fix: wire GH_AW_COPILOT_SDK_SERVER_ARGS into SDK driver permission config

[Copilot]

The SDK driver's main() never read GH_AW_COPILOT_SDK_SERVER_ARGS, so onPermissionRequest was never set on the SDK session. The Go engine correctly computed --allow-tool shell(safeoutputs:*) and placed it in that env var, the harness correctly passed the env var to the driver subprocess — but the driver discarded it entirely, leaving the SDK to fall back to its own default permission behavior.

Changes

• copilot_sdk_driver.cjs — adds parsePermissionConfigFromServerArgs(serverArgsJson) which parses the JSON array from GH_AW_COPILOT_SDK_SERVER_ARGS into a permissionConfig ({ allowAllTools: true } or { allowedTools: [...] }). main() now calls this and passes the result to runWithCopilotSDK.

// Before
async function main() {
  // ...
  await runWithCopilotSDK({ uri, model, provider, maxToolDenials });
}

// After
async function main() {
  // ...
  const permissionConfig = parsePermissionConfigFromServerArgs(
    process.env.GH_AW_COPILOT_SDK_SERVER_ARGS
  );
  await runWithCopilotSDK({ uri, model, provider, maxToolDenials, permissionConfig });
}

• copilot_sdk_driver.test.cjs — 11 new unit tests for parsePermissionConfigFromServerArgs covering invalid inputs, --allow-all-tools precedence, multi-entry --allow-tool, and a realistic shell(safeoutputs:*) scenario.

[Copilot]

Pull request overview

This PR fixes a permissions wiring gap in the Copilot SDK driver by reading GH_AW_COPILOT_SDK_SERVER_ARGS and converting the sidecar’s --allow-tool / --allow-all-tools flags into the SDK session’s permission configuration, ensuring onPermissionRequest is correctly applied.

Changes:

• Add parsePermissionConfigFromServerArgs(serverArgsJson) to parse permission-related flags out of the JSON-encoded sidecar args array.
• Wire the parsed permissionConfig into main() so runWithCopilotSDK() can install the correct onPermissionRequest policy.
• Add unit tests covering invalid inputs, --allow-all-tools precedence, and multiple --allow-tool cases including shell(safeoutputs:*).

Show a summary per file

File	Description
actions/setup/js/copilot_sdk_driver.cjs	Parse GH_AW_COPILOT_SDK_SERVER_ARGS into a permission config and pass it into the SDK session setup.
actions/setup/js/copilot_sdk_driver.test.cjs	Add focused unit tests for parsePermissionConfigFromServerArgs to validate parsing and precedence behavior.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0