Set working directory to GITHUB_WORKSPACE for safe-inputs MCP handlers

[Copilot]

Safe-inputs MCP server handlers were spawning processes in their default working directory rather than the repository root, causing path resolution issues for tools expecting to run from the workspace root.

Changes

• Handler updates: Added cwd option to execFile calls in all handler types (shell, Python, Go, JavaScript)
• Fallback pattern: Uses process.env.GITHUB_WORKSPACE || process.cwd() for local compatibility
• Test coverage: Added tests verifying cwd behavior with and without GITHUB_WORKSPACE set

Implementation

execFile(
  scriptPath,
  [],
  {
    env,
    cwd: process.env.GITHUB_WORKSPACE || process.cwd(),
    timeout: timeoutSeconds * 1000,
    maxBuffer: 10 * 1024 * 1024,
  },
  // ...
);

Applied consistently across mcp_handler_shell.cjs, mcp_handler_python.cjs, mcp_handler_go.cjs, and mcp_handler_javascript.cjs.

Original prompt

In the safe-inputs MCP server, when spawning processes, make sure they execute from the GitHub workspace root folder.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.