[copilot-cli-research] Copilot CLI Deep Research - 2026-07-20

[github-actions]

Analysis Date: 2026-07-20
Repository: github/gh-aw
Scope: 258 total workflows, 37 using engine: copilot directly (128+ including extended id: copilot)

---

📊 Executive Summary

Research Topic: Copilot CLI Optimization Opportunities
Key Findings:

1. LSP servers are entirely unused (0/258 workflows) — significant missed opportunity for a Go+TypeScript codebase
2. engine.bare is never used with Copilot despite 11 custom agent files in .github/agents/
3. 5 long-running Copilot workflows (45–180 min) have no max-continuations, risking silent hangs
4. max-tool-denials is unconfigured across all SDK workflows — safety gap persists from previous runs
5. engine.cwd and harness retry tuning remain at 0% adoption across all 258 workflows

This is the second consecutive analysis finding the same critical gaps unchanged. The LSP, max-tool-denials, and engine.cwd opportunities have been identified in prior runs but not yet adopted.

Primary Recommendation: Add max-continuations: 3 to the 5 long-running Copilot workflows that have timeout-minutes >= 45 but no continuation guard: agent-persona-explorer.md (180 min), update-astro.md, stale-repo-identifier.md, slide-deck-maintainer.md, daily-doc-updater.md.

---

Critical Findings

🔴 High Priority Issues

1. Long-running Copilot workflows without max-continuations

Five workflows run 45–180 minutes with no autopilot continuation limit:

• agent-persona-explorer.md — 180 minutes (highest risk)
• update-astro.md, stale-repo-identifier.md, slide-deck-maintainer.md, daily-doc-updater.md — 45 min each

Without max-continuations, these will run to the full timeout if the agent loops.

2. max-tool-denials absent from all 258 workflows

Prevents infinite tool-retry spirals in SDK mode. 0 usage despite 65+ SDK workflows. Persists from previous analysis run.

🟡 Medium Priority Opportunities

3. LSP servers not configured — codebase is Go+TypeScript but no workflow uses lsp: config.

4. engine.bare unused with Copilot — 11 custom .agent.md files exist but none of the 37 Copilot workflows use bare: true.

5. 25 Copilot workflows missing tracker-id — deduplication and telemetry gap.

---

View Full Analysis

1️⃣ Current State Analysis

View Copilot CLI Capabilities Inventory

Copilot CLI Capabilities Inventory

Feature	Available	Notes
engine.agent	✅	Custom agent file via .github/agents/
engine.bare	✅	--no-custom-instructions
max-continuations	✅	Autopilot --max-autopilot-continues
max-tool-denials	✅	SDK safety threshold
engine.cwd	✅	Working directory override
engine.args	✅	Custom CLI args injected before --prompt
engine.version	✅	Pin specific CLI version
engine.harness	✅	Custom/retry harness config
engine.mcp.tool-timeout	✅	MCP tool timeout
lsp servers	✅	LSP server config in settings.json
BYOK mode	✅	COPILOT_PROVIDER_BASE_URL
engine.model-provider	✅	LLM provider override
network.blocked	✅	Domain blocklist
tracker-id	✅	Run deduplication key
strict mode	✅	Strict secret/env validation
mcp-scripts	✅	Custom MCP script steps
repo-memory tool	✅	Persistent git-backed memory
cache-memory tool	✅	Fast in-run file cache

View Usage Statistics

Usage Statistics (37 simple engine: copilot workflows)

Feature	Count	%
timeout-minutes set	37	100%
tools: config	36	97%
network: config	25	68%
repo-memory/cache-memory	11	30%
tracker-id	12	32%
model: override	4	11%
engine.version pin	7	19%
engine.args custom	3	8%
max-continuations	0	0%
engine.bare	0	0%
lsp:	0	0%
mcp-scripts:	0	0%
engine.cwd	0	0%
engine.harness retry tuning	0	0%
max-tool-denials	0	0%

---

2️⃣ Feature Usage Matrix

Feature Category	Available	Used	Not Used
Autopilot/Continuations	max-continuations	11 all-engine	Copilot direct: 0
Agent Personas	engine.bare, .agent.md	engine.agent partial	engine.bare = 0
Safety Limits	max-tool-denials, max-turns	max-turns only	max-tool-denials = 0
Language Servers	lsp:	0	All 258 workflows
Custom Harness	engine.harness retry	1 custom	Retry tuning = 0
Working Dir	engine.cwd	0	All 258 workflows
Memory/Cache	repo-memory, cache-memory	37 / 94	Some gaps
BYOK	COPILOT_PROVIDER_*	3	Most workflows
Network Security	network.blocked	2	256

---

3️⃣ Missed Opportunities

View High Priority Opportunities

🔴 High Priority

Opportunity 1: Long-running workflows without max-continuations

• What: max-continuations enables Copilot autopilot with a cap on continuation rounds
• Why It Matters: Prevents infinite loops and unpredictable credit consumption
• Where: agent-persona-explorer.md (180 min), update-astro.md, stale-repo-identifier.md, slide-deck-maintainer.md, daily-doc-updater.md (45 min each)
• How to Implement:

max-continuations: 3
timeout-minutes: 45
engine: copilot

Opportunity 2: max-tool-denials for SDK workflows

• What: Limits consecutive tool denials before the agent aborts
• Why It Matters: Prevents SDK agents from spinning on denied tools indefinitely
• Where: All 65+ copilot-sdk: true workflows
• How to Implement:

engine:
  id: copilot
  copilot-sdk: true
  max-tool-denials: 5

View Medium Priority Opportunities

🟡 Medium Priority

Opportunity 3: LSP Server Configuration

• What: Configure language servers (gopls, typescript-language-server) in lsp: frontmatter
• Why It Matters: Rich symbol navigation, diagnostics, type info for agent analysis tasks
• How to Implement:

lsp:
  go:
    command: gopls
  typescript:
    command: typescript-language-server
    args: ["--stdio"]

