[agent-issue]: Support allowlisted Copilot CLI session flags in workflow front matter #1720

Submission requirements

• I generated this issue with an agent that used .github/agents/ado-aw.agent.md.
• I reviewed the generated issue and confirm it is being filed directly in githubnext/ado-aw.

Problem summary

Add a supported workflow front-matter field for passing allowlisted Copilot CLI session flags to the generated Agent invocation.

This is needed for flags such as --excluded-tools skill, so a workflow can prevent repository-local skills from overriding its configured MCP/tool path.

The field should preserve ado-aw's security model:

• Allow only explicitly supported session flags.
• Reject credential-, provider-, output-, permission-, or path-changing flags unless individually supported.
• Validate flag names and argument shapes at compile time.
• Support repeatable flags such as excluded-tools.
• Render deterministic lock YAML.
• Document precedence relative to ado-aw-generated flags.

Reproduction details

Environment:

• ado-aw v0.45.1
• Copilot CLI 1.0.72-1

A workflow configured the Azure DevOps MCP tool repo_list_pull_request_threads. The repository also contained the project skill ado-pr-feedback.

When the generated Agent ran, Copilot selected that skill, which used direct az devops invoke commands instead of the configured Azure DevOps MCP tool. ado-aw currently provides no supported way to add --excluded-tools skill to the generated invocation.

Expected: the workflow can explicitly disable repository-local skills and retain its configured MCP/tool path.

Observed: skill selection redirected execution away from that path. The temporary workaround requires manually editing the generated .lock.yml, removing its integrity-check step, and appending --excluded-tools skill to the Copilot invocation.

Proposed next step

Define and implement an allowlisted front-matter field for Copilot CLI session flags, initially supporting excluded-tools. Add schema validation, deterministic compilation/lock-file tests, repeatable-flag coverage, security rejection tests, and precedence documentation.