diff --git a/docs/adr/49826-shellcheck-docker-fallback-and-mcp-reenable.md b/docs/adr/49826-shellcheck-docker-fallback-and-mcp-reenable.md
new file mode 100644
index 00000000000..19181d8d8e0
--- /dev/null
+++ b/docs/adr/49826-shellcheck-docker-fallback-and-mcp-reenable.md
@@ -0,0 +1,60 @@
+# ADR-49826: Shellcheck Docker Fallback for Systems Without Native Binary; Re-enable in MCP
+
+**Date**: 2026-08-02
+**Status**: Draft
+**Deciders**: pelikhan, copilot-swe-agent
+
+---
+
+### Context
+
+The shellcheck integration in the compile pipeline (introduced in ADR-49762) relied exclusively on a native shellcheck binary being present in PATH. On platforms that lack a native package (notably Windows), shellcheck was silently skipped, leaving run: step linting inoperative for those users. Separately, MCP compilation explicitly disabled shellcheck via `--no-shellcheck` on the assumption that shellcheck output would not reach the LLM — but this also prevented any shell script validation from occurring in that context.
+
+The goal is to make shellcheck linting reliable across all supported platforms and re-enable it in MCP compilation, without requiring users to install shellcheck natively.
+
+### Decision
+
+We will add a lazy Docker container fallback for shellcheck (`koalaman/shellcheck:v0.10.0`, SHA-pinned) that is invoked only when the native binary is absent and Docker is available. The Docker path pipes scripts via stdin (no volume mount required). In parallel, we will remove `--no-shellcheck` from MCP compilation so that shellcheck runs during MCP compilation via whichever path (binary or Docker) is available.
+
+The fallback precedence is: native binary → Docker container → silent skip. Warnings and errors in `--strict`/`--validate` mode fire only when neither path is available.
+
+### Alternatives Considered
+
+#### Alternative 1: Require Native Binary Installation
+
+Continue requiring users to install shellcheck natively on every platform. Document the requirement more prominently, and surface a clear error on unsupported platforms.
+
+Rejected because it creates a hard barrier for Windows users and automated MCP environments where installing system packages is not feasible. The user experience degrades from "linting is silently skipped" to "an error is shown", with no practical linting benefit on those platforms.
+
+#### Alternative 2: Keep Shellcheck Disabled in MCP
+
+Continue passing `--no-shellcheck` during MCP compilation, accepting that LLM-generated workflows are never linted for shell script quality.
+
+Rejected because the original rationale (shellcheck output not reaching the LLM via JSON response) was addressed by the Docker fallback design: shellcheck now has a reliable execution path in any environment that has Docker running, which covers the MCP use case.
+
+#### Alternative 3: Require Docker Pull at Startup
+
+Pull the shellcheck Docker image eagerly at compile startup rather than lazily on first use.
+
+Rejected in favor of the lazy pull: Docker is only contacted when there are actual bash/sh run: steps to lint. An eager pull would add latency to all compilations, including those with no shell scripts.
+
+### Consequences
+
+#### Positive
+- Shellcheck linting is now available on all platforms that have Docker, including Windows.
+- MCP-compiled workflows receive shell script validation, improving quality of AI-generated workflow steps.
+- The Docker image is SHA-pinned, preventing unexpected behavior from upstream image changes.
+- No temporary files or volume mounts are required; scripts are piped via stdin.
+
+#### Negative
+- Docker must be running for the fallback to work; users without Docker on non-PATH platforms still get silent skips.
+- The first use of the fallback triggers a Docker image pull, adding latency that is invisible to the user.
+- Adding Docker as an implicit runtime dependency for shellcheck increases the surface area of the tool's external dependencies.
+
+#### Neutral
+- MCP shellcheck output goes to stderr (not the JSON response body), so the LLM does not see individual findings — only whether compilation succeeded or failed.
+- The existing `--no-shellcheck` flag remains available for users who want to opt out of linting entirely.
+
+---
+
+*ADR created by [adr-writer agent]. Review and finalize before changing status from Draft to Accepted.*
diff --git a/pkg/cli/compile_external_tools.go b/pkg/cli/compile_external_tools.go
index 26ed52efec5..222045b288f 100644
--- a/pkg/cli/compile_external_tools.go
+++ b/pkg/cli/compile_external_tools.go
@@ -85,8 +85,14 @@ func RunYamllintOnFiles(lockFiles []string, verbose bool, strict bool) error {
 // from the provided lock files. Shellcheck must be installed as a system binary;
 // unlike other tools it does not use Docker. When shellcheck is not available
 // the function returns nil (callers are responsible for warning the user).
-func RunShellcheckOnLockFiles(lockFiles []string, verbose bool, strict bool) error {
-	return runBatchLockFileTool("shellcheck", lockFiles, verbose, strict, runShellcheckOnLockFiles)
+func RunShellcheckOnLockFiles(ctx context.Context, lockFiles []string, verbose bool, strict bool) error {
+	if len(lockFiles) == 0 {
+		compileExternalToolsLog.Printf("No lock files to process with shellcheck")
+		return nil
+	}
+
+	compileExternalToolsLog.Printf("Running batch shellcheck on %d lock files", len(lockFiles))
+	return handleBatchToolError("shellcheck", runShellcheckOnLockFiles(ctx, lockFiles, verbose, strict), strict, verbose)
 }
 
 // RunSyftOnLockFiles runs the syft SBOM scanner on container images extracted
diff --git a/pkg/cli/compile_orchestrator.go b/pkg/cli/compile_orchestrator.go
index 6964c1318ff..3a1d3d92db9 100644
--- a/pkg/cli/compile_orchestrator.go
+++ b/pkg/cli/compile_orchestrator.go
@@ -67,11 +67,15 @@ func CompileWorkflows(ctx context.Context, config CompileConfig) ([]*workflow.Wo
 	// Warn or error when shellcheck is enabled (the default) but not installed.
 	// Skip this check when --no-emit is set: no lock files are written so shellcheck
 	// is never invoked, regardless of the --strict or --validate flags.
+	// When the binary is absent, Docker is used as a fallback (lazy — only when
+	// there are scripts to lint). Only warn/error when neither is available.
 	if !config.NoShellcheck && !config.NoEmit && !isShellcheckAvailable() {
-		if config.Strict {
-			return nil, errors.New("shellcheck binary not found in PATH; run step linting requires shellcheck to be installed (use --no-shellcheck to skip)")
-		} else if config.Validate {
-			fmt.Fprintln(os.Stderr, console.FormatWarningMessageStderr("shellcheck binary not found in PATH; run step linting will be skipped. Install shellcheck to enable run step linting."))
+		if !IsDockerAvailable(ctx) {
+			if config.Strict {
+				return nil, errors.New("shellcheck not available: binary not found in PATH and Docker is not running; install shellcheck or start Docker to enable run step linting, or use --no-shellcheck to skip")
+			} else if config.Validate {
+				fmt.Fprintln(os.Stderr, console.FormatWarningMessageStderr("shellcheck binary not found in PATH and Docker is not running; run step linting will be skipped"))
+			}
 		}
 	}
 
diff --git a/pkg/cli/compile_pipeline.go b/pkg/cli/compile_pipeline.go
index 7f8ce965df1..a1ac3125375 100644
--- a/pkg/cli/compile_pipeline.go
+++ b/pkg/cli/compile_pipeline.go
@@ -301,7 +301,7 @@ func compileSpecificFiles(
 		if err := ctx.Err(); err != nil {
 			return workflowDataList, err
 		}
-		if err := RunShellcheckOnLockFiles(lockFilesForShellcheck, config.Verbose && !config.JSONOutput, config.Strict); err != nil {
+		if err := RunShellcheckOnLockFiles(ctx, lockFilesForShellcheck, config.Verbose && !config.JSONOutput, config.Strict); err != nil {
 			if config.Strict {
 				return workflowDataList, err
 			}
@@ -609,7 +609,7 @@ func compileAllFilesInDirectory(
 		if err := ctx.Err(); err != nil {
 			return workflowDataList, err
 		}
-		if err := RunShellcheckOnLockFiles(lockFilesForShellcheck, config.Verbose && !config.JSONOutput, config.Strict); err != nil {
+		if err := RunShellcheckOnLockFiles(ctx, lockFilesForShellcheck, config.Verbose && !config.JSONOutput, config.Strict); err != nil {
 			if config.Strict {
 				return workflowDataList, err
 			}
diff --git a/pkg/cli/docker_images.go b/pkg/cli/docker_images.go
index 3b7037ee2ee..796bd383e13 100644
--- a/pkg/cli/docker_images.go
+++ b/pkg/cli/docker_images.go
@@ -37,6 +37,9 @@ const (
 	GrypeImage       = "anchore/grype:v0.116.1@sha256:1e71065c0a4cff3e6bd3b8add525ffac4343eb4971694eb90a31cf6d4d3e85db"
 	GrantImage       = "anchore/grant:v0.6.8@sha256:172463611795f43b77302cdfbd7b3f81295492a7330e0820cfe41c3674920237"
 	YamllintImage    = "pipelinecomponents/yamllint:latest@sha256:5ab5eb7da0ed5e606b07c1723fc8b275e925189f70ac259b26b7329cb5f8f44d"
+	// ShellcheckImage is the Docker fallback for shellcheck when the binary is not installed.
+	// Used automatically when the shellcheck binary is not found in PATH (e.g. on Windows).
+	ShellcheckImage = "koalaman/shellcheck:v0.10.0@sha256:2097951f02e735b613f4a34de20c40f937a6c8f18ecb170612c88c34517221fb"
 )
 
 // inflightDownload holds the join channel and result for an in-progress pull.
diff --git a/pkg/cli/docker_images_test.go b/pkg/cli/docker_images_test.go
index f01f5133d74..44dd71c8705 100644
--- a/pkg/cli/docker_images_test.go
+++ b/pkg/cli/docker_images_test.go
@@ -113,6 +113,9 @@ func TestDockerImageConstants(t *testing.T) {
 	if GrantImage == "" {
 		t.Error("GrantImage constant should not be empty")
 	}
+	if ShellcheckImage == "" {
+		t.Error("ShellcheckImage constant should not be empty")
+	}
 
 	// Verify they are docker image references
 	expectedImages := map[string]string{
@@ -123,6 +126,7 @@ func TestDockerImageConstants(t *testing.T) {
 		"syft":         SyftImage,
 		"grype":        GrypeImage,
 		"grant":        GrantImage,
+		"shellcheck":   ShellcheckImage,
 	}
 
 	for name, image := range expectedImages {
diff --git a/pkg/cli/mcp_subprocess_guardrail.go b/pkg/cli/mcp_subprocess_guardrail.go
index 791141eb259..1d7f739c1ee 100644
--- a/pkg/cli/mcp_subprocess_guardrail.go
+++ b/pkg/cli/mcp_subprocess_guardrail.go
@@ -1,6 +1,7 @@
 package cli
 
 import (
+	"bytes"
 	"context"
 	"os/exec"
 
@@ -85,3 +86,19 @@ func runMCPExecOutput(ctx context.Context, execCmd execCmdFunc, args ...string)
 func runMCPExecCombinedOutput(ctx context.Context, execCmd execCmdFunc, args ...string) ([]byte, error) {
 	return runMCPSubprocessCombinedOutput(ctx, execCmd(ctx, args...))
 }
+
+func runMCPExecOutputWithStderr(ctx context.Context, execCmd execCmdFunc, args ...string) ([]byte, []byte, error) {
+	cmd := execCmd(ctx, args...)
+
+	if err := defaultMCPSubprocessGuardrail.acquire(ctx); err != nil {
+		return nil, nil, err
+	}
+	defer defaultMCPSubprocessGuardrail.release()
+
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	err := cmd.Run()
+	return stdout.Bytes(), stderr.Bytes(), err
+}
diff --git a/pkg/cli/mcp_tools_readonly.go b/pkg/cli/mcp_tools_readonly.go
index a4fb18b2ee3..bf5e8533e2d 100644
--- a/pkg/cli/mcp_tools_readonly.go
+++ b/pkg/cli/mcp_tools_readonly.go
@@ -6,6 +6,7 @@ import (
 	"errors"
 	"os/exec"
 	"path/filepath"
+	"strings"
 
 	"github.com/modelcontextprotocol/go-sdk/jsonrpc"
 	"github.com/modelcontextprotocol/go-sdk/mcp"
@@ -140,6 +141,7 @@ Returns JSON array with validation results for each workflow:
 		// the caller knows linting was skipped, while preserving each workflow's
 		// valid/invalid status.
 		var dockerUnavailableWarning string
+		var shellcheckUnavailableWarning string
 
 		// Check if any static analysis tools are requested that require Docker images
 		if args.Zizmor || args.Poutine || args.Actionlint || args.RunnerGuard || args.Syft || args.Grype || args.Grant || args.Yamllint {
@@ -172,7 +174,7 @@ Returns JSON array with validation results for each workflow:
 					// Images are still downloading — ask the caller to retry.
 					// Build per-workflow validation errors instead of throwing an MCP protocol error,
 					// so callers always receive consistent JSON regardless of the failure mode.
-					results := buildDockerErrorResults(args.Workflows, err.Error())
+					results := buildCompileErrorResults(args.Workflows, err.Error())
 					jsonBytes, jsonErr := json.Marshal(results)
 					if jsonErr != nil {
 						return nil, nil, newMCPError(jsonrpc.CodeInternalError, "failed to marshal docker error results", jsonErr.Error())
@@ -193,9 +195,15 @@ Returns JSON array with validation results for each workflow:
 
 		// Build command arguments
 		// Always validate workflows during compilation and use JSON output for MCP.
-		// Shellcheck output goes to stderr (captured in subprocess error buffer only) and
-		// therefore never reaches the LLM via the JSON response — always disable it.
-		cmdArgs := []string{"compile", "--validate", "--json", "--no-shellcheck"}
+		cmdArgs := []string{"compile", "--validate", "--json"}
+
+		// Keep compile JSON responses usable in MCP on hosts without shellcheck support.
+		// When neither a native shellcheck binary nor Docker fallback is available,
+		// skip shellcheck for this subprocess and return a structured warning.
+		if !isShellcheckAvailable() && !IsDockerAvailable(ctx) {
+			cmdArgs = append(cmdArgs, "--no-shellcheck")
+			shellcheckUnavailableWarning = "shellcheck binary not found in PATH and Docker is not running; run step linting was skipped"
+		}
 
 		// Add fix flag if requested
 		if args.Fix {
@@ -248,7 +256,7 @@ Returns JSON array with validation results for each workflow:
 		// Use separate stdout/stderr capture instead of CombinedOutput because:
 		// - Stdout contains JSON output (--json flag)
 		// - Stderr contains console messages that shouldn't be mixed with JSON
-		stdout, err := runMCPExecOutput(ctx, execCmd, cmdArgs...)
+		stdout, stderr, err := runMCPExecOutputWithStderr(ctx, execCmd, cmdArgs...)
 
