fix(claude): replace bypassPermissions with acceptEdits and fix missing MCP server tools in --allowed-tools#28047
Open
fix(claude): replace bypassPermissions with acceptEdits and fix missing MCP server tools in --allowed-tools#28047
Conversation
…Edits bypassPermissions silently ignores --allowed-tools, making the tool allowlist ineffective as a security boundary. acceptEdits still supports headless CI execution (auto-approves file edits) while enforcing MCP tool restrictions via --allowed-tools. Recompile all 57 affected lock files." Agent-Logs-Url: https://github.com/github/gh-aw/sessions/f2a224d7-4a44-458e-96eb-62aedb6621d8 Co-authored-by: szabta89 <1330202+szabta89@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix allowed-tools flag ineffectiveness in bypassPermissions mode
fix(claude): replace bypassPermissions with acceptEdits to enforce --allowed-tools
Apr 23, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR closes a security gap in the Claude engine where --permission-mode bypassPermissions causes --allowed-tools to be ignored, making all MCP gateway tools reachable regardless of workflow configuration.
Changes:
- Switch Claude CLI permission mode from
bypassPermissionstoacceptEditsso--allowed-toolsremains enforced. - Update Claude engine test to assert the new permission mode.
- Regenerate workflow lock files to reflect the updated Claude CLI invocation.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/claude_engine.go | Uses --permission-mode acceptEdits to ensure --allowed-tools is honored as the effective tool boundary. |
| pkg/workflow/claude_engine_test.go | Updates test expectation to match acceptEdits. |
| .github/workflows/api-consumption-report.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/approach-validator.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/audit-workflows.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/aw-failure-investigator.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/blog-auditor.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/ci-doctor.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/claude-code-user-docs-review.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/cli-version-checker.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/cloclo.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/commit-changes-analyzer.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/copilot-agent-analysis.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/copilot-session-insights.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-aw-cross-repo-compile-check.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-choice-test.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-code-metrics.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-doc-healer.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-doc-updater.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-function-namer.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-multi-device-docs-tester.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-otel-instrumentation-advisor.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-rendering-scripts-verifier.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-safe-output-optimizer.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-safe-outputs-conformance.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-security-red-team.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-team-evolution-insights.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/daily-token-consumption-report.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/deep-report.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/design-decision-gate.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/developer-docs-consolidator.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/example-workflow-analyzer.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/github-mcp-structural-analysis.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/github-mcp-tools-report.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/go-fan.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/go-logger.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/go-pattern-detector.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/hourly-ci-cleaner.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/instructions-janitor.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/lockfile-stats.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/prompt-clustering-analysis.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/safe-output-health.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/schema-consistency-checker.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/scout.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/semantic-function-refactor.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/sergo.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/smoke-agent-all-merged.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/smoke-agent-all-none.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/smoke-agent-public-approved.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/smoke-agent-public-none.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/smoke-agent-scoped-approved.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/smoke-claude.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/spec-enforcer.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/static-analysis-report.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/step-name-alignment.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/test-create-pr-error-handling.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/typist.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
| .github/workflows/unbloat-docs.lock.yml | Regenerated lock workflow to use --permission-mode acceptEdits. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 59/59 changed files
- Comments generated: 0
Contributor
🧪 Test Quality Sentinel ReportTest Quality Score: 90/100✅ Excellent test quality
Test Classification Details
Test Analysis✅
|
Collaborator
|
@copilot review all comments |
Contributor
Author
Reviewed all comments. The automated reviewer examined all 59 changed files and raised 0 issues. The Test Quality Sentinel approved at 90/100. No action needed. |
Contributor
|
🚀 Smoke OpenCode MISSION COMPLETE! OpenCode delivered. 🔥 |
Contributor
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
Contributor
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
Contributor
|
|
Contributor
|
|
Contributor
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
Contributor
Agent Container Tool Check
Result: 12/12 tools available ✅ Overall Status: PASS
|
Contributor
|
Smoke test
Warning The following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "ab.chatgpt.com"
- "chatgpt.com"See Network Configuration for more information.
