github · pelikhan · Dec 8, 2025 · Dec 8, 2025 · Dec 8, 2025 · Dec 8, 2025
diff --git a/.changeset/patch-fix-missing-safe-inputs-bootstrap.md b/.changeset/patch-fix-missing-safe-inputs-bootstrap.md
diff --git a/.github/workflows/copilot-pr-merged-report.lock.yml b/.github/workflows/copilot-pr-merged-report.lock.yml
diff --git a/.github/workflows/daily-performance-summary.lock.yml b/.github/workflows/daily-performance-summary.lock.yml
diff --git a/.github/workflows/dev.lock.yml b/.github/workflows/dev.lock.yml
diff --git a/.github/workflows/release.lock.yml b/.github/workflows/release.lock.yml
diff --git a/.github/workflows/smoke-copilot-no-firewall.lock.yml b/.github/workflows/smoke-copilot-no-firewall.lock.yml
diff --git a/.github/workflows/smoke-copilot-playwright.lock.yml b/.github/workflows/smoke-copilot-playwright.lock.yml
diff --git a/.github/workflows/smoke-copilot-safe-inputs.lock.yml b/.github/workflows/smoke-copilot-safe-inputs.lock.yml
diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml
diff --git a/.github/workflows/test-python-safe-input.lock.yml b/.github/workflows/test-python-safe-input.lock.yml
diff --git a/pkg/workflow/js.go b/pkg/workflow/js.go
@@ -826,6 +826,11 @@ func GetSafeInputsToolFactoryScript() string {
 	return safeInputsToolFactoryScript
 }
 
+// GetSafeInputsBootstrapScript returns the embedded safe_inputs_bootstrap.cjs script
+func GetSafeInputsBootstrapScript() string {
+	return safeInputsBootstrapScript
+}
+
 // GetSafeInputsValidationScript returns the embedded safe_inputs_validation.cjs script
 func GetSafeInputsValidationScript() string {
 	return safeInputsValidationScript

diff --git a/pkg/workflow/mcp_servers.go b/pkg/workflow/mcp_servers.go
@@ -339,6 +339,12 @@ func (c *Compiler) generateMCPSetup(yaml *strings.Builder, tools map[string]any,
 		}
 		yaml.WriteString("          EOF_VALIDATION\n")
 
+		yaml.WriteString("          cat > /tmp/gh-aw/safe-inputs/safe_inputs_bootstrap.cjs << 'EOF_BOOTSTRAP'\n")
+		for _, line := range FormatJavaScriptForYAML(GetSafeInputsBootstrapScript()) {
+			yaml.WriteString(line)
+		}
+		yaml.WriteString("          EOF_BOOTSTRAP\n")
+
 		// Write safe-inputs MCP server main module
 		yaml.WriteString("          cat > /tmp/gh-aw/safe-inputs/safe_inputs_mcp_server.cjs << 'EOF_SAFE_INPUTS_SERVER'\n")
 		for _, line := range FormatJavaScriptForYAML(GetSafeInputsMCPServerScript()) {