Prioritize repeated-permission-denial context over generic missing-tool warning (#38036)

Author: Copilot

actions/setup/js/handle_agent_failure.cjs

@@ -1110,13 +1110,22 @@ function loadMissingToolMessages(items) {
   }
 }
 
+/**
+ * Determine whether a missing_tool message represents permission denial.
+ * @param {{tool: string|null, denied_commands: Array<string>}} message
+ * @returns {boolean}
+ */
+function isPermissionDeniedMissingTool(message) {
+  return message.tool === "tool/permission" && Array.isArray(message.denied_commands) && message.denied_commands.length > 0;
+}
+
 /**
  * Build missing_tool context string for display in failure issues/comments.
  * @param {Array<any>} [items] - Optional pre-loaded agent output items. When provided, avoids re-reading the output file.
  * @returns {string} Formatted missing tool context
  */
 function buildMissingToolContext(items) {
-  const missingToolMessages = loadMissingToolMessages(items);
+  const missingToolMessages = loadMissingToolMessages(items).filter(message => !isPermissionDeniedMissingTool(message));
 
   if (missingToolMessages.length === 0) {
     return "";
@@ -1142,9 +1151,7 @@ function buildMissingToolContext(items) {
  */
 function buildPermissionDeniedContext(items, workflowId) {
   const missingToolMessages = loadMissingToolMessages(items);
-
-  const isPermissionDeniedItem = m => m.tool === "tool/permission" && Array.isArray(m.denied_commands) && m.denied_commands.length > 0;
-  const permissionItems = missingToolMessages.filter(isPermissionDeniedItem);
+  const permissionItems = missingToolMessages.filter(isPermissionDeniedMissingTool);
 
   if (permissionItems.length === 0) {
     return "";

actions/setup/js/handle_agent_failure.test.cjs

@@ -2225,6 +2225,50 @@ describe("handle_agent_failure", () => {
       expect(result).toContain("tool1");
       expect(result).toContain("tool2");
     });
+
+    it("suppresses generic context for repeated permission denied missing_tool entries", () => {
+      fs.writeFileSync(
+        path.join(tmpDir, "agent_output.json"),
+        JSON.stringify({
+          items: [{ type: "missing_tool", tool: "tool/permission", reason: "permission denied", denied_commands: ["go version 2>&1"] }],
+        })
+      );
+      vi.resetModules();
+      ({ buildMissingToolContext } = require("./handle_agent_failure.cjs"));
+      expect(buildMissingToolContext()).toBe("");
+    });
+
+    it("does not suppress tool/permission entry when denied_commands is empty", () => {
+      fs.writeFileSync(
+        path.join(tmpDir, "agent_output.json"),
+        JSON.stringify({
+          items: [{ type: "missing_tool", tool: "tool/permission", reason: "permission queried", denied_commands: [] }],
+        })
+      );
+      vi.resetModules();
+      ({ buildMissingToolContext } = require("./handle_agent_failure.cjs"));
+      const result = buildMissingToolContext();
+      expect(result).toContain("Missing Tools Reported");
+      expect(result).toContain("tool/permission");
+    });
+
+    it("keeps non-permission missing tools when permission-denied entries are present", () => {
+      fs.writeFileSync(
+        path.join(tmpDir, "agent_output.json"),
+        JSON.stringify({
+          items: [
+            { type: "missing_tool", tool: "tool/permission", reason: "permission denied", denied_commands: ["go version 2>&1"] },
+            { type: "missing_tool", tool: "bash", reason: "bash is not available" },
+          ],
+        })
+      );
+      vi.resetModules();
+      ({ buildMissingToolContext } = require("./handle_agent_failure.cjs"));
+      const result = buildMissingToolContext();
+      expect(result).toContain("Missing Tools Reported");
+      expect(result).toContain("bash");
+      expect(result).not.toContain("tool/permission");
+    });
   });
 
   // ──────────────────────────────────────────────────────