Use literal printf pipelines for SDK-compatible Rig launches

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: 2 people

.github/workflows/rig-skill-integration.lock.yml

@@ -22,7 +22,7 @@ timeout-minutes: 10
 env:
   RIG_DEBUG: "agent:failure,workflow:event"
 tools:
-  bash: ["node"]
+  bash: ["printf", "node"]
   edit: false
 safe-outputs:
   noop:
@@ -50,29 +50,29 @@ post-steps:
 # Rig skill integration
 
 Execute this prevalidated fixture, not a setup or environment-diagnosis task.
-Bash execution is enabled for `node`. Your only Bash invocation must be the
-standalone Node launch below; a denial of another command does not mean Bash
+Bash execution is enabled for `printf` and `node`. Your only Bash invocation must
+be the launch pipeline below; a denial of another command does not mean Bash
 or Node is unavailable.
 
 1. Load the installed `rig` skill. Read `.github/skills/rig/SKILL.md` and
    `.github/skills/rig/runtime.md` with file-reading tools, not Bash commands.
-2. Choose a fresh 7-character pseudo-random alphanumeric delimiter yourself
-   while composing the command, without a tool call. Verify it is not a complete
-   line of the fence contents; regenerate on collision. Do not use Python,
-   Node, `/dev/urandom`, `base64`, `tr`, or a shell pipeline to generate it.
-3. Run the following `rig` fence **once**, unchanged, by substituting its contents
-   into the command below. Replace both `<delimiter>` placeholders with the
-   same literal seven characters. Single-quote the opening delimiter and put
-   the unquoted closing delimiter alone on an unindented line.
+2. Copy the following `rig` fence **unchanged** into one single-quoted `printf`
+   argument per source line, including `''` for blank lines. Escape each literal
+   apostrophe as `'"'"'`. Use the fixed format `'%s\n'`, not the source as a format
+   string; preserve percent signs, backslashes, dollar signs, and backticks.
+   Do not double-quote source, encode it, use shell variables or substitutions,
+   or generate delimiters. Do not use a heredoc with the Copilot SDK driver.
+3. Run the fence **once** using this pipeline. Replace the placeholder argument
+   with all source-line arguments, without markdown fence markers:
 
 ```bash
-node .github/skills/rig/run.ts <<'<delimiter>' > /tmp/gh-aw/agent/rig-skill-integration.json
-<contents of the rig fence below, without the markdown fence markers>
-<delimiter>
+printf '%s\n' \
+  '<one single-quoted argument per source line of the rig fence>' \
+  | node .github/skills/rig/run.ts > /tmp/gh-aw/agent/rig-skill-integration.json
 ```
 
-The command must begin with `node`. Do not prepend `mkdir`, `cd`, `env`, `export`,
-or any command joined by `&&`; do not use a fixed delimiter or a shell variable.
+The command must begin with `printf`. Do not prepend `mkdir`, `cd`, `env`, `export`,
+or any command joined by `&&`.
 The working directory is already the repository root, `/tmp/gh-aw/agent`
 already exists, and Node.js and SDK dependencies are already provisioned.
 Do not run version checks, dependency checks, package installation, linting,
@@ -127,7 +127,7 @@ and call `noop` with a brief summary of the three judgments and majority verdict
 Do not invoke Bash again to read or validate the result: the post-step owns
 validation. Success requires no repository write. If the launcher,
 SDK, schema validation, or expected verdict fails, report the exact error with
-`report_incomplete` and stop. Never call `noop` on failure. A rejected standalone Node heredoc
-is a permission-parser failure, not evidence that Node or the SDK is missing.
+`report_incomplete` and stop. Never call `noop` on failure. A rejected launch pipeline
+is a permission failure, not evidence that Node or the SDK is missing.
 Do not fabricate results, modify the fixture, or retry model calls. The
 post-step fails the workflow when the result file is missing or invalid.