Opportunity 4: engine.bare for focused agent tasks

• What: Disables AGENTS.md / copilot-instructions.md loading
• Why It Matters: When using a custom .agent.md, global instructions may conflict
• How to Implement:

engine:
  id: copilot
  agent: technical-doc-writer
  bare: true

Opportunity 5: tracker-id for 25 missing Copilot workflows

• What: Unique per-workflow deduplication key
• How to Implement: Add tracker-id: <workflow-slug> to frontmatter

View Low Priority Opportunities

🟢 Low Priority

Opportunity 6: engine.cwd for workspace clarity

Override the agent's starting working directory — useful for monorepo subdirectory workflows.

Opportunity 7: Harness retry tuning

engine.harness.max-retries and .delay customize CAPIError 400 retry behavior. Useful for high-frequency daily workflows.

Opportunity 8: network.blocked domain list

Only 2 workflows block specific domains. Defense-in-depth for sensitive workflows.

Opportunity 9: mcp-scripts for reusable tool bundles

0 Copilot workflows use mcp-scripts:. Enables composable tool bundles without inline duplication.

---

4️⃣ Specific Workflow Recommendations

View Workflow-Specific Recommendations

Workflow	Current State	Recommendation	Benefit
agent-persona-explorer.md	180 min, no max-continuations	Add max-continuations: 5	Prevents 3-hour runaway
update-astro.md	45 min, no max-continuations	Add max-continuations: 3	Safety cap
stale-repo-identifier.md	45 min, no max-continuations	Add max-continuations: 3	Safety cap
slide-deck-maintainer.md	45 min, no max-continuations	Add max-continuations: 3	Safety cap
daily-doc-updater.md	45 min, no max-continuations	Add max-continuations: 3	Safety cap
All SDK workflows (65+)	No max-tool-denials	Add max-tool-denials: 5	Prevents tool-denial spirals

---

5️⃣ Trends & Insights

View Historical Trends (vs 2026-07-19 run)

Feature	Prev Run	This Run	Trend
max-tool-denials	0	0	⚠️ No change
engine.cwd	0	0	⚠️ No change
lsp: servers	0	0	⚠️ No change
engine.bare (Copilot)	0	0	⚠️ No change
network.blocked	2	2	✅ Stable
version pinning	18	7	✅ Declining (good)
Long-running without continuations	identified	5 (Copilot specific)	🔴 Risk

Core safety gaps (max-tool-denials, lsp, engine.cwd) remain unaddressed after multiple consecutive research cycles.

---

6️⃣ Best Practice Guidelines

1. Always set max-continuations on Copilot workflows with timeout-minutes >= 30
2. Set max-tool-denials: 5 on all copilot-sdk: true workflows
3. Add tracker-id to every workflow for reliable deduplication
4. Use engine.bare: true when combining a custom .agent.md with a focused task
5. Enable LSP servers for workflows analyzing Go/TypeScript code
6. Use network.blocked to deny sensitive internal endpoints proactively

---

---

7️⃣ Action Items

Immediate Actions (this week):

• Add max-continuations: 3 to update-astro.md, stale-repo-identifier.md, slide-deck-maintainer.md, daily-doc-updater.md
• Add max-continuations: 5 to agent-persona-explorer.md (180-min workflow)
• Add max-tool-denials: 5 to top 10 SDK workflows by run frequency

Short-term (this month):

• Add tracker-id to 25 Copilot workflows currently missing it
• Evaluate engine.bare: true for workflows using custom .agent.md files
• Pilot lsp: go: config on 2–3 workflows that analyze Go source code

Long-term (this quarter):

• Standardize max-tool-denials across all SDK workflows
• Explore mcp-scripts for reusable tool bundles across workflow families
• Evaluate network.blocked coverage for security-sensitive workflows
• Benchmark harness retry tuning for high-frequency daily workflows

---

View Supporting Evidence & Methodology

📚 References

• Copilot Engine docs: docs/src/content/docs/reference/engines.md
• Engine execution source: pkg/workflow/copilot_engine_execution.go
• MCP config source: pkg/workflow/copilot_mcp.go
• Previous research: /tmp/gh-aw/repo-memory/default/copilot-cli-research/latest.json

Research Methodology

1. Enumerated pkg/workflow/copilot_engine*.go for all available flags and features
2. Scanned all 258 .github/workflows/*.md files for feature usage patterns
3. Counted adoption rates per feature category
4. Cross-referenced with docs/src/content/docs/reference/engines.md
5. Compared against previous run stored in repo-memory
6. Identified long-running workflows (timeout >= 45 min) without safety caps

---

Generated by Copilot CLI Deep Research (Run: §29717858191)

Generated by 🔬 Copilot CLI Deep Research Agent · 65.7 AIC · ⌖ 11.1 AIC · ⊞ 7.4K · ◷

• expires on Jul 20, 2026, 9:00 PM UTC-08:00

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #46975

View newer issue

---

This action was performed automatically by the Copilot CLI Deep Research Agent workflow.