feat: remove features.mcp-cli flag, rename mount-as-clis to cli-proxy

[Copilot]

The features.mcp-cli flag was a redundant gate on top of tools.mount-as-clis. This removes the feature flag and makes CLI mounting default behavior when tools.cli-proxy: true is set. Safeoutputs and mcpscripts lose their auto-mount privilege — they now require explicit cli-proxy: true like all other servers.

Changes

• pkg/constants/feature_constants.go — Remove MCPCLIFeatureFlag ("mcp-cli")
• pkg/workflow/mcp_cli_mount.go
  • Gate on ParsedTools.CLIProxy instead of isFeatureEnabled(MCPCLIFeatureFlag)
  • Remove alwaysCLIMountedServers — safeoutputs/mcpscripts are no longer unconditionally mounted; they follow the same cli-proxy: true path as playwright, custom servers, etc.
  • Simplify getMCPCLIExcludeFromAgentConfig (drops dual-access special-casing)
  • Remove feature-flag auto-synthesis from buildCLIWorkflowDataForMounts
• pkg/workflow/tools_types.go / tools_parser.go / schema — Rename MountAsCLIs/mount-as-clis → CLIProxy/cli-proxy
• 162+ workflow .md files — mount-as-clis: true → cli-proxy: true; mcp-cli: true removed from features: blocks; empty features: blocks cleaned up
• Engine tests — Updated to use CLIProxy field, MCPCLIFeatureFlag references removed
• pkg/cli/codemod_mount_as_clis.go — New codemod mount-as-clis-to-cli-proxy that renames tools.mount-as-clis → tools.cli-proxy and removes the deprecated features.mcp-cli flag; registered in GetAllCodemods() and runnable via gh aw fix

Before / After

# Before
tools:
  mount-as-clis: true
features:
  mcp-cli: true

# After
tools:
  cli-proxy: true

[pelikhan]

@copilot add codemod to rename mount-as-cli to cli-proxy

[Copilot]

@copilot add codemod to rename mount-as-cli to cli-proxy

Added in db61398. The mount-as-clis-to-cli-proxy codemod is now registered in GetAllCodemods() and handles:

• Renaming tools.mount-as-clis → tools.cli-proxy
• Removing the deprecated features.mcp-cli flag

Run it with gh aw fix to migrate existing workflows.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

[pelikhan]

@copilot Merge main and recompile

[Copilot]

@copilot Merge main and recompile

Done in 85245cd. Merged origin/main (163 lock file conflicts resolved), rebuilt the binary, and recompiled all 204 workflow lock files successfully.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -embedcfg /tmp/go-build3313774004/b349/embedcfg -pack (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv (http block)
• https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv (http block)
• https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv (http block)
• https://api.github.com/repos/github/gh-aw
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[pelikhan]

@copilot merge main and recompile

[Copilot]

@copilot merge main and recompile

Done in b71d912. Resolved 1 lock file conflict, rebuilt the binary, and recompiled all 204 workflow lock files successfully.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv {commit} (http block)
• https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv {commit} (http block)
• https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv (http block)
• https://api.github.com/repos/github/gh-aw
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[github-actions]

Comment Memory

CI lights the path\nGreen checks bloom at dawn\nQuiet bots still sing

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

Generated by Smoke CI for issue #28842 · ◷