Harden SDK tool config helpers

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Author: Copilot

pkg/workflow/copilot_engine_sdk_tools.go

@@ -149,13 +149,17 @@ func extractCopilotAllowedTools(args []string) []string {
 }
 
 func buildCopilotSDKToolConfig(workflowData *WorkflowData, toolArgs []string) copilotSDKToolConfig {
+	if workflowData == nil {
+		workflowData = &WorkflowData{}
+	}
+	tools := workflowData.Tools
 	config := copilotSDKToolConfig{
 		Version: copilotSDKToolConfigVersion,
 		Capabilities: copilotSDKToolCapabilities{
 			Bash:      isCopilotBashToolEnabled(workflowData),
-			Edit:      isCopilotEditToolEnabled(workflowData.Tools, workflowData),
-			WebFetch:  isCopilotToolValueEnabled(workflowData.Tools, "web-fetch"),
-			WebSearch: isCopilotToolValueEnabled(workflowData.Tools, "web-search"),
+			Edit:      isCopilotEditToolEnabled(tools, workflowData),
+			WebFetch:  isCopilotToolValueEnabled(tools, "web-fetch"),
+			WebSearch: isCopilotToolValueEnabled(tools, "web-search"),
 			MCP:       hasCopilotSDKMCPTools(workflowData),
 			CLIProxy:  workflowData.ParsedTools != nil && workflowData.ParsedTools.CLIProxy,
 		},

pkg/workflow/copilot_engine_tools.go

@@ -94,7 +94,7 @@ func (e *CopilotEngine) computeCopilotToolArguments(tools map[string]any, safeOu
 		args = append(args, "--allow-tool", "shell")
 	} else if bashConfig, hasBash := tools["bash"]; hasBash && isCopilotToolValueEnabled(tools, "bash") {
 		if bashCommands, ok := bashConfig.([]any); ok {
-			hasRestrictedBashAllowlist = len(bashCommands) > 0 && (workflowData == nil || !workflowData.BashDisabled)
+			hasRestrictedBashAllowlist = len(bashCommands) > 0
 			// Add specific shell commands
 			for _, cmd := range bashCommands {
 				if cmdStr, ok := cmd.(string); ok {