.github/workflows/rig-skill-integration.md

@@ -3,7 +3,7 @@ runtimes:
   node:
     version: "24"
 tools:
-  bash: ["node"]
+  bash: ["printf", "node"]
 network:
   allowed: [defaults, github, node]
 ---
@@ -20,10 +20,11 @@ Load the installed `rig` skill and read its Running and engines reference before
 creating or running Rig programs.
 Run Rig programs with Node.js 24 or later using the installed skill's `run.ts`
 launcher and host-provisioned dependencies. Do not install packages from the
-agent prompt; report missing dependencies and stop. Use heredocs and redirections
-for inline programs and output files, following the skill's fresh-delimiter rules.
-Choose the 7-character delimiter yourself without a tool call. Start the launch
-command with `node`; do not prepend `mkdir`, `cd`, `env`, or any `&&` preparation.
+agent prompt; report missing dependencies and stop. Pipe literal source using
+`printf '%s\n' ... | node <skill-dir>/run.ts`, with one single-quoted argument
+per line and each literal apostrophe escaped as `'"'"'`. Do not use heredocs
+with the Copilot SDK driver. Start the pipeline with `printf`; do not prepend
+`mkdir`, `cd`, `env`, or any `&&` preparation.
 Use existing output directories; `/tmp/gh-aw/agent` is already provisioned.
 Read only named environment variables needed by the program; do not dump the
 environment or print credentials.

.github/workflows/shared/rig.md

@@ -56,15 +56,17 @@ engine:
 skills:
   - githubnext/rig/skills/rig/SKILL.md@<full-commit-sha>
 tools:
-  bash: ["node"]
+  bash: ["printf", "node"]
 ```
 
 The [shared Rig template](.github/workflows/shared/rig.md) provisions Node.js 24
-and allows `node`. In this repository, import
+and allows `printf` and `node`. In this repository, import
 `shared/rig.md` instead. Without the template, configure these prerequisites
 explicitly; see the [runtime reference](skills/rig/runtime.md#github-agentic-workflows).
 Grant `copilot-requests: write` and provision the skill's dependencies in the host.
-Use heredocs or redirections rather than `cat`/`echo` pipelines. Grant additional
+For Copilot SDK workflows, use `printf '%s\n' ... | node` rather than heredocs,
+which gh-aw v0.91.1's SDK permission parser rejects. Single-quote each source
+line and escape literal apostrophes as `'"'"'`. Grant additional
 commands only for the program's own tool calls. This is a smaller tool
 allowlist, not a security boundary: Node can still start subprocesses.
 
@@ -122,19 +124,18 @@ Its [integration guide](skills/rig/runtime.md#choosing-an-integration)
 compares engine capabilities, model selection, tool ownership, and output
 enforcement.
 
-For every heredoc below, replace `<delimiter>` with a fresh 7-character
-pseudo-random alphanumeric string; no tool call is needed to generate it.
-Check it is not an entire line of the contents, single-quote the opener, and
-repeat the exact unquoted delimiter alone on the closing line. See the
-[inline-program guide](skills/rig/runtime.md#inline-programs) for the
-delimiter rules; do not reuse fixed delimiters or shell variables.
+Use the fixed `printf '%s\n'` format with one single-quoted argument per source
+line. Escape literal apostrophes as `'"'"'`; do not use source as the format
+string or double-quote it. See the
+[inline-program guide](skills/rig/runtime.md#inline-programs) for quoting rules
+and heredoc alternatives outside the Copilot SDK workflow driver.
 
 **Design on the fly** — just describe what you want as a string and let the model figure out the rest:
 
 ```bash
-node skills/rig/run.ts <<'<delimiter>'
-export default "Run npm test, diagnose any failures, apply the smallest safe fix, and repeat up to 3 times.";
-<delimiter>
+printf '%s\n' \
+  'export default "Run npm test, diagnose any failures, apply the smallest safe fix, and repeat up to 3 times.";' \
+  | node skills/rig/run.ts
 ```
 
 Or ask Copilot (with the skill) to generate a full program for you. Describe your goal in natural language and Copilot returns a runnable `rig` markdown fence like this:
@@ -166,20 +167,18 @@ export default ralfLoop;
 ```
 ````
 
-Pass the fence contents directly to the launcher with a heredoc:
+Pass the fence contents directly to the launcher with a literal pipeline:
 
