Add sandbox shell-expansion guard detection + safer multi-line body prompt guidance

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Author: Copilot

actions/setup/js/detect_agent_errors.cjs

@@ -34,6 +34,14 @@
  *     Detected from the agent stdio log (text pattern) and the AWF firewall audit
  *     JSONL log (`unknown_model_ai_credits` event type). Both sources are checked
  *     and their results merged.
+ *   - shell_expansion_guard_rejected: The sandbox's shell command-injection guard
+ *     rejected a shell command for containing (or appearing to contain) bash
+ *     expansion patterns (command substitution, indirect expansion, parameter
+ *     transformation, etc.), e.g. "...could enable arbitrary code execution.
+ *     Please rewrite the command without these expansion patterns." This can
+ *     misfire on benign multi-line `printf`/`safeoutputs` CLI invocations; agents
+ *     should switch to the `jq -Rs` file-piping pattern instead of retrying the
+ *     same command verbatim.
  * This replaces the individual bash scripts (detect_inference_access_error.sh,
  * detect_mcp_policy_error.sh) with a single JavaScript step.
  *
@@ -173,6 +181,16 @@ const INVOCATION_CAP_EXCEEDED_PATTERN = buildCombinedPattern(MAX_RUNS_EXCEEDED_P
 // parseMaxCacheMissesExceededFromEventLog().
 const MAX_CACHE_MISSES_EXCEEDED_PATTERN = /(?:\bmax_cache_misses_exceeded\b|\bmaximum\s+consecutive\s+cache\s+misses\s+exceeded\b)/i;
 
+// Pattern: the sandbox's shell command-injection guard rejected a shell command believed to
+// contain dangerous bash expansion patterns (command substitution, indirect expansion, parameter
+// transformation, backtick substitution, etc.). Observed message form:
+//   "...indirect expansion, or nested command substitution) that could enable arbitrary code
+//   execution. Please rewrite the command without these expansion patterns."
+// This guard can misfire on benign multi-line printf/safeoutputs CLI invocations. Retrying the
+// identical command is pointless — it will be rejected again — so this is surfaced as a distinct,
+// actionable diagnostic instead of a generic shell failure.
+const SHELL_EXPANSION_GUARD_REJECTED_PATTERN = /could enable arbitrary code execution\b[^\n]{0,160}\brewrite the command without these expansion patterns\b/i;
+
 /**
  * Determines if the collected output contains the observed Copilot/CAPI quota exhaustion error.
  * @param {string} output - Collected stdout+stderr from the process
@@ -205,6 +223,18 @@ function isMaxCacheMissesExceededError(output) {
   return MAX_CACHE_MISSES_EXCEEDED_PATTERN.test(output);
 }
 
+/**
+ * Determines if the collected output shows the sandbox's shell command-injection guard
+ * rejected a command for containing (or appearing to contain) dangerous bash expansion
+ * patterns. Retrying the same command verbatim will not succeed; the agent should switch
+ * to the `jq -Rs` file-piping pattern for multi-line safeoutputs CLI bodies instead.
+ * @param {string} output - Collected stdout+stderr from the process
+ * @returns {boolean}
+ */
+function isShellExpansionGuardRejectedError(output) {
+  return SHELL_EXPANSION_GUARD_REJECTED_PATTERN.test(output);
+}
+
 /**
  * Normalize model names to a single safe line for GitHub Actions outputs and issue titles.
  * @param {string} value
@@ -227,7 +257,7 @@ function extractMissingModelPricingModelName(logContent) {
 /**
  * Detect known error patterns in a log string and return detection results.
  * @param {string} logContent - Contents of the agent stdio log
- * @returns {{ inferenceAccessError: boolean, mcpPolicyError: boolean, agenticEngineTimeout: boolean, modelNotSupportedError: boolean, http400ResponseError: boolean, capiQuotaExceededError: boolean, invocationCapExceeded: boolean, maxCacheMissesExceeded: boolean, missingModelPricingError: boolean, missingModelPricingModelName: string }}
+ * @returns {{ inferenceAccessError: boolean, mcpPolicyError: boolean, agenticEngineTimeout: boolean, modelNotSupportedError: boolean, http400ResponseError: boolean, capiQuotaExceededError: boolean, invocationCapExceeded: boolean, maxCacheMissesExceeded: boolean, missingModelPricingError: boolean, missingModelPricingModelName: string, shellExpansionGuardRejected: boolean }}
  */
 function detectErrors(logContent) {
   const missingModelPricingModelName = extractMissingModelPricingModelName(logContent);
@@ -242,12 +272,13 @@ function detectErrors(logContent) {
     maxCacheMissesExceeded: isMaxCacheMissesExceededError(logContent),
     missingModelPricingError: missingModelPricingModelName !== "",
     missingModelPricingModelName,
+    shellExpansionGuardRejected: isShellExpansionGuardRejectedError(logContent),
   };
 }
 