 		// The compile command always outputs JSON to stdout when --json flag is used, even on error.
 		// We should return the JSON output to the LLM so it can see validation errors.
@@ -262,12 +270,26 @@ Returns JSON array with validation results for each workflow:
 			// If we have no output, this is a real execution failure
 			if outputStr == "" {
 				// Try to get stderr for error details
-				var stderr string
+				var stderrText string
 				var exitErr *exec.ExitError
 				if errors.As(err, &exitErr) {
-					stderr = string(exitErr.Stderr)
+					stderrText = string(exitErr.Stderr)
+				}
+				if strings.TrimSpace(stderrText) == "" {
+					stderrText = string(stderr)
+				}
+				errMsg := strings.TrimSpace(stderrText)
+				if errMsg == "" {
+					errMsg = err.Error()
 				}
-				return nil, nil, newMCPError(jsonrpc.CodeInternalError, "failed to compile workflows", map[string]any{"error": err.Error(), "stderr": stderr})
+				results := buildCompileErrorResults(args.Workflows, errMsg)
+				jsonBytes, jsonErr := json.Marshal(results)
+				if jsonErr != nil {
+					return nil, nil, newMCPError(jsonrpc.CodeInternalError, "failed to marshal compile error results", jsonErr.Error())
+				}
+				return &mcp.CallToolResult{
+					Content: []mcp.Content{&mcp.TextContent{Text: string(jsonBytes)}},
+				}, nil, nil
 			}
 			// Otherwise, we have output (likely validation errors in JSON), so continue
 			// and return it to the LLM
@@ -279,6 +301,10 @@ Returns JSON array with validation results for each workflow:
 		if dockerUnavailableWarning != "" {
 			outputStr = injectDockerUnavailableWarning(outputStr, dockerUnavailableWarning)
 		}
+		if shellcheckUnavailableWarning != "" {
+			outputStr = injectShellcheckUnavailableWarning(outputStr, shellcheckUnavailableWarning)
+		}
+		outputStr = injectShellcheckDiagnostics(outputStr, string(stderr))
 
 		return &mcp.CallToolResult{
 			Content: []mcp.Content{
@@ -436,11 +462,10 @@ Also returns pr_number, head_sha, check_runs, statuses, and total_count.`,
 	})
 }
 
-// buildDockerErrorResults builds a []ValidationResult with a config_error for each target
-// workflow. It is used when Docker images are still being downloaded (transient error) so
-// the compile tool returns consistent structured JSON instead of a protocol-level error.
-// For the persistent case where Docker is not available at all, see injectDockerUnavailableWarning.
-func buildDockerErrorResults(requestedWorkflows []string, errMsg string) []ValidationResult {
+// buildCompileErrorResults builds a []ValidationResult with a config_error for each target
+// workflow. It is used when the compile subprocess cannot return JSON output, so the compile
+// tool can still return consistent structured JSON instead of a protocol-level error.
+func buildCompileErrorResults(requestedWorkflows []string, errMsg string) []ValidationResult {
 	// Determine which workflow names to report
 	var workflowNames []string
 	if len(requestedWorkflows) > 0 {
@@ -491,18 +516,81 @@ func buildDockerErrorResults(requestedWorkflows []string, errMsg string) []Valid
 // the compile-time valid/invalid status of each workflow.
 // If the JSON cannot be parsed the original output is returned unchanged.
 func injectDockerUnavailableWarning(outputStr, warningMsg string) string {
+	return injectValidationWarning(outputStr, CompileValidationError{
+		Type:    "docker_unavailable",
+		Message: warningMsg,
+	})
+}
+
+func injectShellcheckUnavailableWarning(outputStr, warningMsg string) string {
+	return injectValidationWarning(outputStr, CompileValidationError{
+		Type:    "shellcheck_unavailable",
+		Message: warningMsg,
+	})
+}
+
+func injectShellcheckDiagnostics(outputStr, stderrOutput string) string {
+	diagnostics := extractShellcheckDiagnostics(stderrOutput)
+	if len(diagnostics) == 0 {
+		return outputStr
+	}
+
+	warnings := make([]CompileValidationError, 0, len(diagnostics))
+	for _, diagnostic := range diagnostics {
+		warnings = append(warnings, CompileValidationError{
+			Type:    "shellcheck",
+			Message: diagnostic,
+		})
+	}
+	return injectValidationWarnings(outputStr, warnings)
+}
+
+func extractShellcheckDiagnostics(stderrOutput string) []string {
+	if stderrOutput == "" || !strings.Contains(stderrOutput, "shellcheck findings in ") {
+		return nil
+	}
+
+	lines := strings.Split(stderrOutput, "\n")
+	diagnostics := make([]string, 0)
+	current := ""
+
+	flush := func() {
+		if strings.TrimSpace(current) != "" {
+			diagnostics = append(diagnostics, strings.TrimSpace(current))
+		}
+		current = ""
+	}
+
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		switch {
+		case strings.Contains(trimmed, "shellcheck findings in "):
+			flush()
+			current = trimmed
+		case current != "" && (strings.Contains(trimmed, "script:") || strings.HasPrefix(trimmed, "script ")):
+			current += "\n" + trimmed
+		case current != "" && trimmed == "":
+			flush()
+		}
+	}
+	flush()
+
+	return diagnostics
+}
+
+func injectValidationWarnings(outputStr string, warnings []CompileValidationError) string {
+	if len(warnings) == 0 {
+		return outputStr
+	}
+
 	var results []ValidationResult
 	if err := json.Unmarshal([]byte(outputStr), &results); err != nil {
 		// Can't parse — return original output so we don't lose information.
 		return outputStr
 	}
 
-	warning := CompileValidationError{
-		Type:    "docker_unavailable",
-		Message: warningMsg,
-	}
 	for i := range results {
-		results[i].Warnings = append(results[i].Warnings, warning)
+		results[i].Warnings = append(results[i].Warnings, warnings...)
 	}
 
 	jsonBytes, err := json.Marshal(results)
@@ -511,3 +599,7 @@ func injectDockerUnavailableWarning(outputStr, warningMsg string) string {
 	}
 	return string(jsonBytes)
 }
+
+func injectValidationWarning(outputStr string, warning CompileValidationError) string {
+	return injectValidationWarnings(outputStr, []CompileValidationError{warning})
+}
diff --git a/pkg/cli/mcp_tools_readonly_test.go b/pkg/cli/mcp_tools_readonly_test.go
index f7a5be2188a..03a2e46d312 100644
--- a/pkg/cli/mcp_tools_readonly_test.go
+++ b/pkg/cli/mcp_tools_readonly_test.go
@@ -79,3 +79,63 @@ func TestInjectDockerUnavailableWarning_InvalidJSONReturnedUnchanged(t *testing.
 		t.Errorf("Expected original output to be returned unchanged for invalid JSON, got: %s", output)
 	}
 }
+
+func TestInjectShellcheckDiagnostics_AppendsWarnings(t *testing.T) {
+	inputJSON := `[{"workflow":"a.md","valid":true,"errors":[],"warnings":[]}]`
+	stderr := "shellcheck findings in a.lock.yml (step: lint):\nscript:1:1: warning: foo [SC1000]\n"
+
+	output := injectShellcheckDiagnostics(inputJSON, stderr)
+
+	var results []ValidationResult
+	if err := json.Unmarshal([]byte(output), &results); err != nil {
+		t.Fatalf("Failed to parse injected output: %v", err)
+	}
+	if len(results) != 1 {
+		t.Fatalf("Expected 1 result, got %d", len(results))
+	}
+	if len(results[0].Warnings) != 1 {
+		t.Fatalf("Expected 1 warning, got %d", len(results[0].Warnings))
+	}
+	if results[0].Warnings[0].Type != "shellcheck" {
+		t.Fatalf("Expected warning type shellcheck, got %s", results[0].Warnings[0].Type)
+	}
+	if results[0].Warnings[0].Message == "" {
+		t.Fatal("Expected non-empty warning message")
+	}
+}
+
+func TestInjectShellcheckDiagnostics_IgnoresUnrelatedStderr(t *testing.T) {
+	inputJSON := `[{"workflow":"a.md","valid":true,"errors":[],"warnings":[]}]`
+	stderr := "diagnostic noise should not be returned"
+
+	output := injectShellcheckDiagnostics(inputJSON, stderr)
+
+	if output != inputJSON {
+		t.Fatalf("Expected unchanged output for unrelated stderr, got: %s", output)
+	}
+}
+
+func TestBuildCompileErrorResults_NormalizesRequestedWorkflowNames(t *testing.T) {
+	results := buildCompileErrorResults([]string{"foo", "bar.md", "nested/baz"}, "compile failed")
+
+	if len(results) != 3 {
+		t.Fatalf("Expected 3 results, got %d", len(results))
+	}
+	if results[0].Workflow != "foo.md" {
+		t.Fatalf("Expected foo.md, got %s", results[0].Workflow)
+	}
+	if results[1].Workflow != "bar.md" {
+		t.Fatalf("Expected bar.md, got %s", results[1].Workflow)
+	}
+	if results[2].Workflow != "baz.md" {
+		t.Fatalf("Expected baz.md, got %s", results[2].Workflow)
+	}
+	for _, r := range results {
+		if r.Valid {
+			t.Fatalf("Expected workflow %s to be invalid", r.Workflow)
+		}
+		if len(r.Errors) != 1 || r.Errors[0].Type != "config_error" || r.Errors[0].Message != "compile failed" {
+			t.Fatalf("Unexpected error payload for workflow %s: %+v", r.Workflow, r.Errors)
+		}
+	}
+}
diff --git a/pkg/cli/shellcheck.go b/pkg/cli/shellcheck.go
index c60c6a001f0..eff78139beb 100644
--- a/pkg/cli/shellcheck.go
+++ b/pkg/cli/shellcheck.go
@@ -15,6 +15,7 @@ package cli
 
 import (
 	"bytes"
+	"context"
 	"errors"
 	"fmt"
 	"os"
@@ -29,6 +30,7 @@ import (
 )
 
 var shellcheckLog = logger.New("cli:shellcheck")
+var dockerCommandContext = exec.CommandContext
 
 // ghaExpressionRE matches GitHub Actions ${{ ... }} expression syntax so it can
 // be replaced with a shell-safe placeholder before linting.  The (?s) flag lets
@@ -294,26 +296,102 @@ func stepLabel(info runStepInfo) string {
 	return filepath.Base(info.LockFile)
 }
 
