8/x--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name config At,event,headBranch,headSha,displayTitle remote.origin.urgit GO111MODULE r: $owner, name:--show-toplevel grep -n itattributes-test288917891/.github/workflows .github/workflows/design-decision-gate.lock.yml 040906/b287/vet.cfg l GO111MODULE ache/go/1.25.8/x--show-toplevel bash (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE e/jsonschema-go//tmp/js-hash-test-3191298695/test-hash.js GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 vMoO/r1c5PlYHcFDLvhFNvMoO 64/pkg/tool/linux_amd64/compile GOINSECURE ntio/encoding/jsrev-parse GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name show /snap/bin/bash -json GO111MODULE repository(owne--show-toplevel bash --no�� runs/20260501-024835-62855/test-source-field-variant-1548196433 go e/git */*.ts' '**/*.jsgit GO111MODULE r.lock.yml e/git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu^remote\..*\.gh-resolved$ (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 .cfg ionpins.test GOINSECURE GOMOD GOMODCACHE ionpins.test 6353�� 1424459469/.github/workflows 5374934/b024/vet.cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name rev-parse /home/REDACTED/.local/bin/bash -json GO111MODULE r: $owner, name:--show-toplevel bash --no�� FieldEnforcement1902334469/001 go bject.type] | @tsv */*.ts' '**/*.jsgit GO111MODULE ache/go/1.25.8/x--show-toplevel bash (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name GO111MODULE x_amd64/compile GOINSECURE fips140/nistec ache/go/1.25.8/x--show-toplevel x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 stmain.go .cfg GOINSECURE fips140/ecdsa GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-test.v=true inst�� 40/001/test-simple-frontmatter.m-test.timeout=10m0s flge/CEDVAjFSK2LRG6vPflge .cfg GOSUMDB GOWORK 64/bin/go ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name rev-parse /opt/hostedtoolcache/uv/0.11.8/x86_64/bash -json GO111MODULE de_modules/.bin/--show-toplevel bash --no�� itattributes-test288917891 go kflows/test.lock.yml -json GO111MODULE r: $owner, name:--show-toplevel head (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/link GOINSECURE fips140cache ache/go/1.25.8/x/home/REDACTED/work/gh-aw/gh-aw/.github/workflows/audit-workflows.md 64/pkg/tool/linux_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 .cfg .cfg GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name show 1/x64/bin/node -json GO111MODULE $name) { has--show-toplevel 1/x64/bin/node --no�� itattributes-test288917891/.github/workflows pins synced sucshow repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -json GO111MODULE ache/go/1.25.8/xlist head (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE 098614/b011/sys_rev-parse ache/go/1.25.8/x--show-toplevel 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 gLhb/hBEUOkjpLNrZf4ikgLhb ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-trimpath (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name config 1/x64/bin/node remote.origin.urgit GO111MODULE $name) { has--show-toplevel 1/x64/bin/node --no�� e: ${{ secrets.TOKEN }} go ache/node/24.14.1/x64/bin/node -json GO111MODULE (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name zm1t/ybsydLQ-bM8eUCGDzm1t 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 eFae/0ahu769BnKYz-hV-eFae 64/pkg/tool/linux_amd64/compile GOINSECURE fips140/mlkem GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name show ache/node/24.14.1/x64/bin/node -json GO111MODULE repository(owne--show-toplevel bash t-24�� bility_SameInputSameOutput2131200416/001/stability-test.md go ache/go/1.25.8/x64/pkg/tool/linux_amd64/link -json GO111MODULE repository(owne--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/link (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE x_amd64/vet env _.a @v1.19.2/parser/color.go x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 /go-yaml/token 098614/b047/syma--show-toplevel 64/pkg/tool/linux_amd64/vet env 94119404 GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linutest@example.com (http block)
  • https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md