 /**
  * Build GitHub Actions output lines from detection results.
- * @param {{ inferenceAccessError: boolean, mcpPolicyError: boolean, agenticEngineTimeout: boolean, modelNotSupportedError: boolean, http400ResponseError: boolean, capiQuotaExceededError: boolean, invocationCapExceeded: boolean, maxCacheMissesExceeded: boolean, missingModelPricingError: boolean, missingModelPricingModelName: string }} results
+ * @param {{ inferenceAccessError: boolean, mcpPolicyError: boolean, agenticEngineTimeout: boolean, modelNotSupportedError: boolean, http400ResponseError: boolean, capiQuotaExceededError: boolean, invocationCapExceeded: boolean, maxCacheMissesExceeded: boolean, missingModelPricingError: boolean, missingModelPricingModelName: string, shellExpansionGuardRejected: boolean }} results
  * @returns {string[]}
  */
 function buildOutputLines(results) {
@@ -263,12 +294,13 @@ function buildOutputLines(results) {
     `max_cache_misses_exceeded=${results.maxCacheMissesExceeded}`,
     `missing_model_pricing_error=${results.missingModelPricingError}`,
     `missing_model_pricing_model_name=${results.missingModelPricingModelName}`,
+    `shell_expansion_guard_rejected=${results.shellExpansionGuardRejected}`,
   ];
 }
 
 /**
  * Write GitHub Actions outputs to $GITHUB_OUTPUT.
- * @param {{ inferenceAccessError: boolean, mcpPolicyError: boolean, agenticEngineTimeout: boolean, modelNotSupportedError: boolean, http400ResponseError: boolean, capiQuotaExceededError: boolean, invocationCapExceeded: boolean, maxCacheMissesExceeded: boolean, missingModelPricingError: boolean, missingModelPricingModelName: string }} results
+ * @param {{ inferenceAccessError: boolean, mcpPolicyError: boolean, agenticEngineTimeout: boolean, modelNotSupportedError: boolean, http400ResponseError: boolean, capiQuotaExceededError: boolean, invocationCapExceeded: boolean, maxCacheMissesExceeded: boolean, missingModelPricingError: boolean, missingModelPricingModelName: string, shellExpansionGuardRejected: boolean }} results
  */
 function writeOutputs(results) {
   const outputFile = process.env.GITHUB_OUTPUT;
@@ -351,6 +383,11 @@ function main() {
   if (results.missingModelPricingError && !auditMissingPricing) {
     process.stderr.write(`[detect-agent-errors] Detected missing model pricing: model "${results.missingModelPricingModelName}" has no AI credits pricing configured\n`);
   }
+  if (results.shellExpansionGuardRejected) {
+    process.stderr.write(
+      "[detect-agent-errors] Detected sandbox shell expansion guard rejection: a shell command was rejected for dangerous bash expansion patterns; use the jq -Rs file-piping pattern for multi-line safeoutputs CLI bodies instead of retrying\n"
+    );
+  }
 