+// runShellcheckOnScriptViaDocker runs shellcheck on a script snippet using the Docker
+// container image (ShellcheckImage). The script is piped to the container via stdin,
+// so no temporary file or volume mount is required.
+//
+// This is the fallback path when the shellcheck binary is not installed locally
+// (e.g. on Windows). It mirrors the behaviour of runShellcheckOnScript: findings are
+// printed to stderr and an error is returned when shellcheck reports issues.
+func runShellcheckOnScriptViaDocker(ctx context.Context, info runStepInfo, ignoreCodes []string, verbose bool) error {
+	shellcheckLog.Printf("Running shellcheck via Docker on step %q (shell=%s)", info.Name, info.Shell)
+
+	sanitizedScript := sanitizeGHAExpressions(info.Script)
+
+	args := []string{
+		"run",
+		"--rm",
+		"-i",
+		ShellcheckImage,
+		"--shell=" + shellcheckShell(info.Shell),
+		"--format=gcc",
+	}
+	for _, code := range ignoreCodes {
+		args = append(args, "--exclude="+code)
+	}
+	args = append(args, "-") // read script from stdin
+
+	if verbose {
+		shellcheckLog.Printf("Invoking: docker %s", strings.Join(args, " "))
+		fmt.Fprintf(os.Stderr, "%s\n", console.FormatInfoMessage("docker run --rm -i "+ShellcheckImage+" <shellcheck flags> <script>"))
+	}
+
+	// #nosec G204 -- ShellcheckImage is a SHA-pinned constant; all other args are
+	// built from controlled values (shell name, SC codes, and the literal "-").
+	cmd := dockerCommandContext(ctx, "docker", args...)
+	cmd.Stdin = strings.NewReader(sanitizedScript)
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	err := cmd.Run()
+
+	// In gcc format with stdin, shellcheck prefixes findings with "-:LINE:COL: ...".
+	// Replace the leading "-:" (stdin indicator) with "script:" so that reported
+	// positions are clearly relative to the run: script snippet.
+	findings := strings.ReplaceAll(stdout.String(), "-:", "script:")
+	if findings != "" {
+		fmt.Fprintf(os.Stderr, "%s\n", console.FormatWarningMessage("shellcheck findings in "+stepLabel(info)+":"))
+		fmt.Fprint(os.Stderr, findings)
+	}
+
+	if err != nil {
+		var exitErr *exec.ExitError
+		if errors.As(err, &exitErr) {
+			if exitErr.ExitCode() == 1 {
+				// Exit code 1 means shellcheck found issues; already printed above.
+				return fmt.Errorf("shellcheck found issues in %s", stepLabel(info))
+			}
+		}
+		stderrText := strings.TrimSpace(strings.ReplaceAll(stderr.String(), "-:", "script:"))
+		if stderrText != "" {
+			return fmt.Errorf("shellcheck (docker) failed: %w: %s", err, stderrText)
+		}
+		return fmt.Errorf("shellcheck (docker) failed: %w", err)
+	}
+
+	return nil
+}
+
 // runShellcheckOnLockFiles extracts run: steps from each lock file and runs
 // shellcheck on the shell snippets. It uses shellcheckDefaultIgnoreCodes to
 // suppress known false positives from GitHub Actions expression syntax.
 //
+// When the shellcheck binary is not installed, it falls back to the Docker
+// container (ShellcheckImage) if Docker is available. This allows shellcheck
+// to run on systems without a native shellcheck installation (e.g. Windows).
+// The fallback is lazy: the Docker image is only invoked when there are scripts
+// to lint and the binary is absent.
+//
 // When strict is false, individual step failures are printed as warnings and
 // the function returns nil. When strict is true, the first step failure causes
 // an error to be returned immediately (fail fast).
-func runShellcheckOnLockFiles(lockFiles []string, verbose bool, strict bool) error {
+func runShellcheckOnLockFiles(ctx context.Context, lockFiles []string, verbose bool, strict bool) error {
 	if len(lockFiles) == 0 {
 		return nil
 	}
+	useDocker := false
 
-	// Silently skip when shellcheck is not installed. The orchestrator is responsible
-	// for warning the user in --validate mode.
 	if !isShellcheckAvailable() {
-		shellcheckLog.Print("shellcheck binary not found in PATH; skipping run step linting")
-		return nil
+		if !IsDockerAvailable(ctx) {
+			shellcheckLog.Print("shellcheck binary not found and Docker is unavailable; skipping run step linting")
+			return nil
+		}
+		useDocker = true
+		shellcheckLog.Print("shellcheck binary not found in PATH; using Docker container fallback")
 	}
 
-	shellcheckLog.Printf("Running shellcheck on run steps in %d lock file(s) (strict=%t)", len(lockFiles), strict)
+	shellcheckLog.Printf("Running shellcheck on run steps in %d lock file(s) (strict=%t, docker=%t)", len(lockFiles), strict, useDocker)
 
 	if len(lockFiles) == 1 {
 		fmt.Fprintf(os.Stderr, "%s\n", console.FormatInfoMessage("Running shellcheck on run steps in "+filepath.Base(lockFiles[0])))
@@ -335,11 +413,17 @@ outer:
 
 		for _, step := range steps {
 			totalSteps++
-			if err := runShellcheckOnScript(step, shellcheckDefaultIgnoreCodes, verbose); err != nil {
+			var stepErr error
+			if useDocker {
+				stepErr = runShellcheckOnScriptViaDocker(ctx, step, shellcheckDefaultIgnoreCodes, verbose)
+			} else {
+				stepErr = runShellcheckOnScript(step, shellcheckDefaultIgnoreCodes, verbose)
+			}
+			if stepErr != nil {
 				totalIssues++
-				shellcheckLog.Printf("shellcheck issue in %s step %q: %v", lockFile, step.Name, err)
+				shellcheckLog.Printf("shellcheck issue in %s step %q: %v", lockFile, step.Name, stepErr)
 				if strict {
-					firstErr = err
+					firstErr = stepErr
 					break outer // fail fast in strict mode
 				}
 			}
diff --git a/pkg/cli/shellcheck_test.go b/pkg/cli/shellcheck_test.go
index 4121c29edcb..e916e3b5fde 100644
--- a/pkg/cli/shellcheck_test.go
+++ b/pkg/cli/shellcheck_test.go
@@ -3,8 +3,12 @@
 package cli
 
 import (
+	"context"
 	"os"
+	"os/exec"
 	"path/filepath"
+	"runtime"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -261,23 +265,171 @@ func TestDefaultIgnoreCodes(t *testing.T) {
 }
 
 // TestRunShellcheckOnLockFilesSkipsWhenUnavailable verifies that the function
-// returns nil (no error) and does not panic when shellcheck is not in PATH.
-// We use a PATH override to hide any real shellcheck binary.
+// returns nil (no error) and does not panic when shellcheck is not in PATH and
+// Docker is also unavailable. We use a PATH override to hide both binaries.
 func TestRunShellcheckOnLockFilesSkipsWhenUnavailable(t *testing.T) {
 	orig := os.Getenv("PATH")
 	t.Cleanup(func() { os.Setenv("PATH", orig) })
-	os.Setenv("PATH", "") // ensure shellcheck cannot be found
+	os.Setenv("PATH", "") // ensure neither shellcheck nor docker can be found
 
-	err := runShellcheckOnLockFiles([]string{"/fake/file.lock.yml"}, false, false)
+	err := runShellcheckOnLockFiles(context.Background(), []string{"/fake/file.lock.yml"}, false, false)
 	assert.NoError(t, err)
 }
 
 // TestRunShellcheckOnLockFilesEmpty returns nil for an empty list.
 func TestRunShellcheckOnLockFilesEmpty(t *testing.T) {
-	err := runShellcheckOnLockFiles(nil, false, false)
+	err := runShellcheckOnLockFiles(context.Background(), nil, false, false)
 	assert.NoError(t, err)
 }
 