    • Triggering command: /tmp/go-build3635374934/b404/cli.test /tmp/go-build3635374934/b404/cli.test -test.testlogfile=/tmp/go-build3635374934/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /tmp/go-build870040906/b404/cli.test /tmp/go-build870040906/b404/cli.test -test.testlogfile=/tmp/go-build870040906/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go env ck 'scripts/**/*.js' --ignore-paremote.origin.url GO111MODULE repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git 3040972623 Sak5XWYSYfQ9xL6Irev-parse 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/link /usr/bin/git ingutil.test /tmp/go-build363-k 64/pkg/tool/linu/tmp/gh-aw/aw-feature-branch.patch git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git 4835-62855/test-git config ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git graphql -f e/git git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv se 5374934/b057/vet.cfg .cfg -I /tmp/go-build138rev-parse -I ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw/.github/workflows ghcr.io/github/serena-mcp-server:latest me: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } l GO111MODULE 64/bin/go git -C /home/REDACTED/work/gh-aw/gh-aw show ity-sentinel.lock.yml -json GO111MODULE $name) { has--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet 0154�� _.a GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv ithub/workflows GOPROXY /usr/bin/git GOSUMDB GOWORK 64/bin/go git _bra�� ithub/workflows go /usr/bin/infocmp -json GO111MODULE 64/bin/go infocmp (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env _.a GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet 4722�� _.a GO111MODULE x_amd64/vet GOINSECURE bug GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json irent.go x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env _.a GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv on GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env _.a GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw **/*.cjs kflows/daily-community-attribution.lock.yml **/*.json --ignore-path ../../../.pretti-bool gh api Gitmaster_branch-errorsas Gitmaster_branch-ifaceassert /usr/bin/git l GO111MODULE ed } } git (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv rdian.md 5374934/b061/vet.cfg x_amd64/link -I /tmp/go-build138-1 -I x_amd64/link sRem�� se 5374934/b224/vet.cfg .cfg -p vendor/golang.orrev-parse -lang=go1.25 Bh/hKJC44cVKMHVnpBvTgXO/G1KutSxXremote2 (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv ithub/workflows show /usr/bin/git l GO111MODULE DiscussionsEnablgithub.event.issue.number git -C or.md config tro.lock.yml remote.origin.urgit GO111MODULE DiscussionsEnabladd /usr/bin/gh (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE t/internal/strinrev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet estl�� /ref/tags/v9 5374934/b039/vet.cfg sv -I /tmp/go-build138rev-parse -I ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion .js' --ignore-pagit GO111MODULE ache/go/1.25.8/x--show-toplevel bash --no�� runs/20260501-024835-62855/test-2671091871/.github/workflows go /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -json GO111MODULE k/gh-aw/gh-aw/ac--get-regexp /opt/hostedtoolc^remote\..*\.gh-resolved$ (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD sm_wasm.s x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD emclr_wasm.s x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state .cfg GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -o 098614/b164/importcfg -trimpath ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -p runtime -lang=go1.25 ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json eyset.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name ithub/workflows GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env k/gh-aw/gh-aw/.github/workflows GO111MODULE yml GOINSECURE GOMOD GOMODCACHE sh (http block)
  • https://api.github.com/repos/test/repo
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch 40/001/test-complex-frontmatter--s k16k/fLMkIGmGY3YvZBL1k16k .cfg GOSUMDB GOWORK 64/bin/go ache/go/1.25.8/x64/pkg/tool/linuremote -o 098614/b213/importcfg -trimpath x_amd64/vet -p crypto/internal/config -lang=go1.25 x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch Secret: ${{ secrets.TOKEN }} node /usr/bin/git k/gh-aw/gh-aw/.ggit **/*.cjs /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git k/gh-aw/gh-aw/.ggit remote.origin.urrev-parse DiscussionsEnabl--show-toplevel git (http block)
  • invalid.example.invalid
    • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin https://invalid.example.invalid/nonexistent-repo.git e/git init�� ndor/bin/git git ode_modules/.bin/git =receive test@example.com--git-dir=/tmp/bare-incremental-BJV4as /git (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