   writeOutputs(results);
 }
@@ -378,5 +415,7 @@ module.exports = {
   INVOCATION_CAP_EXCEEDED_PATTERN,
   MAX_CACHE_MISSES_EXCEEDED_PATTERN,
   MISSING_MODEL_PRICING_PATTERN,
+  SHELL_EXPANSION_GUARD_REJECTED_PATTERN,
+  isShellExpansionGuardRejectedError,
   buildOutputLines,
 };

actions/setup/js/detect_agent_errors.test.cjs

@@ -17,6 +17,8 @@ const {
   INVOCATION_CAP_EXCEEDED_PATTERN,
   MAX_CACHE_MISSES_EXCEEDED_PATTERN,
   MISSING_MODEL_PRICING_PATTERN,
+  SHELL_EXPANSION_GUARD_REJECTED_PATTERN,
+  isShellExpansionGuardRejectedError,
   extractMissingModelPricingModelName,
   buildOutputLines,
 } = require("./detect_agent_errors.cjs");
@@ -326,6 +328,7 @@ describe("detect_agent_errors.cjs", () => {
       expect(result.maxCacheMissesExceeded).toBe(false);
       expect(result.missingModelPricingError).toBe(false);
       expect(result.missingModelPricingModelName).toBe("");
+      expect(result.shellExpansionGuardRejected).toBe(false);
     });
 
     it("detects inference access error only", () => {
@@ -416,6 +419,24 @@ describe("detect_agent_errors.cjs", () => {
       expect(result.invocationCapExceeded).toBe(true);
     });
 
+    it("detects shell expansion guard rejection only (issue github/gh-aw#52254 payload shape)", () => {
+      const log = [
+        "[copilot-harness] attempt 1: shell(safeoutputs create_discussion --title 'MCP toolset unavailable' --body \"...\\n...\")",
+        "Command rejected: shell command contains dangerous patterns (command substitution, indirect expansion, or nested command substitution) that could enable arbitrary code execution. Please rewrite the command without these expansion patterns.",
+        "[copilot-harness] attempt 2: retrying identical command",
+        "Command rejected: shell command contains dangerous patterns (command substitution, indirect expansion, or nested command substitution) that could enable arbitrary code execution. Please rewrite the command without these expansion patterns.",
+        "##[error]The action 'Execute GitHub Copilot CLI' has timed out after 5 minutes.",
+      ].join("\n");
+      const result = detectErrors(log);
+      expect(result.inferenceAccessError).toBe(false);
+      expect(result.mcpPolicyError).toBe(false);
+      expect(result.modelNotSupportedError).toBe(false);
+      expect(result.http400ResponseError).toBe(false);
+      expect(result.capiQuotaExceededError).toBe(false);
+      expect(result.invocationCapExceeded).toBe(false);
+      expect(result.shellExpansionGuardRejected).toBe(true);
+    });
+
     it("detects both capi quota and invocation-cap flags when both signatures are present", () => {
       const result = detectErrors("CAPIError: Too Many Requests\nCAPIError: 429 Maximum LLM invocations exceeded (25/25)");
       expect(result.capiQuotaExceededError).toBe(true);
@@ -621,6 +642,46 @@ commentary" has no AI credits pricing`;
     });
   });
 