 ```bash
-node skills/rig/run.ts <<'<delimiter>'
-// Paste the rig fence contents here.
-<delimiter>
+printf '%s\n' \
+  '<one single-quoted argument per source line of the rig fence>' \
+  | node skills/rig/run.ts
 ```
 
 Or run a program file:
 
 ```bash
-node skills/rig/run.ts src/program.ts <<'<delimiter>'
-Review this diff
-<delimiter>
+printf '%s\n' 'Review this diff' | node skills/rig/run.ts src/program.ts
 ```
 
 Use `--typecheck` to validate a program without running it:

README.md

@@ -99,23 +99,19 @@ node skills/rig/run.ts --typecheck < program.ts
 ```
 
 For an installed skill, replace `skills/rig` with its installed directory. Use
-`run.ts` to launch without installing packages; inline programs use
-`node <skill-dir>/run.ts <<'<delimiter>'`. For each heredoc, generate a fresh
-7-character pseudo-random alphanumeric delimiter without a tool call.
-Choose the seven characters yourself in the response; do not execute Python,
-Node, `/dev/urandom`, or a shell pipeline to generate them.
-Ensure it is not a complete line in the contents; regenerate on collision.
-Single-quote the opening delimiter and repeat the same literal, unquoted
-delimiter alone on the closing line. Never use a fixed delimiter or shell
-variable; see [Running and engines](./runtime.md).
+`run.ts` to launch without installing packages. For Copilot SDK workflows, pipe
+literal source with `printf '%s\n' '<source line>' ... | node <skill-dir>/run.ts`.
+Use one single-quoted argument per source line, escaping each literal apostrophe
+as `'"'"'`. Keep `%s\n` as the fixed format; never use source as a format string,
+double-quote source, or expand shell variables. Do not use heredocs with the
+SDK driver; see [Running and engines](./runtime.md) for quoting and alternatives.
 Install the skill with `gh skill install githubnext/rig rig`.
 Assume SDKs are already installed in the agent container; do not install them.
-Only `node` needs a Bash tool grant for launching an installed skill; grant
-additional commands only when the program itself needs them.
-The launch command must begin with `node`: no `mkdir`, `cd`, `env`, package
-manager, or other preparatory command, and no `&&` prefix. Use existing output
-directories and inherit the SDK environment. A denial of another command does
-not disable Bash or `node`; report the denied command accurately.
+Import the shared Rig workflow template or explicitly allow `printf` and `node`
+with `bash: ["printf", "node"]`. Grant other commands only when the program needs
+them. The launch pipeline must begin with `printf`: no `mkdir`, `cd`, `env`,
+package manager, or other preparation, and no `&&` prefix. Use existing output
+directories and inherit the SDK environment. Report denied commands accurately.
 
 ## Final check
 

skills/rig/SKILL.md

@@ -4,7 +4,26 @@ Read this reference when launching or typechecking programs, handling stdin, or
 
 ## Inline programs
 
-Treat a fenced `rig` block as a runnable program. Pass its contents to the launcher with a heredoc:
+Treat a fenced `rig` block as a runnable program. For Copilot SDK workflows,
+pass its contents to the launcher through a literal `printf` pipeline:
+
+```bash
+printf '%s\n' \
+  '// Agent role: summarize this repository in one sentence.' \
+  'export default "Summarize this repository in one sentence.";' \
+  | node skills/rig/run.ts
+```
+
+Use one single-quoted argument per source line, including `''` for empty lines.
+Escape each literal apostrophe as `'"'"'`; for example, the source line
+`const label = "don't";` becomes `'const label = "don'"'"'t";'`.
+Always use the fixed format `'%s\n'`, never the source as a format string.
+This preserves percent signs, backslashes, dollar signs, and backticks literally.
+Do not double-quote source, expand variables, encode it, or execute substitutions.
+Each argument emits its original line followed by a newline. Copy the whole
+fence without markdown markers; do not rewrite the TypeScript.
+
+Heredocs remain an alternative outside the Copilot SDK workflow driver:
 
 Before constructing each heredoc command, generate a fresh 7-character
 pseudo-random alphanumeric string to use as the delimiter. Choose the seven
@@ -53,11 +72,11 @@ container. Do not attempt to install them from the driver or agent prompt.
 Missing dependencies stop the run with a nonzero exit and an error on stderr.
 `rig.ts` remains the direct runtime entry point. Node.js 24 or later is required.
 
-For agentic workflows, the launch Bash allowlist is just
-`bash: ["node"]`. Heredocs and input/output redirections avoid `cat`, `echo`,
-and separate file-creation commands. Neither launch nor typechecking invokes
+For inline agentic workflows, explicitly grant both stages with
+`bash: ["printf", "node"]`, or import the shared Rig template below. This avoids
+`cat`, `echo`, and separate file-creation commands. Neither launch nor typechecking invokes
 npm or npx, and neither downloads dependencies.
-Start the launch command directly with `node`; do not prepend `mkdir`, `cd`,
+Start the inline launch pipeline with `printf`; do not prepend `mkdir`, `cd`,
 `env`, dependency checks, or any other command with `&&`. Read the installed
 skill and its reference with file-reading tools, not shell bootstrap commands.
 For a provided, unchanged, prevalidated fixture, skip lint and typecheck
@@ -69,17 +88,15 @@ Redirect output only into an existing directory. In GitHub Agentic Workflows,
 required directory is missing, report that prerequisite instead of adding a
 disallowed preparation command. Inherit SDK environment variables without
 `env` or `export` commands. If an unrelated command is denied before the launcher
-runs, remove that command and use the permitted standalone Node launch; do not
+runs, remove that command and use the permitted `printf` plus `node` pipeline; do not
 claim that Bash is unavailable. If the launcher itself fails, report its exact
 error and respect the workflow's retry policy.
 
 GitHub Agentic Workflows v0.91.1's Copilot SDK permission parser treats heredoc
-body lines as shell commands. It can therefore reject a valid standalone
-`node` launch despite `bash: ["node"]`. If this happens, report the exact denial
-as a workflow permission-parser limitation, not a missing Node runtime or SDK.
-Do not broaden the shell allowlist or encode the program to evade enforcement.
-The workflow host needs a heredoc-aware permission parser before this inline
-launch pattern can run in that SDK driver.
+body lines as shell commands. Use the explicitly permitted `printf` plus `node`
+pipeline instead, not a heredoc or a blanket shell grant. If either stage is
+denied, report the exact command and required grant, not a missing Node runtime
+or SDK. Respect the workflow's retry policy.
 
 This reduces tool configuration, not sandbox permissions: allowing arbitrary
 Node code still permits filesystem and subprocess operations. Add commands
@@ -90,9 +107,7 @@ required by the program's own tool calls separately.
 Export the root and pass stdin plus the file path:
 
 ```bash
-node skills/rig/run.ts src/program.ts <<'<delimiter>'
-Review this diff
-<delimiter>
+printf '%s\n' 'Review this diff' | node skills/rig/run.ts src/program.ts
 ```
 
 Stdin coercion follows the root schema:
@@ -146,7 +161,7 @@ engine:
 skills:
   - githubnext/rig/skills/rig/SKILL.md@<full-commit-sha>
 tools:
-  bash: ["node"]
+  bash: ["printf", "node"]
 ```
 
 Import `configureAgent` and `copilotEngine` in the fenced program and call `configureAgent(copilotEngine())` before defining agents. Launch with the installed skill's `run.ts` and host-provisioned dependencies. Grant `copilot-requests: write`, and enable only the additional tools and network access the program uses.
@@ -159,7 +174,7 @@ runtimes:
   node:
     version: "24"
 tools:
-  bash: ["node"]
+  bash: ["printf", "node"]
 network:
   allowed: [defaults, github, node]
 ```