…put usage

Fixes the Design Decision Gate failing on complex PRs with error_max_turns:
- Increase max-turns from 12 to 15 (complex PRs need 12-13 turns vs 4-5 for simple)
- Update prompt turn budget table and stopping criteria references (turn 14/15)
- Add explicit warning to use mcp__safeoutputs tools, not bash safeoutputs add_comment
- Recompile lock file to reflect --max-turns 15 and GH_AW_MAX_TURNS: 15

Closes #29327"

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/381c07a1-f8b7-4b5c-a100-a06ff409b4cf

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix DDG agent hitting max turns on complex PRs fix(ddg): raise max-turns to 15, clarify MCP safe-output path May 1, 2026
Copilot AI requested a review from gh-aw-bot May 1, 2026 02:54
@pelikhan pelikhan marked this pull request as ready for review May 1, 2026 02:55
Copilot AI review requested due to automatic review settings May 1, 2026 02:55
@pelikhan pelikhan closed this May 1, 2026
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the Design Decision Gate workflow configuration to reduce error_max_turns failures on complex PRs by increasing the agent turn budget and clarifying the correct safe-output invocation path.

Changes:

  • Increased the Claude engine hard turn budget from 12 to 15 turns and updated the turn-budget table / stopping criteria accordingly.
  • Added documentation clarifying that safe outputs should be invoked via MCP tools (not via the safeoutputs bash CLI).
  • Recompiled the lockfile to reflect the new --max-turns 15 / GH_AW_MAX_TURNS: 15 settings.
Show a summary per file
File Description
.github/workflows/design-decision-gate.md Raises max-turns to 15 and updates guidance/stopping criteria; adds a note about using MCP for safe outputs.
.github/workflows/design-decision-gate.lock.yml Regenerated lockfile reflecting updated max-turns and related prompt/config hashes.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 2/2 changed files
  • Comments generated: 3

