fix(safe-outputs): re-derive patch/bundle paths and stop double-writing infrastructure fields

[dsyme]

fix(safe-outputs): re-derive patch/bundle paths and stop double-writing infrastructure fields

Summary

This PR delivers two orthogonal but related sets of changes:

1. Security / correctness fix in safe-outputs — patch_path and bundle_path are no longer written onto safe-output entries by the MCP server. Instead, they are re-derived on the privileged host side from the validated branch (and optional repo) fields. A new resolve_transport_paths.cjs module encapsulates the derivation logic. The now-obsolete "infrastructure field stripping" block in the type validator is removed because agents can no longer inject arbitrary file paths via those fields.

2. Terminology rename — Every reference to max-effective-tokens / GH_AW_DEFAULT_MAX_EFFECTIVE_TOKENS / Effective Tokens (ET) across docs, specs, workflow frontmatter, golden files, error templates, and compiled Go code is replaced with max-ai-credits / GH_AW_DEFAULT_MAX_AI_CREDITS / AI Credits (AIC). The old backward-compatibility note is also removed since the deprecation period is over.

---

Changes by area

actions/setup/js/ — safe-outputs host-side infrastructure (root fix)

File	Change
safe_outputs_handlers.cjs	Root fix. Removed entry.patch_path = ... and entry.bundle_path = ... assignments from both the create_pull_request and push_to_pull_request_branch handlers. Paths are now re-derived from branch and never transmitted through the entry.
safe_output_type_validator.cjs	Removed the "SECURITY: Strip infrastructure fields" block. patch_path/bundle_path are no longer present on entries; base_commit and diff_size are legitimate metadata and should pass through.
safe_output_type_validator.test.cjs	Removed "infrastructure field stripping" test suite; renamed to "undeclared field passthrough"; flipped assertions so base_commit/diff_size are asserted present on normalizedItem.
resolve_transport_paths.cjs	New file. Derives patch/bundle paths from a validated branch field. Iterates repo candidates (message.repo → defaultTargetRepo → null) and checks fs.existsSync() for each derived path. Exports resolveTransportPaths(message, defaultTargetRepo).
resolve_transport_paths.test.cjs	New file. 7 test cases: no branch, single-repo patch/bundle, multi-repo preference, defaultTargetRepo fallback, single-repo fallback when multi-repo misses, no-file case, bundle-only case.
create_pull_request.cjs	Replaced direct reads of pullRequestItem.patch_path/bundle_path with resolveTransportPaths(pullRequestItem, defaultTargetRepo); added null-guard if (!isEmpty && patchFilePath).
create_pull_request.test.cjs	Added canonicalPatchPath(), canonicalBundlePath(), cleanupCanonicalTransports() helpers + beforeEach/afterEach hooks; all handler call-sites now pass { branch: "..." } instead of { patch_path: ... }.
push_to_pull_request_branch.cjs	Same pattern as create_pull_request.cjs — replaced direct path reads with resolveTransportPaths.
push_to_pull_request_branch.test.cjs	Same test harness pattern as create_pull_request.test.cjs; createPatchFile() gains branch as its first argument.
collect_ndjson_output.cjs	Updated comment from "SECURITY: strips infrastructure fields" to reflect the new design.

actions/setup/js/ — path-derivation function renames (breaking: internal exports)

Old name	New name	File
getPatchPath	getPatchPathForBranch	git_patch_utils.cjs
getPatchPathForRepo	getPatchPathForBranchInRepo	git_patch_utils.cjs
getBundlePath	getBundlePathForBranch	generate_git_bundle.cjs
getBundlePathForRepo	getBundlePathForBranchInRepo	generate_git_bundle.cjs

All corresponding test files (git_patch_utils.test.cjs, generate_git_patch.test.cjs, find_repo_checkout.test.cjs) and import sites updated accordingly.