+func TestRunShellcheckOnScriptViaDocker(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("uses shell script stub")
+	}
+
+	t.Run("success passes stdin and args", func(t *testing.T) {
+		restore := stubDockerCommand(t, `#!/bin/sh
+set -eu
+printf '%s\n' "$*" > "$DOCKER_ARGS_FILE"
+cat > "$DOCKER_STDIN_FILE"
+exit 0
+`)
+		defer restore()
+
+		info := runStepInfo{
+			Name:     "docker step",
+			Script:   `echo "${{ github.actor }}"`,
+			Shell:    "bash",
+			LockFile: "/tmp/test.lock.yml",
+		}
+		err := runShellcheckOnScriptViaDocker(context.Background(), info, []string{"SC2016"}, false)
+		require.NoError(t, err)
+
+		argsText, readErr := os.ReadFile(os.Getenv("DOCKER_ARGS_FILE"))
+		require.NoError(t, readErr)
+		assert.Contains(t, string(argsText), "run --rm -i "+ShellcheckImage)
+		assert.Contains(t, string(argsText), "--shell=bash")
+		assert.Contains(t, string(argsText), "--exclude=SC2016")
+		assert.True(t, strings.HasSuffix(strings.TrimSpace(string(argsText)), "-"))
+
+		stdinText, readErr := os.ReadFile(os.Getenv("DOCKER_STDIN_FILE"))
+		require.NoError(t, readErr)
+		assert.Equal(t, "echo \"__GHA_EXPR__\"", string(stdinText))
+	})
+
+	t.Run("shellcheck exit code one is reported as findings", func(t *testing.T) {
+		restore := stubDockerCommand(t, `#!/bin/sh
+echo "-:1:1: warning: test finding [SC1000]"
+exit 1
+`)
+		defer restore()
+
+		info := runStepInfo{
+			Name:     "docker step",
+			Script:   "echo hello",
+			Shell:    "bash",
+			LockFile: "/tmp/test.lock.yml",
+		}
+		err := runShellcheckOnScriptViaDocker(context.Background(), info, nil, false)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "shellcheck found issues")
+	})
+
+	t.Run("docker failure includes stderr", func(t *testing.T) {
+		restore := stubDockerCommand(t, `#!/bin/sh
+echo "cannot connect to daemon" 1>&2
+exit 2
+`)
+		defer restore()
+
+		info := runStepInfo{
+			Name:     "docker step",
+			Script:   "echo hello",
+			Shell:    "bash",
+			LockFile: "/tmp/test.lock.yml",
+		}
+		err := runShellcheckOnScriptViaDocker(context.Background(), info, nil, false)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "shellcheck (docker) failed")
+		assert.Contains(t, err.Error(), "cannot connect to daemon")
+	})
+}
+
+func TestRunShellcheckOnLockFiles_UsesDockerFallbackWhenBinaryMissing(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("uses shell script stub")
+	}
+
+	lockFile := writeTempLockFile(t, `
+jobs:
+  build:
+    steps:
+      - name: lint me
+        run: echo hello
+`)
+
+	restore := stubDockerCommand(t, `#!/bin/sh
+set -eu
+if [ "${1:-}" = "info" ]; then
+  exit 0
+fi
+if [ "${1:-}" = "run" ]; then
+  echo run >> "$DOCKER_CALLS_FILE"
+  cat >/dev/null
+  exit 0
+fi
+exit 2
+`)
+	defer restore()
+
+	origPath := os.Getenv("PATH")
+	t.Cleanup(func() { os.Setenv("PATH", origPath) })
+	// Ensure native shellcheck cannot be discovered.
+	require.NoError(t, os.Setenv("PATH", filepath.Dir(os.Getenv("DOCKER_BIN"))))
+
+	err := runShellcheckOnLockFiles(context.Background(), []string{lockFile}, false, false)
+	require.NoError(t, err)
+
+	calls, readErr := os.ReadFile(os.Getenv("DOCKER_CALLS_FILE"))
+	require.NoError(t, readErr)
+	assert.Contains(t, string(calls), "run")
+}
+
+func stubDockerCommand(t *testing.T, script string) func() {
+	t.Helper()
+	dir := t.TempDir()
+	bin := filepath.Join(dir, "docker")
+	require.NoError(t, os.WriteFile(bin, []byte(script), 0o755))
+
+	argsFile := filepath.Join(dir, "docker-args.txt")
+	stdinFile := filepath.Join(dir, "docker-stdin.txt")
+	callsFile := filepath.Join(dir, "docker-calls.txt")
+
+	origDocker := dockerCommandContext
+	dockerCommandContext = exec.CommandContext
+
+	origPath := os.Getenv("PATH")
+	origArgs := os.Getenv("DOCKER_ARGS_FILE")
+	origStdin := os.Getenv("DOCKER_STDIN_FILE")
+	origCalls := os.Getenv("DOCKER_CALLS_FILE")
+	origBin := os.Getenv("DOCKER_BIN")
+
+	require.NoError(t, os.Setenv("PATH", dir+string(os.PathListSeparator)+origPath))
+	require.NoError(t, os.Setenv("DOCKER_ARGS_FILE", argsFile))
+	require.NoError(t, os.Setenv("DOCKER_STDIN_FILE", stdinFile))
+	require.NoError(t, os.Setenv("DOCKER_CALLS_FILE", callsFile))
+	require.NoError(t, os.Setenv("DOCKER_BIN", bin))
+
+	return func() {
+		dockerCommandContext = origDocker
+		_ = os.Setenv("PATH", origPath)
+		_ = os.Setenv("DOCKER_ARGS_FILE", origArgs)
+		_ = os.Setenv("DOCKER_STDIN_FILE", origStdin)
+		_ = os.Setenv("DOCKER_CALLS_FILE", origCalls)
+		_ = os.Setenv("DOCKER_BIN", origBin)
+	}
+}
+
 // writeTempLockFile writes content to a temporary *.lock.yml file and returns its path.
 func writeTempLockFile(t *testing.T, content string) string {
 	t.Helper()
diff --git a/pkg/workflow/js/safe_outputs_tools.json b/pkg/workflow/js/safe_outputs_tools.json
index abe35428b3d..03b10fe4553 100644
--- a/pkg/workflow/js/safe_outputs_tools.json
+++ b/pkg/workflow/js/safe_outputs_tools.json
@@ -4,10 +4,7 @@
     "description": "WRITE-ONCE: do NOT call this tool with empty or placeholder arguments to probe or discover its schema \u2014 required fields (title, body) are listed in this schema; if you are not ready to open the real issue, call `noop` instead. Creates a new GitHub issue for tracking bugs, feature requests, or tasks. Use this for actionable work items that need assignment, labeling, and status tracking. For reports, announcements, or status updates that don't require task tracking, use create_discussion instead. Compatibility: labels may be passed as either an array of strings or a comma-separated string; string input is split, trimmed, and normalized to an array.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "title",
-        "body"
-      ],
+      "required": ["title", "body"],
       "$defs": {
         "structured_data": {
           "type": "object",
@@ -27,10 +24,7 @@
           "description": "Detailed issue description in Markdown. Must be the final intended body \u2014 not a placeholder or test value. Do NOT repeat the title as a heading since it already appears as the issue's h1. Include context, reproduction steps, or acceptance criteria as appropriate."
         },
         "labels": {
-          "type": [
-            "array",
-            "string"
-          ],
+          "type": ["array", "string"],
           "items": {
             "type": "string"
           },
@@ -41,20 +35,14 @@
           "description": "Optional issue fields to set after creating the issue (e.g., Priority, Iteration, Start Date).",
           "items": {
             "type": "object",
-            "required": [
-              "name",
-              "value"
-            ],
+            "required": ["name", "value"],
             "properties": {
               "name": {
                 "type": "string",
                 "description": "Issue field name exactly as configured in the repository (e.g., \"Priority\", \"Iteration\")."
               },
               "value": {
-                "type": [
-                  "string",
-                  "number"
-                ],
+                "type": ["string", "number"],
                 "description": "Field value. Use string for text, single-select, iteration, and date (YYYY-MM-DD) fields; use number for numeric fields."
               }
             },
@@ -62,19 +50,14 @@
           }
         },
         "parent": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Parent issue number for creating sub-issues. This is the numeric ID from the GitHub URL (e.g., 42 in github.com/owner/repo/issues/42). Can also be a temporary_id from a previously created issue in the same workflow run \u2014 use the '#aw_abc123' form (e.g., '#aw_Test123'); the bare 'aw_abc123' form is also accepted and normalised to '#aw_abc123'."
         },
         "temporary_id": {
           "type": "string",
           "pattern": "^#?aw_[A-Za-z0-9_]{3,12}$",
           "description": "Unique temporary identifier for this issue. Canonical form: '#aw_' followed by 3 to 12 alphanumeric or underscore characters (A-Za-z0-9_) \u2014 e.g., '#aw_abc1', '#aw_pr_fix'. The bare 'aw_abc1' form is also accepted and normalised to '#aw_abc1'. Use this same '#aw_ID' form in body text to cross-reference the issue; these references are replaced with the real issue number after creation.",
-          "x-synonyms": [
-            "temporaryId"
-          ]
+          "x-synonyms": ["temporaryId"]
         },
         "secrecy": {
           "type": "string",
@@ -93,9 +76,7 @@
     "description": "Create a GitHub Copilot coding agent session to delegate coding work. Use this when you need another Copilot coding agent to implement code changes, fix bugs, or complete development tasks. The task becomes a new issue that triggers the Copilot coding agent. For non-coding tasks or manual work items, use create_issue instead.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "body"
-      ],
+      "required": ["body"],
       "properties": {
         "body": {
           "type": "string",
@@ -119,10 +100,7 @@
     "description": "Create a GitHub discussion for announcements, Q&A, reports, status updates, or community conversations. Use this for content that benefits from threaded replies, doesn't require task tracking, or serves as documentation. For actionable work items that need assignment and status tracking, use create_issue instead. Arguments must be flat tool arguments (title, body), not nested under create_discussion.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "title",
-        "body"
-      ],
+      "required": ["title", "body"],
       "properties": {
         "title": {
           "type": "string",
@@ -136,10 +114,7 @@
         "category": {
           "type": "string",
           "description": "Discussion category by name (e.g., 'General'), slug (e.g., 'general'), or ID. If omitted, uses the first available category. Category must exist in the repository. NOTE: the field is named category (not categoryId or category_id as in the GitHub GraphQL API).",
-          "x-synonyms": [
-            "categoryId",
-            "category_id"
-          ]
+          "x-synonyms": ["categoryId", "category_id"]
         },
         "secrecy": {
           "type": "string",
@@ -176,14 +151,9 @@
           "description": "Replace the discussion labels with this list (e.g., ['bug', 'help wanted']). Labels must exist in the repository. This replaces all existing labels on the discussion."
         },
         "discussion_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Discussion number to update. This is the numeric ID from the GitHub URL (e.g., 345 in github.com/owner/repo/discussions/345). Required when the workflow target is '*' (any discussion).",
-          "x-synonyms": [
-            "discussionNumber"
-          ]
+          "x-synonyms": ["discussionNumber"]
         },
         "secrecy": {
           "type": "string",
@@ -199,9 +169,7 @@
     "x-safe-outputs-target-requirements": {
       "*": {
         "primary": "discussion_number",
-        "anyOf": [
-          "discussion_number"
-        ]
+        "anyOf": ["discussion_number"]
       }
     }
   },
@@ -210,9 +178,7 @@
     "description": "Close a GitHub discussion with a resolution comment and optional reason. You can and should always add a comment when closing a discussion to explain the action or provide context. Use this to mark discussions as resolved, answered, or no longer needed. The closing comment should explain why the discussion is being closed. If the discussion is already closed, a comment will still be posted.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "body"
-      ],
+      "required": ["body"],
       "properties": {
         "body": {
           "type": "string",
@@ -221,23 +187,13 @@
         },
         "reason": {
           "type": "string",
-          "enum": [
-            "RESOLVED",
-            "DUPLICATE",
-            "OUTDATED",
-            "ANSWERED"
-          ],
+          "enum": ["RESOLVED", "DUPLICATE", "OUTDATED", "ANSWERED"],
           "description": "Resolution reason: RESOLVED (issue addressed), DUPLICATE (discussed elsewhere), OUTDATED (no longer relevant), or ANSWERED (question answered)."
         },
         "discussion_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Discussion number to close. This is the numeric ID from the GitHub URL (e.g., 678 in github.com/owner/repo/discussions/678). If omitted, closes the discussion that triggered this workflow (requires a discussion event trigger).",
-          "x-synonyms": [
-            "discussionNumber"
-          ]
+          "x-synonyms": ["discussionNumber"]
         },
         "secrecy": {
           "type": "string",
@@ -256,9 +212,7 @@
     "description": "Close a GitHub issue with a closing comment. You can and should always add a comment when closing an issue to explain the action or provide context. This tool is ONLY for closing issues - use update_issue if you need to change the title, body, labels, or other metadata without closing. Use close_issue when work is complete, the issue is no longer relevant, or it's a duplicate. The closing comment should explain the resolution or reason for closing. If the issue is already closed, a comment will still be posted.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "body"
-      ],
+      "required": ["body"],
       "properties": {
         "body": {
           "type": "string",
@@ -266,14 +220,9 @@
           "maxLength": 65536
         },
         "issue_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Issue number to close. This is the numeric ID from the GitHub URL (e.g., 901 in github.com/owner/repo/issues/901). If omitted, closes the issue that triggered this workflow (requires an issue event trigger).",
-          "x-synonyms": [
-            "issueNumber"
-          ]
+          "x-synonyms": ["issueNumber"]
         },
         "rationale": {
           "type": "string",
@@ -282,11 +231,7 @@
         },
         "confidence": {
           "type": "string",
-          "enum": [
-            "LOW",
-            "MEDIUM",
-            "HIGH"
-          ],
+          "enum": ["LOW", "MEDIUM", "HIGH"],
           "description": "Optional confidence level for closing the issue."
         },
         "suggest": {
@@ -294,14 +239,9 @@
           "description": "When true, route through pending suggestion review."
         },
         "duplicate_of": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Issue number or URL of the canonical original issue when closing as a duplicate. Accepts: a bare number (e.g. 123), a #-prefixed number (e.g. #123), an owner/repo#number reference (e.g. github/gh-aw#123), or a full GitHub issue URL. When provided together with state_reason: duplicate, creates a native GitHub duplicate relationship (marked_as_duplicate timeline event). Omit if not closing as a duplicate.",
-          "x-synonyms": [
-            "duplicateOf"
-          ]
+          "x-synonyms": ["duplicateOf"]
         },
         "secrecy": {
           "type": "string",
@@ -320,9 +260,7 @@
     "description": "Close a pull request WITHOUT merging, adding a closing comment. You can and should always add a comment when closing a PR to explain the action or provide context. Use this for PRs that should be abandoned, superseded, or closed for other reasons. The closing comment should explain why the PR is being closed. This does NOT merge the changes. If the PR is already closed, a comment will still be posted.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "body"
-      ],
+      "required": ["body"],
       "properties": {
         "body": {
           "type": "string",
@@ -330,14 +268,9 @@
           "maxLength": 65536
         },
         "pull_request_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Pull request number to close. This is the numeric ID from the GitHub URL (e.g., 432 in github.com/owner/repo/pull/432). If omitted, closes the PR that triggered this workflow (requires a pull_request event trigger). Required when the workflow target is '*' (any PR).",
-          "x-synonyms": [
-            "pullRequestNumber"
-          ]
+          "x-synonyms": ["pullRequestNumber"]
         },
         "secrecy": {
           "type": "string",
@@ -353,9 +286,7 @@
     "x-safe-outputs-target-requirements": {
       "*": {
         "primary": "pull_request_number",
-        "anyOf": [
-          "pull_request_number"
-        ]
+        "anyOf": ["pull_request_number"]
       }
     }
   },
@@ -364,9 +295,7 @@