# shellcheck disable=SC1003
sudo -E awf --config "${RUNNER_TEMP}/gh-aw/awf-config.json" --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" --tty --env-all --exclude-env ANTHROPIC_API_KEY --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --allow-host-ports 80,443,8080 --skip-pull \
-- /bin/bash -c 'export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && export PATH="$(find /opt/hostedtoolcache /home/runner/work/_tool -maxdepth 4 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true && claude --print --no-chrome --max-turns 12 --mcp-config "${{ runner.temp }}/gh-aw/mcp-config/mcp-servers.json" --allowed-tools '\''Bash(cat),Bash(cat:*),Bash(date),Bash(echo),Bash(echo:*),Bash(find:*),Bash(git add:*),Bash(git branch:*),Bash(git checkout:*),Bash(git commit:*),Bash(git diff:*),Bash(git log:*),Bash(git ls-remote:*),Bash(git merge:*),Bash(git rm:*),Bash(git show:*),Bash(git status),Bash(git switch:*),Bash(grep),Bash(grep:*),Bash(head),Bash(ls),Bash(ls:*),Bash(pwd),Bash(safeoutputs:*),Bash(sort),Bash(tail),Bash(uniq),Bash(wc),Bash(wc:*),Bash(yq),BashOutput,Edit,ExitPlanMode,Glob,Grep,KillBash,LS,MultiEdit,NotebookEdit,NotebookRead,Read,Task,TodoWrite,Write,mcp__github__download_workflow_run_artifact,mcp__github__get_code_scanning_alert,mcp__github__get_commit,mcp__github__get_dependabot_alert,mcp__github__get_discussion,mcp__github__get_discussion_comments,mcp__github__get_file_contents,mcp__github__get_job_logs,mcp__github__get_label,mcp__github__get_latest_release,mcp__github__get_me,mcp__github__get_notification_details,mcp__github__get_pull_request,mcp__github__get_pull_request_comments,mcp__github__get_pull_request_diff,mcp__github__get_pull_request_files,mcp__github__get_pull_request_review_comments,mcp__github__get_pull_request_reviews,mcp__github__get_pull_request_status,mcp__github__get_release_by_tag,mcp__github__get_secret_scanning_alert,mcp__github__get_tag,mcp__github__get_workflow_run,mcp__github__get_workflow_run_logs,mcp__github__get_workflow_run_usage,mcp__github__issue_read,mcp__github__list_branches,mcp__github__list_code_scanning_alerts,mcp__github__list_commits,mcp__github__list_dependabot_alerts,mcp__github__list_discussion_categories,mcp__github__list_discussions,mcp__github__list_issue_types,mcp__github__list_issues,mcp__github__list_label,mcp__github__list_notifications,mcp__github__list_pull_requests,mcp__github__list_releases,mcp__github__list_secret_scanning_alerts,mcp__github__list_starred_repositories,mcp__github__list_tags,mcp__github__list_workflow_jobs,mcp__github__list_workflow_run_artifacts,mcp__github__list_workflow_runs,mcp__github__list_workflows,mcp__github__pull_request_read,mcp__github__search_code,mcp__github__search_issues,mcp__github__search_orgs,mcp__github__search_pull_requests,mcp__github__search_repositories,mcp__github__search_users,mcp__safeoutputs'\'' --debug-file /tmp/gh-aw/agent-stdio.log --verbose --permission-mode acceptEdits --output-format stream-json "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_CLAUDE:+ --model "$GH_AW_MODEL_AGENT_CLAUDE"}' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
-- /bin/bash -c 'export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && export PATH="$(find /opt/hostedtoolcache /home/runner/work/_tool -maxdepth 4 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true && claude --print --no-chrome --max-turns 15 --mcp-config "${{ runner.temp }}/gh-aw/mcp-config/mcp-servers.json" --allowed-tools '\''Bash(cat),Bash(cat:*),Bash(date),Bash(echo),Bash(echo:*),Bash(find:*),Bash(git add:*),Bash(git branch:*),Bash(git checkout:*),Bash(git commit:*),Bash(git diff:*),Bash(git log:*),Bash(git ls-remote:*),Bash(git merge:*),Bash(git rm:*),Bash(git show:*),Bash(git status),Bash(git switch:*),Bash(grep),Bash(grep:*),Bash(head),Bash(ls),Bash(ls:*),Bash(pwd),Bash(safeoutputs:*),Bash(sort),Bash(tail),Bash(uniq),Bash(wc),Bash(wc:*),Bash(yq),BashOutput,Edit,ExitPlanMode,Glob,Grep,KillBash,LS,MultiEdit,NotebookEdit,NotebookRead,Read,Task,TodoWrite,Write,mcp__github__download_workflow_run_artifact,mcp__github__get_code_scanning_alert,mcp__github__get_commit,mcp__github__get_dependabot_alert,mcp__github__get_discussion,mcp__github__get_discussion_comments,mcp__github__get_file_contents,mcp__github__get_job_logs,mcp__github__get_label,mcp__github__get_latest_release,mcp__github__get_me,mcp__github__get_notification_details,mcp__github__get_pull_request,mcp__github__get_pull_request_comments,mcp__github__get_pull_request_diff,mcp__github__get_pull_request_files,mcp__github__get_pull_request_review_comments,mcp__github__get_pull_request_reviews,mcp__github__get_pull_request_status,mcp__github__get_release_by_tag,mcp__github__get_secret_scanning_alert,mcp__github__get_tag,mcp__github__get_workflow_run,mcp__github__get_workflow_run_logs,mcp__github__get_workflow_run_usage,mcp__github__issue_read,mcp__github__list_branches,mcp__github__list_code_scanning_alerts,mcp__github__list_commits,mcp__github__list_dependabot_alerts,mcp__github__list_discussion_categories,mcp__github__list_discussions,mcp__github__list_issue_types,mcp__github__list_issues,mcp__github__list_label,mcp__github__list_notifications,mcp__github__list_pull_requests,mcp__github__list_releases,mcp__github__list_secret_scanning_alerts,mcp__github__list_starred_repositories,mcp__github__list_tags,mcp__github__list_workflow_jobs,mcp__github__list_workflow_run_artifacts,mcp__github__list_workflow_runs,mcp__github__list_workflows,mcp__github__pull_request_read,mcp__github__search_code,mcp__github__search_issues,mcp__github__search_orgs,mcp__github__search_pull_requests,mcp__github__search_repositories,mcp__github__search_users,mcp__safeoutputs'\'' --debug-file /tmp/gh-aw/agent-stdio.log --verbose --permission-mode acceptEdits --output-format stream-json "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_CLAUDE:+ --model "$GH_AW_MODEL_AGENT_CLAUDE"}' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
Copy link