+  describe("SHELL_EXPANSION_GUARD_REJECTED_PATTERN / isShellExpansionGuardRejectedError", () => {
+    // Exact payload shape from the issue report (github/gh-aw#52254): the sandbox's shell
+    // command-injection guard rejected a benign multi-line `printf` call to `safeoutputs
+    // create_discussion` for containing bash expansion patterns.
+    const ISSUE_REJECTION_MESSAGE =
+      "Command rejected: shell command contains dangerous patterns (command substitution, " +
+      "indirect expansion, or nested command substitution) that could enable arbitrary code " +
+      "execution. Please rewrite the command without these expansion patterns.";
+
+    it("matches the exact rejection message from the issue report", () => {
+      expect(SHELL_EXPANSION_GUARD_REJECTED_PATTERN.test(ISSUE_REJECTION_MESSAGE)).toBe(true);
+      expect(isShellExpansionGuardRejectedError(ISSUE_REJECTION_MESSAGE)).toBe(true);
+    });
+
+    it("matches when embedded in larger multi-line log output", () => {
+      const log = [
+        "[copilot-harness] attempt 1: invoking shell(safeoutputs create_discussion --title ... --body ...)",
+        ISSUE_REJECTION_MESSAGE,
+        "[copilot-harness] attempt 2: retrying identical command",
+        ISSUE_REJECTION_MESSAGE,
+        "##[error]The action 'Execute GitHub Copilot CLI' has timed out after 5 minutes.",
+      ].join("\n");
+      expect(isShellExpansionGuardRejectedError(log)).toBe(true);
+    });
+
+    it("is case-insensitive", () => {
+      expect(SHELL_EXPANSION_GUARD_REJECTED_PATTERN.test(ISSUE_REJECTION_MESSAGE.toUpperCase())).toBe(true);
+    });
+
+    it("does not match unrelated shell errors", () => {
+      expect(isShellExpansionGuardRejectedError("bash: safeoutputs: command not found")).toBe(false);
+      expect(isShellExpansionGuardRejectedError("permission denied by workflow tool permissions")).toBe(false);
+      expect(isShellExpansionGuardRejectedError("")).toBe(false);
+    });
+
+    it("does not match arbitrary code execution mentions without the rewrite guidance", () => {
+      expect(isShellExpansionGuardRejectedError("This could enable arbitrary code execution if left unchecked.")).toBe(false);
+    });
+  });
+
   describe("WATCHDOG_SIGTERM_PATTERN", () => {
     it("matches a process closed line with SIGTERM and watchdogFired=true", () => {
       const log = "[copilot-harness] attempt 1: process closed exitCode=1 signal=SIGTERM duration=12m 38s hasOutput=true watchdogFired=true";
@@ -799,5 +860,23 @@ commentary" has no AI credits pricing`;
 
       expect(lines).toContain("max_cache_misses_exceeded=false");
     });
+
+    it("emits shell_expansion_guard_rejected=true when detected", () => {
+      const lines = buildOutputLines({
+        inferenceAccessError: false,
+        mcpPolicyError: false,
+        agenticEngineTimeout: false,
+        modelNotSupportedError: false,
+        http400ResponseError: false,
+        capiQuotaExceededError: false,
+        invocationCapExceeded: false,
+        maxCacheMissesExceeded: false,
+        missingModelPricingError: false,
+        missingModelPricingModelName: "",
+        shellExpansionGuardRejected: true,
+      });
+
+      expect(lines).toContain("shell_expansion_guard_rejected=true");
+    });
   });
 });

actions/setup/md/mcp_cli_tools_prompt.md

@@ -13,6 +13,17 @@ printf '{"item_number":42,"body":"### Title\n\nBody."}' | safeoutputs add_commen
 # or write to a file: safeoutputs create_pull_request . < /tmp/payload.json
 ```
 
+**Multi-line or long `body` content:** do NOT build the JSON payload with `printf`/`echo` embedding raw newlines or many escaped characters directly in the command line — the sandbox's shell command-injection guard may reject long or complex quoted arguments (reporting "expansion patterns"/"command substitution" even though none are present) and retrying the identical command will fail again. Instead, write the content to a temp file with a heredoc, then use `jq -Rs` to inject it as the `body` field:
+```bash
+cat <<'EOF' > /tmp/gh-aw/body.md
+### Title
+
+Multi-line body content goes here.
+EOF
+jq -Rs '{title: "My title", body: .}' /tmp/gh-aw/body.md | safeoutputs create_discussion .
+```
+If a shell command is rejected for containing expansion patterns, do not retry the same command — switch to the heredoc + `jq -Rs` pattern above.
+
 To inject an entire local file as the `body` field without re-embedding its content in the model context, use `jq -Rs`:
 ```bash
 jq -Rs --arg discussion_number "$DISCUSSION_NUMBER" \