[aw] Systemic Tool Denial Cluster — 3+ Workflows Affected (Jun 9)

[github-actions]

Multiple agentic workflows are hitting the guard.tool_denials_exceeded guardrail systematically on Jun 9. This appears to be a cluster of related failures where workflows use disallowed shell/Python patterns.

Affected Workflows

Workflow	Issue	Denial Count	Blocked Command
Daily Compiler Quality Check	#38021	5/5	shell(python3 -c "import re; open(...)")
Copilot CLI Deep Research Agent	#38035	5/5	(analysis shell commands)
jsweep - JavaScript Unbloater	#38032	2/2	shell(rm -rf /tmp/x)

Pattern Analysis

Root causes (per workflow type):

1. Compiler Quality + Deep Research: Agents using inline shell(python3 -c ...) one-liners to read/parse source files. These are blocked by the tool allowlist. Fix: Update workflows to use view, grep, glob tools directly instead of Python file-reading via shell.

2. jsweep: Agent attempting shell(rm -rf /tmp/x) — the security guardrail correctly blocks this pattern. Fix: Update jsweep to use safer cleanup patterns (e.g., rm /tmp/x without -rf, or targeted file deletion).

Impact

• Compiler quality checks: 4 consecutive days non-functional (Jun 6–9)
• Deep Research and jsweep: newly failing Jun 9
• Risk: tool denial pattern may be spreading to other workflows as agents learn/copy patterns

Recommended Actions

1. Daily Compiler Quality Check (P1, [aw] Daily Compiler Quality Check failed #38021): Update workflow to use native file-reading tools instead of Python one-liners
2. jsweep ([aw] jsweep - JavaScript Unbloater failed #38032): Replace rm -rf /tmp/x with safer file cleanup
3. Copilot CLI Deep Research ([aw] Copilot CLI Deep Research Agent failed #38035): Audit shell commands; replace with structured tool calls
4. Preventive: Review all workflows using shell() for inline scripting patterns; add lint check for shell(python3 -c patterns in workflow prompts

References

• Run §27186641830 (Health Manager, Jun 9)
• Run §27182217983 (Compiler Quality)
• Run §27184884999 (Deep Research)
• Run §27184823684 (jsweep)

Generated by 🏥 Workflow Health Manager - Meta-Orchestrator · 349.8 AIC · ⌖ 34.6 AIC · ⊞ 23.3K · ◷

• expires on Jun 9, 2026, 9:59 PM UTC-08:00