Copilot AI May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The compiled workflow still allows Bash(safeoutputs:*) in the agent’s --allowed-tools list, but the updated prompt explicitly instructs agents not to use the safeoutputs CLI and to use the MCP safeoutputs tool instead. To prevent regressions (agents picking the CLI path and hitting the same permission denials), consider removing Bash(safeoutputs:*) from the allowed-tools list for this workflow when regenerating the lockfile, so only the MCP safeoutputs tool path is available.

Suggested change
-- /bin/bash -c 'export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && export PATH="$(find /opt/hostedtoolcache /home/runner/work/_tool -maxdepth 4 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true && claude --print --no-chrome --max-turns 15 --mcp-config "${{ runner.temp }}/gh-aw/mcp-config/mcp-servers.json" --allowed-tools '\''Bash(cat),Bash(cat:*),Bash(date),Bash(echo),Bash(echo:*),Bash(find:*),Bash(git add:*),Bash(git branch:*),Bash(git checkout:*),Bash(git commit:*),Bash(git diff:*),Bash(git log:*),Bash(git ls-remote:*),Bash(git merge:*),Bash(git rm:*),Bash(git show:*),Bash(git status),Bash(git switch:*),Bash(grep),Bash(grep:*),Bash(head),Bash(ls),Bash(ls:*),Bash(pwd),Bash(safeoutputs:*),Bash(sort),Bash(tail),Bash(uniq),Bash(wc),Bash(wc:*),Bash(yq),BashOutput,Edit,ExitPlanMode,Glob,Grep,KillBash,LS,MultiEdit,NotebookEdit,NotebookRead,Read,Task,TodoWrite,Write,mcp__github__download_workflow_run_artifact,mcp__github__get_code_scanning_alert,mcp__github__get_commit,mcp__github__get_dependabot_alert,mcp__github__get_discussion,mcp__github__get_discussion_comments,mcp__github__get_file_contents,mcp__github__get_job_logs,mcp__github__get_label,mcp__github__get_latest_release,mcp__github__get_me,mcp__github__get_notification_details,mcp__github__get_pull_request,mcp__github__get_pull_request_comments,mcp__github__get_pull_request_diff,mcp__github__get_pull_request_files,mcp__github__get_pull_request_review_comments,mcp__github__get_pull_request_reviews,mcp__github__get_pull_request_status,mcp__github__get_release_by_tag,mcp__github__get_secret_scanning_alert,mcp__github__get_tag,mcp__github__get_workflow_run,mcp__github__get_workflow_run_logs,mcp__github__get_workflow_run_usage,mcp__github__issue_read,mcp__github__list_branches,mcp__github__list_code_scanning_alerts,mcp__github__list_commits,mcp__github__list_dependabot_alerts,mcp__github__list_discussion_categories,mcp__github__list_discussions,mcp__github__list_issue_types,mcp__github__list_issues,mcp__github__list_label,mcp__github__list_notifications,mcp__github__list_pull_requests,mcp__github__list_releases,mcp__github__list_secret_scanning_alerts,mcp__github__list_starred_repositories,mcp__github__list_tags,mcp__github__list_workflow_jobs,mcp__github__list_workflow_run_artifacts,mcp__github__list_workflow_runs,mcp__github__list_workflows,mcp__github__pull_request_read,mcp__github__search_code,mcp__github__search_issues,mcp__github__search_orgs,mcp__github__search_pull_requests,mcp__github__search_repositories,mcp__github__search_users,mcp__safeoutputs'\'' --debug-file /tmp/gh-aw/agent-stdio.log --verbose --permission-mode acceptEdits --output-format stream-json "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_CLAUDE:+ --model "$GH_AW_MODEL_AGENT_CLAUDE"}' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
