Auto-allow gh in restricted bash when tools.github.mode: gh-proxy

[Copilot]

Bug Fix

gh-proxy mode routes GitHub operations through the gh CLI, but restricted tools.bash allowlists did not automatically permit gh, causing tool access gaps. This change aligns bash/Copilot permissions with gh-proxy behavior by auto-authorizing gh when needed.

What was the bug?

When tools.github.mode: gh-proxy was enabled with a restricted bash allowlist, GitHub access could still be blocked because gh was not implicitly allowed.

How did you fix it?

• Bash allowlist augmentation
  • In restricted bash mode, automatically inject gh:* when GitHub CLI mode is active.
• Copilot tool permission parity
  • Automatically add shell(gh:*) to Copilot --allow-tool arguments under the same conditions.
• Apply across agentic engines
  • Regenerated affected compiled lock workflows so engine-specific generated allowlists consistently include gh:*/engine-equivalent shell permissions in gh-proxy + restricted bash configurations.
• Targeted regression coverage
  • Added/updated unit tests for:
    • restricted bash augmentation in gh-proxy mode
    • Copilot tool argument generation in gh-proxy mode

Example

tools:
  github:
    mode: gh-proxy
  bash:
    - echo

With this change, the effective restricted shell permissions include gh:* (and Copilot receives shell(gh:*)), so GitHub MCP access via gh works without manual allowlist edits.

Testing

Added focused unit coverage to validate gh:*/shell(gh:*) auto-injection only when gh-proxy is enabled with restricted bash, and recompiled lock workflows to propagate the behavior across affected agentic engine workflows.

[Copilot]

Pull request overview

Fixes a permissions gap when tools.github.mode: gh-proxy is used alongside a restricted tools.bash allowlist by implicitly allowing gh in both the restricted bash allowlist and Copilot CLI --allow-tool arguments.

Changes:

• Augments restricted bash allowlists with gh:* when GitHub CLI (gh-proxy) mode is enabled.
• Adds --allow-tool shell(gh:*) to Copilot CLI arguments under the same conditions, and updates unit tests.
• Regenerates/updates compiled workflow lock files.

Show a summary per file

File	Description
pkg/workflow/mcp_cli_mount.go	Injects gh:* into restricted bash allowlists when GitHub CLI mode is enabled.
pkg/workflow/mcp_cli_mount_test.go	Adds regression tests for gh:* injection behavior.
pkg/workflow/copilot_engine_tools.go	Adds shell(gh:*) to Copilot tool args for restricted bash in gh-proxy mode; refactors mount-data handling.
pkg/workflow/copilot_engine_test.go	Adds unit coverage ensuring shell(gh:*) is granted for gh-proxy + restricted bash.
.github/workflows/daily-news.lock.yml	Recompiled lock file with substantial workflow wiring/version/env/behavior changes.
.github/workflows/cli-version-checker.lock.yml	Recompiled lock file updates (prompt heredocs, metadata/hash, description text).

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 6/6 changed files
• Comments generated: 3

[pelikhan]

@copilot apply to all agentic engines

[Copilot]

@copilot apply to all agentic engines

Applied across agentic engines by regenerating all affected lock workflows so restricted bash includes gh:* in gh-proxy mode (including Claude/Copilot generated allowlists). Addressed in d06c440.