Parse Copilot SDK tool-denial logs in permission issue extraction

[Copilot]

The workflow failed with repeated tool denials, but the permission parser did not extract denied tool calls from Copilot SDK driver log format. As a result, missing-tool reporting lost actionable denial details.

• Problem focus

  • Extend denied-command extraction beyond pipe-formatted output to SDK-driver denial lines emitted during permission gating.

• Parser changes (permission_denied_helpers.cjs)

  • Added pattern matching for:
    • permission denied by workflow tool permissions: <summary>
    • tool denial N/M: permission denied: <summary>
  • Preserved existing fallback that scans nearby pipe-marked command lines.
  • Continued deduplication via Set so repeated denials collapse to unique entries.

• Test coverage (permission_denied_helpers.test.cjs)

  • Added a case with real SDK-driver-style denial lines (shell(...), read) to verify extraction and deduplication behavior.

const output = [
  "[copilot-sdk-driver] [sdk-driver] permission denied by workflow tool permissions: shell(agenticworkflows --help 2>&1 | head -60)",
  "[copilot-sdk-driver] [sdk-driver] tool denial 1/5: permission denied: shell(agenticworkflows --help 2>&1 | head -60)",
  "[copilot-sdk-driver] [sdk-driver] permission denied by workflow tool permissions: read",
].join("\n");

extractDeniedCommands(output);
// => ["shell(agenticworkflows --help 2>&1 | head -60)", "read"]

[Copilot]

Pull request overview

Improves missing-tool/permission issue extraction by teaching the permission-denied parser to recognize Copilot SDK driver “tool denial” log formats, so workflows that fail due to repeated tool permission denials surface actionable denied-command details.

Changes:

• Extended extractDeniedCommands() to parse SDK-driver denial summaries (in addition to the existing pipe-marker fallback).
• Added a Vitest case that validates extraction + deduplication for SDK-driver style denial lines.

Show a summary per file

File	Description
actions/setup/js/permission_denied_helpers.cjs	Adds regex-based parsing for SDK-driver “permission denied by workflow tool permissions” and “tool denial N/M” lines while preserving the existing pipe-marker fallback.
actions/setup/js/permission_denied_helpers.test.cjs	Adds test coverage for SDK-driver denial log extraction and deduplication behavior.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0