     "description": "WRITE-ONCE: do NOT call this tool with empty or placeholder arguments to probe or discover its schema \u2014 the required `body` field is listed in this schema; if you are not ready to post a real comment, call `noop` instead. Adds a comment to an existing GitHub issue, pull request, or discussion. Use this to provide feedback, answer questions, or add information to an existing conversation. For creating new items, use create_issue, create_discussion, or create_pull_request instead. IMPORTANT: Comments are subject to validation constraints enforced by the MCP server - maximum 65536 characters for the complete comment (including footer which is added automatically), 10 mentions (@username), and 50 links. Exceeding these limits will result in an immediate error with specific guidance. NOTE: By default, this tool does not require discussions:write permission. Set 'discussions: true' in the workflow's safe-outputs.add-comment configuration to enable discussion comments and request this permission.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "body"
-      ],
+      "required": ["body"],
       "properties": {
         "body": {
           "type": "string",
@@ -374,63 +303,38 @@
           "description": "The comment text in Markdown format. Must be the final intended comment \u2014 not a placeholder or test value. This is the 'body' field - do not use 'comment_body' or other variations. Provide helpful, relevant information that adds value to the conversation. CONSTRAINTS: The complete comment (your body text + automatically added footer) must not exceed 65536 characters total. Maximum 10 mentions (@username), maximum 50 links (http/https URLs). A footer (~200-500 characters) is automatically appended with workflow attribution, so leave adequate space. If these limits are exceeded, the tool call will fail with a detailed error message indicating which constraint was violated."
         },
         "item_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "The issue, pull request, or discussion number to comment on. This is the numeric ID from the GitHub URL (e.g., 123 in github.com/owner/repo/issues/123). Can also be a temporary_id from a previously created issue in the same workflow run \u2014 use the '#aw_abc123' form; the bare 'aw_abc123' form is also accepted and normalised to '#aw_abc123'. If omitted, the tool auto-targets the issue, PR, or discussion that triggered this workflow. Auto-targeting only works for issue, pull_request, discussion, and comment event triggers \u2014 it does NOT work for schedule, workflow_dispatch, push, or workflow_run triggers. For those trigger types, always provide item_number explicitly, or the tool call will fail with an error. Required when safe-outputs.add-comment.target is '*' (any item): calls without item_number (or pr_number/pr alias) are rejected. NOTE: this field is named item_number, NOT issue_number.",
-          "x-synonyms": [
-            "issue_number",
-            "itemNumber"
-          ]
+          "x-synonyms": ["issue_number", "itemNumber"]
         },
         "pr_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Alias for item_number when targeting a pull request. Prefer item_number in new calls.",
-          "x-synonyms": [
-            "prNumber"
-          ]
+          "x-synonyms": ["prNumber"]
         },
         "pr": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Alias for item_number when targeting a pull request. Prefer item_number in new calls."
         },
         "temporary_id": {
           "type": "string",
           "pattern": "^#?aw_[A-Za-z0-9_]{3,12}$",
           "description": "Unique temporary identifier for this comment. Canonical form: '#aw_' followed by 3 to 12 alphanumeric or underscore characters (A-Za-z0-9_) \u2014 e.g., '#aw_abc1', '#aw_pr_fix'. The bare 'aw_abc1' form is also accepted and normalised to '#aw_abc1'. Auto-generated if not provided. The temporary ID is returned in the tool response so you can reference this comment later.",
-          "x-synonyms": [
-            "temporaryId"
-          ]
+          "x-synonyms": ["temporaryId"]
         },
         "reply_to_id": {
           "type": "string",
           "description": "Node ID of the discussion comment to reply to, enabling threaded discussion comments. When provided, the new comment is posted as a reply to the specified top-level discussion comment. If the given node ID belongs to a nested reply, the handler automatically resolves it to the top-level parent. Only applicable for discussion comments \u2014 ignored for issue and pull request comments.",
-          "x-synonyms": [
-            "replyToId"
-          ]
+          "x-synonyms": ["replyToId"]
         },
         "comment_id": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Existing issue or pull request comment ID to update instead of creating a new comment.",
-          "x-synonyms": [
-            "commentId"
-          ]
+          "x-synonyms": ["commentId"]
         },
         "target": {
           "type": "string",
-          "enum": [
-            "status"
-          ],
+          "enum": ["status"],
           "description": "When set to 'status', updates the activation status comment for this run (if available) instead of creating a new comment."
         },
         "secrecy": {
@@ -447,11 +351,7 @@
     "x-safe-outputs-target-requirements": {
       "*": {
         "primary": "item_number",
-        "anyOf": [
-          "item_number",
-          "pr_number",
-          "pr"
-        ]
+        "anyOf": ["item_number", "pr_number", "pr"]
       }
     }
   },
@@ -460,10 +360,7 @@
     "description": "Create a new GitHub pull request to propose code changes. Use this after making file edits to submit them for review and merging. The PR will be created from the current branch with your committed changes. This is a write-once declaration for a real intended PR, not a sandbox or probe: do not call it with placeholder content, test titles/bodies, or auth experiments. If you are not ready to open the real PR, use noop or report_incomplete instead. For code review comments on an existing PR, use create_pull_request_review_comment instead.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "title",
-        "body"
-      ],
+      "required": ["title", "body"],
       "properties": {
         "title": {
           "type": "string",
@@ -501,9 +398,7 @@
           "type": "string",
           "pattern": "^#?aw_[A-Za-z0-9_]{3,12}$",
           "description": "Unique temporary identifier for this pull request. Canonical form: '#aw_' followed by 3 to 12 alphanumeric or underscore characters (A-Za-z0-9_) \u2014 e.g., '#aw_pr1', '#aw_fix_123'. The bare 'aw_pr1' form is also accepted and normalised to '#aw_pr1'. Use this same '#aw_ID' form in body text to cross-reference this PR; these references are replaced with the real pull request number after creation.",
-          "x-synonyms": [
-            "temporaryId"
-          ]
+          "x-synonyms": ["temporaryId"]
         },
         "secrecy": {
           "type": "string",
@@ -522,21 +417,14 @@
     "description": "Create a review comment on a specific line of code in a pull request. Use this for inline code review feedback, suggestions, or questions about specific code changes. For general PR comments not tied to specific lines, use add_comment instead. When the workflow is configured with `target: \"*\"`, you must specify `pull_request_number` to indicate which PR to target.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "path",
-        "line",
-        "body"
-      ],
+      "required": ["path", "line", "body"],
       "properties": {
         "path": {
           "type": "string",
           "description": "File path relative to the repository root (e.g., 'src/auth/login.js'). Must be a file that was changed in the PR."
         },
         "line": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Line number for the comment. For single-line comments, this is the target line. For multi-line comments, this is the ending line."
         },
         "body": {
@@ -545,31 +433,18 @@
           "maxLength": 65536
         },
         "pull_request_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Pull request number to add the review comment to. This is the numeric ID from the GitHub URL (e.g., 876 in github.com/owner/repo/pull/876). If omitted, adds the comment to the PR that triggered this workflow. Required when the workflow target is '*' (any PR) \u2014 omitting it will cause the comment to fail.",
-          "x-synonyms": [
-            "pullRequestNumber"
-          ]
+          "x-synonyms": ["pullRequestNumber"]
         },
         "start_line": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Starting line number for multi-line comments. When set, the comment spans from start_line to line. Omit for single-line comments.",
-          "x-synonyms": [
-            "startLine"
-          ]
+          "x-synonyms": ["startLine"]
         },
         "side": {
           "type": "string",
-          "enum": [
-            "LEFT",
-            "RIGHT"
-          ],
+          "enum": ["LEFT", "RIGHT"],
           "description": "Side of the diff to comment on: RIGHT for the new version (additions), LEFT for the old version (deletions). Defaults to RIGHT."
         },
         "repo": {
@@ -590,9 +465,7 @@
     "x-safe-outputs-target-requirements": {
       "*": {
         "primary": "pull_request_number",
-        "anyOf": [
-          "pull_request_number"
-        ]
+        "anyOf": ["pull_request_number"]
       }
     }
   },
@@ -609,25 +482,14 @@
         },
         "event": {
           "type": "string",
-          "enum": [
-            "APPROVE",
-            "REQUEST_CHANGES",
-            "COMMENT"
-          ],
+          "enum": ["APPROVE", "REQUEST_CHANGES", "COMMENT"],
           "description": "Review decision: APPROVE to approve the pull request, REQUEST_CHANGES to formally request changes before merging, or COMMENT for general feedback without a formal decision. Defaults to COMMENT when omitted.",
-          "x-synonyms": [
-            "action"
-          ]
+          "x-synonyms": ["action"]
         },
         "pull_request_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Pull request number to submit the review on. This is the numeric ID from the GitHub URL (e.g., 876 in github.com/owner/repo/pull/876). If omitted, submits the review on the PR that triggered this workflow. Required when the workflow target is '*' (any PR) \u2014 omitting it will cause the review to fail.",
-          "x-synonyms": [
-            "pullRequestNumber"
-          ]
+          "x-synonyms": ["pullRequestNumber"]
         },
         "repo": {
           "type": "string",
@@ -647,9 +509,7 @@
     "x-safe-outputs-target-requirements": {
       "*": {
         "primary": "pull_request_number",
-        "anyOf": [
-          "pull_request_number"
-        ]
+        "anyOf": ["pull_request_number"]
       }
     }
   },
@@ -658,20 +518,12 @@
     "description": "Reply to an existing review comment on a pull request. Use this to respond to feedback, answer questions, or acknowledge review comments. The comment_id must be the numeric ID of an existing review comment.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "comment_id",
-        "body"
-      ],
+      "required": ["comment_id", "body"],
       "properties": {
         "comment_id": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "The numeric ID of the review comment to reply to (e.g., 42853901 from the comment URL or API response).",
-          "x-synonyms": [
-            "commentId"
-          ]
+          "x-synonyms": ["commentId"]
         },
         "body": {
           "type": "string",
@@ -679,14 +531,9 @@
           "maxLength": 65536
         },
         "pull_request_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Pull request number to reply on. This is the numeric ID from the GitHub URL (e.g., 876 in github.com/owner/repo/pull/876). If omitted, replies on the PR that triggered this workflow.",
-          "x-synonyms": [
-            "pullRequestNumber"
-          ]
+          "x-synonyms": ["pullRequestNumber"]
         },
         "secrecy": {
           "type": "string",
@@ -705,19 +552,12 @@
     "description": "Use this tool to dismiss a pull request review when the review is stale after automated updates. The review must be authored by the same workflow actor who is dismissing it. By default, the actor is inferred from the current GitHub Actions context (github.actor / GITHUB_ACTOR). If review_id is omitted, all dismissible reviews by the current actor are dismissed automatically. You must provide a justification of at least 20 characters.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "justification"
-      ],
+      "required": ["justification"],
       "properties": {
         "review_id": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Numeric pull request review ID to dismiss (for example, 123456789), or 'auto' to dismiss all dismissible (APPROVED or CHANGES_REQUESTED) reviews authored by the current workflow actor. Defaults to 'auto' when omitted.",
-          "x-synonyms": [
-            "reviewId"
-          ]
+          "x-synonyms": ["reviewId"]
         },
         "justification": {
           "type": "string",
@@ -730,14 +570,9 @@
           "description": "Optional expected review author login. If provided, it must match the current workflow actor."
         },
         "pull_request_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Pull request number containing the review. If omitted, uses the triggering PR context.",
-          "x-synonyms": [
-            "pullRequestNumber"
-          ]
+          "x-synonyms": ["pullRequestNumber"]
         },
         "repo": {
           "type": "string",
@@ -757,9 +592,7 @@
     "x-safe-outputs-target-requirements": {
       "*": {
         "primary": "pull_request_number",
-        "anyOf": [
-          "pull_request_number"
-        ]
+        "anyOf": ["pull_request_number"]
       }
     }
   },
@@ -768,16 +601,12 @@
     "description": "Resolve a review thread on a pull request. Use this to mark a review conversation as resolved after addressing the feedback. The thread_id must be the node ID of the review thread (e.g., PRRT_kwDO...).",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "thread_id"
-      ],
+      "required": ["thread_id"],
       "properties": {
         "thread_id": {
           "type": "string",
           "description": "The node ID of the review thread to resolve (e.g., 'PRRT_kwDOABCD...'). This is the GraphQL node ID, not a numeric ID.",
-          "x-synonyms": [
-            "threadId"
-          ]
+          "x-synonyms": ["threadId"]
         },
         "secrecy": {
           "type": "string",
@@ -796,46 +625,28 @@
     "description": "Create a code scanning alert for security vulnerabilities, code quality issues, or other findings. Alerts appear in the repository's Security tab and integrate with GitHub's security features. Use this for automated security analysis results.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "file",
-        "line",
-        "severity",
-        "message"
-      ],
+      "required": ["file", "line", "severity", "message"],
       "properties": {
         "file": {
           "type": "string",
           "description": "File path relative to the repository root where the issue was found (e.g., 'src/auth/password.js')."
         },
         "line": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Line number where the issue was found in the file."
         },
         "severity": {
           "type": "string",
-          "enum": [
-            "error",
-            "warning",
-            "info",
-            "note"
-          ],
+          "enum": ["error", "warning", "info", "note"],
           "description": "Alert severity level: 'error' (critical security issues), 'warning' (potential problems), 'info' (informational), or 'note' (minor observations). This field is named severity, NOT level.",
-          "x-synonyms": [
-            "level"
-          ]
+          "x-synonyms": ["level"]
         },
         "message": {
           "type": "string",
           "description": "Clear description of the security issue or finding. Include what's wrong and ideally how to fix it."
         },