|
Contributor
Comment MemoryNight build hums softly, Branches braid in dawn-lit logs, Green checks warm the sky.Note This comment is managed by comment memory. What this comment doesIt stores persistent context for this thread in the Warning The following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "ab.chatgpt.com"
- "chatgpt.com"See Network Configuration for more information.
|
Contributor
|
🤖 Smoke Test #24837492910 — PASS ✅
Overall: PASS | PR author:
|
Contributor
Comment Memory# Smoke Test Agent MemoryCode runs, tests pass, Note This comment is managed by comment memory. What this comment doesIt stores persistent context for this thread in the
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Smoke test review of PR #28047. Lock files appear to be regenerated correctly reflecting the permission mode fix. Verified the changed lines look consistent with the security fix described in the PR body.
📰 BREAKING: Report filed by Smoke Copilot · ● 733.5K
| # shellcheck disable=SC1003 | ||
| sudo -E awf --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" --tty --env-all --exclude-env ANTHROPIC_API_KEY --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --allow-domains '*.githubusercontent.com,*.pythonhosted.org,anaconda.org,anthropic.com,api.anthropic.com,api.github.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,binstar.org,bootstrap.pypa.io,cdn.playwright.dev,codeload.github.com,conda.anaconda.org,conda.binstar.org,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,files.pythonhosted.org,ghcr.io,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,lfs.github.com,objects.githubusercontent.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,pip.pypa.io,playwright.download.prss.microsoft.com,ppa.launchpad.net,pypi.org,pypi.python.org,raw.githubusercontent.com,registry.npmjs.org,repo.anaconda.com,repo.continuum.io,s.symcb.com,s.symcd.com,security.ubuntu.com,sentry.io,statsig.anthropic.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com' --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --allow-host-ports 80,443,8080 --image-tag 0.25.28,squid=sha256:844c18280f82cd1b06345eb2f4e91966b34185bfc51c9f237c3e022e848fb474,agent=sha256:a8834e285807654bf680154faa710d43fe4365a0868142f5c20e48c85e137a7a,api-proxy=sha256:93290f2393752252911bd7c39a047f776c0b53063575e7bde4e304962a9a61cb,cli-proxy=sha256:fdf310e4678ce58d248c466b89399e9680a3003038fd19322c388559016aaac7 --skip-pull --enable-api-proxy \ | ||
| -- /bin/bash -c 'export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && export PATH="$(find /opt/hostedtoolcache -maxdepth 4 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true && claude --print --no-chrome --mcp-config "${{ runner.temp }}/gh-aw/mcp-config/mcp-servers.json" --allowed-tools '\''Bash,BashOutput,Edit,Edit(/tmp/gh-aw/cache-memory/*),ExitPlanMode,Glob,Grep,KillBash,LS,MultiEdit,MultiEdit(/tmp/gh-aw/cache-memory/*),NotebookEdit,NotebookRead,Read,Read(/tmp/gh-aw/cache-memory/*),Task,TodoWrite,Write,Write(/tmp/gh-aw/cache-memory/*),mcp__github__download_workflow_run_artifact,mcp__github__get_code_scanning_alert,mcp__github__get_commit,mcp__github__get_dependabot_alert,mcp__github__get_discussion,mcp__github__get_discussion_comments,mcp__github__get_file_contents,mcp__github__get_job_logs,mcp__github__get_label,mcp__github__get_latest_release,mcp__github__get_me,mcp__github__get_notification_details,mcp__github__get_pull_request,mcp__github__get_pull_request_comments,mcp__github__get_pull_request_diff,mcp__github__get_pull_request_files,mcp__github__get_pull_request_review_comments,mcp__github__get_pull_request_reviews,mcp__github__get_pull_request_status,mcp__github__get_release_by_tag,mcp__github__get_secret_scanning_alert,mcp__github__get_tag,mcp__github__get_workflow_run,mcp__github__get_workflow_run_logs,mcp__github__get_workflow_run_usage,mcp__github__issue_read,mcp__github__list_branches,mcp__github__list_code_scanning_alerts,mcp__github__list_commits,mcp__github__list_dependabot_alerts,mcp__github__list_discussion_categories,mcp__github__list_discussions,mcp__github__list_issue_types,mcp__github__list_issues,mcp__github__list_label,mcp__github__list_notifications,mcp__github__list_pull_requests,mcp__github__list_releases,mcp__github__list_secret_scanning_alerts,mcp__github__list_starred_repositories,mcp__github__list_tags,mcp__github__list_workflow_jobs,mcp__github__list_workflow_run_artifacts,mcp__github__list_workflow_runs,mcp__github__list_workflows,mcp__github__pull_request_read,mcp__github__search_code,mcp__github__search_issues,mcp__github__search_orgs,mcp__github__search_pull_requests,mcp__github__search_repositories,mcp__github__search_users'\'' --debug-file /tmp/gh-aw/agent-stdio.log --verbose --permission-mode bypassPermissions --output-format stream-json "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_CLAUDE:+ --model "$GH_AW_MODEL_AGENT_CLAUDE"}' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log | ||
| -- /bin/bash -c 'export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && export PATH="$(find /opt/hostedtoolcache -maxdepth 4 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true && claude --print --no-chrome --mcp-config "${{ runner.temp }}/gh-aw/mcp-config/mcp-servers.json" --allowed-tools '\''Bash,BashOutput,Edit,Edit(/tmp/gh-aw/cache-memory/*),ExitPlanMode,Glob,Grep,KillBash,LS,MultiEdit,MultiEdit(/tmp/gh-aw/cache-memory/*),NotebookEdit,NotebookRead,Read,Read(/tmp/gh-aw/cache-memory/*),Task,TodoWrite,Write,Write(/tmp/gh-aw/cache-memory/*),mcp__github__download_workflow_run_artifact,mcp__github__get_code_scanning_alert,mcp__github__get_commit,mcp__github__get_dependabot_alert,mcp__github__get_discussion,mcp__github__get_discussion_comments,mcp__github__get_file_contents,mcp__github__get_job_logs,mcp__github__get_label,mcp__github__get_latest_release,mcp__github__get_me,mcp__github__get_notification_details,mcp__github__get_pull_request,mcp__github__get_pull_request_comments,mcp__github__get_pull_request_diff,mcp__github__get_pull_request_files,mcp__github__get_pull_request_review_comments,mcp__github__get_pull_request_reviews,mcp__github__get_pull_request_status,mcp__github__get_release_by_tag,mcp__github__get_secret_scanning_alert,mcp__github__get_tag,mcp__github__get_workflow_run,mcp__github__get_workflow_run_logs,mcp__github__get_workflow_run_usage,mcp__github__issue_read,mcp__github__list_branches,mcp__github__list_code_scanning_alerts,mcp__github__list_commits,mcp__github__list_dependabot_alerts,mcp__github__list_discussion_categories,mcp__github__list_discussions,mcp__github__list_issue_types,mcp__github__list_issues,mcp__github__list_label,mcp__github__list_notifications,mcp__github__list_pull_requests,mcp__github__list_releases,mcp__github__list_secret_scanning_alerts,mcp__github__list_starred_repositories,mcp__github__list_tags,mcp__github__list_workflow_jobs,mcp__github__list_workflow_run_artifacts,mcp__github__list_workflow_runs,mcp__github__list_workflows,mcp__github__pull_request_read,mcp__github__search_code,mcp__github__search_issues,mcp__github__search_orgs,mcp__github__search_pull_requests,mcp__github__search_repositories,mcp__github__search_users'\'' --debug-file /tmp/gh-aw/agent-stdio.log --verbose --permission-mode acceptEdits --output-format stream-json "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_CLAUDE:+ --model "$GH_AW_MODEL_AGENT_CLAUDE"}' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log |
Contributor
There was a problem hiding this comment.
This line includes --permission-mode acceptEdits — the PR's goal is to fix the security issue where bypassPermissions ignores --allowed-tools. Make sure this lock file reflects the updated permission mode from the source workflow.