-- /bin/bash -c 'export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && export PATH="$(find /opt/hostedtoolcache /home/runner/work/_tool -maxdepth 4 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true && claude --print --no-chrome --max-turns 15 --mcp-config "${{ runner.temp }}/gh-aw/mcp-config/mcp-servers.json" --allowed-tools '\''Bash(cat),Bash(cat:*),Bash(date),Bash(echo),Bash(echo:*),Bash(find:*),Bash(git add:*),Bash(git branch:*),Bash(git checkout:*),Bash(git commit:*),Bash(git diff:*),Bash(git log:*),Bash(git ls-remote:*),Bash(git merge:*),Bash(git rm:*),Bash(git show:*),Bash(git status),Bash(git switch:*),Bash(grep),Bash(grep:*),Bash(head),Bash(ls),Bash(ls:*),Bash(pwd),Bash(sort),Bash(tail),Bash(uniq),Bash(wc),Bash(wc:*),Bash(yq),BashOutput,Edit,ExitPlanMode,Glob,Grep,KillBash,LS,MultiEdit,NotebookEdit,NotebookRead,Read,Task,TodoWrite,Write,mcp__github__download_workflow_run_artifact,mcp__github__get_code_scanning_alert,mcp__github__get_commit,mcp__github__get_dependabot_alert,mcp__github__get_discussion,mcp__github__get_discussion_comments,mcp__github__get_file_contents,mcp__github__get_job_logs,mcp__github__get_label,mcp__github__get_latest_release,mcp__github__get_me,mcp__github__get_notification_details,mcp__github__get_pull_request,mcp__github__get_pull_request_comments,mcp__github__get_pull_request_diff,mcp__github__get_pull_request_files,mcp__github__get_pull_request_review_comments,mcp__github__get_pull_request_reviews,mcp__github__get_pull_request_status,mcp__github__get_release_by_tag,mcp__github__get_secret_scanning_alert,mcp__github__get_tag,mcp__github__get_workflow_run,mcp__github__get_workflow_run_logs,mcp__github__get_workflow_run_usage,mcp__github__issue_read,mcp__github__list_branches,mcp__github__list_code_scanning_alerts,mcp__github__list_commits,mcp__github__list_dependabot_alerts,mcp__github__list_discussion_categories,mcp__github__list_discussions,mcp__github__list_issue_types,mcp__github__list_issues,mcp__github__list_label,mcp__github__list_notifications,mcp__github__list_pull_requests,mcp__github__list_releases,mcp__github__list_secret_scanning_alerts,mcp__github__list_starred_repositories,mcp__github__list_tags,mcp__github__list_workflow_jobs,mcp__github__list_workflow_run_artifacts,mcp__github__list_workflow_runs,mcp__github__list_workflows,mcp__github__pull_request_read,mcp__github__search_code,mcp__github__search_issues,mcp__github__search_orgs,mcp__github__search_pull_requests,mcp__github__search_repositories,mcp__github__search_users,mcp__safeoutputs'\'' --debug-file /tmp/gh-aw/agent-stdio.log --verbose --permission-mode acceptEdits --output-format stream-json "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_CLAUDE:+ --model "$GH_AW_MODEL_AGENT_CLAUDE"}' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log

