Fix Copilot SDK headless auth/driver path and tool-permission denials in daily workflows (#37322)

Author: Copilot

.github/workflows/daily-syntax-error-quality.lock.yml

@@ -16,13 +16,7 @@ engine:
   copilot-sdk: true
 tools:
   cli-proxy: true
-  bash:
-    - "gh aw compile *"
-    - "gh aw compile /tmp/gh-aw/agent/syntax-error-tests/*.md"
-    - "head -n 30 /tmp/gh-aw/agent/candidates/"
-    - "cp /tmp/gh-aw/agent/candidates/"
-    - "cat /tmp/gh-aw/agent/syntax-error-tests/*.md"
-    - "mkdir -p /tmp/gh-aw/agent/syntax-error-tests"
+  bash: true
 safe-outputs:
   create-issue:
     expires: 3d

.github/workflows/daily-syntax-error-quality.md

@@ -18,7 +18,6 @@ tracker-id: daily-workflow-updater
 engine:
   id: copilot
   copilot-sdk: true
-  copilot-sdk-driver: .github/drivers/copilot_sdk_driver_sample_ruby.rb
 strict: true
 
 network:

.github/workflows/daily-workflow-updater.lock.yml

@@ -203,7 +203,7 @@ function buildCopilotSDKPermissionHandler(permissionConfig, approveAll, logOptio
       case "write":
         return allowedToolEntries.has("write");
       case "read":
-        return allowedToolEntries.has("read");
+        return allowedToolEntries.has("read") || allowedToolEntries.has("shell");
       case "url":
         return allowedToolEntries.has("web_fetch");
       case "mcp":

.github/workflows/daily-workflow-updater.md

@@ -265,6 +265,41 @@ describe("copilot_sdk_driver.cjs", () => {
       expect(onPermissionRequest({ kind: "read", fileName: "a.txt" })).toEqual({ kind: "approve-once" });
     });
 
+    it("allows read requests when shell access is allowlisted", async () => {
+      const disconnect = vi.fn().mockResolvedValue(undefined);
+      const stop = vi.fn().mockResolvedValue(undefined);
+      const createSession = vi.fn().mockResolvedValue({
+        sessionId: "session-read-via-shell",
+        on: () => {},
+        sendAndWait: vi.fn().mockResolvedValue({ data: { content: "ok" } }),
+        disconnect,
+      });
+      class FakeCopilotClient {
+        start = vi.fn().mockResolvedValue(undefined);
+        createSession = createSession;
+        stop = stop;
+      }
+
+      const result = await runWithCopilotSDK({
+        sdkUri: "http://127.0.0.1:3002",
+        prompt: "test prompt",
+        logger: () => {},
+        permissionConfig: {
+          allowedTools: ["shell"],
+        },
+        sdkModule: {
+          CopilotClient: FakeCopilotClient,
+          RuntimeConnection: { forUri: vi.fn(() => ({})) },
+          approveAll: () => ({ kind: "approve-once" }),
+        },
+      });
+
+      expect(result.exitCode).toBe(0);
+      const sessionConfig = createSession.mock.calls[0][0];
+      const onPermissionRequest = sessionConfig.onPermissionRequest;
+      expect(onPermissionRequest({ kind: "read", fileName: "a.txt" })).toEqual({ kind: "approve-once" });
+    });
+
     it("logs permission-denied SDK requests as core warnings", async () => {
       const disconnect = vi.fn().mockResolvedValue(undefined);
       const stop = vi.fn().mockResolvedValue(undefined);