From 00b9c051e5dc05c1d95810aa9e2256bdd9a34cdd Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 23 Sep 2026 01:12:39 +0000
Subject: [PATCH] docs: fix broken links in docs/tools.md and docs/network.md

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 docs/network.md | 2 +-
 docs/tools.md   | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/docs/network.md b/docs/network.md
index 6d8ff7417..d11572d89 100644
--- a/docs/network.md
+++ b/docs/network.md
@@ -131,7 +131,7 @@ not found" failure mode.
   agent on that runner needs `az`) or to install `azure-cli` on the
   runner image.
 
-See [`docs/tools.md`](tools.md#built-in-clis) for the agent-facing
+See [`docs/tools.md`](tools.md#host-provided-clis) for the agent-facing
 contract (auth scope, available subcommands).
 
 ## Renewable Azure authentication for MCP servers
diff --git a/docs/tools.md b/docs/tools.md
index cc3b607d3..c814ed9c7 100644
--- a/docs/tools.md
+++ b/docs/tools.md
@@ -161,10 +161,10 @@ subcommands. When configured, use `tools.azure-devops` for authenticated ADO
 reads. Do not run `az login` or inject Azure credentials into the Agent
 sandbox; use SafeOutputs or request a supported tool instead.
 
-A daily smoke pipeline at
-[`tests/safe-outputs/azure-cli.md`](../tests/safe-outputs/azure-cli.md)
-exercises binary/subcommand availability without claiming authenticated direct
-ADO access.
+A smoke pipeline at
+[`tests/smoke/ado-proxy.md`](../tests/smoke/ado-proxy.md)
+exercises the wrapped `az` path (`az devops`, `az rest`) against the
+credential-isolated proxy without claiming unauthenticated direct ADO access.
 
 ### GitHub CLI (`gh`)