Fix missing safe_inputs_bootstrap.cjs in compiled workflows

[Copilot]

Workflows using safe-inputs failed with "Cannot find module './safe_inputs_bootstrap.cjs'" because the bootstrap module was embedded but never written to disk during compilation.

Changes

• pkg/workflow/js.go: Added GetSafeInputsBootstrapScript() getter function to expose the embedded bootstrap script
• pkg/workflow/mcp_servers.go: Added file writing step for safe_inputs_bootstrap.cjs in correct dependency order (after validation, before mcp_server modules that require it)
• Workflow lock files: Recompiled to include the bootstrap module

The bootstrap file provides shared initialization logic for safe-inputs MCP servers:

const { bootstrapSafeInputsServer, cleanupConfigFile } = require("./safe_inputs_bootstrap.cjs");

Without this file on disk, the require statement failed at runtime despite the source being properly embedded in the Go binary.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/githubnext/gh-aw/actions/jobs/57388214685/logs
  • Triggering command: /usr/bin/curl curl -s -L REDACTED (http block)
• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user --jq .login it/ref/tags/v5 GO111MODULE che/go-build/94/945c5af7514a5e8f81540a3b301a34860fb67b1c5b8f924614c8332c904292d3-d/gh-aw GOINSECURE GOMOD GOMODCACHE che/go-build/94/--jq env /ref/tags/v8 GO111MODULE e/git GOINSECURE GOMOD GOMODCACHE e/git (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go by/9dfc4987083degh GOMOD GOMODCACHE go env it/ref/tags/v5 by/9dfc4987083de1a31200c10835c55e9128523e74282b53dd9a605fbf809b5275 /opt/hostedtoolcache/go/1.25.0/x64/bin/go by/9dfc4987083de/home/REDACTED/work/gh-aw/gh-aw/gh-aw 9a605fbf809b5275mcp-server GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login -node.git -node.git 0fad33fd31ca1ed373138f77b9fde52ba75/log.json GOINSECURE %H %ct %D GOMODCACHE go 1/x6�� -json GO111MODULE (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Fix missing agent bootstrap .cjs is not written.

Reference: https://github.com/githubnext/gh-aw/actions/runs/20014046412/job/57388214685#step:19:1

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

---

Changeset

• Type: patch
• Description: Adds missing agent bootstrap support for safe_inputs_bootstrap.cjs. This change adds a getter exposing the embedded bootstrap script and writes the safe_inputs_bootstrap.cjs file so workflows that require it can load successfully.

🏴‍☠️ Ahoy! This treasure was crafted by Changeset Generator

---

---

Smoke Test Summary (2025-12-08T02:25:04Z)

Status: PASS
Summary: Copilot engine validated - GitHub MCP, file operations, bash, playwright, and cache memory all functional.

🤖 DIAGNOSTIC REPORT GENERATED BY Smoke Copilot No Firewall

[github-actions]

📰🚀🔍👀📡🕵️ https://github.com/githubnext/gh-aw/actions/runs/20014651241

[github-actions]

🔮 The ancient spirits stir... Smoke Codex awakens to divine this pull request...

[github-actions]

📰 BREAKING: Smoke Copilot Playwright is now investigating this pull request. Sources say the story is developing...

[github-actions]

💥 WHOOSH! Smoke Claude springs into action on this pull request! [Panel 1 begins...]

[github-actions]

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

[github-actions]

🤖 SYSTEM_INIT: Smoke Copilot No Firewall ACTIVATED. PROCESSING pull request. ALL SUBSYSTEMS ONLINE.

[github-actions]

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

[github-actions]

Smoke Test - 2025-12-08T02:24:46Z

Last 2 Merged PRs:

• Expose safe-inputs MCP HTTP server via host.docker.internal and add to default firewall domains #5791: Expose safe-inputs MCP HTTP server via host.docker.internal and add to default firewall domains
• Consolidate duplicate MCP server implementations #5787: Consolidate duplicate MCP server implementations

Test Results:

• ✅ GitHub MCP: Retrieved recent PRs
• ✅ File Writing: Created smoke test file
• ✅ Bash Tool: Verified file contents
• ❌ GitHub MCP get_me: Not available with default toolset (expected)
• ✅ Cache Memory: Created and verified cache file
• ✅ Safe Input gh Tool: Accessed successfully

Status: PASS (5/6 tests, 1 expected failure)

📰 BREAKING: Report filed by Smoke Copilot fer issue #5796 🗺️

[github-actions]

Smoke Test Results

✅ Playwright MCP: Navigated to github.com, title contains "GitHub"
✅ Cache Memory: Created /tmp/gh-aw/cache-memory/smoke-test-20014651247.txt successfully
✅ GitHub API: Retrieved issues via GitHub MCP server

Overall Status: PASS

📰 BREAKING: Report filed by Smoke Copilot Playwright fer issue #5796 🗺️

[github-actions]

Smoke Test - Run 20014651243

PRs: #5791 (safe-inputs), #5787 (MCP consolidation)

Results:

• ✅ GitHub MCP
• ✅ File Writing
• ✅ Bash Tool
• ✅ Playwright
• ✅ Cache Memory
• ❌ gh Tool (auth not configured)

Status: PASS (5/6 tests; gh auth expected to fail)

💥 [THE END] — Illustrated by Smoke Claude fer issue #5796 🗺️

[github-actions]

Smoke Test Results (Run 20014651248)

Last 2 Merged PRs:

• [WIP] Create spec-kit execute GitHub Actions workflow #5797: [WIP] Create spec-kit execute GitHub Actions workflow
• [docs] Remove bloat from memory.md reference documentation #5793: [docs] Remove bloat from memory.md reference documentation

Test Results:
✅ GitHub MCP Testing - Retrieved PR data successfully
✅ File Writing - Created /tmp/gh-aw/agent/smoke-test-copilot-20014651248.txt
✅ Bash Tool - Verified file contents successfully
✅ Playwright MCP - Navigated to github.com, title contains "GitHub"
✅ Cache Memory - Created and verified /tmp/gh-aw/cache-memory/smoke-test-20014651248.txt
❌ Safe Input gh Tool - Authentication not configured in bash environment

Overall Status: PASS (5/6 tests passed, gh auth is expected limitation)

🤖 DIAGNOSTIC REPORT GENERATED BY Smoke Copilot No Firewall fer issue #5796 🗺️

[github-actions]

PRs reviewed: [docs] Remove bloat from memory.md reference documentation; Fix agentics-maintenance.yml syntax by updating generator to use bundler
Tests: GitHub MCP PR fetch ✅; Agent file write/read ✅; Cache memory file ✅; Playwright title check ✅; gh issues list --limit 3 ❌ (gh not authenticated/command unavailable)
Overall: FAIL

🔮 The oracle has spoken through Smoke Codex fer issue #5796 🗺️

[github-actions]

Smoke Test Results - Copilot Engine

Test Results:

• ✅ File Writing: Successfully created /tmp/gh-aw/agent/smoke-test-copilot-20014651241.txt
• ✅ Bash Tool: Verified file creation and read content back
• ❌ GitHub MCP: MCP client not available in environment (/opt/mcp-client/bin/mcp-client not found)
• ❌ Serena MCP: MCP client not available in environment
• ❌ Safe Input gh Tool: Tool not accessible via function calling interface

Overall Status: ⚠️ PARTIAL PASS

Note: File operations and bash commands work correctly. MCP server integrations are configured but client tooling is not accessible in this environment. The gh safe-input tool was not available in the function calling interface.

📰🔥📋 https://github.com/githubnext/gh-aw/actions/runs/20014651241 fer issue #5796 🗺️