         "column": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Column number for more precise location of the issue within the line."
         },
         "ruleIdSuffix": {
@@ -869,9 +680,7 @@
               },
               {
                 "type": "object",
-                "required": [
-                  "name"
-                ],
+                "required": ["name"],
                 "properties": {
                   "name": {
                     "type": "string",
@@ -884,11 +693,7 @@
                   },
                   "confidence": {
                     "type": "string",
-                    "enum": [
-                      "LOW",
-                      "MEDIUM",
-                      "HIGH"
-                    ],
+                    "enum": ["LOW", "MEDIUM", "HIGH"],
                     "description": "Optional confidence level for the change."
                   },
                   "suggest": {
@@ -903,15 +708,10 @@
           "description": "Labels to add (e.g., ['bug', 'priority-high']). Each entry can be either a label name string or an object with name plus optional rationale/confidence/suggest intent metadata. Labels must exist in the repository. This field is required \u2014 omitting it will cause a validation error."
         },
         "item_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "pattern": "^(\\d+|#?aw_[A-Za-z0-9_]{3,12})$",
           "description": "Issue or PR number to add labels to. This is the numeric ID from the GitHub URL (e.g., 456 in github.com/owner/repo/issues/456). Can also be a temporary_id from a previously created issue in the same workflow run \u2014 use the '#aw_abc123' form; the bare 'aw_abc123' form is also accepted and normalised to '#aw_abc123'. If omitted, adds labels to the issue or PR that triggered this workflow. Only works for issue or pull_request event triggers. For schedule, workflow_dispatch, or other triggers, item_number is required \u2014 omitting it will silently skip the label operation.",
-          "x-synonyms": [
-            "itemNumber"
-          ]
+          "x-synonyms": ["itemNumber"]
         },
         "secrecy": {
           "type": "string",
@@ -922,9 +722,7 @@
           "description": "Trustworthiness level of the message source (e.g., \"low\", \"medium\", \"high\")."
         }
       },
-      "required": [
-        "labels"
-      ],
+      "required": ["labels"],
       "additionalProperties": false
     }
   },
@@ -943,9 +741,7 @@
               },
               {
                 "type": "object",
-                "required": [
-                  "name"
-                ],
+                "required": ["name"],
                 "properties": {
                   "name": {
                     "type": "string",
@@ -958,11 +754,7 @@
                   },
                   "confidence": {
                     "type": "string",
-                    "enum": [
-                      "LOW",
-                      "MEDIUM",
-                      "HIGH"
-                    ],
+                    "enum": ["LOW", "MEDIUM", "HIGH"],
                     "description": "Optional confidence level for the change."
                   },
                   "suggest": {
@@ -977,15 +769,10 @@
           "description": "Labels to remove (e.g., ['smoke', 'needs-triage']). Each entry can be either a label name string or an object with name plus optional rationale/confidence/suggest intent metadata. Non-existent labels are silently skipped."
         },
         "item_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "pattern": "^(\\d+|#?aw_[A-Za-z0-9_]{3,12})$",
           "description": "Issue or PR number to remove labels from. This is the numeric ID from the GitHub URL (e.g., 456 in github.com/owner/repo/issues/456). Can also be a temporary_id from a previously created issue in the same workflow run \u2014 use the '#aw_abc123' form; the bare 'aw_abc123' form is also accepted and normalised to '#aw_abc123'. If omitted, removes labels from the item that triggered this workflow.",
-          "x-synonyms": [
-            "itemNumber"
-          ]
+          "x-synonyms": ["itemNumber"]
         },
         "secrecy": {
           "type": "string",
@@ -996,9 +783,7 @@
           "description": "Trustworthiness level of the message source (e.g., \"low\", \"medium\", \"high\")."
         }
       },
-      "required": [
-        "labels"
-      ],
+      "required": ["labels"],
       "additionalProperties": false
     }
   },
@@ -1021,19 +806,12 @@
             "type": "string"
           },
           "description": "GitHub team slugs to add as team reviewers (e.g., ['platform-team', 'security-reviewers']). Teams must have access to the repository.",
-          "x-synonyms": [
-            "teamReviewers"
-          ]
+          "x-synonyms": ["teamReviewers"]
         },
         "pull_request_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Pull request number to add reviewers to. This is the numeric ID from the GitHub URL (e.g., 876 in github.com/owner/repo/pull/876). If omitted, adds reviewers to the PR that triggered this workflow. Only works for pull_request event triggers. For workflow_dispatch, schedule, or other triggers, pull_request_number is required \u2014 omitting it will silently skip the reviewer assignment.",
-          "x-synonyms": [
-            "pullRequestNumber"
-          ]
+          "x-synonyms": ["pullRequestNumber"]
         },
         "secrecy": {
           "type": "string",
@@ -1052,36 +830,22 @@
     "description": "Assign an issue to a milestone for release planning and progress tracking. Milestones can be specified by number or title. When auto_create is configured, missing milestones are created automatically.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "issue_number"
-      ],
+      "required": ["issue_number"],
       "properties": {
         "issue_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Issue number to assign to the milestone. This is the numeric ID from the GitHub URL (e.g., 567 in github.com/owner/repo/issues/567). Can also be a temporary_id from a previously created issue in the same workflow run \u2014 use the '#aw_abc123' form; the bare 'aw_abc123' form is also accepted and normalised to '#aw_abc123'.",
-          "x-synonyms": [
-            "issueNumber"
-          ]
+          "x-synonyms": ["issueNumber"]
         },
         "milestone_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Milestone number to assign the issue to. This is the numeric ID from the milestone URL (e.g., 12 in github.com/owner/repo/milestone/12). Either milestone_number or milestone_title must be provided.",
-          "x-synonyms": [
-            "milestoneNumber"
-          ]
+          "x-synonyms": ["milestoneNumber"]
         },
         "milestone_title": {
           "type": "string",
           "description": "Milestone title to assign the issue to (e.g., \"v1.0\"). Used as an alternative to milestone_number \u2014 the handler looks up the milestone by title. Either milestone_number or milestone_title must be provided.",
-          "x-synonyms": [
-            "milestoneTitle"
-          ]
+          "x-synonyms": ["milestoneTitle"]
         },
         "secrecy": {
           "type": "string",
@@ -1102,24 +866,14 @@
       "type": "object",
       "properties": {
         "issue_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Issue number to assign the Copilot coding agent to. This is the numeric ID from the GitHub URL (e.g., 234 in github.com/owner/repo/issues/234). Can also be a temporary_id from an issue created earlier in the same workflow run \u2014 use the '#aw_abc123' form (e.g., '#aw_Test123'); the bare 'aw_abc123' form is also accepted and normalised to '#aw_abc123'. The issue should contain clear, actionable requirements. Either issue_number or pull_number must be provided, but not both.",
-          "x-synonyms": [
-            "issueNumber"
-          ]
+          "x-synonyms": ["issueNumber"]
         },
         "pull_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Pull request number to assign the Copilot coding agent to. This is the numeric ID from the GitHub URL (e.g., 456 in github.com/owner/repo/pull/456). Either issue_number or pull_number must be provided, but not both.",
-          "x-synonyms": [
-            "pullNumber"
-          ]
+          "x-synonyms": ["pullNumber"]
         },
         "agent": {
           "type": "string",
@@ -1132,11 +886,7 @@
         },
         "confidence": {
           "type": "string",
-          "enum": [
-            "LOW",
-            "MEDIUM",
-            "HIGH"
-          ],
+          "enum": ["LOW", "MEDIUM", "HIGH"],
           "description": "Optional confidence level for the assignment."
         },
         "suggest": {
@@ -1146,9 +896,7 @@
         "pull_request_repo": {
           "type": "string",
           "description": "Target repository where the pull request should be created, in 'owner/repo' format. If omitted, the PR will be created in the same repository as the issue. This allows issues and code to live in different repositories. The global pull-request-repo configuration (if set) is automatically allowed; additional repositories must be listed in allowed-pull-request-repos.",
-          "x-synonyms": [
-            "pullRequestRepo"
-          ]
+          "x-synonyms": ["pullRequestRepo"]
         },
         "secrecy": {
           "type": "string",
@@ -1167,19 +915,12 @@
     "description": "Assign one or more GitHub users to an issue. Use this to delegate work to specific team members. Users must have access to the repository.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "issue_number"
-      ],
+      "required": ["issue_number"],
       "properties": {
         "issue_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Issue number to assign users to. This is the numeric ID from the GitHub URL (e.g., 543 in github.com/owner/repo/issues/543). If omitted, assigns to the issue that triggered this workflow.",
-          "x-synonyms": [
-            "issueNumber"
-          ]
+          "x-synonyms": ["issueNumber"]
         },
         "assignees": {
           "type": "array",
@@ -1199,11 +940,7 @@
         },
         "confidence": {
           "type": "string",
-          "enum": [
-            "LOW",
-            "MEDIUM",
-            "HIGH"
-          ],
+          "enum": ["LOW", "MEDIUM", "HIGH"],
           "description": "Optional confidence level for the assignment."
         },
         "suggest": {
@@ -1229,14 +966,9 @@
       "type": "object",
       "properties": {
         "issue_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Issue number to unassign users from. This is the numeric ID from the GitHub URL (e.g., 543 in github.com/owner/repo/issues/543). If omitted, uses the issue that triggered this workflow.",
-          "x-synonyms": [
-            "issueNumber"
-          ]
+          "x-synonyms": ["issueNumber"]
         },
         "assignees": {
           "type": "array",
@@ -1273,10 +1005,7 @@
       "properties": {
         "status": {
           "type": "string",
-          "enum": [
-            "open",
-            "closed"
-          ],
+          "enum": ["open", "closed"],
           "description": "New issue status: 'open' to reopen a closed issue, 'closed' to close an open issue."
         },
         "title": {
@@ -1290,12 +1019,7 @@
         },
         "operation": {
           "type": "string",
-          "enum": [
-            "replace",
-            "append",
-            "prepend",
-            "replace-island"
-          ],
+          "enum": ["replace", "append", "prepend", "replace-island"],
           "description": "How to update the issue body: 'append' (default - add to end with separator), 'prepend' (add to start with separator), 'replace' (overwrite entire body), or 'replace-island' (update a run-specific section)."
         },
         "labels": {
@@ -1307,9 +1031,7 @@
               },
               {
                 "type": "object",
-                "required": [
-                  "name"
-                ],
+                "required": ["name"],
                 "properties": {
                   "name": {
                     "type": "string",
@@ -1322,11 +1044,7 @@
                   },
                   "confidence": {
                     "type": "string",
-                    "enum": [
-                      "LOW",
-                      "MEDIUM",
-                      "HIGH"
-                    ],
+                    "enum": ["LOW", "MEDIUM", "HIGH"],
                     "description": "Optional confidence level for the change."
                   },
                   "suggest": {
@@ -1348,21 +1066,13 @@
           "description": "Replace the issue assignees with this list of GitHub usernames (e.g., ['octocat', 'mona'])."
         },
         "milestone": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Milestone number to assign (e.g., 1). Use null to clear."
         },
         "issue_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Issue number to update. This is the numeric ID from the GitHub URL (e.g., 789 in github.com/owner/repo/issues/789). ONLY effective when the workflow is configured with `update-issue: target: '*'` in the frontmatter. When the workflow uses `target: triggering` (the default), this field is ignored and the tool updates the issue that triggered the workflow instead. If you need to update a specific issue in a scheduled or workflow_dispatch workflow, the workflow frontmatter must include `update-issue: target: '*'`.",
-          "x-synonyms": [
-            "issueNumber"
-          ]
+          "x-synonyms": ["issueNumber"]
         },
         "secrecy": {
           "type": "string",
@@ -1393,45 +1103,26 @@
         },
         "operation": {
           "type": "string",
-          "enum": [
-            "replace",
-            "append",
-            "prepend"
-          ],
+          "enum": ["replace", "append", "prepend"],
           "description": "How to update the PR body: 'replace' (default - completely overwrite), 'append' (add to end with separator), or 'prepend' (add to start with separator). Title is always replaced."
         },
         "update_branch": {
           "type": "boolean",
           "description": "When true, update the pull request branch with the latest base branch changes before applying other updates. Defaults to false. Note: only true counts as a meaningful update; passing false is the same as omitting this field.",
-          "x-synonyms": [
-            "updateBranch"
-          ]
+          "x-synonyms": ["updateBranch"]
         },
         "pull_request_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Pull request number to update. This is the numeric ID from the GitHub URL (e.g., 234 in github.com/owner/repo/pull/234). Required when the workflow target is '*' (any PR).",
-          "x-synonyms": [
-            "pullRequestNumber"
-          ]
+          "x-synonyms": ["pullRequestNumber"]
         },
         "pr_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Alias for pull_request_number. Prefer pull_request_number in new calls.",
-          "x-synonyms": [
-            "prNumber"
-          ]
+          "x-synonyms": ["prNumber"]
         },
         "pr": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Alias for pull_request_number. Prefer pull_request_number in new calls."
         },
         "draft": {
@@ -1452,11 +1143,7 @@
     "x-safe-outputs-target-requirements": {
       "*": {
         "primary": "pull_request_number",
-        "anyOf": [
-          "pull_request_number",
-          "pr_number",
-          "pr"
-        ]
+        "anyOf": ["pull_request_number", "pr_number", "pr"]
       }
     }
   },
@@ -1467,40 +1154,25 @@
       "type": "object",
       "properties": {
         "pull_request_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Pull request number to merge. This is the numeric ID from the GitHub URL (e.g., 321 in github.com/owner/repo/pull/321). If omitted, uses the triggering pull request context.",
-          "x-synonyms": [
-            "pullRequestNumber"
-          ]
+          "x-synonyms": ["pullRequestNumber"]
         },
         "merge_method": {
           "type": "string",
-          "enum": [
-            "merge",
-            "squash",
-            "rebase"
-          ],
+          "enum": ["merge", "squash", "rebase"],