Terminology rename: Effective Tokens → AI Credits

All of the following are mechanical search-and-replace across docs, specs, workflows, and source:

Old	New
max-effective-tokens: (frontmatter key)	max-ai-credits:
GH_AW_DEFAULT_MAX_EFFECTIVE_TOKENS (env var)	GH_AW_DEFAULT_MAX_AI_CREDITS
total_effective_tokens (metric field)	removed
default_max_effective_tokens	default_max_ai_credits
GetMaxEffectiveTokens() (Go method)	removed (GetMaxAICredits() remains)

Files touched (terminology):

• .changeset/patch-bump-awf-v0-25-44.md
• .github/aw/syntax-agentic.md, token-optimization.md
• .github/workflows/ — 6 workflow frontmatter files
• DICTATION.md
• actions/setup/js/handle_agent_failure.test.cjs (rate-limit error message)
• actions/setup/md/effective_tokens_rate_limit_error.md
• docs/adr/35286-compiler-managed-enterprise-env-controls.md
• docs/src/content/docs/ — 10 reference/guide/experimental docs
• pkg/workflow/engine.go
• scratchpad/token-budget-guidelines.md
• specs/aw-harness.md (breaking: spec key changed)

Golden files — GH_AW_TIMEOUT_MINUTES env var

Added GH_AW_TIMEOUT_MINUTES to all affected WASM golden snapshots:

Golden file	Value added
TestWasmGolden_AllEngines/copilot.golden	GH_AW_TIMEOUT_MINUTES
TestWasmGolden_CompileFixtures/basic-copilot.golden	10
TestWasmGolden_CompileFixtures/playwright-cli-mode.golden	20
TestWasmGolden_CompileFixtures/smoke-copilot.golden	15
TestWasmGolden_CompileFixtures/with-imports.golden	10

Action pins

pkg/actionpins/data/action_pins.json and pkg/workflow/data/action_pins.json updated (version bumps from workflow recompiles).

---

Why re-derive instead of strip?

Previously, the MCP server wrote patch_path/bundle_path onto each safe-output entry, and the type validator stripped those fields as a security measure to prevent agents from injecting arbitrary host paths. This created a redundant write-then-strip cycle.

The new approach: the MCP server never writes these paths onto entries (so there is nothing to inject), and the host-side action re-derives the correct paths from the already-validated branch field using resolveTransportPaths. This eliminates the attack surface at the source rather than patching it at the sink.

---

Breaking changes

Scope	Change
Internal JS exports	getPatchPath, getPatchPathForRepo, getBundlePath, getBundlePathForRepo renamed
Spec / frontmatter key	max-effective-tokens: → max-ai-credits: in specs/aw-harness.md and all workflow frontmatter
Env var	GH_AW_DEFAULT_MAX_EFFECTIVE_TOKENS → GH_AW_DEFAULT_MAX_AI_CREDITS
Go API	EngineConfig.GetMaxEffectiveTokens() removed

Generated by PR Description Updater for issue #37299 · 596.3 AIC · ⌖ 13.1 AIC · ◷

[Copilot]

Pull request overview

Fixes safe-output handler failures where create_pull_request / push_to_pull_request_branch could not locate patch/bundle files after validateItem() stripped transport fields during NDJSON normalization, by re-deriving expected on-disk paths from message.branch (+ optional repo context).

Changes:

• Added resolve_transport_paths.cjs helper to re-derive patch_path / bundle_path from branch (+ repo / defaultTargetRepo) by checking existing candidate paths.
• Wired the resolver into create_pull_request.cjs and push_to_pull_request_branch.cjs so handlers can recover when paths were stripped.
• Added a dedicated Vitest suite covering passthrough, recovery, fallback ordering, and missing-file cases.

Show a summary per file

File	Description
actions/setup/js/resolve_transport_paths.cjs	New helper to recover patch/bundle transport paths from branch/repo context.
actions/setup/js/resolve_transport_paths.test.cjs	New unit tests validating recovery and fallback behavior.
actions/setup/js/create_pull_request.cjs	Uses resolver instead of relying on stripped patch_path/bundle_path.
actions/setup/js/push_to_pull_request_branch.cjs	Uses resolver instead of relying on stripped patch_path/bundle_path.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 4/4 changed files
• Comments generated: 4

[Copilot]

Copilot's findings

• Files reviewed: 15/15 changed files
• Comments generated: 3

[github-actions]

Fix failing test/build/lint jobs and rerun checks.

Generated by 👨‍🍳 PR Sous Chef · 29.3 AIC · ⌖ 1.04 AIC · ◷

[github-actions]

✅ smoke-ci: safeoutputs CLI comment + comment-memory run (27062132969)

Generated by 🧪 Smoke CI for issue #37299 · ◷