refactor: reduce complexity of copilot_args in engine.rs

[github-actions]

What was complex

copilot_args in src/engine.rs had a Clippy cognitive complexity of 27/25. The two main contributors were:

1. A large if !use_allow_all_tools block (≈85 lines) containing nested for loops over extensions and MCP servers, a nested match over McpConfig, another for loop for bash command collection, and yet another loop with per-command validation — all at 2–3 levels of nesting.

2. An args validation loop with a nested for over BLOCKED_ARG_PREFIXES, adding an extra nesting level inside an already-nested for arg in ... loop.

What changed

Two private helper functions were extracted:

collect_allowed_tools(front_matter, extensions, edit_enabled) -> Result<Vec<String>>

Moves the entire body of the if !use_allow_all_tools block into a dedicated function. Collects:

• Tool names from compiler extensions (github, safeoutputs, azure-devops, ...)
• Tool names from user-defined MCP servers with a backing container/url
• The write tool when edit is enabled
• shell(<cmd>) tool identifiers for each allowed bash command (with single-quote validation)

The call site in copilot_args becomes a clean ternary:

let allowed_tools: Vec<String> = if use_allow_all_tools {
    Vec::new()
} else {
    collect_allowed_tools(front_matter, extensions, edit_enabled)?
};

validate_user_arg(arg: &str) -> Result<()>

Moves the two-level validation (character allowlist + blocked-prefix scan) for each engine.args entry into its own function, leaving the call site as a single flat line:

for arg in front_matter.engine.args() {
    validate_user_arg(arg)?;
    params.push(arg.to_string());
}

Before / After

Metric	Before	After
Cognitive complexity	27	below 25 (not flagged)
copilot_args lines	~215	~115
Helpers added	0	2 (collect_allowed_tools, validate_user_arg)

Verification

• cargo test — all tests pass ✅
• cargo clippy --all-targets --all-features — no warnings ✅
• cargo clippy ... -W clippy::cognitive_complexity — engine.rs no longer flagged ✅

Behaviour is identical; no public API signatures were changed.

Warning

⚠️ Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• dev.azure.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "dev.azure.com"

See Network Configuration for more information.

Generated by Cyclomatic Complexity Reducer · ● 1.2M · ◷