           "description": "Merge strategy to use: 'merge', 'squash', or 'rebase'. Defaults to 'merge'.",
-          "x-synonyms": [
-            "mergeMethod"
-          ]
+          "x-synonyms": ["mergeMethod"]
         },
         "commit_title": {
           "type": "string",
           "description": "Optional custom commit title to use for the merge commit/squash commit.",
-          "x-synonyms": [
-            "commitTitle"
-          ]
+          "x-synonyms": ["commitTitle"]
         },
         "commit_message": {
           "type": "string",
           "description": "Optional custom commit message body for the merge.",
-          "x-synonyms": [
-            "commitMessage"
-          ],
+          "x-synonyms": ["commitMessage"],
           "maxLength": 65536
         },
         "repo": {
@@ -1524,16 +1196,12 @@
     "description": "Push committed changes to a pull request's branch. APPEND-ONLY: this tool adds new commits on top of the existing PR branch \u2014 force-push is NOT supported and will be rejected. Use this to add follow-up commits to an existing PR, such as addressing review feedback or fixing issues. This is a write-once declaration for a real intended PR branch update, not a sandbox or probe: do not call it with probe branches, placeholder commit messages, or auth experiments. If you are not ready to push the real update, use noop or report_incomplete instead. Changes must be committed locally before calling this tool. IMPORTANT: always supply the 'branch' argument with the local branch name you committed to. In batch workflows that process multiple PRs, this is required \u2014 if omitted, the branch is inferred from the current git HEAD, which will produce wrong results if the workspace has been checked out to a different branch between commit and tool-call time. IMPORTANT: do NOT use 'git merge' to update the branch against another branch \u2014 merge commits cannot be signed; the action will attempt to squash them into a single linear commit before pushing, but this rewrites history. Use 'git rebase' instead to avoid the rewrite. This tool auto-pins the PR branch HEAD before pushing, so it takes no concurrency-control / compare-and-swap parameter \u2014 do NOT pass expected_head_sha, head_sha, or base_sha; the only accepted fields are message, branch, pull_request_number, and repo.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "message"
-      ],
+      "required": ["message"],
       "properties": {
         "message": {
           "type": "string",
           "description": "Commit message describing the changes. Follow repository commit message conventions (e.g., conventional commits). This field is named message, NOT commit_message.",
-          "x-synonyms": [
-            "commit_message"
-          ],
+          "x-synonyms": ["commit_message"],
           "maxLength": 65536
         },
         "branch": {
@@ -1541,14 +1209,9 @@
           "description": "The local branch name that contains the committed changes to push (e.g., \"feature/my-fix\"). Providing this explicitly prevents race conditions in batch workflows where the working tree may have been checked out to a different PR's branch between commit and tool-call time. When omitted, the branch is inferred from the current git HEAD \u2014 only safe for single-PR workflows."
         },
         "pull_request_number": {
-          "type": [
-            "number",
-            "string"
-          ],
-          "description": "Pull request number to push changes to. This is the numeric ID from the GitHub URL (e.g., 654 in github.com/owner/repo/pull/654). Required when the workflow target is '*' (any PR) \u2014 both pull_request_number and repo must be supplied together for wildcard targets.",
-          "x-synonyms": [
-            "pullRequestNumber"
-          ]
+          "type": ["number", "string"],
+          "description": "Pull request number to push changes to. This is the numeric ID from the GitHub URL (e.g., 654 in github.com/owner/repo/pull/654). Required when the workflow target is '*' (any PR) — both pull_request_number and repo must be supplied together for wildcard targets.",
+          "x-synonyms": ["pullRequestNumber"]
         },
         "repo": {
           "type": "string",
@@ -1568,12 +1231,8 @@
     "x-safe-outputs-target-requirements": {
       "*": {
         "primary": "repo",
-        "anyOf": [
-          "repo"
-        ],
-        "allOf": [
-          "pull_request_number"
-        ]
+        "anyOf": ["repo"],
+        "allOf": ["pull_request_number"]
       }
     }
   },
@@ -1582,9 +1241,7 @@
     "description": "Upload a file as a URL-addressable asset that can be referenced in issues, PRs, or comments. The file is stored on an orphaned git branch and returns a permanent URL. Use this for images, diagrams, or other files that need to be embedded in GitHub content.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "path"
-      ],
+      "required": ["path"],
       "properties": {
         "path": {
           "type": "string",
@@ -1637,9 +1294,7 @@
           "type": "string",
           "pattern": "^#?aw_[A-Za-z0-9_]{3,12}$",
           "description": "Optional temporary identifier for this artifact upload. Canonical form: '#aw_' followed by 3 to 12 alphanumeric or underscore characters (A-Za-z0-9_) \u2014 e.g., '#aw_chart1', '#aw_img_out'. The bare 'aw_chart1' form is also accepted. Declare this ID here if you plan to embed the artifact URL in a subsequent message body using '#aw_ID' \u2014 for example '![chart](#aw_chart1)' in a create_discussion body. The safe-outputs processor replaces '#aw_ID' references with the actual artifact download URL after upload. When skip-archive is true the URL points directly to the file and is suitable for inline images.",
-          "x-synonyms": [
-            "temporaryId"
-          ]
+          "x-synonyms": ["temporaryId"]
         },
         "secrecy": {
           "type": "string",
@@ -1658,11 +1313,7 @@
     "description": "Update a GitHub release description by replacing, appending to, or prepending to the existing content. Use this to add release notes, changelogs, or additional information to an existing release.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "tag",
-        "operation",
-        "body"
-      ],
+      "required": ["tag", "operation", "body"],
       "properties": {
         "tag": {
           "type": "string",
@@ -1670,11 +1321,7 @@
         },
         "operation": {
           "type": "string",
-          "enum": [
-            "replace",
-            "append",
-            "prepend"
-          ],
+          "enum": ["replace", "append", "prepend"],
           "description": "How to update the release body: 'replace' (completely overwrite), 'append' (add to end with separator), or 'prepend' (add to start with separator)."
         },
         "body": {
@@ -1700,9 +1347,7 @@
     "description": "Report that a tool or capability needed to complete the task is not available, or share any information you deem important about missing functionality or limitations. Use this when you cannot accomplish what was requested because the required functionality is missing or access is restricted. When a bash command is blocked by security policy, call this tool with reason set to \"security\".",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "reason"
-      ],
+      "required": ["reason"],
       "properties": {
         "tool": {
           "type": "string",
@@ -1733,9 +1378,7 @@
     "description": "Log a transparency message when no significant actions are needed. Use this to confirm workflow completion and provide visibility when analysis is complete but no changes or outputs are required (e.g., 'No issues found', 'All checks passed'). This ensures the workflow produces human-visible output even when no other actions are taken.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "message"
-      ],
+      "required": ["message"],
       "properties": {
         "message": {
           "type": "string",
@@ -1759,30 +1402,17 @@
     "description": "Link an issue as a sub-issue of a parent issue. Use this to establish parent-child relationships between issues for better organization and tracking of related work items.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "parent_issue_number",
-        "sub_issue_number"
-      ],
+      "required": ["parent_issue_number", "sub_issue_number"],
       "properties": {
         "parent_issue_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "The parent issue number to link the sub-issue to. This is the numeric ID from the GitHub URL (e.g., 100 in github.com/owner/repo/issues/100).",
-          "x-synonyms": [
-            "parentIssueNumber"
-          ]
+          "x-synonyms": ["parentIssueNumber"]
         },
         "sub_issue_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "The issue number to link as a sub-issue of the parent. This is the numeric ID from the GitHub URL (e.g., 101 in github.com/owner/repo/issues/101).",
-          "x-synonyms": [
-            "subIssueNumber"
-          ]
+          "x-synonyms": ["subIssueNumber"]
         },
         "repo": {
           "type": "string",
@@ -1805,27 +1435,16 @@
     "description": "Hide a comment on a GitHub issue, pull request, or discussion. This collapses the comment and marks it as spam, abuse, off-topic, outdated, resolved, or low-quality. Use this for inappropriate, off-topic, or outdated comments. The comment_id must be a GraphQL node ID (string like 'IC_kwDOABCD123456'), not a numeric REST API comment ID. NOTE: By default, this tool requires discussions:write permission. If your GitHub App lacks Discussions permission, set 'discussions: false' in the workflow's safe-outputs.hide-comment configuration to exclude this permission.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "comment_id"
-      ],
+      "required": ["comment_id"],
       "properties": {
         "comment_id": {
           "type": "string",
           "description": "GraphQL node ID of the comment to hide (e.g., 'IC_kwDOABCD123456'). This is the GraphQL node ID, not the numeric comment ID from REST API. Can be obtained from GraphQL queries or comment API responses.",
-          "x-synonyms": [
-            "commentId"
-          ]
+          "x-synonyms": ["commentId"]
         },
         "reason": {
           "type": "string",
-          "enum": [
-            "SPAM",
-            "ABUSE",
-            "OFF_TOPIC",
-            "OUTDATED",
-            "RESOLVED",
-            "LOW_QUALITY"
-          ],
+          "enum": ["SPAM", "ABUSE", "OFF_TOPIC", "OUTDATED", "RESOLVED", "LOW_QUALITY"],
           "description": "Optional reason for hiding the comment. Defaults to SPAM if not provided. Valid values: SPAM (spam content), ABUSE (abusive/harassment content), OFF_TOPIC (not relevant to discussion), OUTDATED (no longer applicable), RESOLVED (issue/question has been resolved), LOW_QUALITY (low-quality content)."
         },
         "secrecy": {
@@ -1845,26 +1464,17 @@
     "description": "Set the type of a GitHub issue. Pass an empty string \"\" to clear the issue type. Issue types must be configured in the repository or organization settings before they can be assigned.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "issue_type"
-      ],
+      "required": ["issue_type"],
       "properties": {
         "issue_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Issue number to set the type for. If omitted, sets the type on the issue that triggered this workflow.",
-          "x-synonyms": [
-            "issueNumber"
-          ]
+          "x-synonyms": ["issueNumber"]
         },
         "issue_type": {
           "type": "string",
           "description": "Issue type name to set (e.g., \"Bug\", \"Feature\", \"Task\"). Use an empty string \"\" to clear the current issue type.",
-          "x-synonyms": [
-            "issueType"
-          ]
+          "x-synonyms": ["issueType"]
         },
         "rationale": {
           "type": "string",
@@ -1873,11 +1483,7 @@
         },
         "confidence": {
           "type": "string",
-          "enum": [
-            "LOW",
-            "MEDIUM",
-            "HIGH"
-          ],
+          "enum": ["LOW", "MEDIUM", "HIGH"],
           "description": "Optional confidence level for the change."
         },
         "suggest": {
@@ -1901,33 +1507,22 @@
     "description": "Set a single GitHub issue custom field by name and value. Use field_name for discovery by field label (for example, \"Priority\"), or provide field_node_id to skip discovery. Supports text, number, date (YYYY-MM-DD), and single-select fields (value must match an option name). Does NOT support builtin issue fields such as \"title\", \"body\", or \"state\" \u2014 use the update_issue tool for those (for open/closed state, use update_issue.status).",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "value"
-      ],
+      "required": ["value"],
       "properties": {
         "issue_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Issue number to set the field on. If omitted, targets the issue that triggered this workflow.",
-          "x-synonyms": [
-            "issueNumber"
-          ]
+          "x-synonyms": ["issueNumber"]
         },
         "field_name": {
           "type": "string",
           "description": "Issue field name to set (e.g., \"Priority\", \"Severity\", \"Customer Impact\").",
-          "x-synonyms": [
-            "fieldName"
-          ]
+          "x-synonyms": ["fieldName"]
         },
         "field_node_id": {
           "type": "string",
           "description": "Optional GraphQL node ID of the issue field. Provide this to skip field-name discovery and set a field directly.",
-          "x-synonyms": [
-            "fieldNodeId"
-          ]
+          "x-synonyms": ["fieldNodeId"]
         },
         "value": {
           "type": "string",
@@ -1940,11 +1535,7 @@
         },
         "confidence": {
           "type": "string",
-          "enum": [
-            "LOW",
-            "MEDIUM",
-            "HIGH"
-          ],
+          "enum": ["LOW", "MEDIUM", "HIGH"],
           "description": "Optional confidence level for the change."
         },
         "suggest": {
@@ -1968,9 +1559,7 @@
     "description": "Manage GitHub Projects: add issues/pull requests/draft issues, update item fields (status, priority, effort, dates), manage custom fields, and create project views. Use this to organize work by adding items to projects, updating field values, creating custom fields up-front, and setting up project views (table, board, roadmap).\n\nThree modes: (1) Add or update project items with custom field values; (2) Create project fields; (3) Create project views. This is the primary tool for ProjectOps automation - add items to projects, set custom fields for tracking, and organize project boards.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "project"
-      ],
+      "required": ["project"],
       "properties": {
         "project": {
           "type": "string",
@@ -1979,72 +1568,48 @@
         },
         "operation": {
           "type": "string",
-          "enum": [
-            "create_fields",
-            "create_view"
-          ],
+          "enum": ["create_fields", "create_view"],
           "description": "Optional operation mode. Use create_fields to create required fields up-front, or create_view to add a project view. When omitted, the tool adds/updates project items."
         },
         "content_type": {
           "type": "string",
-          "enum": [
-            "issue",
-            "pull_request",
-            "draft_issue"
-          ],
+          "enum": ["issue", "pull_request", "draft_issue"],
           "description": "Type of item to add to the project. Use 'issue' or 'pull_request' to add existing repo content, or 'draft_issue' to create a draft item inside the project. Required when operation is not specified.",
-          "x-synonyms": [
-            "contentType"
-          ]
+          "x-synonyms": ["contentType"]
         },
         "content_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Issue or pull request number to add to the project. This is the numeric ID from the GitHub URL (e.g., 123 in github.com/owner/repo/issues/123 for issue #123, or 456 in github.com/owner/repo/pull/456 for PR #456), or a temporary ID from a recent create_issue call \u2014 use '#aw_abc123' (canonical); bare 'aw_abc123' is also accepted. Required when content_type is 'issue' or 'pull_request'.",