Contributor
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
Contributor
|
Commit pushed:
|
Collaborator
|
@copilot investigate why no safe outputs were created https://github.com/github/gh-aw/actions/runs/24837492924/job/72701891498 |
Collaborator
|
@copilot investigate why no safe outputs were created. https://github.com/github/gh-aw/actions/runs/24837492924/job/72701891498 |
…tEdits mode With --permission-mode acceptEdits, the --allowed-tools list is actually enforced (unlike bypassPermissions which silently ignored it). Several system/implicit MCP servers were missing from the allowed list: - mcp__safeoutputs: now added when safe-outputs is configured - mcp__mcpscripts: now added when mcp-scripts is configured - mcp__agenticworkflows: handle agentic-workflows bool tool value - Custom MCP without allowed key: default to mcp__<server> wildcard Also adds mcpScripts parameter to computeAllowedClaudeToolsString. Recompile all lock files to reflect the updated --allowed-tools flag. Agent-Logs-Url: https://github.com/github/gh-aw/sessions/9918b946-8c1c-4c40-b480-64c856dc0764 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Root cause: Switching Fix (commit
57 lock files recompiled to reflect the updated Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
fix(claude): replace bypassPermissions with acceptEdits to enforce --allowed-tools
fix(claude): replace bypassPermissions with acceptEdits and fix missing MCP server tools in --allowed-tools
Apr 23, 2026
Collaborator
|
@copilot also make sure that when mount-as-clis is enabled, the proper allowed commands are added |
Contributor
Author
Already investigated and fixed in commit |
Collaborator
|
@copilot when bash: "*" is used, you can use bypassPermissions |
…mount-as-clis CLI allowlist Agent-Logs-Url: https://github.com/github/gh-aw/sessions/5926ddff-01b7-47e2-a8d5-25d9e494cf63 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
When
Done in commit Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
--permission-mode bypassPermissionssilently ignores--allowed-tools, meaning every tool the MCP gateway exposes is reachable regardless of the workflow's declared tool configuration. This nullifies the primary tool-restriction security control for the Claude engine.Switching to
acceptEditsproperly enforces--allowed-tools, but exposed a secondary issue: several system and implicit MCP servers were never added to the allowlist, so their tools were silently blocked underacceptEdits.Changes
pkg/workflow/claude_engine.go: Conditionally select--permission-modebased on bash access:acceptEdits(default) — properly enforces--allowed-toolsas the MCP tool security boundary, supports headless CI execution via auto-approval of file edits.bypassPermissions— used when the workflow grants unrestricted bash access (bash: "*"). With full bash access the agent can reach any tool via the shell regardless, so--allowed-toolsprovides no meaningful security boundary andbypassPermissionsproduces a smoother headless experience. The threat detection step always usesbash: ["*"]by design and also getsbypassPermissions.pkg/workflow/claude_tools.go: AddhasBashWildcardInToolshelper that detects unrestricted bash (bash: "*",bash: ":*", or non-list bash value). FixcomputeAllowedClaudeToolsStringto include all system/implicit MCP servers in--allowed-tools:mcp__safeoutputs— added whensafe-outputsis configured (was the direct cause of no safe outputs being created)mcp__mcpscripts— added when mcp-scripts is configured (addsmcpScripts *MCPScriptsConfigparameter)mcp__agenticworkflows— theagentic-workflowstool has a bool value, not a map, so it was silently dropped by the type assertion; now handled explicitlyallowed:key (e.g.serena) — previously produced nomcp__*entry; now default to amcp__<serverName>wildcardpkg/workflow/claude_engine_test.go: AddTestClaudeEnginePermissionModetable tests assertingbypassPermissionsforbash: "*"andacceptEditsfor restricted/absent bash. EnhanceTestClaudeEngineAllowsMountedMCPCLICommandsInRestrictedBashto assertacceptEditsis used (notbypassPermissions) when bash is restricted andmount-as-clisis enabled.pkg/workflow/claude_engine_tools_test.go: AddTestHasBashWildcardInToolsunit tests and update assertions to reflect the new tools added to the allowlist.--permission-modeand--allowed-toolsflags. Workflows withbash: "*"now emitbypassPermissions; all others emitacceptEdits.