Copilot uses AI. Check for mistakes.
- **No ADR, decision inferable**: Draft ADR generated → call `push-to-pull-request-branch` + `add-comment` and **stop**.
- **No ADR, decision not inferable**: Decision cannot be inferred from PR evidence → call `add-comment` explaining what context is missing and **stop**.
- **Turn 11 reached**: If you are on turn 11 and have not yet called a safe output, emit the best available output immediately on turn 12 — do not start a new investigation step. Turn 12 is the hard limit enforced by the engine.
- **Turn 14 reached**: If you are on turn 14 and have not yet called a safe output, emit the best available output immediately on turn 15 — do not start a new investigation step. Turn 15 is the hard limit enforced by the engine.
Copy link

Copilot AI May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The “Turn 14 reached” stopping criterion says to “emit … immediately on turn 15”, which is internally contradictory (it’s not immediate if deferred a turn) and may confuse the intended behavior near the budget limit. Consider rewording to make the intent explicit (e.g., start finalization on turn 14 so the safe-output tool call happens on/within turn 15) and align wording with “Stop and emit … immediately” above.

Suggested change
- **Turn 14 reached**: If you are on turn 14 and have not yet called a safe output, emit the best available output immediately on turn 15 — do not start a new investigation step. Turn 15 is the hard limit enforced by the engine.
- **Turn 14 reached**: If you are on turn 14 and have not yet called a safe output, begin finalization immediately and emit the best available safe output on or before turn 15 — do not start a new investigation step. Turn 15 is the hard limit enforced by the engine.

Copilot uses AI. Check for mistakes.
{"noop": {"message": "No action needed: [brief explanation of what was found and why no action was required]"}}
```

> ⚠️ **Safe Output Mechanism**: Always invoke safe outputs through the **MCP tool** (`mcp__safeoutputs__add_comment`, `mcp__safeoutputs__push_to_pull_request_branch`, `mcp__safeoutputs__noop`). Do **NOT** use `bash safeoutputs add_comment` — the bash CLI path is not the correct invocation method for this workflow's safe-output jobs.
Copy link

Copilot AI May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This note introduces MCP tool names (e.g., mcp__safeoutputs__add_comment) while earlier sections instruct to call safe outputs by their configured names (add-comment, push-to-pull-request-branch). To avoid operator/agent confusion, please add a brief clarification that these refer to the same safe-output actions (dash-separated config keys vs underscore-separated MCP tool functions), and that the CLI safeoutputs command should not be used in this workflow.

Suggested change
> ⚠️ **Safe Output Mechanism**: Always invoke safe outputs through the **MCP tool** (`mcp__safeoutputs__add_comment`, `mcp__safeoutputs__push_to_pull_request_branch`, `mcp__safeoutputs__noop`). Do **NOT** use `bash safeoutputs add_comment` — the bash CLI path is not the correct invocation method for this workflow's safe-output jobs.
> ⚠️ **Safe Output Mechanism**: Always invoke safe outputs through the **MCP tool** (`mcp__safeoutputs__add_comment`, `mcp__safeoutputs__push_to_pull_request_branch`, `mcp__safeoutputs__noop`). These are the MCP function forms of the same safe-output actions referenced elsewhere by their configured names (for example, `add-comment``mcp__safeoutputs__add_comment`, `push-to-pull-request-branch``mcp__safeoutputs__push_to_pull_request_branch`, and `noop``mcp__safeoutputs__noop`). Do **NOT** use the `safeoutputs` CLI in this workflow (for example, `bash safeoutputs add_comment`) — the CLI path is not the correct invocation method for this workflow's safe-output jobs.

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[aw-failures] Fix: DDG agent hits max_turns on complex PRs — bash safeoutputs add_comment not authorized

4 participants