chore: sync actions from gh-aw@v0.89.16

[github-actions]

Automated sync of actions from gh-aw at v0.89.16.

[Copilot]

🟡 Changes recommended

Resolve the guardrail output, accounting, retry, MCP tracing, and timeout issues before approval.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Automated sync of runtime actions from gh-aw@v0.89.16.

Changes:

• Updates AWF/Copilot versions, compatibility metadata, dependencies, and model pricing.
• Adds native tracing, inline JSON CLI support, and safe-output improvements.
• Refines retries, permissions, diagnostics, and AI Credits accounting.

File summaries

File	Summary
setup/sh/run_awf_with_startup_retries.sh	Records pre-harness execution evidence.
setup/sh/install_copilot_cli.sh	Updates the default Copilot version.
setup/sh/install_awf_binary.sh	Adds compatible curl retry detection.
setup/md/mcp_cli_tools_with_safeoutputs_prompt.md	Documents inline JSON invocation.
setup/md/effective_tokens_rate_limit_error.md	Removes obsolete token guidance.
setup/md/ai_credits_rate_limit_throttle.md	Updates rate-limit messaging.
setup/js/trace_graders.cjs	Adds native tool-event tracing; MCP payload-method matching needs correction.
setup/js/tool_call_details.cjs	Extracts structured tool inputs.
setup/js/safe_outputs_tools.json	Updates safe-output schemas and aliases.
setup/js/safe_outputs_handlers.cjs	Improves artifact path staging.
setup/js/parse_mcp_gateway_log.cjs	Refines rate-limit detection.
setup/js/package.json	Updates JavaScript dependencies.
setup/js/models.json	Adds models and pricing updates.
setup/js/mcp_cli_schema_docs.cjs	Updates generated CLI examples.
setup/js/mcp_cli_bridge.cjs	Supports inline JSON arguments.
setup/js/handle_agent_failure.cjs	Adds CLI diagnostics and accounting updates.
setup/js/error_recovery.cjs	Expands transient retries; retry-after-only 403 responses need coverage.
setup/js/daily_aic_component_coverage.cjs	Updates accounting; missing evidence must not be treated as zero.
setup/js/copilot_sdk_session.cjs	Adds denial timeouts and event fields; large timeout values need clamping.
setup/js/copilot_sdk_permissions.cjs	Improves shell-rule matching.
setup/js/check_daily_aic_workflow_guardrail.cjs	Updates daily AIC outputs; the downstream workflow still expects the old output name.
setup/js/ai_credits_context.cjs	Refines rate-limit signal parsing.
setup/js/add_labels.cjs	Gracefully skips empty label requests.
.github/aw/compat.json	Raises the supported Copilot version.

Review details

Suppressed comments (3)

setup/js/copilot_sdk_session.cjs:301

• getEnvPositiveIntOrDefault accepts any positive safe integer, so values above Node's 2^31-1 ms timer limit reach setTimeout unchanged. Those timers are clamped to an immediate timeout, meaning a large configured guard timeout can force-exit almost immediately instead of waiting. Clamp or reject the override before scheduling it.

    const denialGuardTimeoutMs = getEnvPositiveIntOrDefault("GH_AW_DENIAL_GUARD_TIMEOUT_MS", DENIAL_GUARD_FORCE_EXIT_MS_DEFAULT);

setup/js/daily_aic_component_coverage.cjs:188

• When an agent failure has no accounting and no execution.json, this branch records zero solely because the legacy agent artifact was not inspected. artifactInspected: false also covers an absent, expired, or unavailable artifact, none of which proves that the agent never reached inference; billable usage could be lost by an artifact/transport failure. This should remain fail-closed unless the new execution evidence or a positively inspected pre-harness log proves no inference occurred.

      if (name === "agent" && job.conclusion === "failure" && candidateStates[0].state === "missing" && !fs.existsSync(path.join(directory, name, "execution.json")) && !legacyAgentEvidence?.artifactInspected) {
        logComponentAIC(runId, name, job, 0, "failed_before_accounting", {
          source: candidateStates[0].file,
        });
        continue;

setup/js/trace_graders.cjs:498

• rpc-messages.jsonl entries store the request as payload.method === "tools/call" (the parser in parse_mcp_gateway_log.cjs uses that shape), but this filter only checks e.method and payload.tool_name. A standard JSON-RPC entry therefore has no matching tool_name and is dropped before the mapper can read payload.params.name/arguments, so MCP calls disappear from grader traces. Include the payload method in this filter.

      return e.type === "tool_call" || e.method === "tools/call" || e.event === "tool_call" || typeof e.tool_name === "string" || (payload !== null && typeof payload.tool_name === "string");

• Files reviewed: 24/24 changed files
• Comments generated: 3
• Review effort level: Lite (auto)

Note

Copilot is running an experiment and ran this review at Lite.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.