-          "x-synonyms": [
-            "contentNumber"
-          ]
+          "x-synonyms": ["contentNumber"]
         },
         "target_repo": {
           "type": "string",
           "pattern": "^[a-zA-Z0-9_.-]+/[a-zA-Z0-9_.-]+$",
           "description": "Repository containing the issue or pull request, in \"owner/repo\" format (e.g., \"github/docs\"). Use this when the issue or PR belongs to a different repository than the one running the workflow. The repository must be permitted by either safe-outputs.update-project.target-repo (including the default host repository) or safe-outputs.update-project.allowed-repos.",
-          "x-synonyms": [
-            "targetRepo"
-          ]
+          "x-synonyms": ["targetRepo"]
         },
         "draft_title": {
           "type": "string",
           "description": "Title for a Projects v2 draft issue. Required when content_type is 'draft_issue'.",
-          "x-synonyms": [
-            "draftTitle"
-          ]
+          "x-synonyms": ["draftTitle"]
         },
         "draft_body": {
           "type": "string",
           "description": "Optional body for a Projects v2 draft issue (markdown). Only used when content_type is 'draft_issue'.",
-          "x-synonyms": [
-            "draftBody"
-          ],
+          "x-synonyms": ["draftBody"],
           "maxLength": 65536
         },
         "draft_issue_id": {
           "type": "string",
           "pattern": "^#?aw_[A-Za-z0-9_]{3,12}$",
           "description": "Temporary ID of an existing draft issue to update \u2014 use '#aw_abc1' (canonical); bare 'aw_abc1' is also accepted. Use this to reference a draft created earlier with a matching temporary_id. When provided, draft_title is not required for updates.",
-          "x-synonyms": [
-            "draftIssueId"
-          ]
+          "x-synonyms": ["draftIssueId"]
         },
         "temporary_id": {
           "type": "string",
           "pattern": "^#?aw_[A-Za-z0-9_]{3,12}$",
           "description": "Unique temporary identifier for this draft issue. Canonical form: '#aw_' followed by 3 to 12 alphanumeric or underscore characters (A-Za-z0-9_) \u2014 e.g., '#aw_abc1', '#aw_pr_fix'. The bare 'aw_abc1' form is also accepted. Provide this when creating a new draft to enable future updates via draft_issue_id.",
-          "x-synonyms": [
-            "temporaryId"
-          ]
+          "x-synonyms": ["temporaryId"]
         },
         "fields": {
           "type": "object",
@@ -2055,10 +1620,7 @@
           "description": "Field definitions to create when operation is create_fields. Required when operation='create_fields'.",
           "items": {
             "type": "object",
-            "required": [
-              "name",
-              "data_type"
-            ],
+            "required": ["name", "data_type"],
             "properties": {
               "name": {
                 "type": "string",
@@ -2066,13 +1628,7 @@
               },
               "data_type": {
                 "type": "string",
-                "enum": [
-                  "TEXT",
-                  "NUMBER",
-                  "DATE",
-                  "SINGLE_SELECT",
-                  "ITERATION"
-                ],
+                "enum": ["TEXT", "NUMBER", "DATE", "SINGLE_SELECT", "ITERATION"],
                 "description": "Field type. Use SINGLE_SELECT with options for enumerated values."
               },
               "options": {
@@ -2085,28 +1641,19 @@
             },
             "additionalProperties": false
           },
-          "x-synonyms": [
-            "fieldDefinitions"
-          ]
+          "x-synonyms": ["fieldDefinitions"]
         },
         "view": {
           "type": "object",
           "description": "View definition to create when operation is create_view. Required when operation='create_view'.",
-          "required": [
-            "name",
-            "layout"
-          ],
+          "required": ["name", "layout"],
           "properties": {
             "name": {
               "type": "string"
             },
             "layout": {
               "type": "string",
-              "enum": [
-                "table",
-                "board",
-                "roadmap"
-              ]
+              "enum": ["table", "board", "roadmap"]
             },
             "filter": {
               "type": "string"
@@ -2124,9 +1671,7 @@
         "create_if_missing": {
           "type": "boolean",
           "description": "Whether to create the project if it doesn't exist. Defaults to false. Requires projects:write permission when true.",
-          "x-synonyms": [
-            "createIfMissing"
-          ]
+          "x-synonyms": ["createIfMissing"]
         },
         "secrecy": {
           "type": "string",
@@ -2150,9 +1695,7 @@
         "data_type": {
           "type": "string",
           "description": "Type or description of the missing data or information (max 128 characters). Be specific about what data is needed.",
-          "x-synonyms": [
-            "dataType"
-          ]
+          "x-synonyms": ["dataType"]
         },
         "reason": {
           "type": "string",
@@ -2183,9 +1726,7 @@
     "description": "Signal that the task could not be completed due to an infrastructure or tool failure (e.g., MCP server crash, missing authentication, inaccessible repository). Use this when required tools or data are unavailable and the task cannot be meaningfully performed. This is distinct from noop (no action needed) \u2014 it indicates an active failure that prevented the task from running. Provide a specific reason and optional details so downstream issue aggregation can preserve complete incomplete-signal context. The workflow framework will treat this as a failure signal even when the agent exits successfully.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "reason"
-      ],
+      "required": ["reason"],
       "properties": {
         "reason": {
           "type": "string",
@@ -2217,30 +1758,21 @@
         },
         "owner_type": {
           "type": "string",
-          "enum": [
-            "org",
-            "user"
-          ],
+          "enum": ["org", "user"],
           "description": "Type of owner: 'org' for organization or 'user' for user account. Default: 'org'.",
-          "x-synonyms": [
-            "ownerType"
-          ]
+          "x-synonyms": ["ownerType"]
         },
         "item_url": {
           "type": "string",
           "pattern": "^(https://github\\\\.com/[^/]+/[^/]+/issues/(\\\\d+|#?aw_[A-Za-z0-9_]{3,12})|#?aw_[A-Za-z0-9_]{3,12})$",
           "description": "Optional GitHub issue URL or temporary ID to add as the first item to the project. Accepts either a full URL (e.g., 'https://github.com/owner/repo/issues/123'), a URL with temporary ID (e.g., 'https://github.com/owner/repo/issues/#aw_abc1'), or a plain temporary ID \u2014 use '#aw_abc1' (canonical); bare 'aw_abc1' is also accepted.",
-          "x-synonyms": [
-            "itemUrl"
-          ]
+          "x-synonyms": ["itemUrl"]
         },
         "temporary_id": {
           "type": "string",
           "pattern": "^#?aw_[A-Za-z0-9_]{3,12}$",
           "description": "Optional temporary identifier for this project. Canonical form: '#aw_' followed by 3 to 12 alphanumeric or underscore characters (A-Za-z0-9_) \u2014 e.g., '#aw_abc1', '#aw_pr_fix'. The bare 'aw_abc1' form is also accepted. If not provided, one will be auto-generated and returned in the response. Use this same '#aw_ID' form in add_project_item to reference this project.",
-          "x-synonyms": [
-            "temporaryId"
-          ]
+          "x-synonyms": ["temporaryId"]
         },
         "secrecy": {
           "type": "string",
@@ -2259,10 +1791,7 @@
     "description": "Post a status update to a GitHub Project to communicate progress and health. Use this to provide stakeholders with regular updates on project status (on-track, at-risk, off-track, complete, inactive), timeline information, and progress summaries. Status updates create a historical record of project progress, enabling tracking over time and informed decision-making.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "project",
-        "body"
-      ],
+      "required": ["project", "body"],
       "properties": {
         "project": {
           "type": "string",
@@ -2271,30 +1800,20 @@
         },
         "status": {
           "type": "string",
-          "enum": [
-            "ON_TRACK",
-            "AT_RISK",
-            "OFF_TRACK",
-            "COMPLETE",
-            "INACTIVE"
-          ],
+          "enum": ["ON_TRACK", "AT_RISK", "OFF_TRACK", "COMPLETE", "INACTIVE"],
           "description": "Status indicator for the project. Defaults to ON_TRACK. Values: ON_TRACK (progressing well), AT_RISK (has issues/blockers), OFF_TRACK (significantly behind), COMPLETE (finished), INACTIVE (paused/cancelled)."
         },
         "start_date": {
           "type": "string",
           "pattern": "^\\\\d{4}-\\\\d{2}-\\\\d{2}$",
           "description": "Optional project start date in YYYY-MM-DD format (e.g., '2026-01-06').",
-          "x-synonyms": [
-            "startDate"
-          ]
+          "x-synonyms": ["startDate"]
         },
         "target_date": {
           "type": "string",
           "pattern": "^\\\\d{4}-\\\\d{2}-\\\\d{2}$",
           "description": "Optional project target/end date in YYYY-MM-DD format (e.g., '2026-12-31').",
-          "x-synonyms": [
-            "targetDate"
-          ]
+          "x-synonyms": ["targetDate"]
         },
         "body": {
           "type": "string",
@@ -2318,36 +1837,23 @@
     "description": "Create an autofix for a code scanning alert. Use this to provide automated fixes for security vulnerabilities detected by code scanning tools. The fix should contain the corrected code that resolves the security issue.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "alert_number",
-        "fix_description",
-        "fix_code"
-      ],
+      "required": ["alert_number", "fix_description", "fix_code"],
       "properties": {
         "alert_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "The security alert number to create an autofix for. This is the numeric ID from the code scanning alert (e.g., 42 in github.com/owner/repo/security/code-scanning/42).",
-          "x-synonyms": [
-            "alertNumber"
-          ]
+          "x-synonyms": ["alertNumber"]
         },
         "fix_description": {
           "type": "string",
           "description": "Clear description of the fix being applied. Explain what security issue is being resolved and how the fix addresses it. Example: 'Sanitize user input to prevent SQL injection by using parameterized queries instead of string concatenation.'",
-          "x-synonyms": [
-            "fixDescription"
-          ],
+          "x-synonyms": ["fixDescription"],
           "maxLength": 65536
         },
         "fix_code": {
           "type": "string",
           "description": "The code changes to apply as the autofix. This should be the corrected code that resolves the security vulnerability. Example for SQL injection fix: 'query = db.prepare(\"SELECT * FROM users WHERE id = ?\").bind(userId)'",
-          "x-synonyms": [
-            "fixCode"
-          ],
+          "x-synonyms": ["fixCode"],
           "maxLength": 65536
         },
         "secrecy": {
@@ -2367,9 +1873,7 @@
     "description": "Mark a draft pull request as ready for review by setting draft=false and adding a comment. Use this when a draft PR has reached a state where it's ready for team review. The comment should explain what was completed and why the PR is now ready.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "reason"
-      ],
+      "required": ["reason"],
       "properties": {
         "reason": {
           "type": "string",
@@ -2377,14 +1881,9 @@
           "description": "Comment explaining why the PR is ready for review (e.g., 'All tests passing and documentation updated', 'Feature implementation complete and ready for feedback')."
         },
         "pull_request_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Pull request number to mark as ready. This is the numeric ID from the GitHub URL (e.g., 432 in github.com/owner/repo/pull/432). If omitted, marks the PR that triggered this workflow (requires a pull_request event trigger).",
-          "x-synonyms": [
-            "pullRequestNumber"
-          ]
+          "x-synonyms": ["pullRequestNumber"]
         },
         "secrecy": {
           "type": "string",
@@ -2408,9 +1907,7 @@
         "memory_id": {
           "type": "string",
           "description": "Memory identifier to validate. Defaults to 'default' if not specified.",
-          "x-synonyms": [
-            "memoryId"
-          ]
+          "x-synonyms": ["memoryId"]
         }
       },
       "additionalProperties": false
@@ -2421,23 +1918,11 @@
     "description": "Create a GitHub Check Run to report agent analysis results on a commit or pull request. Check Runs appear in the PR checks UI and on commits with a pass/fail status. Use this to surface structured analysis results as a first-class GitHub check. The check run name is configured in the workflow frontmatter and is NOT accepted as a parameter \u2014 do not pass name. When `safe-outputs.create-check-run.target` is configured, pull request targeting follows standard PR target rules. With `target: \"*\"`, include `pull_request_number` (or `pr_number`/`pr`/`pull_number`) in each call.",
     "inputSchema": {
       "type": "object",
-      "required": [
-        "conclusion",
-        "title",
-        "summary"
-      ],
+      "required": ["conclusion", "title", "summary"],
       "properties": {
         "conclusion": {
           "type": "string",
-          "enum": [
-            "success",
-            "failure",
-            "neutral",
-            "cancelled",
-            "skipped",
-            "timed_out",
-            "action_required"
-          ],
+          "enum": ["success", "failure", "neutral", "cancelled", "skipped", "timed_out", "action_required"],
           "description": "The final conclusion of the check run. Use \"success\" when the check passes, \"failure\" when issues are found that must be fixed, \"neutral\" for informational results with no required action."
         },
         "title": {
@@ -2455,47 +1940,24 @@
           "maxLength": 65536
         },
         "pull_request_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Pull request number to attach the check run to when the workflow uses `create-check-run: target: \"*\"` (or equivalent explicit PR targeting). This is the numeric ID from the GitHub URL (e.g., 876 in github.com/owner/repo/pull/876).",
-          "x-synonyms": [
-            "pr_number",
-            "pr",
-            "pull_number"
-          ]
+          "x-synonyms": ["pr_number", "pr", "pull_number"]
         },
         "pr_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Alias for pull_request_number. Prefer pull_request_number in new calls.",
-          "x-synonyms": [
-            "prNumber"
-          ]
+          "x-synonyms": ["prNumber"]
         },
         "pr": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Alias for pull_request_number. Prefer pull_request_number in new calls.",
-          "x-synonyms": [
-            "pullRequest",
-            "pull"
-          ]
+          "x-synonyms": ["pullRequest", "pull"]
         },
         "pull_number": {
-          "type": [
-            "number",
-            "string"
-          ],
+          "type": ["number", "string"],
           "description": "Alias for pull_request_number. Prefer pull_request_number in new calls.",
-          "x-synonyms": [
-            "pullNumber"
-          ]
+          "x-synonyms": ["pullNumber"]
         }
       },
       "additionalProperties": false
@@ -2503,12 +1965,7 @@
     "x-safe-outputs-target-requirements": {
       "*": {
         "primary": "pull_request_number",
-        "anyOf": [
-          "pull_request_number",
-          "pr_number",
-          "pr",
-          "pull_number"
-        ]
+        "anyOf": ["pull_request_number", "pr_number", "pr", "pull_number"]
       }
     }
   }