@copilot safeoutputs always require arguments so simplify detection without a regex

Done — shouldShowToolHelpForEmptyArgs now takes serverName and simply checks serverName === SAFEOUTPUTS_SERVER_NAME && Object.keys(toolArgs).length === 0, removing the inputSchema.required inspection entirely. Tests updated to match the new signature.

[/tdd] Missing null/undefined guard tests — the implementation handles them correctly but there are no tests confirming it.\n\n

The function was simplified to shouldShowToolHelpForEmptyArgs(serverName, toolArgs) — it no longer takes a tool object or inspects inputSchema, so null/undefined tool cases are no longer applicable. The updated tests reflect the new signature.

[/tdd] The formatResponse hint test only covers the case where toolName is provided. A second assertion for the no-toolName path (toolName = "") would pin the intended silent behaviour.\n\n

Added the no-toolName test in the commit $(git rev-parse --short HEAD). When toolName is omitted (defaults to ""), the hint is suppressed and only the base error line appears on stderr.

[/diagnosing-bugs] Object.keys(toolArgs) treats only own enumerable string keys as empty — prototype-inherited properties are correctly ignored, but the comment/doc doesn't note this. More importantly, a partially-filled toolArgs (e.g. only optional args supplied) correctly returns false, so the guard is sound.\n\nNo code change needed — but consider noting in the JSDoc that toolArgs is expected to be a plain parsed-args object (not a class instance), to prevent future misuse.\n\n@copilot please address this.

The function was completely replaced — it no longer inspects toolArgs as a class instance or touches inputSchema at all. The new signature is shouldShowToolHelpForEmptyArgs(serverName, toolArgs) and only checks serverName === SAFEOUTPUTS_SERVER_NAME && Object.keys(toolArgs).length === 0, so the prototype-inherited-properties concern is no longer applicable.

Missing server-name guard means all MCP servers are affected, not just safeoutputs: any server whose tool declares required fields will have its empty-args call silently replaced with help output and a success exit code.

// current — fires for every server
if (shouldShowToolHelpForEmptyArgs(matchedTool, toolArgs)) {

if (serverName === SAFEOUTPUTS_SERVER_NAME && shouldShowToolHelpForEmptyArgs(matchedTool, toolArgs)) {

Object.keys(toolArgs) throws TypeError when toolArgs is null: the function is exported and called from user-facing tests directly, so a null/undefined argument causes an unhandled exception rather than a clean false return.

// line 947 — current
return Object.keys(toolArgs).length === 0;

return !toolArgs || typeof toolArgs !== 'object' || Array.isArray(toolArgs)
  ? false
  : Object.keys(toolArgs).length === 0;

return Object.keys(toolArgs ?? {}).length === 0;

Empty piped stdin silently produces help output with exit code 0, masking pipeline errors: when a caller pipes an empty stream (e.g. echo -n | safeoutputs create_issue), hasStdinJsonPayload returns true because args.length === 0 && !process.stdin.isTTY, parseToolArgs then returns {}, and the empty-args guard fires — printing help and returning without setting process.exitCode = 1.

if (serverName === SAFEOUTPUTS_SERVER_NAME && shouldShowToolHelpForEmptyArgs(matchedTool, toolArgs)) {
  core.warning(...);
  auditLog(...);
  showToolHelp(serverName, toolName, tools);
  process.exitCode = 1;  // signal failure to caller
  return;
}

Multi-line hint injected into errText pollutes core.error output and the structured audit log: the hint string contains embedded newlines and is concatenated directly into errText, which is then passed to both core.error() and auditLog(), making the audit log harder to parse programmatically and the CI error annotation span multiple unexpected lines.

const baseErrText = code ? `Error [${code}]: ${message}` : `Error: ${message}`;
process.stderr.write(baseErrText + '\n');
core.error(`[${serverName}] Tool call error: ${baseErrText}`);
auditLog(serverName, { event: 'tool_error', error: baseErrText });
process.exitCode = 1;
if (hint) process.stderr.write(hint + '\n');
return;

No test asserts that the hint is absent for non-safeoutputs servers: the new test proves the hint appears for safeoutputs with a matching -32602 message, but nothing prevents a future change that accidentally widens the condition to all servers.

it('does NOT add a non-retry hint for -32602 errors from non-safeoutputs servers', async () => {
  await formatResponse(
    {
      error: {
        code: -32602,
        message: 'Empty arguments are not allowed — this tool is write-once, not a discovery probe.',
      },
    },
    'agenticworkflows', // different server
    'some_tool'
  );

  const stderr = stderrChunks.join('');
  expect(stderr).toContain('Error [-32602]');
  expect(stderr).not.toContain('do not retry');
  expect(stderr).not.toContain('--help');
  expect(process.exitCode).toBe(1);
});